2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2015-04-01 02:28:46 +03:00
|
|
|
package command
|
|
|
|
|
|
|
|
import (
|
2018-03-09 22:32:28 +03:00
|
|
|
"flag"
|
2015-04-01 02:28:46 +03:00
|
|
|
"fmt"
|
2018-04-09 19:39:32 +03:00
|
|
|
"strconv"
|
2015-04-01 02:28:46 +03:00
|
|
|
"strings"
|
2017-09-05 07:02:24 +03:00
|
|
|
"time"
|
2015-08-31 21:27:49 +03:00
|
|
|
|
|
|
|
"github.com/hashicorp/vault/api"
|
2017-09-05 07:02:24 +03:00
|
|
|
"github.com/mitchellh/cli"
|
2017-08-25 01:23:40 +03:00
|
|
|
"github.com/posener/complete"
|
2015-04-01 02:28:46 +03:00
|
|
|
)
|
|
|
|
|
2021-04-08 19:43:39 +03:00
|
|
|
var (
|
|
|
|
_ cli.Command = (*SecretsEnableCommand)(nil)
|
|
|
|
_ cli.CommandAutocomplete = (*SecretsEnableCommand)(nil)
|
|
|
|
)
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
type SecretsEnableCommand struct {
|
2017-09-05 07:02:24 +03:00
|
|
|
*BaseCommand
|
|
|
|
|
2018-03-22 02:56:47 +03:00
|
|
|
flagDescription string
|
|
|
|
flagPath string
|
|
|
|
flagDefaultLeaseTTL time.Duration
|
|
|
|
flagMaxLeaseTTL time.Duration
|
|
|
|
flagAuditNonHMACRequestKeys []string
|
|
|
|
flagAuditNonHMACResponseKeys []string
|
|
|
|
flagListingVisibility string
|
|
|
|
flagPassthroughRequestHeaders []string
|
2019-02-06 00:02:15 +03:00
|
|
|
flagAllowedResponseHeaders []string
|
2018-03-22 02:56:47 +03:00
|
|
|
flagForceNoCache bool
|
|
|
|
flagPluginName string
|
2022-09-22 22:55:46 +03:00
|
|
|
flagPluginVersion string
|
2018-03-22 02:56:47 +03:00
|
|
|
flagOptions map[string]string
|
|
|
|
flagLocal bool
|
|
|
|
flagSealWrap bool
|
2019-10-17 20:33:00 +03:00
|
|
|
flagExternalEntropyAccess bool
|
2018-04-09 19:39:32 +03:00
|
|
|
flagVersion int
|
2021-12-10 20:08:28 +03:00
|
|
|
flagAllowedManagedKeys []string
|
2017-09-05 07:02:24 +03:00
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
func (c *SecretsEnableCommand) Synopsis() string {
|
|
|
|
return "Enable a secrets engine"
|
2017-09-05 07:02:24 +03:00
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
func (c *SecretsEnableCommand) Help() string {
|
2017-09-05 07:02:24 +03:00
|
|
|
helpText := `
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: vault secrets enable [options] TYPE
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
Enables a secrets engine. By default, secrets engines are enabled at the path
|
|
|
|
corresponding to their TYPE, but users can customize the path using the
|
|
|
|
-path option.
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
Once enabled, Vault will route all requests which begin with the path to the
|
|
|
|
secrets engine.
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
Enable the AWS secrets engine at aws/:
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
$ vault secrets enable aws
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
Enable the SSH secrets engine at ssh-prod/:
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
$ vault secrets enable -path=ssh-prod ssh
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
Enable the database secrets engine with an explicit maximum TTL of 30m:
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
$ vault secrets enable -max-lease-ttl=30m database
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
Enable a custom plugin (after it is registered in the plugin registry):
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
$ vault secrets enable -path=my-secrets -plugin-name=my-plugin plugin
|
2017-09-05 07:02:24 +03:00
|
|
|
|
2018-11-07 04:21:24 +03:00
|
|
|
OR (preferred way):
|
|
|
|
|
|
|
|
$ vault secrets enable -path=my-secrets my-plugin
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
For a full list of secrets engines and examples, please see the documentation.
