forked from vmware-archive/atc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
secretsmanager.go
114 lines (100 loc) · 3.17 KB
/
secretsmanager.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
package secretsmanager
import (
"bytes"
"encoding/json"
"strings"
"text/template"
"code.cloudfoundry.org/lager"
"github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/service/secretsmanager"
"github.com/aws/aws-sdk-go/service/secretsmanager/secretsmanageriface"
varTemplate "github.com/cloudfoundry/bosh-cli/director/template"
)
type SecretsManager struct {
log lager.Logger
api secretsmanageriface.SecretsManagerAPI
TeamName string
PipelineName string
SecretTemplates []*template.Template
}
func NewSecretsManager(log lager.Logger, api secretsmanageriface.SecretsManagerAPI, teamName string, pipelineName string, secretTemplates []*template.Template) *SecretsManager {
return &SecretsManager{
log: log,
api: api,
TeamName: teamName,
PipelineName: pipelineName,
SecretTemplates: secretTemplates,
}
}
func (s *SecretsManager) buildSecretId(nameTemplate *template.Template, secret string) (string, error) {
var buf bytes.Buffer
err := nameTemplate.Execute(&buf, &Secret{
Team: s.TeamName,
Pipeline: s.PipelineName,
Secret: secret,
})
return buf.String(), err
}
func (s *SecretsManager) Get(varDef varTemplate.VariableDefinition) (interface{}, bool, error) {
for _, st := range s.SecretTemplates {
secretId, err := s.buildSecretId(st, varDef.Name)
if err != nil {
s.log.Error("build-secret-id", err, lager.Data{"template": st.Name(), "secret": varDef.Name})
return nil, false, err
}
if strings.Contains(secretId, "//") {
continue
}
value, found, err := s.getSecretById(secretId)
if err != nil {
s.log.Error("get-secret", err, lager.Data{
"template": st.Name(), "secret": varDef.Name, "secretId": secretId,
})
return nil, false, err
}
if found {
return value, true, nil
}
}
return nil, false, nil
}
/*
Looks up secret by name. Depending on which field is filled it will either
return a string value (SecretString) or a map[interface{}]interface{} (SecretBinary).
In case SecretBinary is set, it is expected to be a valid JSON object or it will error.
*/
func (s *SecretsManager) getSecretById(name string) (interface{}, bool, error) {
value, err := s.api.GetSecretValue(&secretsmanager.GetSecretValueInput{
SecretId: &name,
})
if err == nil {
switch {
case value.SecretString != nil:
return *value.SecretString, true, nil
case value.SecretBinary != nil:
values, err := decodeJsonValue(value.SecretBinary)
if err != nil {
return nil, true, err
}
return values, true, nil
}
} else if errObj, ok := err.(awserr.Error); ok && errObj.Code() == secretsmanager.ErrCodeResourceNotFoundException {
return nil, false, nil
}
return nil, false, err
}
func (s *SecretsManager) List() ([]varTemplate.VariableDefinition, error) {
// not implemented, see vault implementation
return []varTemplate.VariableDefinition{}, nil
}
func decodeJsonValue(data []byte) (map[interface{}]interface{}, error) {
var values map[string]interface{}
if err := json.Unmarshal(data, &values); err != nil {
return nil, err
}
evenLessTyped := map[interface{}]interface{}{}
for k, v := range values {
evenLessTyped[k] = v
}
return evenLessTyped, nil
}