Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature - add HashiCorp Vault secret provider #165

Merged
merged 59 commits into from
Aug 31, 2020
Merged

Feature - add HashiCorp Vault secret provider #165

merged 59 commits into from
Aug 31, 2020

Conversation

stijnmoreels
Copy link
Member

@stijnmoreels stijnmoreels commented Aug 20, 2020

Added a new project (NuGet package) with a secret provider that will interact wtih the KeyValue secret of a HashiCorp Vault.
This feature contains:

  • The ISecretProvider implementation itself
  • User-friendly extensions to register in the secret store for:
    • UserPass authentication
    • Kubernetes authentication
    • Custom configuration
  • Unit tests for all components
  • Integration test that interact with a fresh HashiCorp Vault instance running in 'dev server' mode for:
    • UserPass authentication
  • Feature docs update with examples of how this secret provider can be added to the secret store, with examples of what is required and by default provided and can be overridden.

Relates to #159

@arcus-automation
Copy link

A new preview package for Arcus.Security.All is available on MyGet.

You can pull it locally via the CLI:

PM> Install-Package Arcus.Security.All -Version 20200821.0.0-PR-165 -Source https://www.myget.org/F/arcus/api/v3/index.json

@stijnmoreels stijnmoreels marked this pull request as ready for review August 21, 2020 08:26
@arcus-automation
Copy link

A new preview package for Arcus.Security.All is available on MyGet.

You can pull it locally via the CLI:

PM> Install-Package Arcus.Security.All -Version 20200825.0.0-PR-165 -Source https://www.myget.org/F/arcus/api/v3/index.json

@arcus-automation
Copy link

A new preview package for Arcus.Security.All is available on MyGet.

You can pull it locally via the CLI:

PM> Install-Package Arcus.Security.All -Version 20200826.0.0-PR-165 -Source https://www.myget.org/F/arcus/api/v3/index.json

@tomkerkhove
Copy link
Contributor

Not yet created integration test for Kuberetes authentication bc that would require me to create a Kubernetes service account (extra costs per month) and maybe not the worth the cost for that?
Of course if there's a way that this can be up shortcutted, and there's a way to test this external call by setting up a test server that validates the JWT token for us... we could maybe go that route.

Let's add a dedicated issue where we deploy a container to a Kind cluster and run against that.

Copy link
Contributor

@tomkerkhove tomkerkhove left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, the only suggestion I would have is to move out the Kubernetes auth unless you are certain that it already works fine?

@stijnmoreels
Copy link
Member Author

stijnmoreels commented Aug 28, 2020

LGTM, the only suggestion I would have is to move out the Kubernetes auth unless you are certain that it already works fine?

I can honestly say I don't know anything for certain 😅.
We're just using the already available Kubernetes authentication type and pass along the values, so only if VaultSharp has some problems, I don't think that there's something wrong with it. But again, I'm nothing certain.

@tomkerkhove
Copy link
Contributor

Good enough!

@arcus-automation
Copy link

A new preview package for Arcus.Security.All is available on MyGet.

You can pull it locally via the CLI:

PM> Install-Package Arcus.Security.All -Version 20200831.0.0-PR-165 -Source https://www.myget.org/F/arcus/api/v3/index.json

@stijnmoreels stijnmoreels merged commit 7131882 into arcus-azure:master Aug 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants