Skip to content

Commit e6decc9

Browse files
raffaelespazzoliVikaspogu
raffaelespazzoli
and
Vikaspogu
authored
Alternative name for vault resource (#202)
* initial refactor * fix regex quotes --------- Co-authored-by: Vikas Pogu <[email protected]>
1 parent fa1f20f commit e6decc9

36 files changed

+270
-30
lines changed

‎api/v1alpha1/authenginemount_types.go

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,18 @@ type AuthEngineMountSpec struct {
4646
// The authentication role must have the following capabilities = [ "create", "read", "update", "delete"] on that path /sys/auth/{[spec.authentication.namespace]}/{spec.path}/{metadata.name}.
4747
// +kubebuilder:validation:Required
4848
Path vaultutils.Path `json:"path,omitempty"`
49+
50+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
51+
// +kubebuilder:validation:Optional
52+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
53+
Name string `json:"name,omitempty"`
54+
}
55+
56+
func (d *AuthEngineMount) GetPath() string {
57+
if d.Spec.Name != "" {
58+
return vaultutils.CleansePath(d.GetEngineListPath() + "/" + string(d.Spec.Path) + "/" + d.Spec.Name)
59+
}
60+
return vaultutils.CleansePath(d.GetEngineListPath() + "/" + string(d.Spec.Path) + "/" + d.Name)
4961
}
5062

5163
type AuthMount struct {
@@ -83,7 +95,7 @@ type AuthMountConfig struct {
8395
// AuditNonHMACRequestKeys list of keys that will not be HMAC'd by audit devices in the request data object.
8496
// +kubebuilder:validation:Optional
8597
// +listType=set
86-
// kubebuilder:validation:UniqueItems=true
98+
// kubebuilder:validation:UniqueItems:=true
8799
AuditNonHMACRequestKeys []string `json:"auditNonHMACRequestKeys,omitempty"`
88100

89101
// AuditNonHMACResponseKeys list of keys that will not be HMAC'd by audit devices in the response data object.
@@ -101,7 +113,7 @@ type AuthMountConfig struct {
101113
// PassthroughRequestHeaders list of headers to whitelist and pass from the request to the plugin.
102114
// +kubebuilder:validation:Optional
103115
// +listType=set
104-
// kubebuilder:validation:UniqueItems=true
116+
// kubebuilder:validation:UniqueItems:=true
105117
PassthroughRequestHeaders []string `json:"passthroughRequestHeaders,omitempty"`
106118

107119
// AllowedResponseHeaders list of headers to whitelist, allowing a plugin to include them in the response.
@@ -161,10 +173,6 @@ func (d *AuthEngineMount) GetKubeAuthConfiguration() *vaultutils.KubeAuthConfigu
161173
return &d.Spec.Authentication
162174
}
163175

164-
func (d *AuthEngineMount) GetPath() string {
165-
return vaultutils.CleansePath(d.GetEngineListPath() + "/" + string(d.Spec.Path) + "/" + d.Name)
166-
}
167-
168176
func (d *AuthEngineMount) GetPayload() map[string]interface{} {
169177
return d.Spec.toMap()
170178
}

‎api/v1alpha1/databasesecretengineconfig_types.go

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,11 @@ type DatabaseSecretEngineConfigSpec struct {
5656
// RootCredentials specifies how to retrieve the credentials for this DatabaseEngine connection.
5757
// +kubebuilder:validation:Required
5858
RootCredentials vaultutils.RootCredentialConfig `json:"rootCredentials,omitempty"`
59+
60+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
61+
// +kubebuilder:validation:Optional
62+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
63+
Name string `json:"name,omitempty"`
5964
}
6065

6166
var _ vaultutils.VaultObject = &DatabaseSecretEngineConfig{}
@@ -65,10 +70,16 @@ func (d *DatabaseSecretEngineConfig) GetVaultConnection() *vaultutils.VaultConne
6570
}
6671

6772
func (d *DatabaseSecretEngineConfig) GetPath() string {
68-
return string(d.Spec.Path) + "/" + "config" + "/" + d.Name
73+
if d.Spec.Name != "" {
74+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "config" + "/" + d.Spec.Name)
75+
}
76+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "config" + "/" + d.Name)
6977
}
7078
func (d *DatabaseSecretEngineConfig) GetRootPasswordRotationPath() string {
71-
return string(d.Spec.Path) + "/" + "rotate-root" + "/" + d.Name
79+
if d.Spec.Name != "" {
80+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "rotate-root" + "/" + d.Spec.Name)
81+
}
82+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "rotate-root" + "/" + d.Name)
7283
}
7384
func (d *DatabaseSecretEngineConfig) GetPayload() map[string]interface{} {
7485
return d.Spec.toMap()

