echo: support secrets APIecho/v0.9.0

3 files changed, 53 insertions, 21 deletions

diff --git a/echo/go.mod b/echo/go.mod
index d62094d..0b1ed59 100644
--- a/echo/go.mod
+++ b/echo/go.mod
@@ -5,14 +5,16 @@ go 1.18
 replace code.crute.us/mcrute/golib => ../
 
 require (
-        code.crute.us/mcrute/golib v0.3.6
+        code.crute.us/mcrute/golib v0.4.0
         code.crute.us/mcrute/golib/clients/netbox v0.1.0
+        code.crute.us/mcrute/golib/secrets v0.1.0
         code.crute.us/mcrute/golib/vault v0.2.4
         github.com/elnormous/contenttype v1.0.0
         github.com/labstack/echo/v4 v4.6.1
         github.com/labstack/gommon v0.3.1
         github.com/prometheus/client_golang v1.11.0
         github.com/stretchr/testify v1.7.0
+        gopkg.in/square/go-jose.v2 v2.5.1
 )
 
 require (
@@ -35,16 +37,16 @@ require (
         github.com/hashicorp/go-retryablehttp v0.6.6 // indirect
         github.com/hashicorp/go-rootcerts v1.0.2 // indirect
         github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 // indirect
-        github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 // indirect
-        github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 // indirect
+        github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
+        github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
         github.com/hashicorp/go-sockaddr v1.0.2 // indirect
         github.com/hashicorp/go-uuid v1.0.2 // indirect
         github.com/hashicorp/go-version v1.2.0 // indirect
         github.com/hashicorp/golang-lru v0.5.4 // indirect
         github.com/hashicorp/hcl v1.0.0 // indirect
-        github.com/hashicorp/vault/api v1.5.0 // indirect
-        github.com/hashicorp/vault/api/auth/approle v0.1.1 // indirect
-        github.com/hashicorp/vault/sdk v0.4.1 // indirect
+        github.com/hashicorp/vault/api v1.8.0 // indirect
+        github.com/hashicorp/vault/api/auth/approle v0.3.0 // indirect
+        github.com/hashicorp/vault/sdk v0.6.0 // indirect
         github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb // indirect
         github.com/mattn/go-colorable v0.1.11 // indirect
         github.com/mattn/go-isatty v0.0.14 // indirect
@@ -52,7 +54,7 @@ require (
         github.com/mitchellh/copystructure v1.0.0 // indirect
         github.com/mitchellh/go-homedir v1.1.0 // indirect
         github.com/mitchellh/go-testing-interface v1.0.0 // indirect
-        github.com/mitchellh/mapstructure v1.4.2 // indirect
+        github.com/mitchellh/mapstructure v1.5.0 // indirect
         github.com/mitchellh/reflectwalk v1.0.0 // indirect
         github.com/oklog/run v1.0.0 // indirect
         github.com/pierrec/lz4 v2.5.2+incompatible // indirect
@@ -72,6 +74,5 @@ require (
         google.golang.org/genproto v0.0.0-20200825200019-8632dd797987 // indirect
         google.golang.org/grpc v1.41.0 // indirect
         google.golang.org/protobuf v1.26.0 // indirect
-        gopkg.in/square/go-jose.v2 v2.5.1 // indirect
         gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )
diff --git a/echo/go.sum b/echo/go.sum
index f17007f..63e83e2 100644
--- a/echo/go.sum
+++ b/echo/go.sum
@@ -32,6 +32,8 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 code.crute.us/mcrute/golib/clients/netbox v0.1.0 h1:7ae676WtINm2oSLoUw1ERIZ2ndLD5gi7cvv2iZZd1XI=
 code.crute.us/mcrute/golib/clients/netbox v0.1.0/go.mod h1:csRsnmAwenAz8Pbo7CcQTWzn6uaXadELIdB81JxsacY=
+code.crute.us/mcrute/golib/secrets v0.1.0 h1:22W0rLhE5jvIQlsUDQt1soGBEoBn4rl4a883f1yBybI=
+code.crute.us/mcrute/golib/secrets v0.1.0/go.mod h1:O1ypm8JirXI4SekwNCHwQbfsieDQJxeRNwZYoot6fvw=
 code.crute.us/mcrute/golib/vault v0.2.4 h1:lNc1hq26e/UAGBqxQlZiFffOXZSNEcEkKUzU3oRJ8Eg=
 code.crute.us/mcrute/golib/vault v0.2.4/go.mod h1:23C5g8O0zaeFfo7v6sCO0RKgnHIiHM9ku+ASOWHJD9k=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -177,7 +179,7 @@ github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-kms-wrapping/entropy v0.1.0/go.mod h1:d1g9WGtAunDNpek8jUIEJnBlbgKS1N2Q61QkHiZyR1g=
+github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0/go.mod h1:xvb32K2keAc+R8DSFG2IwDcydK9DBQE+fGA5fsw6hSk=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
@@ -191,11 +193,13 @@ github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR3
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 h1:cCRo8gK7oq6A2L6LICkUZ+/a5rLiRXFMf1Qd4xSwxTc=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 h1:78ki3QBevHwYrVxnyVeaEz+7WtifHhauYF23es/0KlI=
 github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
 github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=
 github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
 github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
@@ -210,14 +214,12 @@ github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+l
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.3.0/go.mod h1:EabNQLI0VWbWoGlA+oBLC8PXmR9D60aUVgQGvangFWQ=
-github.com/hashicorp/vault/api v1.5.0 h1:Bp6yc2bn7CWkOrVIzFT/Qurzx528bdavF3nz590eu28=
-github.com/hashicorp/vault/api v1.5.0/go.mod h1:LkMdrZnWNrFaQyYYazWVn7KshilfDidgVBq6YiTq/bM=
-github.com/hashicorp/vault/api/auth/approle v0.1.1 h1:R5yA+xcNvw1ix6bDuWOaLOq2L4L77zDCVsethNw97xQ=
-github.com/hashicorp/vault/api/auth/approle v0.1.1/go.mod h1:mHOLgh//xDx4dpqXoq6tS8Ob0FoCFWLU2ibJ26Lfmag=
-github.com/hashicorp/vault/sdk v0.3.0/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
-github.com/hashicorp/vault/sdk v0.4.1 h1:3SaHOJY687jY1fnB61PtL0cOkKItphrbLmux7T92HBo=
-github.com/hashicorp/vault/sdk v0.4.1/go.mod h1:aZ3fNuL5VNydQk8GcLJ2TV8YCRVvyaakYkhZRoVuhj0=
+github.com/hashicorp/vault/api v1.8.0 h1:7765sW1XBt+qf4XKIYE4ebY9qc/yi9V2/egzGSUNMZU=
+github.com/hashicorp/vault/api v1.8.0/go.mod h1:uJrw6D3y9Rv7hhmS17JQC50jbPDAZdjZoTtrCCxxs7E=
+github.com/hashicorp/vault/api/auth/approle v0.3.0 h1:Ib0oCNXsCq/QZhPYtXPzJEbGS5WR/KoZf8c84QoFdkU=
+github.com/hashicorp/vault/api/auth/approle v0.3.0/go.mod h1:hm51TbjzUkPO0Y17wkrpwOpvyyMRpXJNueTHiG04t3k=
+github.com/hashicorp/vault/sdk v0.6.0 h1:6Z+In5DXHiUfZvIZdMx7e2loL1PPyDjA4bVh9ZTIAhs=
+github.com/hashicorp/vault/sdk v0.6.0/go.mod h1:+DRpzoXIdMvKc88R4qxr+edwy/RvH5QK8itmxLiDHLc=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb h1:b5rjCoWHc7eqmAS4/qyk21ZsHyb6Mxv/jykxvNTkU4M=
 github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
@@ -276,8 +278,8 @@ github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdI
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.4.2 h1:6h7AQ0yhTcIsmFmnAwQls75jp2Gzs4iB8W7pjMO+rqo=
-github.com/mitchellh/mapstructure v1.4.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
diff --git a/echo/vault.go b/echo/vault.go
index 40096fe..13a7407 100644
--- a/echo/vault.go
+++ b/echo/vault.go
@@ -3,11 +3,16 @@ package echo
 import (
         "context"
 
+        "code.crute.us/mcrute/golib/secrets"
         "code.crute.us/mcrute/golib/service"
         "code.crute.us/mcrute/golib/vault"
         "github.com/labstack/echo/v4"
 )
 
+// MakeVaultClient creates a VaultClient with default configuration and
+// adds it to the service runner with a logger.
+//
+// Deprecated: Use MakeVaultSecretsClient and AttachSecretsClient instead.
 func MakeVaultClient(ctx context.Context, runner *service.AppRunner, log echo.Logger) (vault.VaultClient, error) {
         certRenewal := make(chan *vault.Renewal, 10)
 
@@ -25,3 +30,27 @@ func MakeVaultClient(ctx context.Context, runner *service.AppRunner, log echo.Lo
 
         return c, nil
 }
+
+// MakeVaultSecretsClient creates a secrets.ClientManager connected to
+// Vault and authenticates it.
+func MakeVaultSecretsClient(ctx context.Context) (secrets.ClientManager, error) {
+        vc, err := secrets.NewVaultClient(&secrets.VaultClientConfig{})
+        if err != nil {
+                return nil, err
+        }
+
+        if err = vc.Authenticate(ctx); err != nil {
+                return nil, err
+        }
+
+        return vc, nil
+}
+
+// AttachSecretsClient attaches a secrets client to a runner and
+// configures logger and failure handler to run asynchronously. The
+// failure handler will terminate the application if a critical
+// credential renewal failure occurs.
+func AttachSecretsClient(c secrets.ClientManager, cancel func(), run *service.AppRunner, log echo.Logger) {
+        run.AddBackgroundJob(c.Run)
+        run.AddBackgroundJob(secrets.MakeRenewalLogger(c, log, cancel))
+}