HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/__pycache__/vault.cpython-310.pyc
o

�N�g%8�@s�dZddlZddlZddlZddlZddlZddlmZddlZddl	Z
ddlZ
ddlZ
ddl
Z
ddlmZddlmZe�e�Z	ddd�Zd	d
�Zedfdd�Zd
d�Z	ddd�Zddd�Zddd�Zdd�Zdd�ZGdd�de�ZdS)z�
Runner functions supporting the Vault modules. Configuration instructions are
documented in the execution module docs.

:maintainer:    SaltStack
:maturity:      new
:platform:      all
�N)�Mapping)�NOT_SET)�SaltRunnerErrorFc
Cs�t�d||�t|||��z,t�di�}|�dd�}|�d�}|d�dd�}|r.|dur6|d�d	d
�}|r<|durD|d�dd�}|d�dd
�}	|�dd�}
|�dd�}|dddkr�t�r�t�d�d�|d�}d|ddi}
d|dvr�|dd|
d<d}|dur�d|i}tj|||
|dd�}|j	dkr�d|j
iWS|��dd|dd<t|�}d|ddi}|dur�||d<t
��d d!�|t
��d"d#�d$�}t|||
|d%�||d&�}
|dur�t|�|
d'<|
d(gkr�dd)iWSt�d*�tj|||
|dd�}|j	dk�rd|j
iWS|��d}|d|d+|d,ttt����|d||	|d-�}|d.k�r8||d	<|WSt�yS}zdt|�iWYd}~Sd}~ww)/aF
    Generate a Vault token for minion minion_id

    minion_id
        The id of the minion that requests a token

    signature
        Cryptographic signature which validates that the request is indeed sent
        by the minion (or the master, see impersonated_by_master).

    impersonated_by_master
        If the master needs to create a token on behalf of the minion, this is
        True. This happens when the master generates minion pillars.

    ttl
        Ticket time to live in seconds, 1m minutes, or 2h hrs

    uses
        Number of times a token can be used
    z<Token generation request for %s (impersonated by master: %s)�vault�verifyN�	namespace�auth�allow_minion_overrideF�uses��ttl�
token_backend�session�policies_refresh_pillar�policies_cache_time�<�methodZapprolez#Vault token expired. Recreating onez{}/v1/auth/approle/login�urlZrole_idZ	secret_id�X-Vault-Namespace�x)�headers�jsonr�timeout���errorZclient_token�token�
X-Vault-TokenZ__jid__z<no jid set>Z__user__z
<no user set>)z
saltstack-jidzsaltstack-minionzsaltstack-user��refresh_pillar�expire)�policiesZnum_uses�metaZexplicit_max_ttlr zNo policies matched minionz'Sending token creation request to Vault�lease_duration�	renewable)rr"r#Zissuedrrr
rr)�log�debug�_validate_signature�__opts__�get�_selftoken_expired�format�requestsZpost�status_code�reasonr�_get_token_create_url�globals�_get_policies_cached�str�trace�int�round�time�	Exception)�	minion_id�	signature�impersonated_by_masterrr
�configrrr	Zstorage_typerrr�payloadr�responseZ
audit_dataZ	auth_data�ret�e�r?�F/opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/vault.py�generate_tokens��


�
���


��

��rAcCsHtddD]}tdddt�d|i�d���}|dd	ur!d
Sqd	S)aj
    Unseal Vault server

    This function uses the 'keys' from the 'vault' configuration to unseal vault server

    vault:
      keys:
        - n63/TbrQuL3xaIW7ZZpuXj/tIfnK1/MbVxO4vT3wYD2A
        - S9OwCvMRhErEA4NVVELYBs6w/Me6+urgUr24xGK44Uy3
        - F1j4b7JKq850NS6Kboiy5laJ0xY8dWJvB3fcwA+SraYl
        - 1cYtvjKJNDVam9c7HNqJUfINk4PYyAXIpjkpN/sIuzPv
        - 3pPK5X6vGtwLhNOFv1U2elahECz3HpRUfNXJFYLw6lid

    .. note: This function will send unsealed keys until the api returns back
             that the vault has been unsealed

    CLI Examples:

    .. code-block:: bash

        salt-run vault.unseal
    r�keyszvault.make_request�PUTz
v1/sys/unseal�key)�dataZsealedFT)r'�	__utils__r�dumps)rDr=r?r?r@�unseal�s���rHcCsFt�di�}|tkr|�d�}|dur|n|�dd�}t||||d�S)aB
    Show the Vault policies that are applied to tokens for the given minion.

    minion_id
        The minion's id.

    refresh_pillar
        Whether to refresh the pillar data when rendering templated policies.
        None will only refresh when the cached data is unavailable, boolean values
        force one behavior always.
        Defaults to config value ``policies_refresh_pillar`` or None.

    expire
        Policy computation can be heavy in case pillar data is used in templated policies and
        it has not been cached. Therefore, a short-lived cache specifically for rendered policies
        is used. This specifies the expiration timeout in seconds.
        Defaults to config value ``policies_cache_time`` or 60.