|
2017-09-05 07:02:24 +03:00
|
|
|
|
|
|
|
` + c.Flags().Help()
|
|
|
|
|
|
|
|
return strings.TrimSpace(helpText)
|
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
func (c *SecretsEnableCommand) Flags() *FlagSets {
|
2017-09-05 07:02:24 +03:00
|
|
|
set := c.flagSet(FlagSetHTTP)
|
|
|
|
|
|
|
|
f := set.NewFlagSet("Command Options")
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "description",
|
|
|
|
Target: &c.flagDescription,
|
|
|
|
Completion: complete.PredictAnything,
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "Human-friendly description for the purpose of this engine.",
|
2017-09-05 07:02:24 +03:00
|
|
|
})
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "path",
|
|
|
|
Target: &c.flagPath,
|
|
|
|
Default: "", // The default is complex, so we have to manually document
|
|
|
|
Completion: complete.PredictAnything,
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "Place where the secrets engine will be accessible. This must be " +
|
|
|
|
"unique cross all secrets engines. This defaults to the \"type\" of the " +
|
|
|
|
"secrets engine.",
|
2017-09-05 07:02:24 +03:00
|
|
|
})
|
|
|
|
|
|
|
|
f.DurationVar(&DurationVar{
|
|
|
|
Name: "default-lease-ttl",
|
|
|
|
Target: &c.flagDefaultLeaseTTL,
|
|
|
|
Completion: complete.PredictAnything,
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "The default lease TTL for this secrets engine. If unspecified, " +
|
|
|
|
"this defaults to the Vault server's globally configured default lease " +
|
|
|
|
"TTL.",
|
2017-09-05 07:02:24 +03:00
|
|
|
})
|
|
|
|
|
|
|
|
f.DurationVar(&DurationVar{
|
|
|
|
Name: "max-lease-ttl",
|
|
|
|
Target: &c.flagMaxLeaseTTL,
|
|
|
|
Completion: complete.PredictAnything,
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "The maximum lease TTL for this secrets engine. If unspecified, " +
|
|
|
|
"this defaults to the Vault server's globally configured maximum lease " +
|
|
|
|
"TTL.",
|
2017-09-05 07:02:24 +03:00
|
|
|
})
|
|
|
|
|
2018-03-09 22:32:28 +03:00
|
|
|
f.StringSliceVar(&StringSliceVar{
|
|
|
|
Name: flagNameAuditNonHMACRequestKeys,
|
|
|
|
Target: &c.flagAuditNonHMACRequestKeys,
|
2022-03-14 21:11:49 +03:00
|
|
|
Usage: "Key that will not be HMAC'd by audit devices in the request data object. " +
|
|
|
|
"To specify multiple values, specify this flag multiple times.",
|
2018-03-09 22:32:28 +03:00
|
|
|
})
|
|
|
|
|
|
|
|
f.StringSliceVar(&StringSliceVar{
|
|
|
|
Name: flagNameAuditNonHMACResponseKeys,
|
|
|
|
Target: &c.flagAuditNonHMACResponseKeys,
|
2022-03-14 21:11:49 +03:00
|
|
|
Usage: "Key that will not be HMAC'd by audit devices in the response data object. " +
|
|
|
|
"To specify multiple values, specify this flag multiple times.",
|
2018-03-09 22:32:28 +03:00
|
|
|
})
|
|
|
|
|
2018-03-20 06:16:33 +03:00
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: flagNameListingVisibility,
|
|
|
|
Target: &c.flagListingVisibility,
|
|
|
|
Usage: "Determines the visibility of the mount in the UI-specific listing endpoint.",
|
|
|
|
})
|
|
|
|
|
2018-03-22 02:56:47 +03:00
|
|
|
f.StringSliceVar(&StringSliceVar{
