feat: approle vault
This commit is contained in:
@@ -4,19 +4,34 @@ from functools import lru_cache
|
||||
from typing import List, Literal
|
||||
import os
|
||||
from dotenv import load_dotenv, find_dotenv
|
||||
from pydantic import Field, model_validator
|
||||
from pydantic import AliasChoices,Field,field_validator,model_validator
|
||||
from pydantic_settings import BaseSettings, SettingsConfigDict
|
||||
from src.infrastructure.vault import create_hvac_client, read_kv2_secret
|
||||
from src.infrastructure.vault import create_hvac_client_from_approle,read_kv2_secret
|
||||
|
||||
env_file = find_dotenv(".env")
|
||||
if env_file:
|
||||
load_dotenv(env_file)
|
||||
|
||||
|
||||
def normalize_vault_base_url(raw: str) -> str:
|
||||
u = raw.strip().rstrip('/')
|
||||
if not u:
|
||||
return raw.strip()
|
||||
if '://' not in u:
|
||||
return f'https://{u}'
|
||||
return u
|
||||
|
||||
|
||||
class Settings(BaseSettings):
|
||||
VAULT_ADDR: str = Field(default="http://localhost:8200")
|
||||
VAULT_TOKEN: str = Field(..., description="Vault token is required")
|
||||
VAULT_MOUNT_POINT: str = Field(default="secrets")
|
||||
VAULT_ADDR: str = Field(default='http://localhost:8200')
|
||||
VAULT_ROLE_ID: str = Field(...,description='AppRole role_id')
|
||||
VAULT_SECRET_ID: str = Field(
|
||||
...,
|
||||
description='AppRole secret_id',
|
||||
validation_alias=AliasChoices('VAULT_SECRET_ID','VAULT_SECRET_TOKEN'),
|
||||
)
|
||||
VAULT_NAMESPACE: str | None = Field(default=None)
|
||||
VAULT_MOUNT_POINT: str = Field(default='secrets')
|
||||
|
||||
VAULT_JWT_KID_PATH: str = "jwt/kid"
|
||||
VAULT_JWT_KIDS_PREFIX: str = "jwt/kids"
|
||||
@@ -77,51 +92,110 @@ class Settings(BaseSettings):
|
||||
env_file_encoding="utf-8",
|
||||
case_sensitive=True,
|
||||
extra="ignore",
|
||||
populate_by_name=True,
|
||||
)
|
||||
|
||||
@field_validator('VAULT_ADDR',mode='before')
|
||||
@classmethod
|
||||
def vault_addr_scheme(cls, v):
|
||||
if v is None or not isinstance(v,str):
|
||||
return v
|
||||
return normalize_vault_base_url(v)
|
||||
|
||||
@model_validator(mode="before")
|
||||
@classmethod
|
||||
def load_from_vault(cls, data: dict):
|
||||
addr = data.get("VAULT_ADDR") or os.getenv("VAULT_ADDR") or "http://localhost:8200"
|
||||
token = data.get("VAULT_TOKEN") or os.getenv("VAULT_TOKEN")
|
||||
mount = data.get("VAULT_MOUNT_POINT") or os.getenv("VAULT_MOUNT_POINT") or "secrets"
|
||||
if not isinstance(data,dict):
|
||||
return data
|
||||
addr_raw = data.get('VAULT_ADDR') or os.getenv('VAULT_ADDR') or 'http://localhost:8200'
|
||||
addr = normalize_vault_base_url(addr_raw)
|
||||
data['VAULT_ADDR'] = addr
|
||||
role_id = data.get('VAULT_ROLE_ID') or os.getenv('VAULT_ROLE_ID')
|
||||
secret_id = (
|
||||
data.get('VAULT_SECRET_ID')
|
||||
or data.get('VAULT_SECRET_TOKEN')
|
||||
or os.getenv('VAULT_SECRET_ID')
|
||||
or os.getenv('VAULT_SECRET_TOKEN')
|
||||
)
|
||||
namespace = data.get('VAULT_NAMESPACE')
|
||||
if namespace is None:
|
||||
namespace = os.getenv('VAULT_NAMESPACE')
|
||||
namespace = namespace if namespace else None
|
||||
mount = data.get('VAULT_MOUNT_POINT') or os.getenv('VAULT_MOUNT_POINT') or 'secrets'
|
||||
|
||||
if not token:
|
||||
raise RuntimeError("VAULT_TOKEN is required")
|
||||
if not role_id or not secret_id:
|
||||
raise RuntimeError('VAULT_ROLE_ID and VAULT_SECRET_ID (or VAULT_SECRET_TOKEN) are required for Vault AppRole')
|
||||
|
||||
client = create_hvac_client(url=addr, token=token, timeout=5)
|
||||
data['VAULT_ROLE_ID'] = str(role_id).strip()
|
||||
data['VAULT_SECRET_ID'] = str(secret_id).strip()
