From c69b27826d633c359128d3d115b774e370c95bca Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Wed, 15 Jul 2026 22:20:03 +1000 Subject: [PATCH] Initial terraform-provider-ranchervaultsecret scaffold Terraform provider (plugin-framework) for the vault-plugin-secrets-rancher secrets engine, modeled on terraform-provider-litellmvaultsecret. Resources: - rancher_secret_backend: mount the engine + write config (rancher_url, ca_cert, tls_skip_verify, request_timeout_seconds). - rancher_secret_backend_service_account: seed an auto-rotated Rancher token (write-only token; token_ttl / rotation_period; computed token_name, last_rotated). - rancher_secret_backend_role: minting role (service_account, cluster_name, ttl, max_ttl, description). Source address git.unkin.net/unkin/ranchervaultsecret, resources prefixed rancher_. Ports the litellm Woodpecker terraform-registry release + nfpm-less zip packaging, examples, and a provider e2e (Vault + mock Rancher from the sibling plugin repo). Unit tests cover the coercion/import-ID helpers. --- .gitignore | 14 + .pre-commit-config.yaml | 15 ++ .woodpecker/build.yml | 18 ++ .woodpecker/pre-commit.yaml | 18 ++ .woodpecker/release.yml | 40 +++ .woodpecker/test.yml | 33 +++ Makefile | 65 +++++ README.md | 63 +++++ .../resources/rancher_secret_backend/main.tf | 20 ++ .../rancher_secret_backend_role/main.tf | 16 ++ .../main.tf | 26 ++ go.mod | 49 ++++ go.sum | 147 +++++++++++ internal/provider/client.go | 134 ++++++++++ internal/provider/conversions.go | 47 ++++ internal/provider/conversions_test.go | 48 ++++ internal/provider/provider.go | 101 ++++++++ internal/provider/resource_secret_backend.go | 239 ++++++++++++++++++ .../provider/resource_secret_backend_role.go | 233 +++++++++++++++++ ...resource_secret_backend_service_account.go | 218 ++++++++++++++++ main.go | 28 ++ scripts/e2e.sh | 116 +++++++++ test/docker-compose.yml | 46 ++++ test/e2e/main.tf | 40 +++ test/vault/vault.hcl | 4 + 25 files changed, 1778 insertions(+) create mode 100644 .gitignore create mode 100644 .pre-commit-config.yaml create mode 100644 .woodpecker/build.yml create mode 100644 .woodpecker/pre-commit.yaml create mode 100644 .woodpecker/release.yml create mode 100644 .woodpecker/test.yml create mode 100644 Makefile create mode 100644 README.md create mode 100644 examples/resources/rancher_secret_backend/main.tf create mode 100644 examples/resources/rancher_secret_backend_role/main.tf create mode 100644 examples/resources/rancher_secret_backend_service_account/main.tf create mode 100644 go.mod create mode 100644 go.sum create mode 100644 internal/provider/client.go create mode 100644 internal/provider/conversions.go create mode 100644 internal/provider/conversions_test.go create mode 100644 internal/provider/provider.go create mode 100644 internal/provider/resource_secret_backend.go create mode 100644 internal/provider/resource_secret_backend_role.go create mode 100644 internal/provider/resource_secret_backend_service_account.go create mode 100644 main.go create mode 100755 scripts/e2e.sh create mode 100644 test/docker-compose.yml create mode 100644 test/e2e/main.tf create mode 100644 test/vault/vault.hcl diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..fdbb11e --- /dev/null +++ b/.gitignore @@ -0,0 +1,14 @@ +/terraform-provider-ranchervaultsecret +*.zip +*.out +*.test +dist/ +.terraform/ +.terraform.lock.hcl +*.tfstate +*.tfstate.backup +.env + +# e2e artifacts +test/plugins/ +test/dev.tfrc diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 0000000..5b65ffe --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,15 @@ +repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + - id: check-added-large-files + + - repo: https://github.com/dnephin/pre-commit-golang + rev: v0.5.1 + hooks: + - id: go-fmt + - id: go-vet + - id: go-mod-tidy diff --git a/.woodpecker/build.yml b/.woodpecker/build.yml new file mode 100644 index 0000000..74123b5 --- /dev/null +++ b/.woodpecker/build.yml @@ -0,0 +1,18 @@ +when: + - event: pull_request + +steps: + - name: build + image: golang:1.25 + commands: + - make build + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/.woodpecker/pre-commit.yaml b/.woodpecker/pre-commit.yaml new file mode 100644 index 0000000..d57b508 --- /dev/null +++ b/.woodpecker/pre-commit.yaml @@ -0,0 +1,18 @@ +when: + - event: pull_request + +steps: + - name: pre-commit + image: git.unkin.net/unkin/almalinux9-gobuilder:20260606 + commands: + - uvx pre-commit run --all-files + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/.woodpecker/release.yml b/.woodpecker/release.yml new file mode 100644 index 0000000..10953e6 --- /dev/null +++ b/.woodpecker/release.yml @@ -0,0 +1,40 @@ +when: + - event: tag + +steps: + - name: package + image: git.unkin.net/unkin/almalinux9-gobuilder:20260606 + commands: + - make package VERSION=${CI_COMMIT_TAG} + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 + + - name: upload + image: git.unkin.net/unkin/almalinux9-base:20260606 + commands: + - | + VERSION=$$(echo ${CI_COMMIT_TAG} | sed 's/^v//') + FILE="terraform-provider-ranchervaultsecret_$${VERSION}_linux_amd64.zip" + curl -f -X PUT \ + "https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/terraform-unkin/files/unkin/ranchervaultsecret/$${FILE}" \ + -H "Content-Type: application/zip" \ + --data-binary @"$${FILE}" + depends_on: [package] + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 128Mi + cpu: 100m + limits: + memory: 512Mi + cpu: 500m diff --git a/.woodpecker/test.yml b/.woodpecker/test.yml new file mode 100644 index 0000000..8e81e45 --- /dev/null +++ b/.woodpecker/test.yml @@ -0,0 +1,33 @@ +when: + - event: pull_request + +steps: + - name: lint + image: golang:1.25 + commands: + - make lint + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 + + - name: test + image: golang:1.25 + commands: + - make test + backend_options: + kubernetes: + serviceAccountName: default + resources: + requests: + memory: 512Mi + cpu: 1 + limits: + memory: 2Gi + cpu: 2 diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..0c95201 --- /dev/null +++ b/Makefile @@ -0,0 +1,65 @@ +.PHONY: build install test lint fmt clean tidy package e2e patch minor major check-go + +BINARY := terraform-provider-ranchervaultsecret +VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev") +OS_ARCH := linux_amd64 +INSTALL_VERSION := $(shell echo $(VERSION) | sed 's/^v//') +INSTALL_DIR := ~/.terraform.d/plugins/git.unkin.net/unkin/ranchervaultsecret/$(INSTALL_VERSION)/$(OS_ARCH) +ZIP := $(BINARY)_$(INSTALL_VERSION)_$(OS_ARCH).zip + +GO_VERSION_REQUIRED := 1.25 +GO_VERSION_ACTUAL := $(shell go version | sed 's/go version go\([0-9]*\.[0-9]*\).