|
|
|
|
Name: flagNamePassthroughRequestHeaders,
|
|
|
|
Target: &c.flagPassthroughRequestHeaders,
|
2022-03-14 21:11:49 +03:00
|
|
|
Usage: "Request header value that will be sent to the plugins. To specify multiple " +
|
|
|
|
"values, specify this flag multiple times.",
|
2019-02-06 00:02:15 +03:00
|
|
|
})
|
|
|
|
|
|
|
|
f.StringSliceVar(&StringSliceVar{
|
|
|
|
Name: flagNameAllowedResponseHeaders,
|
|
|
|
Target: &c.flagAllowedResponseHeaders,
|
2022-03-14 21:11:49 +03:00
|
|
|
Usage: "Response header value that plugins will be allowed to set. To specify multiple " +
|
|
|
|
"values, specify this flag multiple times.",
|
2018-03-22 02:56:47 +03:00
|
|
|
})
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "force-no-cache",
|
|
|
|
Target: &c.flagForceNoCache,
|
|
|
|
Default: false,
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "Force the secrets engine to disable caching. If unspecified, this " +
|
2017-09-05 07:02:24 +03:00
|
|
|
"defaults to the Vault server's globally configured cache settings. " +
|
|
|
|
"This does not affect caching of the underlying encrypted data storage.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "plugin-name",
|
|
|
|
Target: &c.flagPluginName,
|
2023-02-06 17:41:56 +03:00
|
|
|
Completion: c.PredictVaultPlugins(api.PluginTypeSecrets, api.PluginTypeDatabase),
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "Name of the secrets engine plugin. This plugin name must already " +
|
|
|
|
"exist in Vault's plugin catalog.",
|
2017-09-05 07:02:24 +03:00
|
|
|
})
|
|
|
|
|
2022-09-22 22:55:46 +03:00
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: flagNamePluginVersion,
|
|
|
|
Target: &c.flagPluginVersion,
|
|
|
|
Default: "",
|
|
|
|
Usage: "Select the semantic version of the plugin to enable.",
|
|
|
|
})
|
|
|
|
|
2018-03-21 22:04:27 +03:00
|
|
|
f.StringMapVar(&StringMapVar{
|
|
|
|
Name: "options",
|
|
|
|
Target: &c.flagOptions,
|
|
|
|
Completion: complete.PredictAnything,
|
2018-03-22 06:58:16 +03:00
|
|
|
Usage: "Key-value pair provided as key=value for the mount options. " +
|
|
|
|
"This can be specified multiple times.",
|
2018-03-21 22:04:27 +03:00
|
|
|
})
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "local",
|
|
|
|
Target: &c.flagLocal,
|
|
|
|
Default: false,
|
2017-09-08 05:01:31 +03:00
|
|
|
Usage: "Mark the secrets engine as local-only. Local engines are not " +
|
|
|
|
"replicated or removed by replication.",
|
2017-09-05 07:02:24 +03:00
|
|
|
})
|
|
|
|
|
2018-01-03 22:02:31 +03:00
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "seal-wrap",
|
|
|
|
Target: &c.flagSealWrap,
|
|
|
|
Default: false,
|
|
|
|
Usage: "Enable seal wrapping of critical values in the secrets engine.",
|
|
|
|
})
|
|
|
|
|
2019-10-17 20:33:00 +03:00
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "external-entropy-access",
|
|
|
|
Target: &c.flagExternalEntropyAccess,
|
|
|
|
Default: false,
|
|
|
|
Usage: "Enable secrets engine to access Vault's external entropy source.",
|
|
|
|
})
|
|
|
|
|
2018-04-09 19:39:32 +03:00
|
|
|
f.IntVar(&IntVar{
|
|
|
|
