Squashed public code drop of the repository

Talebearer is no longer in use at Starling, and the original repository has been archived, but I want to preserve the code for my own record. Initial commit STAR-9351: Implement read_properties, start writer STAR-9351: Add input and output file cli args STAR-9351: Implement WritePropertiesFile STAR-9351: Start adding vault substitutor STAR-9351: Initial implementation of vault value replacement Hard-coded dev token in test.... STAR-9351: Use ! as separator between path and key STAR-9351: Abstract vault client with interface for testing STAR-9351: Read vault params from env, fix test STAR-9351: Fix panic on missing key in Vault STAR-9351: Add usage to readme STAR-9351: Add dockerfile, makefile and ssl certs STAR-9351: Don't specify defaults for file names STAR-9351: Add help text, build for Linux in makefile STAR-9351: Add publish to Makefile STAR-9351: Add tests for substituteValues STAR-9351: Add more test cases STAR-9351: Support partial string substitutions STAR-9351: [readme] s/secrets/secret/g STAR-9351: [lint] fix missing f STAR-9351: Sort properties file output STAR-9351: Implement vault aws auth STAR-9351: Allow arch to be changed; namespace vault api STAR-9351: Use new FlagSet for arguments STAR-9351: Add -inplace option Also makes writes atomic by writing to a tempfile and renaming STAR-9351: Fix arguments, improve arg error handling STAR-9351: Fix make install STAR-9351: Empty commit to trigger build STAR-9351: Empty commit to trigger build STAR-9351: Commit dummy file to trigger build STAR-9351: Remove -v parameter As it is not valid for the talebearer app, it causes an error, as testing is imported without flag.Parse being called. It's complicated 😞 STAR-9351: Testing go get importpath change STAR-9351: Update build task STAR-9351: Create symlinks for libc - alpine uses musl STAR-9351: new dockerfile WIP STAR-9351: Build statically linked binary inside container STAR-9351: Go back to previous minimal container STAR-9351: Detect GOOS using uname STAR-9351: Can't do interactive with no tty on teamcity STAR-9351: Move ssl certs to /usr/local/share/ca-certificates NO-JIRA: Remove dummy file STAR-9351: Add some more useful logging And remove the readProperties output as it could (but should not) contain secrets STAR-9351: Fix missing token in client STAR-9351: Copy file STAR-9351: Fix STAR-9351: Accept default password STAR-9351: Default password Catch-all STAR-9351: Don't exit on sealed vault Tidy propertiesFile.go Create tempfile in same directory as destination This should guarantee that os.Rename will work! STAR-10093: Refactor talebearer to handle generic files STAR-10093: Add verbose get mode STAR-10039: Remove password logging Fix segv in secret.go when err is nil (#7) * Fix segv when err is nil * Break out error logging in secret.go STAR-9526: Fix empty strings (#9) * STAR-9351: Return errors from getClient and catch in main() I think this is a bit tidier, as it properly returns errors from getClient rather than just logging the error but otherwise indicating success. Also fixed a log line not formatting correctly * STAR-9351: Continue on vault client error * Fix subsitution of empty strings when secret fetch fails * Fix pointer dereference in VaultSecret * Also dereference VaultSecret in Retrieve() * Fix accidentally added test/log lines * Reinstate fallback log (used in grafana to detect fallbacks) * Remove extra log message STAR-11384: Refactoring and integration testing (#11) Lock dependencies and convert to multi-stage Docker build (#10) * Locked dependencies with `dep init` * Add vendor dir to