*/\1/') + +check-go: + @if [ "$$(printf '%s\n%s' "$(GO_VERSION_REQUIRED)" "$(GO_VERSION_ACTUAL)" | sort -V | head -1)" != "$(GO_VERSION_REQUIRED)" ]; then \ + echo "ERROR: Go >= $(GO_VERSION_REQUIRED) required, found $(GO_VERSION_ACTUAL)"; exit 1; \ + fi + +build: check-go tidy + go build -ldflags="-s -w -X main.version=$(VERSION)" -o $(BINARY) + +install: build + mkdir -p $(INSTALL_DIR) + cp $(BINARY) $(INSTALL_DIR)/ + +test: check-go + go test -race -count=1 ./... + +lint: check-go + go vet ./... + +fmt: check-go + gofmt -w . + +package: build + cp $(BINARY) $(BINARY)_v$(INSTALL_VERSION) + python3 -c "import zipfile,sys; z=zipfile.ZipFile(sys.argv[1],'w',zipfile.ZIP_DEFLATED); z.write(sys.argv[2]); z.close()" $(ZIP) $(BINARY)_v$(INSTALL_VERSION) + rm $(BINARY)_v$(INSTALL_VERSION) + +# End-to-end: boots Vault + mock Rancher + the plugin and applies real terraform. +e2e: + ./scripts/e2e.sh + +clean: + rm -f $(BINARY) *.zip + +tidy: + go mod tidy + +_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1) +_BASE := $(if $(_LATEST),$(_LATEST),v0.0.0) +_MAJ := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1) +_MIN := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2) +_PAT := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3) + +patch: + @NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \ + git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW + +minor: + @NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \ + git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW + +major: + @NEW=v$(shell expr $(_MAJ) + 1).0.0; \ + git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW diff --git a/README.md b/README.md new file mode 100644 index 0000000..832864d --- /dev/null +++ b/README.md @@ -0,0 +1,63 @@ +# terraform-provider-ranchervaultsecret + +Terraform provider for the [vault-plugin-secrets-rancher](https://git.unkin.net/unkin/vault-plugin-secrets-rancher) +secrets engine. It manages the engine's configuration on HashiCorp Vault or +OpenBao — mounting it, seeding auto-rotated service-account tokens, and defining +token-minting roles. + +The provider's source address is `git.unkin.net/unkin/ranchervaultsecret`; its +resources are prefixed `rancher_` (declare it under the local name `rancher` in +`required_providers`). + +## Resources + +| Resource | Manages | +|----------|---------| +| `rancher_secret_backend` | Mounts the engine and writes `config` (Rancher URL, CA, TLS). | +| `rancher_secret_backend_service_account` | A seeded, auto-rotated Rancher token (`token`, `token_ttl`, `rotation_period`). | +| `rancher_secret_backend_role` | A minting role (`service_account`, `cluster_name`, `ttl`, `max_ttl`, `description`). | + +## Example + +```hcl +provider "rancher" {} # address/token from VAULT_ADDR / VAULT_TOKEN + +resource "rancher_secret_backend" "rancher" { + path = "rancher" + rancher_url = "https://rancher.example.com" + ca_cert = file("rancher-ca.pem") +} + +resource "rancher_secret_backend_service_account" "admin" { + backend = rancher_secret_backend.rancher.path + name = "admin" + token = var.rancher_seed_token + token_ttl = 90 * 24 * 3600 + rotation_period = 45 * 24 * 3600 +} + +resource "rancher_secret_backend_role" "ci" { + backend = rancher_secret_backend.rancher.path + name = "ci" + service_account = rancher_secret_backend_service_account.admin.name + cluster_name = "c-m-abc123" + ttl = 3600 + max_ttl = 28800 +} +``` + +Then mint a token: `vault read rancher/creds/ci`. + +## Development + +```sh +make build # build the provider binary +make install # install into ~/.terraform.d/plugins for local dev_overrides +make test # unit tests +make e2e # apply real terraform against Vault + the plugin + mock Rancher +make package # zip for the artifactapi terraform registry +``` + +Releases are tag-driven (`make patch|minor|major`): a Woodpecker pipeline zips +the provider and uploads it to the internal artifactapi terraform registry, +installable via `source = "git.unkin.net/unkin/ranchervaultsecret"`. diff --git a/examples/resources/rancher_secret_backend/main.tf b/examples/resources/rancher_secret_backend/main.tf new file mode 100644 index 0000000..0bb3df7 --- /dev/null +++ b/examples/resources/rancher_secret_backend/main.tf @@ -0,0 +1,20 @@ +terraform { + required_providers { + rancher = { + source = "git.unkin.net/unkin/ranchervaultsecret" + } + } +} + +provider "rancher" { + # address / token fall back to VAULT_ADDR / VAULT_TOKEN. +} + +# Mount the Rancher secrets engine and write its connection config. +resource "rancher_secret_backend" "rancher" { + path = "rancher" + rancher_url = "https://rancher.example.com" + ca_cert = file("${path.module}/rancher-ca.pem") + + request_timeout_seconds = 30 +} diff --git a/examples/resources/rancher_secret_backend_role/main.tf b/examples/resources/rancher_secret_backend_role/main.tf new file mode 100644 index 0000000..3eb1a27 --- /dev/null +++ b/examples/resources/rancher_secret_backend_role/main.tf @@ -0,0 +1,16 @@ +# A role that mints short-lived tokens scoped to one downstream cluster. Reading +# rancher/creds/ci returns a lease-bound token deleted from Rancher on revoke. +# +# Note: Rancher tokens inherit the service account user's RBAC; only cluster and +# TTL are scoped per-token. For least-privilege, point roles at a service account +# seeded with a purpose-built, limited Rancher user. +resource "rancher_secret_backend_role" "ci" { + backend = rancher_secret_backend.rancher.path + service_account = rancher_secret_backend_service_account.admin.name + + name = "ci" + cluster_name = "c-m-abc123" + description = "CI/CD ephemeral token" + ttl = 3600 # 1h + max_ttl = 28800 # 8h +} diff --git a/examples/resources/rancher_secret_backend_service_account/main.tf b/examples/resources/rancher_secret_backend_service_account/main.tf new file mode 100644 index 0000000..756afc5 --- /dev/null +++ b/examples/resources/rancher_secret_backend_service_account/main.tf @@ -0,0 +1,26 @@ +# Seed a Rancher token the engine will auto-rotate. Rancher caps token TTLs +# (commonly 90d); the engine rotates at rotation_period (default 45d) by minting +# a fresh token with the current one, so the credential never lapses. +resource "rancher_secret_backend_service_account" "admin" { + backend = rancher_secret_backend.rancher.path + name = "admin" + + # The initial token. Write-only: the engine rotates it from here on. + token = var.rancher_seed_token + + # metadata.name of the seed token, so the first rotation can delete it. + token_name = var.rancher_seed_token_name + + token_ttl = 90 * 24 * 3600 # 90d + rotation_period = 45 * 24 * 3600 # 45d +} + +variable "rancher_seed_token" { + type = string + sensitive = true +} + +variable "rancher_seed_token_name" { + type = string + default = "" +} diff --git a/go.mod b/go.mod new file mode 100644 index 0000000..bcb90a3 --- /dev/null +++ b/go.mod @@ -0,0 +1,49 @@ +module git.unkin.net/unkin/terraform-provider-ranchervaultsecret + +go 1.25 + +require ( + github.com/hashicorp/terraform-plugin-framework v1.15.0 + github.com/hashicorp/vault/api v1.15.0 +) + +require ( + github.com/cenkalti/backoff/v4 v4.3.0 // indirect + github.com/fatih/color v1.16.0 // indirect + github.com/go-jose/go-jose/v4 v4.0.4 // indirect + github.com/golang/protobuf v1.5.4 // indirect + github.com/hashicorp/errwrap v1.1.0 // indirect + github.com/hashicorp/go-cleanhttp v0.5.2 // indirect + github.com/hashicorp/go-hclog v1.6.3 // indirect + github.com/hashicorp/go-multierror v1.1.1 // indirect + github.com/hashicorp/go-plugin v1.6.3 // indirect + github.com/hashicorp/go-retryablehttp v0.7.7 // indirect + github.com/hashicorp/go-rootcerts v1.0.2 // indirect + github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect + github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect + github.com/hashicorp/go-sockaddr v1.0.2 // indirect + github.com/hashicorp/go-uuid v1.0.3 // indirect + github.com/hashicorp/hcl v1.0.0 // indirect + github.com/hashicorp/terraform-plugin-go v0.27.0 // indirect + github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect + github.com/hashicorp/terraform-registry-address v0.2.5 // indirect + github.com/hashicorp/terraform-svchost v0.1.1 // indirect + github.com/hashicorp/yamux v0.1.1 // indirect + github.com/mattn/go-colorable v0.1.13 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mitchellh/go-homedir v1.1.0 // indirect + github.com/mitchellh/go-testing-interface v1.14.1 // indirect + github.com/mitchellh/mapstructure v1.5.0 // indirect + github.com/oklog/run v1.0.0 // indirect + github.com/ryanuber/go-glob v1.0.0 // indirect + github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect + github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect + golang.org/x/crypto v0.37.0 // indirect + golang.org/x/net v0.39.0 // indirect + golang.org/x/sys v0.32.0 // indirect + golang.org/x/text v0.24.0 // indirect + golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect + google.golang.org/grpc v1.72.1 // indirect + google.golang.org/protobuf v1.36.6 // indirect +) diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..e5d4aed --- /dev/null +++ b/go.sum @@ -0,0 +1,147 @@ +github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= +github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs= +github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA= +github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8= +github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= +github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= +github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= +github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= +github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= +github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E= +github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc= +github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= +github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw= +github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA= +github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= +github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= +github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= +github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= +github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= +github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= +github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k= +github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= +github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= +github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= +github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= +github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg= +github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0= +github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU= +github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk= +github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc= +github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8= +github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ= +github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8= +github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U= +github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts= +github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4= +github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc= +github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A= +github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8= +github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= +github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4= +github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= +github.com/hashicorp/terraform-plugin-framework v1.15.0 h1:LQ2rsOfmDLxcn5EeIwdXFtr03FVsNktbbBci8cOKdb4= +github.com/hashicorp/terraform-plugin-framework v1.15.0/go.mod h1:hxrNI/GY32KPISpWqlCoTLM9JZsGH3CyYlir09bD/fI= +github.com/hashicorp/terraform-plugin-go v0.27.0 h1:ujykws/fWIdsi6oTUT5Or4ukvEan4aN9lY+LOxVP8EE= +github.com/hashicorp/terraform-plugin-go v0.27.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o= +github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0= +github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow= +github.com/hashicorp/terraform-registry-address v0.2.5 h1:2GTftHqmUhVOeuu9CW3kwDkRe4pcBDq0uuK5VJngU1M= +github.com/hashicorp/terraform-registry-address v0.2.5/go.mod h1:PpzXWINwB5kuVS5CA7m1+eO2f1jKb5ZDIxrOPfpnGkg= +github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ= +github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc= +github.com/hashicorp/vault/api v1.15.0 h1:O24FYQCWwhwKnF7CuSqP30S51rTV7vz1iACXE/pj5DA= +github.com/hashicorp/vault/api v1.15.0/go.mod h1:+5YTO09JGn0u+b6ySD/LLVf8WkJCPLAL2Vkmrn2+CM8= +github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE= +github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ= +github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c= +github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo= +github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= +github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= +github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= +github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= +github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= +github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= +github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= +github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc= +github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= +github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= +github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU= +github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8= +github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo= +github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= +github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= +github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= +github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw= +github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= +github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= +github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= +github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= +github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= +github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8= +github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok= +github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g= +github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds= +go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= +go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= +go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY= +go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI= +go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ= +go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE= +go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A= +go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU= +go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk= +go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w= +go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k= +go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE= +golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE= +golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= +golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY= +golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E= +golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20= +golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0= +golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU= +golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI= +golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ= +google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA= +google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM= +google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY= +google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/internal/provider/client.go b/internal/provider/client.go new file mode 100644 index 0000000..3093993 --- /dev/null +++ b/internal/provider/client.go @@ -0,0 +1,134 @@ +package provider + +import ( + "context" + "errors" + "fmt" + "strings" + + vault "github.com/hashicorp/vault/api" +) + +// vaultClient wraps the Vault/OpenBao API client with the operations this +// provider needs to manage the Rancher secrets engine. +type vaultClient struct { + api *vault.Client +} + +func newVaultClient(address, token string) (*vaultClient, error) { + cfg := vault.DefaultConfig() + if cfg.Error != nil { + return nil, cfg.Error + } + if address != "" { + cfg.Address = address + } + c, err := vault.NewClient(cfg) + if err != nil { + return nil, err + } + if token != "" { + c.SetToken(token) + } + return &vaultClient{api: c}, nil +} + +// mountConfig holds the tunable options applied when enabling the engine. +type mountConfig struct { + DefaultLeaseTTL string + MaxLeaseTTL string +} + +// enableMount mounts the secrets engine of the given plugin type at path. +func (c *vaultClient) enableMount(ctx context.Context, path, pluginType, description string, cfg mountConfig) error { + input := &vault.MountInput{ + Type: pluginType, + Description: description, + Config: vault.MountConfigInput{ + DefaultLeaseTTL: cfg.DefaultLeaseTTL, + MaxLeaseTTL: cfg.MaxLeaseTTL, + }, + } + return c.api.Sys().MountWithContext(ctx, path, input) +} + +// tuneMount updates tunable options of an existing mount (e.g. description). +func (c *vaultClient) tuneMount(ctx context.Context, path, description string, cfg mountConfig) error { + input := vault.MountConfigInput{ + Description: &description, + DefaultLeaseTTL: cfg.DefaultLeaseTTL, + MaxLeaseTTL: cfg.MaxLeaseTTL, + } + return c.api.Sys().TuneMountWithContext(ctx, path, input) +} + +// mountInfo returns the mount at the given path, or nil if it does not exist. +func (c *vaultClient) mountInfo(ctx context.Context, path string) (*vault.MountOutput, error) { + mounts, err := c.api.Sys().ListMountsWithContext(ctx) + if err != nil { + return nil, err + } + key := strings.TrimRight(path, "/") + "/" + if m, ok := mounts[key]; ok { + return m, nil + } + return nil, nil +} + +// disableMount unmounts the secrets engine at path. +func (c *vaultClient) disableMount(ctx context.Context, path string) error { + return c.api.Sys().UnmountWithContext(ctx, path) +} + +// write writes data to an arbitrary path under the backend mount. +func (c *vaultClient) write(ctx context.Context, path string, data map[string]interface{}) error { + _, err := c.api.Logical().WriteWithContext(ctx, path, data) + return err +} + +// read reads an arbitrary path under the backend mount, returning nil if absent. +func (c *vaultClient) read(ctx context.Context, path string) (map[string]interface{}, error) { + secret, err := c.api.Logical().ReadWithContext(ctx, path) + if err != nil { + return nil, err + } + if secret == nil { + return nil, nil + } + return secret.Data, nil +} + +// delete removes an arbitrary path under the backend mount. +func (c *vaultClient) delete(ctx context.Context, path string) error { + _, err := c.api.Logical().DeleteWithContext(ctx, path) + return err +} + +func configPath(backend string) string { + return fmt.Sprintf("%s/config", strings.TrimRight(backend, "/")) +} + +func serviceAccountPath(backend, name string) string { + return fmt.Sprintf("%s/service-accounts/%s", strings.TrimRight(backend, "/"), name) +} + +func rolePath(backend, name string) string { + return fmt.Sprintf("%s/roles/%s", strings.TrimRight(backend, "/"), name) +} + +// isMountAlreadyExists reports whether the error is Vault's "path is already in +// use" response, so callers can surface a friendlier message. +func isMountAlreadyExists(err error) bool { + if err == nil { + return false + } + var respErr *vault.ResponseError + if errors.As(err, &respErr) { + for _, e := range respErr.Errors { + if strings.Contains(e, "path is already in use") { + return true + } + } + } + return false +} diff --git a/internal/provider/conversions.go b/internal/provider/conversions.go new file mode 100644 index 0000000..8c2b8f8 --- /dev/null +++ b/internal/provider/conversions.go @@ -0,0 +1,47 @@ +package provider + +import ( + "encoding/json" + "strings" +) + +// toInt64 coerces the numeric shapes Vault returns (json.Number, float64, int) +// into an int64. +func toInt64(v interface{}) (int64, bool) { + switch n := v.(type) { + case json.Number: + i, err := n.Int64() + if err != nil { + f, ferr := n.Float64() + if ferr != nil { + return 0, false + } + return int64(f), true + } + return i, true + case float64: + return int64(n), true + case int64: + return n, true + case int: + return int64(n), true + default: + return 0, false + } +} + +// splitBackendName splits an import ID of the form "//" +// (e.g. "rancher/roles/ci") into its backend and name parts. +func splitBackendName(id, marker string) (backend, name string, ok bool) { + sep := "/" + marker + "/" + idx := strings.LastIndex(id, sep) + if idx <= 0 { + return "", "", false + } + backend = id[:idx] + name = id[idx+len(sep):] + if backend == "" || name == "" { + return "", "", false + } + return backend, name, true +} diff --git a/internal/provider/conversions_test.go b/internal/provider/conversions_test.go new file mode 100644 index 0000000..948fb95 --- /dev/null +++ b/internal/provider/conversions_test.go @@ -0,0 +1,48 @@ +package provider + +import ( + "encoding/json" + "testing" +) + +func TestToInt64(t *testing.T) { + cases := []struct { + in interface{} + want int64 + ok bool + }{ + {json.Number("42"), 42, true}, + {json.Number("3.0"), 3, true}, + {float64(7), 7, true}, + {int(9), 9, true}, + {int64(11), 11, true}, + {"nope", 0, false}, + {nil, 0, false}, + } + for _, c := range cases { + got, ok := toInt64(c.in) + if ok != c.ok || got != c.want { + t.Errorf("toInt64(%v) = (%d,%v), want (%d,%v)", c.in, got, ok, c.want, c.ok) + } + } +} + +func TestSplitBackendName(t *testing.T) { + cases := []struct { + id, marker, backend, name string + ok bool + }{ + {"rancher/roles/ci", "roles", "rancher", "ci", true}, + {"team/rancher/service-accounts/admin", "service-accounts", "team/rancher", "admin", true}, + {"rancher/roles/", "roles", "", "", false}, + {"/roles/ci", "roles", "", "", false}, + {"nomarker", "roles", "", "", false}, + } + for _, c := range cases { + b, n, ok := splitBackendName(c.id, c.marker) + if ok != c.ok || b != c.backend || n != c.name { + t.Errorf("splitBackendName(%q,%q) = (%q,%q,%v), want (%q,%q,%v)", + c.id, c.marker, b, n, ok, c.backend, c.name, c.ok) + } + } +} diff --git a/internal/provider/provider.go b/internal/provider/provider.go new file mode 100644 index 0000000..4e9f7ac --- /dev/null +++ b/internal/provider/provider.go @@ -0,0 +1,101 @@ +package provider + +import ( + "context" + "os" + + "github.com/hashicorp/terraform-plugin-framework/datasource" + "github.com/hashicorp/terraform-plugin-framework/provider" + "github.com/hashicorp/terraform-plugin-framework/provider/schema" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var _ provider.Provider = &rancherProvider{} + +type rancherProvider struct { + version string +} + +type rancherProviderModel struct { + Address types.String `tfsdk:"address"` + Token types.String `tfsdk:"token"` +} + +func New(version string) func() provider.Provider { + return func() provider.Provider { + return &rancherProvider{version: version} + } +} + +func (p *rancherProvider) Metadata(_ context.Context, _ provider.MetadataRequest, resp *provider.MetadataResponse) { + // The provider's source address is git.unkin.net/unkin/ranchervaultsecret, + // but its resources are prefixed "rancher_" (declare it in required_providers + // under the local name "rancher"), mirroring how google-beta ships google_*. + resp.TypeName = "rancher" + resp.Version = p.version +} + +func (p *rancherProvider) Schema(_ context.Context, _ provider.SchemaRequest, resp *provider.