Environment Nautobot version: 1.2.0 secrets versio

Add support for AppRole authentication to HashiCorp Vault provider about nautobot-app-secrets-providers HOT 1 CLOSED

nautobot commented on June 16, 2024 2

Add support for AppRole authentication to HashiCorp Vault provider

from nautobot-app-secrets-providers.

Comments (1)

jathanism commented on June 16, 2024

Doing a little bit of local debug to try to get it working. In practice we'll just need to set an auth method that defaults to token in the plugin settings. And then have the provider code that sets up the Vault client to choose the auth method based on the one specified in the plugins config.

Plugin config

Pseudo code for processing the plugin settings for token (default) vs approle:

if auth_method == "token":
    required_fields = ("url", "token")
elif auth_method == "approle":
   required_fields = ("url", "role_id", "secret_id")

Plugin config for token:

PLUGINS_CONFIG = {
    "nautobot_secrets_providers": {
        "url": "http://localhost:8200",
        "auth_method": "token",
        "token": "nautobot",
   },
}

Plugin config for approle:

PLUGINS_CONFIG = {
    "nautobot_secrets_providers": {
        "url": "http://localhost:8200",
        "auth_method": "approle",
        "role_id": "e4a3a05a-b83b-ad2f-89f6-4c84edd9ec0b",
        "secret_id": "5b59651c-2687-d14d-ab61-7275b4c39cf4",
   },
}

AppRole testing

For testing we'll need to set this all of this stuff up.

enable_auth_method

client = hvac.Client(url="http://localhost:8200", token="nautobot"

# POST http://localhost:8200/v1/sys/auth/approle
r = client.sys.enable_auth_method(
    method_type='approle',
)

Authentication

Create Policy

policy = """
path "secret/*" {
  capabilities = ["read", "list"]
}
"""
client.sys.create_or_update_policy(name="read-only", policy=policy)

Create AppRole

# POST http://localhost:8200/v1/auth/approle/role/test-role
resp = client.auth.approle.create_or_update_approle(
    role_name="test-role",
    token_policies=["test-policy"],  # <= Needs to be created first
    token_type="service",
)
role_id = resp["data"]["role_id"]

Generate Secret ID

resp = client.auth.approle.generate_secret_id(
    role_name="test-role",
    cidr_list=["127.0.0.1/32", "172.18.0.1/32"],
)
secret_id = resp["data"]["secret_id"]

Login

role_name = "test-role"
role_id = "e4a3a05a-b83b-ad2f-89f6-4c84edd9ec0b"
secret_id = "5b59651c-2687-d14d-ab61-7275b4c39cf4"
r3 = client2.auth.approle.login(role_id=role_id, secret_id=secret_id)

s = client2.secrets.kv.read_secret("hello")
print(s["data"]["data"]["hello"])

from nautobot-app-secrets-providers.

Recommend Projects