gitignore * Add application build to Dockerfile No need to call Makefile any more * Docker build no longer depends on a separate step STAR-14881: Alpine, Golang and Vault upgrade (#13) * NOJIRA: formatting * STAR-14881: Bump alpine * NOJIRA: Don't try to parse -test flags * NOJIRA: Re-initialise dep * NOJIRA: Don't manually install testify Should remove its use really, and is installed by dep * NOJIRA: Add go module files Don't crash when VAULT_SKIP_VERIFY is set (#14) STAR-17402: Build toolchain update (#15) * STAR-17402: Fix linting problems in talebearer.go * STAR-17402: Add dockerignore * STAR-17402: Update gitignore * STAR-17402: Add gometalinter to docker build * STAR-17402: Fix go lint errors * STAR-17402: Add gometalinter to make test * STAR-17402: Go mod init && go mod tidy * STAR-17402: Remove dep metadata * STAR-17402: Remove Vagrantfile * STAR-17402: Refresh go module * STAR-17402: Update makefile after move to go module * STAR-17402: Handle errors when closing/removing tempfile * STAR-17402: Don't remove temp properties file It gets renamed, so would normally fail * STAR-17402: Remove unused propertiesFile.go * STAR-17402: Bump image version in make build * STAR-17402: Fix build, temporarily disable gometalinter * STAR-17402: Fix make test * STAR-17402: Remove GOPATH from Dockerfile STAR-17402: Import vault client from vaultsmith (#16) * STAR-17402: Add vault client from vaultsmith Copy-paste job for now, but could be made separate module in future * STAR-17402: Update tests for new mock vault client * STAR-17402: Add TestRunCallsAuthenticate * STAR-17402: Add Docstrings to vault/mock * STAR-17402: Use vault's own DefaultConfig() function for vault config * STAR-17402: Add apiVersion to BaseClient * STAR-17402: Setup logrus STAR-17402: Support -continue-on-error flag (#17) * STAR-17402: Replace prints with log * STAR-17402: Continue when secrets fail to resolve * STAR-17402: Continue on error in RenderSecrets Panicing was a problem here * STAR-17402: Tidy error strings in Retrieve Use single line for logging purposes (likely to appear out of order in Kibana) * STAR-17402: Add example with fallback value STAR-17402: Handle auth failure properly - Cleanup some error messages - Export main run function STAR-17402: KV v2 support (#18) * STAR-17402: Re-enabled KV v2 * STAR-17402: Add mock for Hashicorp's vault client * STAR-17402: Fix and enable gometalinter in builds * STAR-17402: Shorten the mockVaultClient code * STAR-17402: Handle auth failure properly * STAR-17402: Cleanup some error messages * STAR-17402: Add test for trimBrackets Linter surfaced this. It looks like trimBrackets assumes that only groups of two curly braces would be trimmed, but in actual fact it will remove all of them. * STAR-17402: Add sort=path to make lint * STAR-17402: Fix Lint issues from gometalinter * STAR-17402: Finish/implement secretResolver_test * STAR-17402: Upgrade gometalinter * STAR-17402: Disable cache for prod image apk commands * STAR-17402: Disable gotype lint check See: alecthomas/gometalinter#91 Compiler would fail to build any code that failed this linter, so it's not actually very useful at build time. Developers should rely on their IDE for this, or hook gotype up to their text editor. * STAR-17402: Regenerate go module See testcontainers/testcontainers-go#47 * STAR-17402: Use int for kvApiVersion, add GetSecret * STAR-17402: Update test names in base_test.go * STAR-17402: Fixup base_test and client mocking * STAR-17402: Add test for GetSecret * STAR-17402: Rename BaseClient.handler to authHandler * STAR-17402: Add WriteSecret, test for GetSecret * STAR-17402: Add test for WriteSecret * STAR-17402: Lint fixes * STAR-17402: Remove mock of hashicorp vault client As a general approach I've chosen to go with injecting a dummy http client. * STAR-17402: Rename GetSecret to ReadSecret; add WriteSecret to mock * STAR-17402: go get -u * STAR-17402: Don't exit on metalinter fail For some reason, the following errors occur when building in the Docker container, but not locally: ``` vault/base.go:100:17:warning: unused variable or constant cannot use &(credAws.CLIHandler literal) (value of type *github.com/hashicorp/vault/builtin/credential/aws.CLIHandler) as authHandler value in struct literal: wrong type for method Auth (varcheck, varcheck) vault/base.go:100:17:warning: unused struct field cannot use &(credAws.CLIHandler literal) (value of type *github.com/hashicorp/vault/builtin/credential/aws.CLIHandler) as authHandler value in struct literal: wrong type for method Auth (structcheck, structcheck) vault/base.go:100:17:warning: cannot use &(credAws.CLIHandler literal) (value of type *github.com/hashicorp/vault/builtin/credential/aws.CLIHandler) as authHandler value in struct literal: wrong type for method Auth (interfacer, interfacer, maligned, maligned, unconvert, unconvert) ``` All looks like the same thing, but the Auth method signature looks functionally identical. * STAR-17402: Fix dummy roundTripper to generate own response Reusing this object resulted in reading a buffer from the end * STAR-17402: Remove test prints * STAR-17402: Add test for vault write * STAR-17402: Add tests, return error if KV API version unknown * STAR-17402: Remove kvAPIVersion parameter from client * STAR-17402: Rename response to secret * STAR-17402: Support KV v2 in secret * STAR-17402: Rename tests * STAR-17402: Add test.properties to gitignore * STAR-17402: Add test for KV API v2 retrieve * STAR-17402: Reverse order of api v1 vs v2 A KV API v1 secret called "data" could screw things up here. The way I see it, better to fail on a KV v1 secret called "data" than v2. * STAR-17402: Add warning for secret called data * STAR-17402: Reflect actual v2 secret structure in test * STAR-17402: Failed attempt to predetermine secret version Only the mount response has options, secrets do not * Revert "STAR-17402: Failed attempt to predetermine secret version" This reverts commit 244290a15829797c2eda3e43292f8a2751948744. * STAR-17402: Remove unused mock methods
al4 · Nov 1, 2021 · 7b1a514 · 7b1a514
commit 7b1a514
Show file tree

Hide file tree

Showing 36 changed files with 2,415 additions and 0 deletions.
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,9 @@
+.git/
+.gitignore
+.idea/
+Dockerfile
+Makefile
+README.md
+talebearer
+vendor/
+
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,4 @@
+.idea/
+talebearer
+vendor/
+test.properties
diff --git a/Dockerfile b/Dockerfile
@@ -0,0 +1,39 @@
+# Build stage
+FROM golang:1.11.5-alpine3.8 as builder
+
+ENV CGO_ENABLED 0
+
+RUN apk update && apk add curl git tar bash coreutils
+SHELL ["/bin/bash", "-c"]
+
+RUN curl -fsSlL -o /tmp/gometalinter.tgz https://github.com/alecthomas/gometalinter/releases/download/v3.0.0/gometalinter-3.0.0-linux-amd64.tar.gz && \
+    sha256sum --quiet --check <<< "2cab9691fa1f94184ea1df2b69c00990cdf03037c104e6a9deab6815cdbe6a77 /tmp/gometalinter.tgz" && \
+    tar -xvz --strip-components=1 -C /usr/local/bin -f /tmp/gometalinter.tgz
+
+WORKDIR /src/talebearer
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN go build -a --installsuffix cgo --ldflags="-s"
+
+# Run tests
+RUN go test -v ./...
+# gometalinter, with a long deadline. Use shorter times (~60s) locally.
