Current File : //proc/self/root/proc/3522530/root/usr/lib/python2.7/site-packages/salt/renderers/nacl.pyo
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l
j j Z e j
e � Z d Z d � Z d d d d � Z d S( u�
Renderer that will decrypt NACL ciphers
Any key in the SLS file can be an NACL cipher, and this renderer will decrypt it
before passing it off to Salt. This allows you to safely store secrets in
source control, in such a way that only your Salt master can decrypt them and
distribute them only to the minions that need them.
The typical use-case would be to use ciphers in your pillar data, and keep a
secret key on your master. You can put the public key in source control so that
developers can add new secrets quickly and easily.
This renderer requires the libsodium library binary and libnacl >= 1.5.1
python package (support for sealed boxes came in 1.5.1 version).
Setup
-----
To set things up, first generate a keypair. On the master, run the following:
.. code-block:: bash
# salt-call --local nacl.keygen sk_file=/root/.nacl
Using encrypted pillar
---------------------
To encrypt secrets, copy the public key to your local machine and run:
.. code-block:: bash
$ salt-call --local nacl.enc datatoenc pk_file=/root/.nacl.pub
To apply the renderer on a file-by-file basis add the following line to the
top of any pillar with nacl encrypted data in it:
.. code-block:: yaml
#!yaml|nacl
Now with your renderer configured, you can include your ciphers in your pillar
data like so:
.. code-block:: yaml
#!yaml|nacl
a-secret: "NACL[MRN3cc+fmdxyQbz6WMF+jq1hKdU5X5BBI7OjK+atvHo1ll+w1gZ7XyWtZVfq9gK9rQaMfkDxmidJKwE0Mw==]"
i ( t absolute_importt print_functiont unicode_literalsNu ^NACL\[(.*)\]$c K@ s t j j j | � r( t | j � | � St | t j � r t j
t | � d k rx t
d t j
t | � j d � | � S| Sn� t | t � r� x0 t j | � D] \ } } t | | � | | <q� W| St | t � rx- t | � D] \ } } t | | � | | <q� W| S| Sd S( u�
Recursively try to decrypt any object. If the object is a six.string_types
(string or unicode), and it contains a valid NACLENC pretext, decrypt it,
otherwise keep going until a string is found.
u nacl.deci N( t saltt utilst stringiot is_readablet _decrypt_objectt getvaluet
isinstancet sixt string_typest ret searcht
NACL_REGEXt Nonet __salt__t groupt dictt iteritemst listt enumerate( t objt kwargst keyt value( ( s7 /usr/lib/python2.7/site-packages/salt/renderers/nacl.pyR G s & u baseu c K@ s
t | | � S( ua
Decrypt the data to be rendered using the given nacl key or the one given
in config
( R ( t nacl_datat saltenvt slst arglineR ( ( s7 /usr/lib/python2.7/site-packages/salt/renderers/nacl.pyt render` s ( t __doc__t
__future__R R R R t loggingt salt.utils.stringioR t
salt.syspathst salt.ext.sixt extR
t getLoggert __name__t logR R R ( ( ( s7 /usr/lib/python2.7/site-packages/salt/renderers/nacl.pyt <module>5 s
Mini Shell