‎api/v1alpha1/databasesecretenginerole_types.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ type DatabaseSecretEngineRoleSpec struct {
4848
Path vaultutils.Path `json:"path,omitempty"`
4949

5050
DBSERole `json:",inline"`
51+
52+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
53+
// +kubebuilder:validation:Optional
54+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
55+
Name string `json:"name,omitempty"`
5156
}
5257

5358
var _ vaultutils.VaultObject = &DatabaseSecretEngineRole{}
@@ -59,7 +64,10 @@ func (d *DatabaseSecretEngineRole) GetVaultConnection() *vaultutils.VaultConnect
5964
}
6065

6166
func (d *DatabaseSecretEngineRole) GetPath() string {
62-
return string(d.Spec.Path) + "/" + "roles" + "/" + d.Name
67+
if d.Spec.Name != "" {
68+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "roles" + "/" + d.Spec.Name)
69+
}
70+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "roles" + "/" + d.Name)
6371
}
6472
func (d *DatabaseSecretEngineRole) GetPayload() map[string]interface{} {
6573
return d.Spec.toMap()

‎api/v1alpha1/databasesecretenginestaticrole_types.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ type DatabaseSecretEngineStaticRoleSpec struct {
4848
Path vaultutils.Path `json:"path,omitempty"`
4949

5050
DBSEStaticRole `json:",inline"`
51+
52+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
53+
// +kubebuilder:validation:Optional
54+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
55+
Name string `json:"name,omitempty"`
5156
}
5257

5358
type DBSEStaticRole struct {
@@ -140,7 +145,10 @@ func (d *DatabaseSecretEngineStaticRole) GetVaultConnection() *vaultutils.VaultC
140145
}
141146

142147
func (d *DatabaseSecretEngineStaticRole) GetPath() string {
143-
return string(d.Spec.Path) + "/" + "static-roles" + "/" + d.Name
148+
if d.Spec.Name != "" {
149+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "static-roles" + "/" + d.Spec.Name)
150+
}
151+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "static-roles" + "/" + d.Name)
144152
}
145153
func (d *DatabaseSecretEngineStaticRole) GetPayload() map[string]interface{} {
146154
return d.Spec.toMap()

‎api/v1alpha1/githubsecretenginerole_types.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ type GitHubSecretEngineRoleSpec struct {
5151
// When crafting Vault policy, hyper security sensitive organisations may wish to favour repository_ids (GitHub repository IDs are immutable) instead of repositories (GitHub repository names are mutable).
5252
// +kubebuilder:validation:Optional
5353
PermissionSet `json:",inline"`
54+
55+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
56+
// +kubebuilder:validation:Optional
57+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
58+
Name string `json:"name,omitempty"`
5459
}
5560

5661
type PermissionSet struct {
@@ -93,7 +98,10 @@ func (d *GitHubSecretEngineRole) GetVaultConnection() *vaultutils.VaultConnectio
9398
}
9499

95100
func (d *GitHubSecretEngineRole) GetPath() string {
96-
return string(d.Spec.Path) + "/" + "permissionset" + "/" + d.Name
101+
if d.Spec.Name != "" {
102+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "permissionset" + "/" + d.Spec.Name)
103+
}
104+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "permissionset" + "/" + d.Name)
97105
}
98106
func (d *GitHubSecretEngineRole) GetPayload() map[string]interface{} {
99107
return d.Spec.toMap()

‎api/v1alpha1/group_types.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ type GroupSpec struct {
3939
Authentication vaultutils.KubeAuthConfiguration `json:"authentication,omitempty"`
4040

4141
GroupConfig `json:",inline"`
42+
43+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
44+
// +kubebuilder:validation:Optional
45+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
46+
Name string `json:"name,omitempty"`
4247
}
4348

4449
type GroupConfig struct {
@@ -123,7 +128,10 @@ func (d *Group) GetVaultConnection() *vaultutils.VaultConnection {
123128
}
124129

125130
func (d *Group) GetPath() string {
126-
return string("/identity/group/name/" + d.Name)
131+
if d.Spec.Name != "" {
132+
return vaultutils.CleansePath(string("/identity/group/name/" + d.Spec.Name))
133+
}
134+
return vaultutils.CleansePath(string("/identity/group/name/" + d.Name))
127135
}
128136

129137
func (d *Group) GetPayload() map[string]interface{} {

‎api/v1alpha1/groupalias_types.go

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ type GroupAliasSpec struct {
5151
retrievedAliasID string `json:"-"`
5252

5353
retrievedName string `json:"-"`
54+
55+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
56+
// +kubebuilder:validation:Optional
57+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
58+
Name string `json:"name,omitempty"`
5459
}
5560

