o

�N�g"�@sPdZd
dl
Z
d
dlmZ
d
dlZe
�e�
Zdd�Z					d
dd�
Z
dd	�ZdS)a�
Vault Pillar Module

:maintainer:    SaltStack
:maturity:      New
:platform:      all

.. versionadded:: 2016.11.0

This module allows pillar data to be stored in Hashicorp Vault.

Base configuration instructions are documented in the :ref:`execution module docs <vault-setup>`.
Below are noted extra configuration required for the pillar module, but the base
configuration must also be completed.

After the base Vault configuration is created, add the configuration below to
the ext_pillar section in the Salt master configuration.

.. code-block:: yaml

    ext_pillar:
      - vault: path=secret/salt

Each key needs to have all the key-value pairs with the names you
require. Avoid naming every key 'password' as you they will collide:

If you want to nest results under a nesting_key name use the following format:

.. code-block:: yaml

    ext_pillar:
      - vault:
          conf: path=secret/salt
          nesting_key: vault_key_name

.. code-block:: bash

    $ vault write secret/salt auth=my_password master=127.0.0.1

The above will result in two pillars being available, ``auth`` and ``master``.

You can then use normal pillar requests to get each key pair directly from
pillar root. Example:

.. code-block:: bash

    $ salt-ssh '*' pillar.get auth

Multiple Vault sources may also be used:

.. code-block:: yaml

    ext_pillar:
      - vault: path=secret/salt
      - vault: path=secret/root
      - vault: path=secret/minions/{minion}/pass
      - vault: path=secret/roles/{pillar[roles]}/pass

You can also use nesting here as well.  Identical nesting keys will get merged.

.. code-block:: yaml

    ext_pillar:
      - vault:
           conf: path=secret/salt
           nesting_key: keyname1
      - vault:
           conf: path=secret/root
           nesting_key: keyname1
      - vault:
           conf: path=secret/minions/{minion}/pass
           nesting_key: keyname2

The difference between the return with and without the nesting key is shown below.
This example takes the key value pairs returned from vault as follows:

.. code-block:: text

    path=secret/salt

    Key             Value
    ---             -----
    salt-passwd     badpasswd1

    path=secret/root

    Key             Value
    ---             -----
    root-passwd     rootbadpasswd1

    path=secret/minions/{minion}/pass

    Key             Value
    ---             -----
    minion-passwd   minionbadpasswd1


.. code-block:: yaml

    #Nesting Key not defined

    local:
        ----------
        salt-passwd:
            badpasswd1
        root-passwd:
            rootbadpasswd1
        minion-passwd:
            minionbadpasswd1

    #Nesting Key defined

    local:
        ----------
        keyname1:
            ----------
                salt-passwd:
                    badpasswd1
                root-passwd:
                    rootbadpasswd1
        keyname2:
            ----------
                minion-passwd:
                    minionbadpasswd1

.. versionadded:: 3006.0

    Pillar values from previously rendered pillars can be used to template
    vault ext_pillar paths.

Using pillar values to template vault pillar paths requires them to be defined
before the vault ext_pillar is called. Especially consider the significancy
of :conf_master:`ext_pillar_first <ext_pillar_first>` master config setting.

If a pillar pattern matches multiple paths, the results are merged according to
the master configuration values :conf_master:`pillar_source_merging_strategy <pillar_source_merging_strategy>`
and :conf_master:`pillar_merge_lists <pillar_merge_lists>` by default.

If the optional nesting_key was defined, the merged result will be nested below.
There is currently no way to nest multiple results under different keys.

You can override the merging behavior per defined ext_pillar:

.. code-block:: yaml

    ext_pillar:
      - vault:
           conf: path=secret/roles/{pillar[roles]}
           merge_strategy: smart
           merge_lists: false
�N)
�	HTTPErrorc
Csd
S)z2
    This module has no external dependencies
    T�rrr�E/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/vault.py�__virtual__�src	Cs.
|pi}|�d
�
riS|�
�}dd�|D�
}|s t�d|�
iS|p't�dd�}|p/t�dd�}i}	|d	�d
d�}
t|
||
�D]N}z=td|�
}|d
rQ|d}d|��}
tdd|
�}|��
|�	��di�}|rs|d
rs|d}t
jjj
|	|||d�}	Wq@ty�


t�d|�
Yq@w|r�||	i
}	|	S)zD
    Get pillar data from Vault for the configuration ``conf``.
    Z+_vault_runner_is_compiling_pillar_templatesc
Ssg|]	}
|
�d�
r|
�qS)
�path=)
�
startswith)�.0�comprrr�
<listcomp>�szext_pillar.<locals>.<listcomp>z+"%s" is not a valid Vault ext_pillar configZpillar_source_merging_strategyZsmartZpillar_merge_listsFr
r�zvault.is_v2Zv2�datazv1/zvault.make_requestZGET)Zstrategy�merge_listszVault secret not found for: %s)�get�split�log�errorZ__opts__�replace�
_get_paths�	__utils__Zraise_for_status�json�salt�utilsZ
dictupdate�merger�info)�	minion_id�pillarZconfZnesting_keyZmerge_strategyr
Zextra_minion_data�comps�pathsZvault_pillar�path_pattern�pathZversion2�url�responseZvault_pillar_singlerrr�
ext_pillar�sJ





�















�
�

r"cCst|
|d
�}g}ztd|f
i|�
�
D]
}|�
|jdi|�
�
�

qWnty0


t�d|�
Yn
wt�d|
|�
|S)zB
    Get the paths that should be merged into the pillar dict
    )Zminionrzvault.expand_pattern_listsz(Could not resolve pillar path pattern %sz%s vault pillar paths: %sNr)r�append�format�KeyErrorr�warning�debug)rrrZmappingsrZexpanded_patternrrrr�s



�

��
�
r)NNNN)�__doc__�loggingZrequests.exceptionsrZsalt.utils.dictupdater�	getLogger�__name__rrr"rrrrr�<module>
s




�;