unkin-agent
61bb464e32
Interactive agents are classifier-blocked from plumbing credentials through a shell, so seeding an Authentik outpost token into Vault KV needs to happen inside one binary invocation that never exposes the secret. - Add cmd/agentvault, a fourth CLI sharing the agentpr Vault AppRole login (role_id only, VAULT_ADDR/AGENT_APPROLE_ROLE_ID defaults unchanged). - Add `agentvault seed-outpost`: read the Authentik API token from kv/service/authentik/agent-api-token (field `token`, falling back to `api_token`), exact-match the outpost by name via the instances search, fetch its key from /api/v3/core/tokens/<identifier>/view_key/ and write it to --dest-path under --dest-key. - Print only the outpost name, token identifier, dest path and new KV version; keep secret material out of results, errors and logs. - Distinguish the failure stages (login, KV read denied, outpost missing, view_key, KV write denied) with ErrVaultDenied/ErrVaultNotFound/ ErrOutpostNotFound sentinels and actionable messages. - Add internal/agent vaultkv.go (AppRole-authenticated KV-v2 client) and authentik.go (outpost search + view_key) for reuse by future flows. - Cover the happy path, idempotent re-run, field fallback and every failure mode with httptest servers, including a leak check on error strings. - Wire agentvault into the Makefile, build-rpm.sh, nfpm contents, release cross-builds/assets, README and AGENTS.md.
84 lines
3.1 KiB
Go
84 lines
3.1 KiB
Go
// Command agentvault runs deterministic Vault flows for agents in a single
|
|
// invocation, so credentials are never plumbed through a shell. It authenticates
|
|
// with the same Vault AppRole as agentpr (role_id only, no secret_id).
|
|
//
|
|
// agentvault seed-outpost --outpost <name> --dest-path <kv/path>
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"git.unkin.net/unkin/agent-tools/internal/agent"
|
|
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
var version = "dev"
|
|
|
|
func main() {
|
|
if err := newRootCmd().Execute(); err != nil {
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
// newRootCmd builds the agentvault command tree. Separated from main so tests
|
|
// can execute it against httptest servers.
|
|
func newRootCmd() *cobra.Command {
|
|
root := &cobra.Command{
|
|
Use: "agentvault",
|
|
Short: "Run deterministic Vault flows as the agent AppRole.",
|
|
Long: "agentvault performs self-contained Vault flows for agents: it logs in with the\nagent AppRole and moves secret material between systems without ever printing it.",
|
|
Version: version,
|
|
SilenceUsage: true,
|
|
}
|
|
root.SetVersionTemplate("{{.Version}}\n")
|
|
root.AddCommand(newSeedOutpostCmd(), newVersionCmd())
|
|
return root
|
|
}
|
|
|
|
func newSeedOutpostCmd() *cobra.Command {
|
|
opts := agent.SeedOutpostOptions{}
|
|
cmd := &cobra.Command{
|
|
Use: "seed-outpost",
|
|
Short: "Copy an Authentik outpost token into Vault KV",
|
|
Long: "Read the Authentik API token from Vault KV, resolve the named outpost's\n" +
|
|
"token_identifier, fetch its key and write it to a Vault KV path. Re-running\n" +
|
|
"writes a new KV version. The token value is never printed or logged.",
|
|
SilenceUsage: true,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
opts.VaultAddr = agent.VaultAddr()
|
|
opts.RoleID = agent.RoleID()
|
|
res, err := agent.SeedOutpost(opts)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
out := cmd.OutOrStdout()
|
|
_, _ = fmt.Fprintf(out, "outpost: %s\n", res.Outpost)
|
|
_, _ = fmt.Fprintf(out, "token_identifier: %s\n", res.TokenIdentifier)
|
|
_, _ = fmt.Fprintf(out, "dest: %s/%s\n", res.KVMount, res.DestPath)
|
|
_, _ = fmt.Fprintf(out, "version: %d\n", res.Version)
|
|
return nil
|
|
},
|
|
}
|
|
f := cmd.Flags()
|
|
f.StringVar(&opts.Outpost, "outpost", "", "Authentik outpost name (required)")
|
|
f.StringVar(&opts.DestPath, "dest-path", "", "KV-v2 path to write the token to, e.g. kubernetes/namespace/authentik/default/outpost-token (required)")
|
|
f.StringVar(&opts.DestKey, "dest-key", agent.DefaultDestKey, "Field to write the token under")
|
|
f.StringVar(&opts.KVMount, "kv-mount", agent.DefaultKVMount, "KV-v2 mount holding both the API token and the destination")
|
|
f.StringVar(&opts.TokenPath, "token-path", agent.DefaultOutpostTokenPath, "KV-v2 path of the Authentik API token")
|
|
f.StringVar(&opts.AuthentikURL, "authentik-url", agent.AuthentikURL(), "Authentik base URL")
|
|
_ = cmd.MarkFlagRequired("outpost")
|
|
_ = cmd.MarkFlagRequired("dest-path")
|
|
return cmd
|
|
}
|
|
|
|
func newVersionCmd() *cobra.Command {
|
|
return &cobra.Command{
|
|
Use: "version",
|
|
Short: "Print the version",
|
|
Run: func(cmd *cobra.Command, args []string) { fmt.Println(version) },
|
|
SilenceUsage: true,
|
|
}
|
|
}
|