Name: "version",
|
|
|
|
Target: &c.flagVersion,
|
|
|
|
Default: 0,
|
|
|
|
Usage: "Select the version of the engine to run. Not supported by all engines.",
|
|
|
|
})
|
|
|
|
|
2021-12-10 20:08:28 +03:00
|
|
|
f.StringSliceVar(&StringSliceVar{
|
|
|
|
Name: flagNameAllowedManagedKeys,
|
|
|
|
Target: &c.flagAllowedManagedKeys,
|
|
|
|
Usage: "Managed key name(s) that the mount in question is allowed to access. " +
|
2022-02-08 22:01:19 +03:00
|
|
|
"Note that multiple keys may be specified by providing this option multiple times, " +
|
2021-12-10 20:08:28 +03:00
|
|
|
"each time with 1 key.",
|
|
|
|
})
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
return set
|
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
func (c *SecretsEnableCommand) AutocompleteArgs() complete.Predictor {
|
2017-09-05 07:02:24 +03:00
|
|
|
return c.PredictVaultAvailableMounts()
|
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
func (c *SecretsEnableCommand) AutocompleteFlags() complete.Flags {
|
2017-09-05 07:02:24 +03:00
|
|
|
return c.Flags().Completions()
|
2015-04-01 02:28:46 +03:00
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
func (c *SecretsEnableCommand) Run(args []string) int {
|
2017-09-05 07:02:24 +03:00
|
|
|
f := c.Flags()
|
|
|
|
|
|
|
|
if err := f.Parse(args); err != nil {
|
|
|
|
c.UI.Error(err.Error())
|
2015-04-01 02:28:46 +03:00
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
args = f.Args()
|
2017-09-08 05:01:31 +03:00
|
|
|
switch {
|
|
|
|
case len(args) < 1:
|
|
|
|
c.UI.Error(fmt.Sprintf("Not enough arguments (expected 1, got %d)", len(args)))
|
2017-09-05 07:02:24 +03:00
|
|
|
return 1
|
2017-09-08 05:01:31 +03:00
|
|
|
case len(args) > 1:
|
2017-09-05 07:02:24 +03:00
|
|
|
c.UI.Error(fmt.Sprintf("Too many arguments (expected 1, got %d)", len(args)))
|
2015-04-01 02:28:46 +03:00
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
client, err := c.Client()
|
|
|
|
if err != nil {
|
|
|
|
c.UI.Error(err.Error())
|
|
|
|
return 2
|
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
// Get the engine type type (first arg)
|
|
|
|
engineType := strings.TrimSpace(args[0])
|
2018-11-07 04:21:24 +03:00
|
|
|
if engineType == "plugin" {
|
|
|
|
engineType = c.flagPluginName
|
|
|
|
}
|
2015-04-01 02:28:46 +03:00
|
|
|
|
|
|
|
// If no path is specified, we default the path to the backend type
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
// or use the plugin name if it's a plugin backend
|
2017-09-05 07:02:24 +03:00
|
|
|
mountPath := c.flagPath
|
|
|
|
if mountPath == "" {
|
2017-09-08 05:01:31 +03:00
|
|
|
if engineType == "plugin" {
|
2017-09-05 07:02:24 +03:00
|
|
|
mountPath = c.flagPluginName
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
} else {
|
2017-09-08 05:01:31 +03:00
|
|
|
mountPath = engineType
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
}
|
2015-04-01 02:28:46 +03:00
|
|
|
}
|
|
|
|
|
2018-04-09 19:39:32 +03:00
|
|
|
if c.flagVersion > 0 {
|
|
|
|
if c.flagOptions == nil {
|
|
|
|
c.flagOptions = make(map[string]string)
|
|
|
|
}
|
|
|
|
c.flagOptions["version"] = strconv.Itoa(c.flagVersion)