+RUN gometalinter --deadline=240s --enable-gc --tests --aggregate --disable=gotype -e '^\.\./\.\.' --sort=path ./... || true
+
+# Production image stage
+FROM alpine:3.8
+
+RUN apk --no-cache --update upgrade \
+    && apk --no-cache add ca-certificates
+
+COPY ["./ssl/*.crt", "/usr/local/share/ca-certificates/"]
+RUN /usr/sbin/update-ca-certificates && \
+    rm -rf /var/cache/apk/*
+
+COPY --from=builder /src/talebearer/talebearer /usr/local/bin/
+
+ENTRYPOINT ["/usr/local/bin/talebearer"]
+CMD ["-h"]
diff --git a/Makefile b/Makefile
@@ -0,0 +1,43 @@
+## Makefile
+
+.DEFAULT_GOAL := build
+BUILD_NUMBER ?= SNAPSHOT-$(shell git rev-parse --abbrev-ref HEAD)
+
+GOOS ?= $(uname -s)
+GOARCH ?= amd64
+export GOOS
+export GOARCH
+
+build: docker
+
+clean:
+	go clean
+
+install: clean
+	go install .
+
+test:
+	docker build --target=builder .
+
+lint:
+	gometalinter --deadline=240s --enable-gc --tests --aggregate --disable=gotype --sort=path -e '^\.\./\.\.' ./...
+
+docker:
+	docker build -t quay.io/starlingbank/talebearer:$(BUILD_NUMBER) .
+	docker build -t quay.io/starlingbank/talebearer:latest .
+
+ifneq ($(findstring SNAPSHOT, $(BUILD_NUMBER)), SNAPSHOT)
+  ifeq ($(shell git rev-parse --abbrev-ref HEAD), master)
+publish: docker
+	docker push quay.io/starlingbank/talebearer:latest
+	docker push quay.io/starlingbank/talebearer:$(BUILD_NUMBER)
+  else
+publish:
+	$(warning skipping target "publish", not on master branch)
+  endif
+else
+publish:
+	$(error the target "publish" requires that BUILD_NUMBER be set)
+endif
+
+.PHONY: install, build, docker, test, publish
diff --git a/README.md b/README.md
@@ -0,0 +1,46 @@
+talebearer
+==========
+_noun_
+
+A person who spreads scandal or tells secrets; gossip
+
+What this app does
+------------------
+
+Talebearer takes an input properties file, reads any secret placeholder values from Vault, and writes the resulting properties map to an output properties file.
+
+Secret placeholders are denoted by `{{ }}`, i.e. double curly braces). Talebearer queries vault for the path given within the braces. If a secret is found, it will replace the value with that from Vault, otherwise, it will replace the path with an error message.
+
+The path within the braces is of the form `path/to/secret!key`, i.e. `vault write secret/example foo=bar` would be referenced by `secret/example!foo`.
+
+Examples
+--------
+
+For the following properties file:
+```
+foo={{ secret/example!foo }}
+key1=value1
+```
+
+And the following in vault:
+```
+vault write secret/example foo=bar
+```
+
+The output properties file should contain:
+```
+foo=bar
+key1=value1
+```
+
+Usage
+-----
+Ensure the vault client environment variables are set, e.g:
+```sh
+export VAULT_ADDR=http://127.0.0.1:8200
+export VAULT_TOKEN=d1bc686b-b987-3773-ad7d-15655cb833f4
+```
+
+```
+talebearer -input-file ./examples/example.properties -output-file ./test.properties
+```
diff --git a/examples/example-fallback.properties b/examples/example-fallback.properties
@@ -0,0 +1,4 @@
+public=blah
+secret={{ secret/example!foo:default_value }}
+secret-two={{ secret/example!two }}
+baz=boz
diff --git a/examples/example.json b/examples/example.json
@@ -0,0 +1,4 @@
+{
+  "foo": "bar",
+  "baz": "{{ secret/example!password_key }}"
+}
diff --git a/examples/example.pem b/examples/example.pem
@@ -0,0 +1 @@
+{{ secret/rsa_key!pem }}
