2015-04-01 02:28:46 +03:00
|
|
|
package command
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"strings"
|
2017-09-05 07:02:24 +03:00
|
|
|
"time"
|
2015-08-31 21:27:49 +03:00
|
|
|
|
|
|
|
"github.com/hashicorp/vault/api"
|
2017-09-05 07:02:24 +03:00
|
|
|
"github.com/mitchellh/cli"
|
2017-08-25 01:23:40 +03:00
|
|
|
"github.com/posener/complete"
|
2015-04-01 02:28:46 +03:00
|
|
|
)
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
// Ensure we are implementing the right interfaces.
|
|
|
|
var _ cli.Command = (*MountCommand)(nil)
|
|
|
|
var _ cli.CommandAutocomplete = (*MountCommand)(nil)
|
|
|
|
|
2015-04-01 02:28:46 +03:00
|
|
|
// MountCommand is a Command that mounts a new mount.
|
|
|
|
type MountCommand struct {
|
2017-09-05 07:02:24 +03:00
|
|
|
*BaseCommand
|
|
|
|
|
|
|
|
flagDescription string
|
|
|
|
flagPath string
|
|
|
|
flagDefaultLeaseTTL time.Duration
|
|
|
|
flagMaxLeaseTTL time.Duration
|
|
|
|
flagForceNoCache bool
|
|
|
|
flagPluginName string
|
|
|
|
flagLocal bool
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *MountCommand) Synopsis() string {
|
|
|
|
return "Mounts a secret backend at a path"
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *MountCommand) Help() string {
|
|
|
|
helpText := `
|
|
|
|
Usage: vault mount [options] TYPE
|
|
|
|
|
|
|
|
Mount a secret backend at a particular path. By default, secret backends are
|
|
|
|
mounted at the path corresponding to their "type", but users can customize
|
|
|
|
the mount point using the -path option.
|
|
|
|
|
|
|
|
Once mounted at a path, Vault will route all requests which begin with the
|
|
|
|
path to the secret backend.
|
|
|
|
|
|
|
|
Mount the AWS backend at aws/:
|
|
|
|
|
|
|
|
$ vault mount aws
|
|
|
|
|
|
|
|
Mount the SSH backend at ssh-prod/:
|
|
|
|
|
|
|
|
$ vault mount -path=ssh-prod ssh
|
|
|
|
|
|
|
|
Mount the database backend with an explicit maximum TTL of 30m:
|
|
|
|
|
|
|
|
$ vault mount -max-lease-ttl=30m database
|
|
|
|
|
|
|
|
Mount a custom plugin (after it is registered in the plugin registry):
|
|
|
|
|
|
|
|
$ vault mount -path=my-secrets -plugin-name=my-custom-plugin plugin
|
|
|
|
|
|
|
|
For a full list of secret backends and examples, please see the documentation.
|
|
|
|
|
|
|
|
` + c.Flags().Help()
|
|
|
|
|
|
|
|
return strings.TrimSpace(helpText)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *MountCommand) Flags() *FlagSets {
|
|
|
|
set := c.flagSet(FlagSetHTTP)
|
|
|
|
|
|
|
|
f := set.NewFlagSet("Command Options")
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "description",
|
|
|
|
Target: &c.flagDescription,
|
|
|
|
Completion: complete.PredictAnything,
|
|
|
|
Usage: "Human-friendly description for the purpose of this mount.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "path",
|
|
|
|
Target: &c.flagPath,
|
|
|
|
Default: "", // The default is complex, so we have to manually document
|
|
|
|
Completion: complete.PredictAnything,
|
|
|
|
Usage: "Place where the mount will be accessible. This must be " +
|
|
|
|
"unique across all mounts. This defaults to the \"type\" of the mount.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.DurationVar(&DurationVar{
|
|
|
|
Name: "default-lease-ttl",
|
|
|
|
Target: &c.flagDefaultLeaseTTL,
|
|
|
|
Completion: complete.PredictAnything,
|
|
|
|
Usage: "The default lease TTL for this backend. If unspecified, this " +
|
|
|
|
"defaults to the Vault server's globally configured default lease TTL.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.DurationVar(&DurationVar{
|
|
|
|
Name: "max-lease-ttl",
|
|
|
|
Target: &c.flagMaxLeaseTTL,
|
|
|
|
Completion: complete.PredictAnything,
|
|
|
|
Usage: "The maximum lease TTL for this backend. If unspecified, this " +
|
|
|
|
"defaults to the Vault server's globally configured maximum lease TTL.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "force-no-cache",
|
|
|
|
Target: &c.flagForceNoCache,
|
|
|
|
Default: false,
|
|
|
|
Usage: "Force the backend to disable caching. If unspecified, this " +
|
|
|
|
"defaults to the Vault server's globally configured cache settings. " +
