Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tokenRead will renew resource token instead of access token #423

Merged
merged 3 commits into from
Aug 9, 2019
Merged

tokenRead will renew resource token instead of access token #423

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5edf608
tokenRead will renew resource token instead of access token
May 21, 2019
fba53f3
Merge remote-tracking branch 'upstream/master' into renew-resource-token
Aug 8, 2019
7bfec6e
Remove ExpectNonEmptyPlan from TestResourceToken_renew
Aug 8, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions vault/resource_token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,17 +264,18 @@ func tokenCreate(d *schema.ResourceData, meta interface{}) error {
func tokenRead(d *schema.ResourceData, meta interface{}) error {
client := meta.(*api.Client)

id := d.Id()
id := d.Get("client_token").(string)
accessor := d.Id()

log.Printf("[DEBUG] Reading token accessor %q", id)
resp, err := client.Auth().Token().LookupAccessor(id)
log.Printf("[DEBUG] Reading token accessor %q", accessor)
resp, err := client.Auth().Token().LookupAccessor(accessor)
if err != nil {
log.Printf("[WARN] Token not found, removing from state")
d.SetId("")
return nil
}

log.Printf("[DEBUG] Read token accessor %q", id)
log.Printf("[DEBUG] Read token accessor %q", accessor)

iPolicies := resp.Data["policies"].([]interface{})
policies := make([]string, 0, len(iPolicies))
Expand Down Expand Up @@ -305,23 +306,22 @@ func tokenRead(d *schema.ResourceData, meta interface{}) error {
d.Set("lease_duration", int(expireTime.Sub(issueTime).Seconds()))

if d.Get("renewable").(bool) && tokenCheckLease(d) {
log.Printf("[DEBUG] Lease for token accessor %q expiring soon, renewing", d.Id())
log.Printf("[DEBUG] Lease for token accessor %q expiring soon, renewing", accessor)

increment := d.Get("lease_duration").(int)

if v, ok := d.GetOk("renew_increment"); ok {
increment = v.(int)
}

renewed, err := client.Auth().Token().RenewSelf(increment)
renewed, err := client.Auth().Token().Renew(id, increment)
if err != nil {
log.Printf("[DEBUG] Error renewing token, removing from state")
d.SetId("")
return nil
}

log.Printf("[DEBUG] Lease for token accessor %q renewed, new lease duration %d", d.Id(),
renewed.Auth.LeaseDuration)
log.Printf("[DEBUG] Lease for token accessor %q renewed, new lease duration %d", id, renewed.Auth.LeaseDuration)

d.Set("lease_duration", renewed.Data["lease_duration"])
d.Set("lease_started", time.Now().Format(time.RFC3339))
Expand Down Expand Up @@ -366,15 +366,16 @@ func tokenExists(d *schema.ResourceData, meta interface{}) (bool, error) {
}

func tokenCheckLease(d *schema.ResourceData) bool {
accessor := d.Id()

startedStr := d.Get("lease_started").(string)
if startedStr == "" {
return false
}

started, err := time.Parse(time.RFC3339, startedStr)
if err != nil {
log.Printf("[DEBUG] lease_started %q for token accessor %q is an invalid value, removing: %s", startedStr,
d.Id(), err)
log.Printf("[DEBUG] lease_started %q for token accessor %q is an invalid value, removing: %s", startedStr, accessor, err)
d.SetId("")

return false
Expand All @@ -384,7 +385,7 @@ func tokenCheckLease(d *schema.ResourceData) bool {

expireTime := started.Add(time.Second * time.Duration(leaseDuration))
if expireTime.Before(time.Now()) {
log.Printf("[DEBUG] token accessor %q has expired", d.Id())
log.Printf("[DEBUG] token accessor %q has expired", accessor)
d.SetId("")

return false
Expand All @@ -398,7 +399,7 @@ func tokenCheckLease(d *schema.ResourceData) bool {

renewTime := int(expireTime.Sub(time.Now()).Seconds())
if renewTime <= renewMinLease {
log.Printf("[DEBUG] token accessor %q must be renewed", d.Id())
log.Printf("[DEBUG] token accessor %q must be renewed", accessor)

return true
}
Expand Down
1 change: 0 additions & 1 deletion vault/resource_token_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,6 @@ func TestResourceToken_renew(t *testing.T) {
resource.TestCheckResourceAttrSet("vault_token.test", "lease_started"),
resource.TestCheckResourceAttrSet("vault_token.test", "client_token"),
),
ExpectNonEmptyPlan: true,
},
{
Config: testResourceTokenConfig_renew(),
Expand Down