diff --git a/examples/example.properties b/examples/example.properties
@@ -0,0 +1,4 @@
+public=blah
+secret={{ secret/example!foo }}
+secret-two={{ secret/example!two }}
+baz=boz
diff --git a/examples/file1.in b/examples/file1.in
@@ -0,0 +1,4 @@
+public=blah
+secret={{ secret/example!key }}
+secret-two={{ secret/example!key }}
+baz=boz
diff --git a/examples/file1.out b/examples/file1.out
@@ -0,0 +1,4 @@
+public=blah
+secret=value1
+secret-two=value1
+baz=boz
diff --git a/examples/file2.in b/examples/file2.in
@@ -0,0 +1,6 @@
+public=blah
+
+secret=nosecretshere
+secret-two=yep-definitely-no-secrets-in-here
+
+baz=boz
diff --git a/examples/file2.out b/examples/file2.out
@@ -0,0 +1,6 @@
+public=blah
+
+secret=nosecretshere
+secret-two=yep-definitely-no-secrets-in-here
+
+baz=boz
diff --git a/examples/file3.in b/examples/file3.in
@@ -0,0 +1,6 @@
+This is just a generic configuration file that has
+some {{ secret/example!key }} secrets in random places
+
+No structure required {{ secret/example!key }}
+
+Incomplete secrets such as {{ secret/invalid!invalid } should not be resolved
diff --git a/examples/file3.out b/examples/file3.out
@@ -0,0 +1,6 @@
+This is just a generic configuration file that has
+some value1 secrets in random places
+
+No structure required value1
+
+Incomplete secrets such as {{ secret/invalid!invalid } should not be resolved
diff --git a/examples/file4.in b/examples/file4.in
@@ -0,0 +1,3 @@
+{{ secret/example!key }}
+{{ secret/example!key }}
+{{ secret/invalid!invalid }}
diff --git a/examples/file5.in b/examples/file5.in
@@ -0,0 +1,3 @@
+{{ secret/example!key }}
+{{ secret/example!key }}
+{{ secret/FATAL!invalid }}
diff --git a/examples/generic.conf b/examples/generic.conf
@@ -0,0 +1,6 @@
+This is just a generic configuration file that has
+some {{ secret/example!foo }} secrets in random places
+
+No structure required {{ secret/bar!password_key }}
+
+Incomplete secrets such as {{ secret/invalid!invalid } should not be resolved
diff --git a/examples/nosecrets.conf b/examples/nosecrets.conf
@@ -0,0 +1,9 @@
+File with no secrets:
+
+This is an example of a file with no secrets
+
+The file should remain identical
+
+before.
+
+and after secret rendering.
diff --git a/examples/write.sh b/examples/write.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+vault write secret/example foo=bar
+vault write secret/example two=2222
diff --git a/go.mod b/go.mod
@@ -0,0 +1,75 @@
+module github.com/starlingbank/talebearer
+
+require (
+	dmitri.shuralyov.com/app/changes v0.0.0-20181114035150-5af16e21babb // indirect
+	dmitri.shuralyov.com/service/change v0.0.0-20190203163610-217368fe4577 // indirect
+	git.apache.org/thrift.git v0.12.0 // indirect
+	github.com/SermoDigital/jose v0.9.1 // indirect
+	github.com/Shopify/sarama v1.20.1 // indirect
+	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/aws/aws-sdk-go v1.16.35 // indirect
+	github.com/coreos/go-systemd v0.0.0-20190212144455-93d5ec2c7f76 // indirect
+	github.com/fullsailor/pkcs7 v0.0.0-20180613152042-8306686428a5 // indirect
+	github.com/go-logfmt/logfmt v0.4.0 // indirect
+	github.com/gogo/protobuf v1.2.0 // indirect
+	github.com/golang/lint v0.0.0-20181217174547-8f45f776aaf1 // indirect
+	github.com/google/pprof v0.0.0-20190208070709-b421f19a5c07 // indirect
+	github.com/googleapis/gax-go v2.0.2+incompatible // indirect
+	github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e // indirect
