Format certificates to separate out pem and key

[vickicello]

Summary

This change adds a new template helper, expandFullChain, that will take a map of secrets and separate out the pem and key file if the secret is a certificate.

Some modules were also updated to address the open dependabot PRs. In order to bump the package versions, we also had to update Go to version 1.17.x.

Manual Testing

A few conditions were tested:

• expandFullChain template helper works with both PEM and PKCS12 files
• Disabled secrets will not cause AKVA to error out (GetSecrets has been updated to not pull down disabled secrets by default)
• A mixture of string secrets + certificate secrets, or just certificate secrets can be pulled down successfully
• pkcs12 bundle without key: since Azure does not allow you to upload a pkcs12 file without a key, this will never happen
• stacked pem works

Testing configuration and output:

# akva.yaml

workers:
  -
    resources:
      - kind: all-secrets
        vaultBaseURL: https://my-testing-keyvault.vault.azure.net/
        credential: my-testing-keyvault
    sinks:
      - path: secrets.json
        template: "{{ index .Secrets | expandFullChain | toValues | toJson }}"
    frequency: 10s

# Run AKVA with `go mod download && go build . && ./azure-key-vault-agent -c ./akva.yaml`

# secrets.json - returns all original secrets, plus pem and key separated out for any certificates:

{"test-cert":"...","test-cert.key":"...","test-cert.pem":"...","some-string-secret":"...","different-cert":"...","different-cert.key":"...","different-cert.pem":"..."}

Caveat

expandFullChain is only expected to be used on the all-secrets kind. Like the toValues template helper, expandFullChain will throw an error if you try to use it on an individual secret or certificate. The intended behavior and use is reflected in the README.

[chrisjohnson]

Overall looks fantastic 😍 small question

[chrisjohnson]

I think key is already a secrets.Secret -- what happens if you just do results[secretName+".key"] = key?

[vickicello]

Yep that isn't needed anymore - I'll commit that change

[drewby08]

We should also update the README's list of helpers:

azure-key-vault-agent/README.md

Line 141 in 5e0774c

Complete List of Cert Helpers:

[drewby08]

Looks great, thank you for the new feature :)