Cyberark refactor

[joseph-klein-cmm]

Summary

Adds the ability for secrets to be pulled from CyberArk, as well as AKV.

This includes a good bit of refactoring to avoid having to a) litter the code with type checks, and b) try to hijack the keyvault-based Secret object for storing CyberArk secrets. At a high level, the refactoring:

1. Abstracts the client code to allow an additional implementation for CyberArk
2. Moves the resource retrieval functions (GetSecret, GetKey, etc) to methods of the concrete Client objects.
3. Rewrite the Secret resource type that can be used for both CyberArk and AKV secrets

Testing:

• Default credentials:
  • Cyberark and Keyvault defaults both defined in env vars
  • Keyvault default only defined in env vars
  • cyberark defauly only defined in env vars
  • Neither defined in env vars
• Syncing secrets
  • Cyberark secret pull/sync
  • Cyberark all secrets pull/sync
  • Kevault secret pull/sync

Sanitized version of the file used for testing the above cases:

credentials:
  -
    name: cyberark_test_one
    login: D-AppA-POC-Workload
    apiKey: ****
    account: conjur
    applianceURL: https://****.cyberark.cloud/api
  -
    name: cyberark_test_all
    login: D-AppA-POC-Workload
    apiKey: ****
    account: conjur
    applianceURL: https://****.cyberark.cloud/api

workers:
  -
    resources:
      - kind: secret
        name: test
        vaultBaseURL: https://****.vault.azure.net/
        credential: default
    sinks:
      - path: ./password-akv
        template: "{{ .Secrets.test.Value }}"
  -
    resources:
      - kind: cyberark-secret
        name: 'Operating System-SelfManaged-dummy-foo/password'
        safeName: D-AppA
        credential: cyberark_test_one
        version: 1
        alias: password
    sinks:
      - path: ./password-cyberark-one.json
        template: '{{ .Secrets.password.Value }}'
  -
    resources:
      - kind: cyberark-secret
        name: 'Operating System-SelfManaged-dummy-foo/password'
        safeName: D-AppA
        credential: default_cyberark
        alias: password
    sinks:
      - path: ./password-cyberark-default.json
        template: '{{ .Secrets.password.Value }}'
  -
    resources:
      - kind: all-cyberark-secrets
        safeName: D-AppA
        credential: cyberark_test_all
    sinks:
      - path: ./password-cyberark-all.json
        template: '{{ index .Secrets "Operating System-SelfManaged-dummy-foo/password" | toString }}'

[chrisjohnson]

Fantastic work :)