Current File : //lib/python2.7/site-packages/salt/runners/vault.pyo
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z d d l Z d d l
m Z e j e � Z e d � Z d � Z d � Z d � Z d � Z d
� Z d � Z d � Z d S(
u�
:maintainer: SaltStack
:maturity: new
:platform: all
Runner functions supporting the Vault modules. Configuration instructions are
documented in the execution module docs.
i ( t absolute_importt print_functiont unicode_literalsN( t sixc C@ sT t j d | | � t | | | � yt d } | j d d! � } | d d d k rt � rt j d � d j | d � } i | d d
d
6} d | d k r� | d d | d <n t j | d | d
| �} | j
d k r� i | j d 6S| j � d d | d d <qn t
| � } i | d d d 6} i t � j d d � d 6| d 6t � j d d � d 6} i t | | � d 6d d 6| d 6} | d g k r�i d d 6St j d � t j | d | d | d
| �} | j
d k r�i | j d 6S| j � d }
i |
d d 6| d d 6| d 6SWn$ t k
rO} i t j | � d 6SXd! S(" u�
Generate a Vault token for minion minion_id
minion_id
The id of the minion that requests a token
signature
Cryptographic signature which validates that the request is indeed sent
by the minion (or the master, see impersonated_by_master).
impersonated_by_master
If the master needs to create a token on behalf of the minion, this is
True. This happens when the master generates minion pillars.
u< Token generation request for %s (impersonated by master: %s)u vaultu verifyu authu methodu approleu# Vault token expired. Recreating oneu {0}/v1/auth/approle/loginu urlu role_idu secret_idt jsont verifyi� u erroru client_tokenu tokenu
X-Vault-Tokenu __jid__u <no jid set>u
saltstack-jidu saltstack-minionu __user__u
<no user set>u saltstack-useru policiesi u num_usesu metau No policies matched minionu' Sending token creation request to Vaultt headersN( t logt debugt _validate_signaturet __opts__t gett Nonet _selftoken_expiredt formatt requestst postt status_codet reasonR t _get_token_create_urlt globalst
_get_policiest tracet ExceptionR t text_type( t minion_idt signaturet impersonated_by_mastert configR t urlt payloadt responseR t
audit_datat auth_datat e( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyt generate_token sR
"
! c C@ s` xY t d d D]I } t d d d d t j i | d 6� �j � } | d t k r t Sq Wt S( uj
Unseal Vault server
This function uses the 'keys' from the 'vault' configuration to unseal vault server
vault:
keys:
- n63/TbrQuL3xaIW7ZZpuXj/tIfnK1/MbVxO4vT3wYD2A
- S9OwCvMRhErEA4NVVELYBs6w/Me6+urgUr24xGK44Uy3
- F1j4b7JKq850NS6Kboiy5laJ0xY8dWJvB3fcwA+SraYl
- 1cYtvjKJNDVam9c7HNqJUfINk4PYyAXIpjkpN/sIuzPv
- 3pPK5X6vGtwLhNOFv1U2elahECz3HpRUfNXJFYLw6lid
.. note: This function will send unsealed keys until the api returns back
that the vault has been unsealed
CLI Examples:
.. code-block:: bash
salt-run vault.unseal
u vaultu keysu vault.make_requestu PUTu
v1/sys/unsealt datau keyu sealed( R
t __utils__R t dumpst Falset True( t keyt ret( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyt unsealc s
/c C@ s t d } t | | � S( u�
Show the Vault policies that are applied to tokens for the given minion
minion_id
The minions id
CLI Example:
.. code-block:: bash
salt-run vault.show_policies myminion
u vault( R
R ( R R ( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyt
show_policies� s
c C@ s� t d } | r" d j | � } n d j | | � } t j d | � t j | � } t j j | | | � s� t j j
d j | � � � n t j d � d S( u^
Validate that either minion with id minion_id, or the master, signed the
request
u pki_diru {0}/master.pubu {0}/minions/{1}u Validating signature for %su) Could not validate token request from {0}u Signature okN( R
R R R t base64t b64decodet saltt cryptt verify_signaturet
exceptionst AuthenticationError( R R R t pki_dirt
public_key( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyR � s
c C@ s� t j j j | t � \ } } } | j d d d g � } i | d 6| pL i d 6} g } xl | D]d } y: x3 t | | � D]" } | j | j | � j � � qy WWq` t
k
r� t j d | � q` Xq` Wt j
d | | � | S( uJ
Get the policies that should be applied to a token for minion_id
u policiesu saltstack/minion/{minion}u saltstack/minionsu minionu grainsu# Could not resolve policy pattern %su %s policies: %s( R/ t utilst minionst get_minion_dataR
R t _expand_pattern_listst appendR t lowert KeyErrorR t warningR ( R R t _t grainst policy_patternst mappingst policiest patternt expanded_pattern( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyR � s !
c K@ s� g } t j � } x� | j | � D]� \ } } } } | d k rF q" n | j | d | � \ } } t | t � r" d j | � } g | D]! } | j | t j
| � � ^ q� } x' | D] }
t |
| � } | | 7} q� W| Sq" W| g S( u�
Expands the pattern for any list-valued mappings, such that for any list of
length N in the mappings present in the pattern, N copies of the pattern are
returned, each with an element of the list substituted.
pattern:
A pattern to expand, for example ``by-role/{grains[roles]}``
mappings:
A dictionary of variables that can be expanded into the pattern.
Example: Given the pattern `` by-role/{grains[roles]}`` and the below grains
.. code-block:: yaml
grains:
roles:
- web
- database
This function will expand into two patterns,
``[by-role/web, by-role/database]``.
Note that this method does not expand any non-list patterns.
u {{{0}}}N( t stringt Formattert parseR t get_fieldt
isinstancet listR t replaceR R R9 ( RC RA t expanded_patternst fR> t
field_namet valuet tokent elemt expandedt
expanded_itemt result( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyR9 � s " .
c C@ s� y� t d j d d � } d j t d d � } d t d d k rH t Si t d d d d 6} t j | d | d | �} | j d
k r� t St SWn7 t k
r� } t j
j d j t j
| � � � � n Xd S(
u>
Validate the current token exists and is still valid
u vaultu verifyu {0}/v1/auth/token/lookup-selfu urlu tokenu authu
X-Vault-TokenR R i� u' Error while looking up self token : {0}N( R
R R R R( R R R' R R/ R2 t CommandExecutionErrorR R ( R R R R R" ( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyR
� s c C@ sB | j d d � } d } | d } d j d � | | | f D� � S( u-
Create Vault url for token creation
u role_nameu /v1/auth/token/createu urlu /c s@ s$ | ] } | r | j d � Vq d S( u /N( t strip( t .0t x( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pys <genexpr>
s N( R R t join( R t role_namet auth_patht base_url( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyR s
( t __doc__t
__future__R R R R- R t loggingRE R t
salt.cryptR/ t salt.exceptionst salt.extR t getLoggert __name__R R' R# R+ R, R R R9 R
R ( ( ( s6 /usr/lib/python2.7/site-packages/salt/runners/vault.pyt <module> s$ G 2
Mini Shell