    CLI Example:

    .. code-block:: bash

        salt-run vault.show_policies myminion
    rrNrrr)r'r(rr0)r7rrr:r?r?r@�
show_policies�s
�rIcCsltd}|r|�d�}n|�d|��}t�d|�t�|�}tj�|||�s/tj�	d|����t�d�dS)z^
    Validate that either minion with id minion_id, or the master, signed the
    request
    �pki_dirz/master.pubz	/minions/zValidating signature for %sz&Could not validate token request from zSignature okN)
r'r$r2�base64�	b64decode�saltZcryptZverify_signature�
exceptionsZAuthenticationError)r7r8r9rJZ
public_keyr?r?r@r&�s
�r&c	Ks�t||�\}}|�dddg�}|||d�}g}|D].}	ztd|	fi|��D]}
|�|
jd	i|�����q&WqtyGt�d|	|�Yqwt�	d||�|S)
zJ
    Get the policies that should be applied to a token for minion_id
    r zsaltstack/minion/{minion}zsaltstack/minions)Zminion�grains�pillarzvault.expand_pattern_listsz1Could not resolve policy pattern %s for minion %sz%s policies: %sNr?)
�_get_minion_datar(rF�appendr*�lower�KeyErrorr$�warningr%)r7r:r�kwargsrOrPZpolicy_patternsZmappingsr �patternZexpanded_patternr?r?r@�
_get_policies�s0��
�����rXrc	Cs�|s	t|||d�Sd|�d�}d}tj�t�}|j||t||||d�}t|t�s?t�d�|�	||�|j||t||||d�}|S)N)rzminions/z/vaultr )rr7r:rz<Cached vault policies were not formed as a list. Refreshing.)
rXrM�cache�factoryr'�
isinstance�listr$rU�flush)r7r:rrZcbankZckeyrYr r?r?r@r0s6�
	
�	r0cCs�tjj�|t�\}}}|durd|i}|dus|durB|durBt�d�r(td��t�t�}ddi}|�	|�t
||||d�}||fS|durHi}||fS)N�idTZ+_vault_runner_is_compiling_pillar_templatesa/Cyclic dependency detected while refreshing pillar for vault policy templating. This is caused by some pillar value relying on the vault execution module. Either remove the dependency from your pillar, disable refreshing pillar data for policy templating or do not use pillar values in policy templates.��extra_minion_data)rM�utilsZminionsZget_minion_datar'r(r�copy�deepcopy�update�
LazyPillar)r7r�_rOrPZ
local_optsr`r?r?r@rQ&s$
�

��rQc
Cs�zItd�dd�}td�d�}d�tdd�}dtddvr$Wd	Sd
tdddi}|dur6||d<tj|||dd
�}|jdkrGWd	SWdSty`}ztj�dt	|�����d}~ww)z>
    Validate the current token exists and is still valid
    rrNrz{}/v1/auth/token/lookup-selfrrrTrrr)rrrrFz$Error while looking up self token : )
r'r(r*r+r,r6rMrNZCommandExecutionErrorr1)rrrrr<r>r?r?r@r)Ps&
���r)cCs2|�dd�}d}|d}d�dd�|||fD��S)z-
    Create Vault url for token creation
    �	role_nameNz/v1/auth/token/creater�/css�|]
}|r|�d�VqdS)rhN)�strip)�.0�xr?r?r@�	<genexpr>ps�z(_get_token_create_url.<locals>.<genexpr>)r(�join)r:rgZ	auth_pathZbase_urlr?r?r@r.isr.c@s:eZdZdZd
dd�Zdd�Zdd�Zd	d
�Zdd�ZdS)rez`
    Simulates a pillar dictionary. Only compiles the pillar
    once an item is requested.
    NcCs&||_||_||_|pi|_d|_dS�N)�optsrOr7r`�_pillar)�selfrorOr7r`r?r?r@�__init__ys


zLazyPillar.__init__cCs0t�d�tjj|j|j|j|jd��	�|_
dS)Nz'Refreshing pillar for vault templating.r_)r$�inforMrPZ
get_pillarrorOr7r`Zcompile_pillarrp�rqr?r?r@�_load�s
��zLazyPillar._loadcCs|jdur	|��|j|Srn�rpru)rqrDr?r?r@�__getitem__��

zLazyPillar.__getitem__ccs$�|jdur
|��|jEdHdSrnrvrtr?r?r@�__iter__�s�
zLazyPillar.__iter__cCs|jdur	|��t|j�Srn)rpru�lenrtr?r?r@�__len__�rxzLazyPillar.__len__rn)	�__name__�
__module__�__qualname__�__doc__rrrurwryr{r?r?r?r@ress
	re)FNNrn)Nr)rrKrbr�loggingr5�collections.abcrr+Z
salt.cacherMZ
salt.cryptZsalt.exceptionsZsalt.pillarZ
salt.defaultsrr�	getLoggerr|r$rArHrIr&rXr0rQr)r.rer?r?r?r@�<module>s6	

�u "
�

*