+	github.com/gorilla/mux v1.7.0 // indirect
+	github.com/gregjones/httpcache v0.0.0-20190212212710-3befbb6ad0cc // indirect
+	github.com/grpc-ecosystem/grpc-gateway v1.7.0 // indirect
+	github.com/hashicorp/go-hclog v0.0.0-20190214225846-90f2fbc4844c // indirect
+	github.com/hashicorp/go-immutable-radix v1.0.0 // indirect
+	github.com/hashicorp/go-plugin v0.0.0-20190212232519-b838ffee39ce // indirect
+	github.com/hashicorp/go-retryablehttp v0.5.2
+	github.com/hashicorp/go-rootcerts v1.0.0 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.1 // indirect
+	github.com/hashicorp/go-uuid v1.0.1 // indirect
+	github.com/hashicorp/go-version v1.1.0 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/vault v1.0.3
+	github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
+	github.com/mattn/go-colorable v0.1.0 // indirect
+	github.com/mattn/go-isatty v0.0.4 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.2 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.0.0 // indirect
+	github.com/mitchellh/mapstructure v1.1.2 // indirect
+	github.com/openzipkin/zipkin-go v0.1.5 // indirect
+	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
+	github.com/pkg/errors v0.8.1 // indirect
+	github.com/posener/complete v1.2.1 // indirect
+	github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 // indirect
+	github.com/prometheus/common v0.2.0 // indirect
+	github.com/prometheus/procfs v0.0.0-20190209105433-f8d8b3f739bd // indirect
+	github.com/russross/blackfriday v2.0.0+incompatible // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/shurcooL/go v0.0.0-20190121191506-3fef8c783dec // indirect
+	github.com/shurcooL/gofontwoff v0.0.0-20181114050219-180f79e6909d // indirect
+	github.com/shurcooL/highlight_diff v0.0.0-20181222201841-111da2e7d480 // indirect
+	github.com/shurcooL/highlight_go v0.0.0-20181215221002-9d8641ddf2e1 // indirect
+	github.com/shurcooL/home v0.0.0-20190204141146-5c8ae21d4240 // indirect
+	github.com/shurcooL/htmlg v0.0.0-20190120222857-1e8a37b806f3 // indirect
+	github.com/shurcooL/httpfs v0.0.0-20181222201310-74dc9339e414 // indirect
+	github.com/shurcooL/issues v0.0.0-20190120000219-08d8dadf8acb // indirect
+	github.com/shurcooL/issuesapp v0.0.0-20181229001453-b8198a402c58 // indirect
+	github.com/shurcooL/notifications v0.0.0-20181111060504-bcc2b3082a7a // indirect
+	github.com/shurcooL/octicon v0.0.0-20181222203144-9ff1a4cf27f4 // indirect
+	github.com/shurcooL/reactions v0.0.0-20181222204718-145cd5e7f3d1 // indirect
+	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
+	github.com/shurcooL/webdavfs v0.0.0-20181215192745-5988b2d638f6 // indirect
+	github.com/sirupsen/logrus v1.3.0
+	github.com/stretchr/testify v1.3.0
+	go.opencensus.io v0.19.0 // indirect
+	go4.org v0.0.0-20181109185143-00e24f1b2599 // indirect
+	golang.org/x/build v0.0.0-20190214220220-5d2b36639e09 // indirect
+	golang.org/x/exp v0.0.0-20190212162250-21964bba6549 // indirect
+	golang.org/x/oauth2 v0.0.0-20190212230446-3e8b2be13635 // indirect
+	golang.org/x/perf v0.0.0-20190124201629-844a5f5b46f4 // indirect
+	golang.org/x/sys v0.0.0-20190214214411-e77772198cdc // indirect
+	golang.org/x/tools v0.0.0-20190214204934-8dcb7bc8c7fe // indirect
+	google.golang.org/grpc v1.18.0 // indirect
+	honnef.co/go/tools v0.0.0-20190215041234-466a0476246c // indirect
+	sourcegraph.com/sqs/pbtypes v1.0.0 // indirect
+)