5661
type GroupAliasConfig struct {
@@ -157,13 +162,16 @@ func (d *GroupAlias) PrepareInternalValues(context context.Context, object clien
157162
return err
158163
}
159164
d.Spec.retrievedCanonicalID = secret.Data["id"].(string)
160-
161-
d.Spec.retrievedName = d.Name
165+
if d.Spec.Name != "" {
166+
d.Spec.retrievedName = d.Spec.Name
167+
} else {
168+
d.Spec.retrievedName = d.Name
169+
}
162170

163171
if d.Status.ID == "" {
164172
//we have to create the group alias as unfortunately this api is asymmetric
165173
payload := map[string]interface{}{
166-
"name": d.Name,
174+
"name": map[bool]string{true: d.Spec.Name, false: d.Name}[d.Spec.Name != ""],
167175
"mount_accessor": d.Spec.retrievedMountAccessor,
168176
"canonical_id": d.Spec.retrievedCanonicalID,
169177
}

‎api/v1alpha1/kubernetesauthengineconfig_types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,21 @@ type KubernetesAuthEngineConfigSpec struct {
5252
// TokenReviewerServiceAccount A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set, the JWT submitted in the login payload will be used to access the Kubernetes TokenReview API.
5353
// +kubebuilder:validation:Optional
5454
TokenReviewerServiceAccount *corev1.LocalObjectReference `json:"tokenReviewerServiceAccount,omitempty"`
55+
56+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
57+
// +kubebuilder:validation:Optional
58+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
59+
Name string `json:"name,omitempty"`
5560
}
5661

5762
func (d *KubernetesAuthEngineConfig) GetVaultConnection() *vaultutils.VaultConnection {
5863
return d.Spec.Connection
5964
}
6065

6166
func (d *KubernetesAuthEngineConfig) GetPath() string {
67+
if d.Spec.Name != "" {
68+
return vaultutils.CleansePath("auth/" + string(d.Spec.Path) + "/" + d.Spec.Name + "/config")
69+
}
6270
return vaultutils.CleansePath("auth/" + string(d.Spec.Path) + "/" + d.Name + "/config")
6371
}
6472

‎api/v1alpha1/kubernetesauthenginerole_types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@ type KubernetesAuthEngineRoleSpec struct {
5353
// TargetNamespaces specifies how to retrieve the namespaces bound to this Vault role.
5454
// +kubebuilder:validation:Required
5555
TargetNamespaces vaultutils.TargetNamespaceConfig `json:"targetNamespaces,omitempty"`
56+
57+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
58+
// +kubebuilder:validation:Optional
59+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
60+
Name string `json:"name,omitempty"`
5661
}
5762

5863
var _ vaultutils.VaultObject = &KubernetesAuthEngineRole{}
@@ -63,6 +68,9 @@ func (d *KubernetesAuthEngineRole) GetVaultConnection() *vaultutils.VaultConnect
6368
}
6469

6570
func (d *KubernetesAuthEngineRole) GetPath() string {
71+
if d.Spec.Name != "" {
72+
return vaultutils.CleansePath("auth/" + string(d.Spec.Path) + "/role/" + d.Spec.Name)
73+
}
6674
return vaultutils.CleansePath("auth/" + string(d.Spec.Path) + "/role/" + d.Name)
6775
}
6876
func (d *KubernetesAuthEngineRole) GetPayload() map[string]interface{} {

‎api/v1alpha1/kubernetessecretenginerole_types.go

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,22 @@ type KubernetesSecretEngineRoleSpec struct {
5050
TargetNamespaces vaultutils.TargetNamespaceConfig `json:"targetNamespaces,omitempty"`
5151

5252
KubeSERole `json:",inline"`
53+
54+
// The name of the obejct created in Vault. If this is specified it takes precedence over {metatada.name}
55+
// +kubebuilder:validation:Optional
56+
// +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?`
57+
Name string `json:"name,omitempty"`
5358
}
5459

5560
var _ vaultutils.VaultObject = &KubernetesSecretEngineRole{}
5661

5762
var _ vaultutils.ConditionsAware = &KubernetesSecretEngineRole{}
5863

5964
func (d *KubernetesSecretEngineRole) GetPath() string {
60-
return string(d.Spec.Path) + "/" + "roles" + "/" + d.Name
65+
if d.Spec.Name != "" {
66+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "roles" + "/" + d.Spec.Name)
67+
}
68+
return vaultutils.CleansePath(string(d.Spec.Path) + "/" + "roles" + "/" + d.Name)
6169
}
6270
func (d *KubernetesSecretEngineRole) GetPayload() map[string]interface{} {
6371
return d.Spec.toMap()

0 commit comments

Comments
 (0)