External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-07 17:37:37 -02:30
Code Issues Packages Projects Releases Wiki Activity

related #4274 - added option to verify server certificate with a specific CA

Browse Source
This commit is contained in:
olia-dev
2019-07-09 13:59:11 +02:00
parent f77298643f
commit 7a5efa1adc
1 changed files with 23 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
awx/main/credential_plugins/hashivault.py
View File

@@ -104,43 +104,33 @@ def kv_backend(**kwargs):
secret_path = kwargs['secret_path'] secret_path = kwargs['secret_path']
secret_key = kwargs.get('secret_key', None) secret_key = kwargs.get('secret_key', None)
cacert = kwargs.get('cacert', None) cacert = kwargs.get('cacert', None)
api_version = kwargs['api_version'] api_version = kwargs['api_version']
request_kwargs = { 'timeout': 30 }
if cacert:
request_kwargs['verify'] = create_temporary_fifo(cacert.encode())
sess = requests.Session() sess = requests.Session()
sess.headers['Authorization'] = 'Bearer {}'.format(token) sess.headers['Authorization'] = 'Bearer {}'.format(token)
if api_version == 'v2': if api_version == 'v2':
params = {}
if kwargs.get('secret_version'): if kwargs.get('secret_version'):
params['version'] = kwargs['secret_version'] request_kwargs['params'] = { 'version': kwargs['secret_version'] }
try: try:
mount_point, *path = pathlib.Path(secret_path.lstrip(os.sep)).parts mount_point, *path = pathlib.Path(secret_path.lstrip(os.sep)).parts
'/'.join(path) '/'.join(path)
except Exception: except Exception:
mount_point, path = secret_path, [] mount_point, path = secret_path, []
# https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version # https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
if cacert: request_url = '/'.join([url, mount_point, 'data'] + path).rstrip('/')
response = sess.get( response = sess.get(request_url, **request_kwargs)
'/'.join([url, mount_point, 'data'] + path).rstrip('/'),
params=params,
verify=create_temporary_fifo(cacert.encode()) ,
timeout=30
)
else:
response = sess.get(
'/'.join([url, mount_point, 'data'] + path).rstrip('/'),
params=params,
timeout=30
)
response.raise_for_status() response.raise_for_status()
json = response.json()['data'] json = response.json()['data']
else: else:
# https://www.vaultproject.io/api/secret/kv/kv-v1.html#read-secret request_url = '/'.join([url, secret_path]).rstrip('/')
if cacert: response = sess.get(request_url, **request_kwargs)
response = sess.get('/'.join([url, secret_path]).rstrip('/'), verify=create_temporary_fifo(cacert.encode()), timeout=30)
else:
response = sess.get('/'.join([url, secret_path]).rstrip('/'), timeout=30)
response.raise_for_status() response.raise_for_status()
json = response.json() json = response.json()
@@ -161,28 +151,20 @@ def ssh_backend(**kwargs):
role = kwargs['role'] role = kwargs['role']
cacert = kwargs.get('cacert', None) cacert = kwargs.get('cacert', None)
request_kwargs = { 'timeout': 30 }
if cacert:
request_kwargs['verify'] = create_temporary_fifo(cacert.encode())
request_kwargs['json'] = { 'public_key': kwargs['public_key'] }
if kwargs.get('valid_principals'):
request_kwargs['json']['valid_principals'] = kwargs['valid_principals']
sess = requests.Session() sess = requests.Session()
sess.headers['Authorization'] = 'Bearer {}'.format(token) sess.headers['Authorization'] = 'Bearer {}'.format(token)
json = {
'public_key': kwargs['public_key']
}
if kwargs.get('valid_principals'):
json['valid_principals'] = kwargs['valid_principals']
# https://www.vaultproject.io/api/secret/ssh/index.html#sign-ssh-key # https://www.vaultproject.io/api/secret/ssh/index.html#sign-ssh-key
if cacert: request_url = '/'.join([url, secret_path, 'sign', role]).rstrip('/')
resp = sess.post( resp = sess.post(request_url, **request_kwargs)
'/'.join([url, secret_path, 'sign', role]).rstrip('/'),
json=json,
verify=create_temporary_fifo(cacert.encode()),
timeout=30
)
else:
resp = sess.post(
'/'.join([url, secret_path, 'sign', role]).rstrip('/'),
json=json,
timeout=30
)
resp.raise_for_status() resp.raise_for_status()
return resp.json()['data']['signed_key'] return resp.json()['data']['signed_key']