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "Manage the Rancher token secrets engine (config, service accounts, and roles) on HashiCorp Vault or OpenBao.", + Attributes: map[string]schema.Attribute{ + "address": schema.StringAttribute{ + Description: "Address of the Vault/OpenBao server. Falls back to the VAULT_ADDR environment variable.", + Optional: true, + }, + "token": schema.StringAttribute{ + Description: "Token used to authenticate to Vault/OpenBao. Falls back to the VAULT_TOKEN environment variable.", + Optional: true, + Sensitive: true, + }, + }, + } +} + +func (p *rancherProvider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) { + var config rancherProviderModel + resp.Diagnostics.Append(req.Config.Get(ctx, &config)...) + if resp.Diagnostics.HasError() { + return + } + + address := os.Getenv("VAULT_ADDR") + if !config.Address.IsNull() && config.Address.ValueString() != "" { + address = config.Address.ValueString() + } + + token := os.Getenv("VAULT_TOKEN") + if !config.Token.IsNull() && config.Token.ValueString() != "" { + token = config.Token.ValueString() + } + + if address == "" { + resp.Diagnostics.AddError( + "missing Vault address", + "Set the provider \"address\" attribute or the VAULT_ADDR environment variable.", + ) + return + } + + client, err := newVaultClient(address, token) + if err != nil { + resp.Diagnostics.AddError("failed to create Vault client", err.Error()) + return + } + + resp.DataSourceData = client + resp.ResourceData = client +} + +func (p *rancherProvider) Resources(_ context.Context) []func() resource.Resource { + return []func() resource.Resource{ + NewSecretBackendResource, + NewSecretBackendServiceAccountResource, + NewSecretBackendRoleResource, + } +} + +func (p *rancherProvider) DataSources(_ context.Context) []func() datasource.DataSource { + return nil +} diff --git a/internal/provider/resource_secret_backend.go b/internal/provider/resource_secret_backend.go new file mode 100644 index 0000000..72c2587 --- /dev/null +++ b/internal/provider/resource_secret_backend.go @@ -0,0 +1,239 @@ +package provider + +import ( + "context" + "fmt" + "strings" + + "github.com/hashicorp/terraform-plugin-framework/path" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/int64default" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var ( + _ resource.Resource = &secretBackendResource{} + _ resource.ResourceWithImportState = &secretBackendResource{} +) + +const defaultPluginType = "vault-plugin-secrets-rancher" + +type secretBackendResource struct { + client *vaultClient +} + +type secretBackendModel struct { + Path types.String `tfsdk:"path"` + Plugin types.String `tfsdk:"plugin"` + Description types.String `tfsdk:"description"` + RancherURL types.String `tfsdk:"rancher_url"` + CACert types.String `tfsdk:"ca_cert"` + TLSSkipVerify types.Bool `tfsdk:"tls_skip_verify"` + RequestTimeoutSeconds types.Int64 `tfsdk:"request_timeout_seconds"` +} + +func NewSecretBackendResource() resource.Resource { + return &secretBackendResource{} +} + +func (r *secretBackendResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_secret_backend" +} + +func (r *secretBackendResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "Mounts the Rancher secrets engine and writes its connection config.", + Attributes: map[string]schema.Attribute{ + "path": schema.StringAttribute{ + Description: "Mount path for the Rancher secrets engine (e.g. \"rancher\").", + Required: true, + PlanModifiers: []planmodifier.String{ + stringplanmodifier.RequiresReplace(), + }, + }, + "plugin": schema.StringAttribute{ + Description: "Registered plugin name/type to mount.", + Optional: true, + Computed: true, + Default: stringdefault.StaticString(defaultPluginType), + PlanModifiers: []planmodifier.String{ + stringplanmodifier.RequiresReplace(), + }, + }, + "description": schema.StringAttribute{ + Description: "Human-readable description of the mount.", + Optional: true, + Computed: true, + Default: stringdefault.StaticString(""), + }, + "rancher_url": schema.StringAttribute{ + Description: "Base URL of the Rancher server (e.g. https://rancher.example.com).", + Required: true, + }, + "ca_cert": schema.StringAttribute{ + Description: "PEM CA certificate that signed the Rancher server's TLS certificate.", + Optional: true, + }, + "tls_skip_verify": schema.BoolAttribute{ + Description: "Skip TLS verification of the Rancher server (not recommended).", + Optional: true, + Computed: true, + Default: booldefault.StaticBool(false), + }, + "request_timeout_seconds": schema.Int64Attribute{ + Description: "HTTP timeout in seconds for calls from the plugin to Rancher.", + Optional: true, + Computed: true, + Default: int64default.StaticInt64(30), + }, + }, + } +} + +func (r *secretBackendResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + if req.ProviderData == nil { + return + } + client, ok := req.ProviderData.(*vaultClient) + if !ok { + resp.Diagnostics.AddError("unexpected provider data type", fmt.Sprintf("got %T", req.ProviderData)) + return + } + r.client = client +} + +func (r *secretBackendResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + var plan secretBackendModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + + mountPath := strings.Trim(plan.Path.ValueString(), "/") + + err := r.client.enableMount(ctx, mountPath, plan.Plugin.ValueString(), plan.Description.ValueString(), mountConfig{}) + if err != nil { + if isMountAlreadyExists(err) { + resp.Diagnostics.AddError( + "mount path already in use", + fmt.Sprintf("A secrets engine is already mounted at %q. Import it or choose another path.", mountPath), + ) + return + } + resp.Diagnostics.AddError("failed to enable rancher secrets engine", err.Error()) + return + } + + if err := r.client.write(ctx, configPath(mountPath), r.configData(plan)); err != nil { + // Roll back the mount so we don't leave a half-configured engine. + _ = r.client.disableMount(ctx, mountPath) + resp.Diagnostics.AddError("failed to write rancher config", err.Error()) + return + } + + plan.Path = types.StringValue(mountPath) + resp.Diagnostics.Append(resp.State.Set(ctx, plan)...) +} + +func (r *secretBackendResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + var state secretBackendModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + + mountPath := strings.Trim(state.Path.ValueString(), "/") + + mount, err := r.client.mountInfo(ctx, mountPath) + if err != nil { + resp.Diagnostics.AddError("failed to read mount", err.Error()) + return + } + if mount == nil { + resp.State.RemoveResource(ctx) + return + } + state.Description = types.StringValue(mount.Description) + if mount.Type != "" { + state.Plugin = types.StringValue(mount.Type) + } + + cfg, err := r.client.read(ctx, configPath(mountPath)) + if err != nil { + resp.Diagnostics.AddError("failed to read rancher config", err.Error()) + return + } + if cfg != nil { + if v, ok := cfg["rancher_url"].(string); ok { + state.RancherURL = types.StringValue(v) + } + if v, ok := cfg["tls_skip_verify"].(bool); ok { + state.TLSSkipVerify = types.BoolValue(v) + } + if n, ok := toInt64(cfg["request_timeout_seconds"]); ok { + state.RequestTimeoutSeconds = types.Int64Value(n) + } + } + // ca_cert is not returned by the backend; preserve the state value. + + resp.Diagnostics.Append(resp.State.Set(ctx, state)...) +} + +func (r *secretBackendResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + var plan, state secretBackendModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + + mountPath := strings.Trim(state.Path.ValueString(), "/") + + if !plan.Description.Equal(state.Description) { + if err := r.client.tuneMount(ctx, mountPath, plan.Description.ValueString(), mountConfig{}); err != nil { + resp.Diagnostics.AddError("failed to tune mount description", err.Error()) + return + } + } + + if err := r.client.write(ctx, configPath(mountPath), r.configData(plan)); err != nil { + resp.Diagnostics.AddError("failed to update rancher config", err.Error()) + return + } + + plan.Path = types.StringValue(mountPath) + resp.Diagnostics.Append(resp.State.Set(ctx, plan)...) +} + +func (r *secretBackendResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + var state secretBackendModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.disableMount(ctx, strings.Trim(state.Path.ValueString(), "/")); err != nil { + resp.Diagnostics.AddError("failed to disable rancher secrets engine", err.Error()) + return + } +} + +func (r *secretBackendResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { + resource.ImportStatePassthroughID(ctx, path.Root("path"), req, resp) +} + +func (r *secretBackendResource) configData(m secretBackendModel) map[string]interface{} { + data := map[string]interface{}{ + "rancher_url": m.RancherURL.ValueString(), + "tls_skip_verify": m.TLSSkipVerify.ValueBool(), + "request_timeout_seconds": m.RequestTimeoutSeconds.ValueInt64(), + } + if !m.CACert.IsNull() && !m.CACert.IsUnknown() { + data["ca_cert"] = m.CACert.ValueString() + } + return data +} diff --git a/internal/provider/resource_secret_backend_role.go b/internal/provider/resource_secret_backend_role.go new file mode 100644 index 0000000..f97e962 --- /dev/null +++ b/internal/provider/resource_secret_backend_role.go @@ -0,0 +1,233 @@ +package provider + +import ( + "context" + "fmt" + + "github.com/hashicorp/terraform-plugin-framework/diag" + "github.com/hashicorp/terraform-plugin-framework/path" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var ( + _ resource.Resource = &secretBackendRoleResource{} + _ resource.ResourceWithImportState = &secretBackendRoleResource{} +) + +type secretBackendRoleResource struct { + client *vaultClient +} + +type secretBackendRoleModel struct { + Backend types.String `tfsdk:"backend"` + Name types.String `tfsdk:"name"` + ServiceAccount types.String `tfsdk:"service_account"` + ClusterName types.String `tfsdk:"cluster_name"` + Description types.String `tfsdk:"description"` + TTL types.Int64 `tfsdk:"ttl"` + MaxTTL types.Int64 `tfsdk:"max_ttl"` +} + +func NewSecretBackendRoleResource() resource.Resource { + return &secretBackendRoleResource{} +} + +func (r *secretBackendRoleResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_secret_backend_role" +} + +func (r *secretBackendRoleResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "Manages a role on the Rancher secrets engine that mints short-lived tokens from a service account.", + Attributes: map[string]schema.Attribute{ + "backend": schema.StringAttribute{ + Description: "Mount path of the Rancher secrets engine.", + Required: true, + PlanModifiers: []planmodifier.String{ + stringplanmodifier.RequiresReplace(), + }, + }, + "name": schema.StringAttribute{ + Description: "Name of the role.", + Required: true, + PlanModifiers: []planmodifier.String{ + stringplanmodifier.RequiresReplace(), + }, + }, + "service_account": schema.StringAttribute{ + Description: "Service account (seeded token) used to mint credentials. Its user's RBAC is inherited by minted tokens.", + Required: true, + }, + "cluster_name": schema.StringAttribute{ + Description: "Downstream cluster to scope minted tokens to (empty = full Rancher-server scope).", + Optional: true, + }, + "description": schema.StringAttribute{ + Description: "Description applied to each minted Rancher token.", + Optional: true, + }, + "ttl": schema.Int64Attribute{ + Description: "Default lease TTL in seconds for tokens minted from this role.", + Optional: true, + }, + "max_ttl": schema.Int64Attribute{ + Description: "Maximum lease TTL in seconds for tokens minted from this role.", + Optional: true, + }, + }, + } +} + +func (r *secretBackendRoleResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + if req.ProviderData == nil { + return + } + client, ok := req.ProviderData.(*vaultClient) + if !ok { + resp.Diagnostics.AddError("unexpected provider data type", fmt.Sprintf("got %T", req.ProviderData)) + return + } + r.client = client +} + +func (r *secretBackendRoleResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + var plan secretBackendRoleModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.write(ctx, rolePath(plan.Backend.ValueString(), plan.Name.ValueString()), roleData(plan)); err != nil { + resp.Diagnostics.AddError("failed to create rancher role", err.Error()) + return + } + resp.Diagnostics.Append(r.readInto(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, plan)...) +} + +func (r *secretBackendRoleResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + var state secretBackendRoleModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + role, err := r.client.read(ctx, rolePath(state.Backend.ValueString(), state.Name.ValueString())) + if err != nil { + resp.Diagnostics.AddError("failed to read rancher role", err.Error()) + return + } + if role == nil { + resp.State.RemoveResource(ctx) + return + } + applyRoleData(&state, role) + resp.Diagnostics.Append(resp.State.Set(ctx, state)...) +} + +func (r *secretBackendRoleResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + var plan secretBackendRoleModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.write(ctx, rolePath(plan.Backend.ValueString(), plan.Name.ValueString()), roleData(plan)); err != nil { + resp.Diagnostics.AddError("failed to update rancher role", err.Error()) + return + } + resp.Diagnostics.Append(r.readInto(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, plan)...) +} + +func (r *secretBackendRoleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + var state secretBackendRoleModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.delete(ctx, rolePath(state.Backend.ValueString(), state.Name.ValueString())); err != nil { + resp.Diagnostics.AddError("failed to delete rancher role", err.Error()) + return + } +} + +func (r *secretBackendRoleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { + backend, name, ok := splitBackendName(req.ID, "roles") + if !ok { + resp.Diagnostics.AddError( + "invalid import ID", + fmt.Sprintf("expected \"/roles/\", got %q", req.ID), + ) + return + } + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("backend"), backend)...) + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("name"), name)...) +} + +func (r *secretBackendRoleResource) readInto(ctx context.Context, m *secretBackendRoleModel) diag.Diagnostics { + var diags diag.Diagnostics + role, err := r.client.read(ctx, rolePath(m.Backend.ValueString(), m.Name.ValueString())) + if err != nil { + diags.AddError("failed to read back rancher role", err.Error()) + return diags + } + if role == nil { + diags.AddError("role missing after write", "the role was not found immediately after being written") + return diags + } + applyRoleData(m, role) + return diags +} + +func roleData(m secretBackendRoleModel) map[string]interface{} { + data := map[string]interface{}{ + "service_account": m.ServiceAccount.ValueString(), + } + if !m.ClusterName.IsNull() && !m.ClusterName.IsUnknown() { + data["cluster_name"] = m.ClusterName.ValueString() + } + if !m.Description.IsNull() && !m.Description.IsUnknown() { + data["description"] = m.Description.ValueString() + } + if !m.TTL.IsNull() && !m.TTL.IsUnknown() { + data["ttl"] = m.TTL.ValueInt64() + } + if !m.MaxTTL.IsNull() && !m.MaxTTL.IsUnknown() { + data["max_ttl"] = m.MaxTTL.ValueInt64() + } + return data +} + +func applyRoleData(m *secretBackendRoleModel, role map[string]interface{}) { + if v, ok := role["service_account"].(string); ok { + m.ServiceAccount = types.StringValue(v) + } + if v, ok := role["cluster_name"].(string); ok && v != "" { + m.ClusterName = types.StringValue(v) + } else if m.ClusterName.IsUnknown() { + m.ClusterName = types.StringNull() + } + if v, ok := role["description"].