Added kubernetes mount point to vault adapter

ghga-de · Jul 17, 2024 · b270766 · b270766
1 parent 3795dcc
commit b270766
Show file tree

Hide file tree

Showing 11 changed files with 60 additions and 4 deletions.
diff --git a/.pyproject_generation/pyproject_custom.toml b/.pyproject_generation/pyproject_custom.toml
@@ -1,6 +1,6 @@
 [project]
 name = "fsb"
-version = "0.1.1"
+version = "0.1.2"
 description = "File Services Backend - monorepo housing file services"
 dependencies = [
     "typer >= 0.12",

diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "fsb"
-version = "0.1.1"
+version = "0.1.2"
 description = "File Services Backend - monorepo housing file services"
 dependencies = [
     "typer >= 0.12",

diff --git a/services/ekss/README.md b/services/ekss/README.md
@@ -219,6 +219,16 @@ The service requires the following configuration parameters:
   ```
 
 
+- **`vault_kube_mount_point`** *(string)*: Name used to address kubernetes under a custom mount path. Default: `"kubernetes"`.
+
+
+  Examples:
+
+  ```json
+  "kubernetes"
+  ```
+
+
 - **`service_account_token_path`** *(string, format: path)*: Path to service account token used by kube auth adapter. Default: `"/var/run/secrets/kubernetes.io/serviceaccount/token"`.
 
 - **`host`** *(string)*: IP of the host. Default: `"127.0.0.1"`.

diff --git a/services/ekss/config_schema.json b/services/ekss/config_schema.json
@@ -142,6 +142,15 @@
       ],
       "title": "Vault Kube Role"
     },
+    "vault_kube_mount_point": {
+      "default": "kubernetes",
+      "description": "Name used to address kubernetes under a custom mount path.",
+      "examples": [
+        "kubernetes"
+      ],
+      "title": "Vault Kube Mount Point",
+      "type": "string"
+    },
     "service_account_token_path": {
       "default": "/var/run/secrets/kubernetes.io/serviceaccount/token",
       "description": "Path to service account token used by kube auth adapter.",

diff --git a/services/ekss/example_config.yaml b/services/ekss/example_config.yaml
@@ -17,6 +17,7 @@ server_public_key: HsKvfHsAFNGykFi/zMssay0xajoHvY30IcYPGDCXrGU=
 service_account_token_path: /var/run/secrets/kubernetes.io/serviceaccount/token
 service_instance_id: '1'
 service_name: encryption_key_store
+vault_kube_mount_point: kubernetes
 vault_kube_role: dummy-role
 vault_path: ekss
 vault_role_id: '**********'

diff --git a/services/ekss/src/ekss/adapters/outbound/vault/client.py b/services/ekss/src/ekss/adapters/outbound/vault/client.py
@@ -36,6 +36,7 @@ def __init__(self, config: VaultConfig):
         self._client = hvac.Client(url=config.vault_url, verify=config.vault_verify)
         self._path = config.vault_path
         self._secrets_mount_point = config.vault_secrets_mount_point
+        self._kube_mount_point = config.vault_kube_mount_point
 
         self._kube_role = config.vault_kube_role
         if self._kube_role:
@@ -63,7 +64,9 @@ def _login(self):
         if self._kube_role:
             with self._service_account_token_path.open() as token_file:
                 jwt = token_file.read()
-            self._kube_adapter.login(role=self._kube_role, jwt=jwt)
+            self._kube_adapter.login(
+                role=self._kube_role, jwt=jwt, mount_point=self._kube_mount_point
+            )
 
         else:
             self._client.auth.approle.login(

diff --git a/services/ekss/src/ekss/config.py b/services/ekss/src/ekss/config.py
@@ -64,6 +64,11 @@ class VaultConfig(BaseSettings):
         examples=["file-ingest-role"],
         description="Vault role name used for Kubernetes authentication",
     )
+    vault_kube_mount_point: str = Field(
+        default="kubernetes",
+        examples=["kubernetes"],
+        description="Name used to address kubernetes under a custom mount path.",
+    )
     service_account_token_path: Path = Field(
         default="/var/run/secrets/kubernetes.io/serviceaccount/token",
         description="Path to service account token used by kube auth adapter.",

diff --git a/services/fis/README.md b/services/fis/README.md
@@ -169,6 +169,16 @@ The service requires the following configuration parameters:
   ```
 
 
+- **`vault_kube_mount_point`** *(string)*: Name used to address kubernetes under a custom mount path. Default: `"kubernetes"`.
+
+
+  Examples:
+
+  ```json
+  "kubernetes"
+  ```
+
+
 - **`service_account_token_path`** *(string, format: path)*: Path to service account token used by kube auth adapter. Default: `"/var/run/secrets/kubernetes.io/serviceaccount/token"`.
 
 - **`private_key`** *(string)*: Base64 encoded private key of the keypair whose public key is used to encrypt the payload.

diff --git a/services/fis/config_schema.json b/services/fis/config_schema.json
@@ -142,6 +142,15 @@
       ],
       "title": "Vault Kube Role"
     },
+    "vault_kube_mount_point": {
+      "default": "kubernetes",
+      "description": "Name used to address kubernetes under a custom mount path.",
+      "examples": [
+        "kubernetes"
+      ],
+      "title": "Vault Kube Mount Point",
+      "type": "string"
+    },
     "service_account_token_path": {
       "default": "/var/run/secrets/kubernetes.io/serviceaccount/token",
       "description": "Path to service account token used by kube auth adapter.",

diff --git a/services/fis/example_config.yaml b/services/fis/example_config.yaml
@@ -31,6 +31,7 @@ source_bucket_id: staging
 token_hashes:
 - abcdef
 - ghijkl
+vault_kube_mount_point: kubernetes
 vault_kube_role: dummy-role
 vault_path: ekss
 vault_role_id: '**********'

diff --git a/services/fis/src/fis/adapters/outbound/vault/client.py b/services/fis/src/fis/adapters/outbound/vault/client.py
@@ -66,6 +66,11 @@ class VaultConfig(BaseSettings):
         examples=["file-ingest-role"],
         description="Vault role name used for Kubernetes authentication",
     )
+    vault_kube_mount_point: str = Field(
+        default="kubernetes",
+        examples=["kubernetes"],
+        description="Name used to address kubernetes under a custom mount path.",
+    )
     service_account_token_path: Path = Field(
         default="/var/run/secrets/kubernetes.io/serviceaccount/token",
         description="Path to service account token used by kube auth adapter.",
@@ -80,6 +85,7 @@ def __init__(self, config: VaultConfig):
         self._client = hvac.Client(url=config.vault_url, verify=config.vault_verify)
         self._path = config.vault_path
         self._secrets_mount_point = config.vault_secrets_mount_point
+        self._kube_mount_point = config.vault_kube_mount_point
 
         self._kube_role = config.vault_kube_role
         if self._kube_role:
@@ -106,7 +112,9 @@ def _login(self):
         if self._kube_role:
             with self._service_account_token_path.open() as token_file:
                 jwt = token_file.read()
-            self._kube_adapter.login(role=self._kube_role, jwt=jwt)
+            self._kube_adapter.login(
+                role=self._kube_role, jwt=jwt, mount_point=self._kube_mount_point
+            )
 
         else:
             self._client.auth.approle.login(