1 files changed, 330 insertions, 0 deletions

diff --git a/vault/client.go b/vault/client.go
new file mode 100644
index 0000000..2f645d4
--- /dev/null
+++ b/vault/client.go
@@ -0,0 +1,330 @@
+package vault
+
+import (
+        "context"
+        "fmt"
+        "os"
+        "path"
+        "sync"
+        "time"
+
+        "github.com/hashicorp/vault/api"
+        "github.com/hashicorp/vault/api/auth/approle"
+        "github.com/mitchellh/mapstructure"
+)
+
+type VaultClient interface {
+        LoginApprole(c context.Context, roleId string, secretId string) error
+
+        DbStaticCredential(c context.Context, suffix string) (*VaultUsernamePassword, error)
+        DbCredential(c context.Context, suffix string) (*VaultUsernamePassword, error)
+
+        KV(c context.Context, suffix string, out interface{}) (*VaultSecret, error)
+        KVApiKey(c context.Context, suffix string) (*VaultApiKey, error)
+        KVCredential(c context.Context, suffix string) (*VaultUsernamePassword, error)
+
+        Destroy(HasSecret)
+        Run(ctx context.Context, wg *sync.WaitGroup) error
+}
+
+type HasSecret interface {
+        VaultSecret() *VaultSecret
+}
+
+// VaultSecret is an opaque reference to a secret from Vault. It is
+// meant to be given to the Destroy function to check-in and destroy
+// unneeded credentials. Everything returned from the client has a
+// VaultSecret and implements HasSecret for that purpose. If the
+// credential is not renewable then destroying it is a no-op.
+type VaultSecret struct {
+        s *api.Secret
+        n string
+}
+
+func (s *VaultSecret) VaultSecret() *VaultSecret {
+        return s
+}
+
+type VaultApiKey struct {
+        Key string `json:"key"`
+        s   *VaultSecret
+}
+
+func (k *VaultApiKey) VaultSecret() *VaultSecret {
+        return k.s
+}
+
+type VaultUsernamePassword struct {
+        Username string `json:"username"`
+        Password string `json:"password"`
+        s        *VaultSecret
+}
+
+func (k *VaultUsernamePassword) VaultSecret() *VaultSecret {
+        return k.s
+}
+
+type Renewal struct {
+        RenewedAt time.Time
+        Name      string
+}
+
+type vaultClient struct {
+        sync.Mutex
+        c           *api.Client
+        lc          *api.Logical
+        wg          *sync.WaitGroup
+        watcherDone chan error
+        watchers    map[string]*api.LifetimeWatcher
+        renewInfo   chan *Renewal
+}
+
+// NewApproleClientEnv is a convenience function to create a new
+// VaultClient based on the environment, start it, and login using
+// Approle authentication.
+//
+// The following environment variables are used and must be present:
+//
+//   VAULT_ADDR - URL to Vault server (of form https://host:port/)
+//   VAULT_ROLE_ID - Role ID used for Approle authentication
+//   VAULT_SECRET_ID - Secret ID used for Approle authentication
+//
+func NewApproleClientEnv(ctx context.Context, wg *sync.WaitGroup, renewInfo chan *Renewal) (VaultClient, error) {
+        vaultHost := os.Getenv("VAULT_ADDR")
+        if vaultHost == "" {
+                return nil, fmt.Errorf("NewApproleClientEnv: VAULT_ADDR is not set in environment")
+        }
+
+        roleId := os.Getenv("VAULT_ROLE_ID")
+        if roleId == "" {
+                return nil, fmt.Errorf("NewApproleClientEnv: VAULT_ROLE_ID is not set in environment")
+        }
+
+        secretId := os.Getenv("VAULT_SECRET_ID")
+        if secretId == "" {
+                return nil, fmt.Errorf("NewApproleClientEnv: VAULT_SECRET_ID is not set in environment")
+        }
+
+        vc, err := NewVaultClient(vaultHost, renewInfo)
+        if err != nil {
+                return nil, fmt.Errorf("NewApproleClientEnv: error creating client %w", err)
+        }
+
+        go vc.Run(ctx, wg)
+
+        if err = vc.LoginApprole(ctx, roleId, secretId); err != nil {
+                return nil, fmt.Errorf("NewApproleClientEnv: error logging in to vault %w", err)
+        }
+
+        return vc, nil
+}
+
+func NewVaultClient(host string, renewInfo chan *Renewal) (VaultClient, error) {
+        cfg := api.DefaultConfig()
+        cfg.Address = host
+
+        c, err := api.NewClient(cfg)
+        if err != nil {
+                return nil, err
+        }
+
+        return &vaultClient{
+                c:           c,
+                lc:          c.Logical(),
+                renewInfo:   renewInfo,
+                watcherDone: make(chan error, 10),
+                watchers:    map[string]*api.LifetimeWatcher{},
+        }, nil
+}
+
+func (c *vaultClient) watchWatcher(w *api.LifetimeWatcher, name string) {
+        c.wg.Add(1)
+        defer c.wg.Done()
+
+        for {
+                select {
+                case err := <-w.DoneCh():
+                        if err != nil {
+                                c.watcherDone <- err
+                        }
+                        return
+                case r := <-w.RenewCh():
+                        // Report this so consumers can do their own reporting, if not
+                        // provided we just read this to drain the chan and throw it away.