|
||||
|
||||
def safe_read(path: str) -> dict:
|
||||
client = create_hvac_client_from_approle(
|
||||
url=addr,
|
||||
role_id=role_id,
|
||||
secret_id=secret_id,
|
||||
namespace=namespace,
|
||||
timeout=5,
|
||||
)
|
||||
|
||||
def read_secret(path: str) -> dict:
|
||||
return read_kv2_secret(client=client,mount_point=mount,path=path)
|
||||
|
||||
def read_secret_optional(path: str) -> dict:
|
||||
try:
|
||||
return read_kv2_secret(client=client, mount_point=mount, path=path)
|
||||
return read_secret(path)
|
||||
except Exception:
|
||||
return {}
|
||||
|
||||
database = safe_read("database")
|
||||
rabbitmq = safe_read("rabbitmq")
|
||||
csrf = safe_read("csrf")
|
||||
database = read_secret('database')
|
||||
csrf = read_secret_optional('csrf')
|
||||
rabbitmq = read_secret_optional('rabbitmq')
|
||||
|
||||
if database:
|
||||
required = ["HOST", "NAME", "USER", "PASSWORD", "PORT"]
|
||||
missing = [k for k in required if k not in database]
|
||||
if missing:
|
||||
raise RuntimeError(f"Vault database secret missing keys {missing}")
|
||||
db_ci = {str(k).lower(): v for k, v in database.items()}
|
||||
|
||||
data["DATABASE_HOST"] = database["HOST"]
|
||||
data["DATABASE_PORT"] = database["PORT"]
|
||||
data["DATABASE_NAME"] = database["NAME"]
|
||||
data["DATABASE_USER"] = database["USER"]
|
||||
data["DATABASE_PASSWORD"] = database["PASSWORD"]
|
||||
def db_nonempty(key: str) -> bool:
|
||||
v = db_ci.get(key)
|
||||
if v is None:
|
||||
return False
|
||||
if isinstance(v,str) and not v.strip():
|
||||
return False
|
||||
return True
|
||||
|
||||
if rabbitmq:
|
||||
data["RABBIT_HOST"] = rabbitmq.get("HOST", data.get("RABBIT_HOST"))
|
||||
data["RABBIT_PORT"] = rabbitmq.get("PORT", data.get("RABBIT_PORT"))
|
||||
data["RABBIT_USER"] = rabbitmq.get("USER", data.get("RABBIT_USER"))
|
||||
data["RABBIT_PASSWORD"] = rabbitmq.get("PASSWORD", data.get("RABBIT_PASSWORD"))
|
||||
data["RABBIT_VHOST"] = rabbitmq.get("VHOST", data.get("RABBIT_VHOST"))
|
||||
required_db = ['host','name','user','password','port']
|
||||
missing_db = [k for k in required_db if not db_nonempty(k)]
|
||||
if missing_db:
|
||||
raise RuntimeError(f'Vault secret database missing non-empty keys: {missing_db}')
|
||||
|
||||
data['DATABASE_HOST'] = str(db_ci['host']).strip()
|
||||
data['DATABASE_PORT'] = int(db_ci['port'])
|
||||
data['DATABASE_NAME'] = str(db_ci['name']).strip()
|
||||
data['DATABASE_USER'] = str(db_ci['user']).strip()
|
||||
data['DATABASE_PASSWORD'] = str(db_ci['password']).strip()
|
||||
|
||||
if csrf:
|
||||
data["CSRF_SECRET_KEY"] = csrf.get("KEY", data.get("CSRF_SECRET_KEY"))
|
||||
csrf_secret = None
|
||||
for entry_key, entry_val in csrf.items():
|
||||
if str(entry_key).lower() == 'key' and entry_val is not None and str(entry_val).strip():
|
||||
csrf_secret = str(entry_val).strip()
|
||||
break
|
||||
if csrf_secret:
|
||||
data['CSRF_SECRET_KEY'] = csrf_secret
|
||||
|
||||
if rabbitmq:
|
||||
r_ci = {str(k).lower(): v for k, v in rabbitmq.items()}
|
||||
|
||||
def rb_set(field: str, env_key: str, *, as_int: bool = False) -> None:
|
||||
v = r_ci.get(field)
|
||||
if v is None:
|
||||
return
|
||||
if isinstance(v,str) and not v.strip():
|
||||
return
|
||||
data[env_key] = int(v) if as_int else str(v).strip()
|
||||
|
||||
rb_set('host','RABBIT_HOST')
|
||||
rb_set('port','RABBIT_PORT',as_int=True)
|
||||
rb_set('user','RABBIT_USER')
|
||||
rb_set('password','RABBIT_PASSWORD')
|
||||
rb_set('vhost','RABBIT_VHOST')
|
||||
|
||||
return data
|
||||
|
||||
|
||||
Reference in New Issue
Block a user