Set a token CIDR based on SecretId CIDR rather than specifying it at appRole creation

[far-blue]

At the moment we have a AppRoles for each of our deployed apps and these apps deploy over clusters with known IP ranges so we limit the AppRole to the appropriate range. We also generate a SecretId for each deploy of our app and for each node in the cluster for the app - so a SecretId generated for nodeA can't be used on nodeB. However, tokens generated by auth'ing with the SecretId value for a particular node generates a token that is not restricted. The only option to restrict the token is by setting token CIDR ranges on the AppRole so the best we can achieve is to limit a token to a cluster rather than a node.

It would be great if we could specify when creating the AppRole that the token's CIDR range(s) should inherit from the SecretId used to auth and generate the token rather than using a fixed config at the point of defining the AppRole. This would allow us to create tokens limited to a specific node.

We have considered creating AppRoles for each combination of App and Node but this results in five times the number of AppRoles to manage.

Thanks,

[jefferai]

This is now implemented -- you can specify a CIDR at secret-id generation time which must be a subset of the cidrs configured on the role (if any). This matches our normal workflow of allowing you to be more specific than a role, but not escape what the role has set. I believe it should solve this use case though as you can set the role value to something more broad that covers all needs (or just not set it at all and allow any value set on the secret ID) and then scope it very specifically when the secret ID is generated.

[far-blue]

While it is now possible to limit a secret is to a subset of the app role cidr, this doesn’t carry over to tokens created by authenticating with the app ID and secret ID. As such, a token extracted from a node using a cidr restricted secret ID can be used anywhere.

[jefferai]

@far-blue Are you using the patch from the PR above in this testing?

[far-blue]

Sorry, I was reading via a mobile while on holiday and misunderstood :) Great news the feature is in the 0.11.0 release and now I'm back at work we'll upgrade and test things out. Thank you :)