awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: File-based credentials

Browse Source
This commit is contained in:
Daniel Hougaard
2024-06-14 23:55:25 +02:00
parent 0b54099789
commit 68f5be2ff1
1 changed files with 45 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
cli/packages/cmd/agent.go
View File

@@ -74,8 +74,8 @@ type GcpIdTokenAuth struct {
}
type GcpIamAuth struct {
IdentityID string `yaml:"identity-id"`
ServiceAccountKeyPath string `yaml:"service-account-key-path"`
IdentityID string `yaml:"identity-id"`
ServiceAccountKey string `yaml:"service-account-key"`
}
type AwsIamAuth struct {
@@ -214,6 +214,17 @@ func ReadFile(filePath string) ([]byte, error) {
return ioutil.ReadFile(filePath)
}
func ReadFileAsString(filePath string) (string, error) {
fileBytes, err := ReadFile(filePath)
if err != nil {
return "", err
}
return string(fileBytes), nil
}
func ExecuteCommandWithTimeout(command string, timeout int64) error {
shell := [2]string{"sh", "-c"}
@@ -499,24 +510,24 @@ func (tm *AgentManager) FetchUniversalAuthAccessToken() (credential infisicalSdk
clientID := os.Getenv(util.INFISICAL_UNIVERSAL_AUTH_CLIENT_ID_NAME)
if clientID == "" {
clientIDAsByte, err := ReadFile(universalAuthConfig.ClientIDPath)
clientId, err := ReadFileAsString(universalAuthConfig.ClientIDPath)
if err != nil {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read client id from file path '%s' due to error: %v", universalAuthConfig.ClientIDPath, err)
}
clientID = string(clientIDAsByte)
clientID = clientId
}
clientSecret := os.Getenv("INFISICAL_UNIVERSAL_CLIENT_SECRET")
if clientSecret == "" {
clientSecretAsByte, err := ReadFile(universalAuthConfig.ClientSecretPath)
secret, err := ReadFileAsString(universalAuthConfig.ClientSecretPath)
if err != nil {
if len(tm.cachedUniversalAuthClientSecret) == 0 {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read client secret from file and no cached client secret found: %v", err)
} else {
clientSecretAsByte = []byte(tm.cachedUniversalAuthClientSecret)
secret = tm.cachedUniversalAuthClientSecret
}
}
clientSecret = string(clientSecretAsByte)
clientSecret = secret
}
tm.cachedUniversalAuthClientSecret = clientSecret
@@ -528,7 +539,7 @@ func (tm *AgentManager) FetchUniversalAuthAccessToken() (credential infisicalSdk
}
func (tm *AgentManager) FetchKubernetesAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, e error) {
func (tm *AgentManager) FetchKubernetesAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, err error) {
var kubernetesAuthConfig KubernetesAuth
if err := ParseAuthConfig(tm.authConfigBytes, &kubernetesAuthConfig); err != nil {
@@ -537,10 +548,10 @@ func (tm *AgentManager) FetchKubernetesAuthAccessToken() (credential infisicalSd
identityId := os.Getenv(util.INFISICAL_KUBERNETES_IDENTITY_ID_NAME)
if identityId == "" {
identityId = kubernetesAuthConfig.IdentityID
identityId, err = ReadFileAsString(kubernetesAuthConfig.IdentityID)
if identityId == "" {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("kubernetes identity id not found")
if err != nil {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read identity id from file path '%s' due to error: %v", kubernetesAuthConfig.IdentityID, err)
}
}
@@ -556,7 +567,7 @@ func (tm *AgentManager) FetchKubernetesAuthAccessToken() (credential infisicalSd
}
func (tm *AgentManager) FetchAzureAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, e error) {
func (tm *AgentManager) FetchAzureAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, err error) {
var azureAuthConfig AzureAuth
if err := ParseAuthConfig(tm.authConfigBytes, &azureAuthConfig); err != nil {
@@ -565,9 +576,10 @@ func (tm *AgentManager) FetchAzureAuthAccessToken() (credential infisicalSdk.Mac
identityId := os.Getenv(util.INFISICAL_AZURE_AUTH_IDENTITY_ID_NAME)
if identityId == "" {
identityId = azureAuthConfig.IdentityID