(string); ok && v != "" { + m.Description = types.StringValue(v) + } else if m.Description.IsUnknown() { + m.Description = types.StringNull() + } + if n, ok := toInt64(role["ttl"]); ok && n != 0 { + m.TTL = types.Int64Value(n) + } else if m.TTL.IsUnknown() { + m.TTL = types.Int64Null() + } + if n, ok := toInt64(role["max_ttl"]); ok && n != 0 { + m.MaxTTL = types.Int64Value(n) + } else if m.MaxTTL.IsUnknown() { + m.MaxTTL = types.Int64Null() + } +} diff --git a/internal/provider/resource_secret_backend_service_account.go b/internal/provider/resource_secret_backend_service_account.go new file mode 100644 index 0000000..bf530f7 --- /dev/null +++ b/internal/provider/resource_secret_backend_service_account.go @@ -0,0 +1,218 @@ +package provider + +import ( + "context" + "fmt" + + "github.com/hashicorp/terraform-plugin-framework/diag" + "github.com/hashicorp/terraform-plugin-framework/path" + "github.com/hashicorp/terraform-plugin-framework/resource" + "github.com/hashicorp/terraform-plugin-framework/resource/schema" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier" + "github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier" + "github.com/hashicorp/terraform-plugin-framework/types" +) + +var ( + _ resource.Resource = &secretBackendServiceAccountResource{} + _ resource.ResourceWithImportState = &secretBackendServiceAccountResource{} +) + +type secretBackendServiceAccountResource struct { + client *vaultClient +} + +type secretBackendServiceAccountModel struct { + Backend types.String `tfsdk:"backend"` + Name types.String `tfsdk:"name"` + Token types.String `tfsdk:"token"` + TokenName types.String `tfsdk:"token_name"` + TokenTTL types.Int64 `tfsdk:"token_ttl"` + RotationPeriod types.Int64 `tfsdk:"rotation_period"` + LastRotated types.String `tfsdk:"last_rotated"` +} + +func NewSecretBackendServiceAccountResource() resource.Resource { + return &secretBackendServiceAccountResource{} +} + +func (r *secretBackendServiceAccountResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) { + resp.TypeName = req.ProviderTypeName + "_secret_backend_service_account" +} + +func (r *secretBackendServiceAccountResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) { + resp.Schema = schema.Schema{ + Description: "Seeds a Rancher service-account token that the engine auto-rotates before Rancher's TTL cap.", + Attributes: map[string]schema.Attribute{ + "backend": schema.StringAttribute{ + Description: "Mount path of the Rancher secrets engine.", + Required: true, + PlanModifiers: []planmodifier.String{ + stringplanmodifier.RequiresReplace(), + }, + }, + "name": schema.StringAttribute{ + Description: "Name of the service account.", + Required: true, + PlanModifiers: []planmodifier.String{ + stringplanmodifier.RequiresReplace(), + }, + }, + "token": schema.StringAttribute{ + Description: "Rancher API token to seed with. Write-only; the engine rotates it from here on and never returns it.", + Required: true, + Sensitive: true, + }, + "token_name": schema.StringAttribute{ + Description: "ext.cattle.io Token resource name (metadata.name) of the seed token, so the engine can delete it after the first rotation.", + Optional: true, + Computed: true, + }, + "token_ttl": schema.Int64Attribute{ + Description: "Lifetime in seconds requested for each rotated replacement token (default 90d). Must not exceed Rancher's auth-token-max-ttl-minutes.", + Optional: true, + Computed: true, + }, + "rotation_period": schema.Int64Attribute{ + Description: "Seconds a token is used before rotation (default 45d). Must be less than token_ttl.", + Optional: true, + Computed: true, + }, + "last_rotated": schema.StringAttribute{ + Description: "RFC3339 timestamp of the current token's issuance (computed).", + Computed: true, + }, + }, + } +} + +func (r *secretBackendServiceAccountResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) { + if req.ProviderData == nil { + return + } + client, ok := req.ProviderData.(*vaultClient) + if !ok { + resp.Diagnostics.AddError("unexpected provider data type", fmt.Sprintf("got %T", req.ProviderData)) + return + } + r.client = client +} + +func (r *secretBackendServiceAccountResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) { + var plan secretBackendServiceAccountModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + resp.Diagnostics.Append(r.writeAndRead(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, plan)...) +} + +func (r *secretBackendServiceAccountResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) { + var plan secretBackendServiceAccountModel + resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + resp.Diagnostics.Append(r.writeAndRead(ctx, &plan)...) + if resp.Diagnostics.HasError() { + return + } + resp.Diagnostics.Append(resp.State.Set(ctx, plan)...) +} + +// writeAndRead writes the service account then refreshes computed fields from +// the backend. +func (r *secretBackendServiceAccountResource) writeAndRead(ctx context.Context, plan *secretBackendServiceAccountModel) diag.Diagnostics { + var diags diag.Diagnostics + data := map[string]interface{}{"token": plan.Token.ValueString()} + if !plan.TokenName.IsNull() && !plan.TokenName.IsUnknown() { + data["token_name"] = plan.TokenName.ValueString() + } + if !plan.TokenTTL.IsNull() && !plan.TokenTTL.IsUnknown() { + data["token_ttl"] = plan.TokenTTL.ValueInt64() + } + if !plan.RotationPeriod.IsNull() && !plan.RotationPeriod.IsUnknown() { + data["rotation_period"] = plan.RotationPeriod.ValueInt64() + } + + if err := r.client.write(ctx, serviceAccountPath(plan.Backend.ValueString(), plan.Name.ValueString()), data); err != nil { + diags.AddError("failed to write rancher service account", err.Error()) + return diags + } + sa, err := r.client.read(ctx, serviceAccountPath(plan.Backend.ValueString(), plan.Name.ValueString())) + if err != nil { + diags.AddError("failed to read back rancher service account", err.Error()) + return diags + } + if sa == nil { + diags.AddError("service account missing after write", "not found immediately after being written") + return diags + } + applyServiceAccount(plan, sa) + return diags +} + +func (r *secretBackendServiceAccountResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) { + var state secretBackendServiceAccountModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + + sa, err := r.client.read(ctx, serviceAccountPath(state.Backend.ValueString(), state.Name.ValueString())) + if err != nil { + resp.Diagnostics.AddError("failed to read rancher service account", err.Error()) + return + } + if sa == nil { + resp.State.RemoveResource(ctx) + return + } + applyServiceAccount(&state, sa) + // token is never returned by the backend; preserve the state value. + resp.Diagnostics.Append(resp.State.Set(ctx, state)...) +} + +func (r *secretBackendServiceAccountResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) { + var state secretBackendServiceAccountModel + resp.Diagnostics.Append(req.State.Get(ctx, &state)...) + if resp.Diagnostics.HasError() { + return + } + if err := r.client.delete(ctx, serviceAccountPath(state.Backend.ValueString(), state.Name.ValueString())); err != nil { + resp.Diagnostics.AddError("failed to delete rancher service account", err.Error()) + return + } +} + +func (r *secretBackendServiceAccountResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) { + backend, name, ok := splitBackendName(req.ID, "service-accounts") + if !ok { + resp.Diagnostics.AddError( + "invalid import ID", + fmt.Sprintf("expected \"/service-accounts/\", got %q", req.ID), + ) + return + } + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("backend"), backend)...) + resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("name"), name)...) +} + +func applyServiceAccount(m *secretBackendServiceAccountModel, sa map[string]interface{}) { + if v, ok := sa["token_name"].(string); ok { + m.TokenName = types.StringValue(v) + } + if n, ok := toInt64(sa["token_ttl"]); ok { + m.TokenTTL = types.Int64Value(n) + } + if n, ok := toInt64(sa["rotation_period"]); ok { + m.RotationPeriod = types.Int64Value(n) + } + if v, ok := sa["last_rotated"].