+                        if c.renewInfo != nil {
+                                c.renewInfo <- &Renewal{
+                                        Name:      name,
+                                        RenewedAt: r.RenewedAt,
+                                }
+                        }
+                }
+        }
+}
+
+func (c *vaultClient) addWatcher(name string, s *api.Secret) error {
+        w, err := c.c.NewLifetimeWatcher(&api.LifetimeWatcherInput{
+                Secret: s,
+        })
+        if err != nil {
+                return err
+        }
+
+        c.Lock()
+        c.watchers[name] = w
+        c.Unlock()
+
+        go w.Start()
+        go c.watchWatcher(w, name)
+
+        return nil
+}
+
+func (c *vaultClient) read(ctx context.Context, prefix, suffix string) (*api.Secret, string, error) {
+        key := path.Join(prefix, suffix)
+
+        s, err := c.lc.ReadWithContext(ctx, key)
+        if err != nil {
+                return nil, "", err
+        }
+
+        if s.Renewable {
+                return s, key, c.addWatcher(key, s)
+        }
+
+        return s, key, nil
+}
+
+func (c *vaultClient) stop() {
+        c.Lock()
+        defer c.Unlock()
+
+        for _, w := range c.watchers {
+                w.Stop()
+        }
+}
+
+func (c *vaultClient) Run(ctx context.Context, wg *sync.WaitGroup) error {
+        c.Lock()
+        c.wg = wg
+        c.Unlock()
+
+        c.wg.Add(1)
+        defer c.wg.Done()
+
+        for {
+                select {
+                case <-ctx.Done():
+                        c.stop()
+                        return nil
+                case err := <-c.watcherDone:
+                        c.stop()
+                        return err
+                }
+        }
+}
+
+func (c *vaultClient) Destroy(s HasSecret) {
+        vs := s.VaultSecret()
+        if vs == nil || vs.n == "" || vs.s == nil {
+                return
+        }
+
+        c.Lock()
+        defer c.Unlock()
+
+        if w, ok := c.watchers[vs.n]; ok {
+                delete(c.watchers, vs.n)
+                w.Stop()
+        }
+
+        // TODO: Delete dynamic credentials like DB sessions from Vault
+
+        // Drop references to the secret so that even if the client holds on to
+        // it we free the RAM.
+        vs.s = nil
+        vs.n = ""
+}
+
+func (c *vaultClient) LoginApprole(ctx context.Context, roleId string, secretId string) error {
+        a, err := approle.NewAppRoleAuth(roleId, &approle.SecretID{FromString: secretId})
+        if err != nil {
+                return err
+        }
+
+        s, err := c.c.Auth().Login(ctx, a)
+        if err != nil {
+                return err
+        }
+
+        // This credential can not be destroyed like the others
+        return c.addWatcher("login", s)
+}
+
+func (c *vaultClient) DbStaticCredential(ctx context.Context, suffix string) (*VaultUsernamePassword, error) {
+        s, k, err := c.read(ctx, "database/static-creds", suffix)
+        if err != nil {
+                return nil, err
+        }
+
+        var d VaultUsernamePassword
+        if err = mapstructure.Decode(s.Data, &d); err != nil {
+                return nil, err
+        }
+
+        d.s = &VaultSecret{s: s, n: k}
+
+        return &d, nil
+}
+
+func (c *vaultClient) DbCredential(ctx context.Context, suffix string) (*VaultUsernamePassword, error) {
+        s, k, err := c.read(ctx, "database/creds", suffix)
+        if err != nil {
+                return nil, err
+        }
+
+        var d VaultUsernamePassword
+        if err = mapstructure.Decode(s.Data, &d); err != nil {
+                return nil, err
+        }
+
+        d.s = &VaultSecret{s: s, n: k}
+
+        return &d, nil
+}
+
+func (c *vaultClient) KV(ctx context.Context, suffix string, out interface{}) (*VaultSecret, error) {
+        s, k, err := c.read(ctx, "kv/data", suffix)
+        if err != nil {
+                return nil, err
+        }
+
+        if err = mapstructure.Decode(s.Data["data"], out); err != nil {
+                return nil, err
+        }
+
+        return &VaultSecret{s: s, n: k}, nil
+}
+
+func (c *vaultClient) KVApiKey(ctx context.Context, suffix string) (*VaultApiKey, error) {
+        var ak VaultApiKey
+        s, err := c.KV(ctx, suffix, &ak)
+        if err != nil {
+                return nil, err
+        }
+
+        ak.s = s
+
+        return &ak, nil
+}
+
+func (c *vaultClient) KVCredential(ctx context.Context, suffix string) (*VaultUsernamePassword, error) {
+        var ak VaultUsernamePassword
+        s, err := c.KV(ctx, suffix, &ak)
+        if err != nil {
+                return nil, err
+        }
+
+        ak.s = s
+
+        return &ak, nil
+}