|
|
|
|
"This does not affect caching of the underlying encrypted data storage.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.StringVar(&StringVar{
|
|
|
|
Name: "plugin-name",
|
|
|
|
Target: &c.flagPluginName,
|
|
|
|
Completion: complete.PredictAnything,
|
|
|
|
Usage: "Name of the plugin to mount. This plugin name must already exist " +
|
|
|
|
"in the Vault server's plugin catalog.",
|
|
|
|
})
|
|
|
|
|
|
|
|
f.BoolVar(&BoolVar{
|
|
|
|
Name: "local",
|
|
|
|
Target: &c.flagLocal,
|
|
|
|
Default: false,
|
|
|
|
Usage: "Mark the mount as a local-only mount. Local mounts are not " +
|
|
|
|
"replicated nor removed by replication.",
|
|
|
|
})
|
|
|
|
|
|
|
|
return set
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *MountCommand) AutocompleteArgs() complete.Predictor {
|
|
|
|
return c.PredictVaultAvailableMounts()
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *MountCommand) AutocompleteFlags() complete.Flags {
|
|
|
|
return c.Flags().Completions()
|
2015-04-01 02:28:46 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
func (c *MountCommand) Run(args []string) int {
|
2017-09-05 07:02:24 +03:00
|
|
|
f := c.Flags()
|
|
|
|
|
|
|
|
if err := f.Parse(args); err != nil {
|
|
|
|
c.UI.Error(err.Error())
|
2015-04-01 02:28:46 +03:00
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
args = f.Args()
|
|
|
|
switch len(args) {
|
|
|
|
case 0:
|
|
|
|
c.UI.Error("Missing TYPE!")
|
|
|
|
return 1
|
|
|
|
case 1:
|
|
|
|
// OK
|
|
|
|
default:
|
|
|
|
c.UI.Error(fmt.Sprintf("Too many arguments (expected 1, got %d)", len(args)))
|
2015-04-01 02:28:46 +03:00
|
|
|
return 1
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
client, err := c.Client()
|
|
|
|
if err != nil {
|
|
|
|
c.UI.Error(err.Error())
|
|
|
|
return 2
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the mount type (first arg)
|
|
|
|
mountType := strings.TrimSpace(args[0])
|
2015-04-01 02:28:46 +03:00
|
|
|
|
|
|
|
// If no path is specified, we default the path to the backend type
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
// or use the plugin name if it's a plugin backend
|
2017-09-05 07:02:24 +03:00
|
|
|
mountPath := c.flagPath
|
|
|
|
if mountPath == "" {
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
if mountType == "plugin" {
|
2017-09-05 07:02:24 +03:00
|
|
|
mountPath = c.flagPluginName
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
} else {
|
2017-09-05 07:02:24 +03:00
|
|
|
mountPath = mountType
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
}
|
2015-04-01 02:28:46 +03:00
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
// Append a trailing slash to indicate it's a path in output
|
|
|
|
mountPath = ensureTrailingSlash(mountPath)
|
2015-04-01 02:28:46 +03:00
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
// Build mount input
|
|
|
|
mountInput := &api.MountInput{
|
2015-08-31 21:27:49 +03:00
|
|
|
Type: mountType,
|
2017-09-05 07:02:24 +03:00
|
|
|
Description: c.flagDescription,
|
|
|
|
Local: c.flagLocal,
|
2015-09-25 16:46:20 +03:00
|
|
|
Config: api.MountConfigInput{
|
2017-09-05 07:02:24 +03:00
|
|
|
DefaultLeaseTTL: c.flagDefaultLeaseTTL.String(),
|
|
|
|
MaxLeaseTTL: c.flagMaxLeaseTTL.String(),
|
|
|
|
ForceNoCache: c.flagForceNoCache,
|
|
|
|
PluginName: c.flagPluginName,
|
2015-09-25 16:46:20 +03:00
|
|
|
},
|
2015-08-31 21:27:49 +03:00
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
if err := client.Sys().Mount(mountPath, mountInput); err != nil {
|
|
|
|
c.UI.Error(fmt.Sprintf("Error mounting: %s", err))
|
2015-04-01 02:28:46 +03:00
|
|
|
return 2
|
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
mountThing := mountType + " secret backend"
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
if mountType == "plugin" {
|
2017-09-05 07:02:24 +03:00
|
|
|
mountThing = c.flagPluginName + " plugin"
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 20:28:40 +03:00
|
|
|
}
|
|
|
|
|
2017-09-05 07:02:24 +03:00
|
|
|
c.UI.Output(fmt.Sprintf("Success! Mounted the %s at: %s", mountThing, mountPath))
|
2015-04-01 02:28:46 +03:00
|
|
|
return 0
|
|
|
|
}
|