(string); ok { + m.LastRotated = types.StringValue(v) + } +} diff --git a/main.go b/main.go new file mode 100644 index 0000000..1017aa2 --- /dev/null +++ b/main.go @@ -0,0 +1,28 @@ +package main + +import ( + "context" + "flag" + "log" + + "github.com/hashicorp/terraform-plugin-framework/providerserver" + + "git.unkin.net/unkin/terraform-provider-ranchervaultsecret/internal/provider" +) + +var version = "0.0.1" + +func main() { + var debug bool + flag.BoolVar(&debug, "debug", false, "enable debug mode") + flag.Parse() + + opts := providerserver.ServeOpts{ + Address: "git.unkin.net/unkin/ranchervaultsecret", + Debug: debug, + } + + if err := providerserver.Serve(context.Background(), provider.New(version), opts); err != nil { + log.Fatal(err) + } +} diff --git a/scripts/e2e.sh b/scripts/e2e.sh new file mode 100755 index 0000000..e183db5 --- /dev/null +++ b/scripts/e2e.sh @@ -0,0 +1,116 @@ +#!/usr/bin/env bash +# +# End-to-end test for terraform-provider-ranchervaultsecret. +# +# Builds the sibling rancher plugin and this provider, boots Vault + a mock +# Rancher ext.cattle.io API in Docker, then runs a real `terraform apply` through +# the provider to mount the engine, seed a service account, and create a role. +# It asserts a token can be minted from the role, then `terraform destroy` and +# verifies the mount is gone. +# +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +PLUGIN_REPO="${PLUGIN_REPO:-${ROOT_DIR}/../vault-plugin-secrets-rancher}" +COMPOSE_FILE="${ROOT_DIR}/test/docker-compose.yml" +COMPOSE="docker compose -f ${COMPOSE_FILE}" +TF="${TF:-terraform}" +E2E_DIR="${ROOT_DIR}/test/e2e" +PLUGIN_BIN="vault-plugin-secrets-rancher" +PROVIDER_BIN="terraform-provider-ranchervaultsecret" + +RANCHER_ADDR="http://127.0.0.1:8443" +export VAULT_ADDR="http://127.0.0.1:8200" +export VAULT_TOKEN="root" +export PLUGIN_SRC="${PLUGIN_REPO}" + +red() { printf '\033[31m%s\033[0m\n' "$*"; } +green() { printf '\033[32m%s\033[0m\n' "$*"; } +blue() { printf '\033[34m==> %s\033[0m\n' "$*"; } +fail() { red "FAIL: $*"; exit 1; } + +cleanup() { + blue "Cleaning up" + if [ -d "${E2E_DIR}" ]; then + (cd "${E2E_DIR}" && TF_CLI_CONFIG_FILE="${ROOT_DIR}/test/dev.tfrc" "${TF}" destroy -auto-approve >/dev/null 2>&1 || true) + rm -f "${E2E_DIR}"/terraform.tfstate* "${E2E_DIR}"/.terraform.lock.hcl + rm -rf "${E2E_DIR}/.terraform" + fi + ${COMPOSE} down -v >/dev/null 2>&1 || true +} +trap cleanup EXIT + +wait_for() { + local desc="$1"; shift + local retries="${WAIT_RETRIES:-90}" i=0 + until "$@" >/dev/null 2>&1; do + i=$((i + 1)) + [ "$i" -ge "$retries" ] && fail "timed out waiting for ${desc}" + sleep 2 + done + green "ready: ${desc}" +} + +# --------------------------------------------------------------------------- +blue "Building rancher plugin from ${PLUGIN_REPO}" +[ -d "${PLUGIN_REPO}" ] || fail "plugin repo not found at ${PLUGIN_REPO} (set PLUGIN_REPO)" +mkdir -p "${ROOT_DIR}/test/plugins" +( cd "${PLUGIN_REPO}" && CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-s -w" \ + -o "${ROOT_DIR}/test/plugins/${PLUGIN_BIN}" ./cmd/vault-plugin-secrets-rancher ) + +blue "Building the provider" +( cd "${ROOT_DIR}" && go build -o "${PROVIDER_BIN}" . ) + +blue "Writing terraform dev_overrides config" +cat > "${ROOT_DIR}/test/dev.tfrc" </dev/null + +# --------------------------------------------------------------------------- +blue "terraform apply (mount engine + service account + role via the provider)" +( cd "${E2E_DIR}" && "${TF}" apply -auto-approve ) +green "apply succeeded" + +blue "Verifying the mount, service account, and role exist" +${COMPOSE} exec -T vault vault secrets list 2>/dev/null | grep -q '^rancher/' \ + || fail "rancher mount not found after apply" +${COMPOSE} exec -T vault vault read rancher/service-accounts/admin >/dev/null \ + || fail "service account admin not found after apply" +${COMPOSE} exec -T vault vault read rancher/roles/ci >/dev/null \ + || fail "role ci not found after apply" +green "mount + service account + role present" + +blue "Minting a token from the terraform-managed role" +TOKEN="$(${COMPOSE} exec -T vault vault read -field=token rancher/creds/ci)" +NAME="$(${COMPOSE} exec -T vault vault read -field=token_name rancher/creds/ci)" +[ -n "${TOKEN}" ] || fail "no token minted" +green "minted token ${TOKEN:0:14}... (${NAME})" + +code="$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer ${TOKEN}" \ + "${RANCHER_ADDR}/apis/ext.cattle.io/v1/tokens/${NAME}")" +[ "${code}" = "200" ] || fail "minted token not usable against rancher (HTTP ${code})" +green "minted token is live in rancher" + +# --------------------------------------------------------------------------- +blue "terraform destroy (unmount engine)" +( cd "${E2E_DIR}" && "${TF}" destroy -auto-approve ) +${COMPOSE} exec -T vault vault secrets list 2>/dev/null | grep -q '^rancher/' \ + && fail "rancher mount still present after destroy" || true +green "mount removed by destroy" + +green "ALL PROVIDER END-TO-END CHECKS PASSED" diff --git a/test/docker-compose.yml b/test/docker-compose.yml new file mode 100644 index 0000000..b51af4e --- /dev/null +++ b/test/docker-compose.yml @@ -0,0 +1,46 @@ +# E2E stack for the provider: a mock Rancher ext.cattle.io API (run from the +# sibling plugin repo) + a Vault dev server with the rancher plugin mounted. +# Bind mounts use ":z" for SELinux (Fedora/RHEL). +services: + rancher: + image: golang:1.25-alpine + working_dir: /src + environment: + MOCKRANCHER_ADDR: ":8443" + MOCKRANCHER_TOKEN: "seed-token" + GOFLAGS: "-mod=mod" + # PLUGIN_SRC is the sibling vault-plugin-secrets-rancher checkout, which + # ships the mock Rancher server under test/mockrancher. + command: ["go", "run", "./test/mockrancher"] + volumes: + - ${PLUGIN_SRC:-../vault-plugin-secrets-rancher}:/src:ro,z + ports: + - "8443:8443" + healthcheck: + test: ["CMD", "wget", "-qO-", "http://localhost:8443/healthz"] + interval: 3s + timeout: 3s + retries: 40 + + vault: + image: hashicorp/vault:1.18 + depends_on: + rancher: + condition: service_healthy + cap_add: + - IPC_LOCK + environment: + VAULT_DEV_ROOT_TOKEN_ID: root + VAULT_ADDR: http://127.0.0.1:8200 + VAULT_TOKEN: root + command: ["server", "-dev", "-dev-listen-address=0.0.0.0:8200", "-config=/vault/vault.hcl"] + volumes: + - ./plugins:/vault/plugins:ro,z + - ./vault/vault.hcl:/vault/vault.hcl:ro,z + ports: + - "8200:8200" + healthcheck: + test: ["CMD", "vault", "status", "-address=http://127.0.0.1:8200"] + interval: 3s + timeout: 3s + retries: 20 diff --git a/test/e2e/main.tf b/test/e2e/main.tf new file mode 100644 index 0000000..601edb0 --- /dev/null +++ b/test/e2e/main.tf @@ -0,0 +1,40 @@ +terraform { + required_providers { + rancher = { + source = "git.unkin.net/unkin/ranchervaultsecret" + } + } +} + +provider "rancher" { + address = "http://127.0.0.1:8200" + token = "root" +} + +resource "rancher_secret_backend" "rancher" { + path = "rancher" + description = "Rancher token engine (e2e)" + # Reachable from inside the vault container, where the plugin runs. + rancher_url = "http://rancher:8443" + tls_skip_verify = true +} + +resource "rancher_secret_backend_service_account" "admin" { + backend = rancher_secret_backend.rancher.path + name = "admin" + + token = "seed-token" + token_name = "seed" + + token_ttl = 90 * 24 * 3600 + rotation_period = 45 * 24 * 3600 +} + +resource "rancher_secret_backend_role" "ci" { + backend = rancher_secret_backend.rancher.path + name = "ci" + service_account = rancher_secret_backend_service_account.admin.name + cluster_name = "c-m-abc123" + ttl = 3600 + max_ttl = 86400 +} diff --git a/test/vault/vault.hcl b/test/vault/vault.hcl new file mode 100644 index 0000000..34a176e --- /dev/null +++ b/test/vault/vault.hcl @@ -0,0 +1,4 @@ +# Combined with `-dev` so the dev server has a plugin_directory to register the +# rancher plugin binary mounted from ./plugins. +plugin_directory = "/vault/plugins" +api_addr = "http://127.0.0.1:8200" -- 2.47.3