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
// Append a trailing slash to indicate it's a path in output
|
|
|
|
mountPath = ensureTrailingSlash(mountPath)
|
2015-04-01 02:28:46 +03:00
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
// Build mount input
|
|
|
|
mountInput := &api.MountInput{
|
2019-10-17 20:33:00 +03:00
|
|
|
Type: engineType,
|
|
|
|
Description: c.flagDescription,
|
|
|
|
Local: c.flagLocal,
|
|
|
|
SealWrap: c.flagSealWrap,
|
|
|
|
ExternalEntropyAccess: c.flagExternalEntropyAccess,
|
2015-09-25 16:46:20 +03:00
|
|
|
Config: api.MountConfigInput{
|
2017-09-05 07:02:24 +03:00
|
|
|
DefaultLeaseTTL: c.flagDefaultLeaseTTL.String(),
|
|
|
|
MaxLeaseTTL: c.flagMaxLeaseTTL.String(),
|
|
|
|
ForceNoCache: c.flagForceNoCache,
|
2015-09-25 16:46:20 +03:00
|
|
|
},
|
2018-03-21 22:04:27 +03:00
|
|
|
Options: c.flagOptions,
|
2015-08-31 21:27:49 +03:00
|
|
|
}
|
|
|
|
|
2018-03-09 22:32:28 +03:00
|
|
|
// Set these values only if they are provided in the CLI
|
|
|
|
f.Visit(func(fl *flag.Flag) {
|
|
|
|
if fl.Name == flagNameAuditNonHMACRequestKeys {
|
|
|
|
mountInput.Config.AuditNonHMACRequestKeys = c.flagAuditNonHMACRequestKeys
|
|
|
|
}
|
|
|
|
|
|
|
|
if fl.Name == flagNameAuditNonHMACResponseKeys {
|
2018-03-19 16:56:57 +03:00
|
|
|
mountInput.Config.AuditNonHMACResponseKeys = c.flagAuditNonHMACResponseKeys
|
2018-03-09 22:32:28 +03:00
|
|
|
}
|
2018-03-20 06:16:33 +03:00
|
|
|
|
|
|
|
if fl.Name == flagNameListingVisibility {
|
|
|
|
mountInput.Config.ListingVisibility = c.flagListingVisibility
|
|
|
|
}
|
2018-03-22 02:56:47 +03:00
|
|
|
|
|
|
|
if fl.Name == flagNamePassthroughRequestHeaders {
|
|
|
|
mountInput.Config.PassthroughRequestHeaders = c.flagPassthroughRequestHeaders
|
|
|
|
}
|
2019-02-06 00:02:15 +03:00
|
|
|
|
|
|
|
if fl.Name == flagNameAllowedResponseHeaders {
|
|
|
|
mountInput.Config.AllowedResponseHeaders = c.flagAllowedResponseHeaders
|
|
|
|
}
|
2021-12-10 20:08:28 +03:00
|
|
|
|
|
|
|
if fl.Name == flagNameAllowedManagedKeys {
|
|
|
|
mountInput.Config.AllowedManagedKeys = c.flagAllowedManagedKeys
|
|
|
|
}
|
2022-09-22 22:55:46 +03:00
|
|
|
|
|
|
|
if fl.Name == flagNamePluginVersion {
|
|
|
|
mountInput.Config.PluginVersion = c.flagPluginVersion
|
|
|
|
}
|
2018-03-09 22:32:28 +03:00
|
|
|
})
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
if err := client.Sys().Mount(mountPath, mountInput); err != nil {
|
2017-09-08 05:01:31 +03:00
|
|
|
c.UI.Error(fmt.Sprintf("Error enabling: %s", err))
|
2015-04-01 02:28:46 +03:00
|
|
|
return 2
|
|
|
|
}
|
|
|
|
|
2017-09-08 05:01:31 +03:00
|
|
|
thing := engineType + " secrets engine"
|
|
|
|
if engineType == "plugin" {
|
|
|
|
thing = c.flagPluginName + " plugin"
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
}
|
2022-10-06 14:54:27 +03:00
|
|
|
if c.flagPluginVersion != "" {
|
|
|
|
thing += " version " + c.flagPluginVersion
|
|
|
|
}
|
2017-09-08 05:01:31 +03:00
|
|
|
c.UI.Output(fmt.Sprintf("Success! Enabled the %s at: %s", thing, mountPath))
|
2015-04-01 02:28:46 +03:00
|
|
|
return 0
|
|
|
|
}
|