if identityId == "" {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("azure identity id not found")
identityId, err = ReadFileAsString(azureAuthConfig.IdentityID)
if err != nil {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read identity id from file path '%s' due to error: %v", azureAuthConfig.IdentityID, err)
}
}
@@ -575,7 +587,7 @@ func (tm *AgentManager) FetchAzureAuthAccessToken() (credential infisicalSdk.Mac
}
func (tm *AgentManager) FetchGcpIdTokenAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, e error) {
func (tm *AgentManager) FetchGcpIdTokenAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, err error) {
var gcpIdTokenAuthConfig GcpIdTokenAuth
if err := ParseAuthConfig(tm.authConfigBytes, &gcpIdTokenAuthConfig); err != nil {
@@ -584,9 +596,10 @@ func (tm *AgentManager) FetchGcpIdTokenAuthAccessToken() (credential infisicalSd
identityId := os.Getenv(util.INFISICAL_GCP_AUTH_IDENTITY_ID_NAME)
if identityId == "" {
identityId = gcpIdTokenAuthConfig.IdentityID
if identityId == "" {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("gcp identity id not found")
identityId, err = ReadFileAsString(gcpIdTokenAuthConfig.IdentityID)
if err != nil {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read identity id from file path '%s' due to error: %v", gcpIdTokenAuthConfig.IdentityID, err)
}
}
@@ -594,7 +607,7 @@ func (tm *AgentManager) FetchGcpIdTokenAuthAccessToken() (credential infisicalSd
}
func (tm *AgentManager) FetchGcpIamAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, e error) {
func (tm *AgentManager) FetchGcpIamAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, err error) {
var gcpIamAuthConfig GcpIamAuth
if err := ParseAuthConfig(tm.authConfigBytes, &gcpIamAuthConfig); err != nil {
@@ -603,15 +616,18 @@ func (tm *AgentManager) FetchGcpIamAuthAccessToken() (credential infisicalSdk.Ma
identityId := os.Getenv(util.INFISICAL_GCP_AUTH_IDENTITY_ID_NAME)
if identityId == "" {
identityId = gcpIamAuthConfig.IdentityID
if identityId == "" {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("gcp identity id not found")
identityId, err = ReadFileAsString(gcpIamAuthConfig.IdentityID)
if err != nil {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read identity id from file path '%s' due to error: %v", gcpIamAuthConfig.IdentityID, err)
}
}
serviceAccountKeyPath := os.Getenv(util.INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH_NAME)
if serviceAccountKeyPath == "" {
serviceAccountKeyPath = gcpIamAuthConfig.ServiceAccountKeyPath
// we don't need to read this file, because the service account key path is directly read inside the sdk
serviceAccountKeyPath = gcpIamAuthConfig.ServiceAccountKey
if serviceAccountKeyPath == "" {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("gcp service account key path not found")
}
@@ -621,7 +637,7 @@ func (tm *AgentManager) FetchGcpIamAuthAccessToken() (credential infisicalSdk.Ma
}
func (tm *AgentManager) FetchAwsIamAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, e error) {
func (tm *AgentManager) FetchAwsIamAuthAccessToken() (credential infisicalSdk.MachineIdentityCredential, err error) {
var awsIamAuthConfig AwsIamAuth
if err := ParseAuthConfig(tm.authConfigBytes, &awsIamAuthConfig); err != nil {
@@ -630,9 +646,10 @@ func (tm *AgentManager) FetchAwsIamAuthAccessToken() (credential infisicalSdk.Ma
identityId := os.Getenv(util.INFISICAL_AWS_IAM_AUTH_IDENTITY_ID_NAME)
if identityId == "" {
identityId = awsIamAuthConfig.IdentityID
if identityId == "" {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("aws identity id not found")
identityId, err = ReadFileAsString(awsIamAuthConfig.IdentityID)
if err != nil {
return infisicalSdk.MachineIdentityCredential{}, fmt.Errorf("unable to read identity id from file path '%s' due to error: %v", awsIamAuthConfig.IdentityID, err)
}
}