Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vault with multiple mount_points, roles and policies #39

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Vault with multiple mount_points, roles and policies #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions stakewise_cli/commands/sync_vault.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ def validate_operator_address(ctx, param, value):
callback=validate_operator_address,
)
def sync_vault(network: str, operator: ChecksumAddress) -> None:
global VAULT_VALIDATORS_MOUNT_POINT
while True:
try:
vault_client = get_vault_client()
Expand Down Expand Up @@ -98,6 +99,14 @@ def sync_vault(network: str, operator: ChecksumAddress) -> None:
fg="red",
)

namespace = click.prompt(
"Enter the validators kubernetes namespace",
default="validators",
type=click.STRING,
)
if VAULT_VALIDATORS_MOUNT_POINT == "":
VAULT_VALIDATORS_MOUNT_POINT = namespace

vault_client.secrets.kv.default_kv_version = 1
try:
vault_client.sys.enable_secrets_engine(
Expand Down Expand Up @@ -126,11 +135,6 @@ def sync_vault(network: str, operator: ChecksumAddress) -> None:
"Error: failed to connect to the Kubernetes API host", bold=True, fg="red"
)

namespace = click.prompt(
"Enter the validators kubernetes namespace",
default="validators",
type=click.STRING,
)
mnemonic = click.prompt(
'Enter your mnemonic separated by spaces (" ")',
value_proc=validate_mnemonic,
Expand Down
2 changes: 1 addition & 1 deletion stakewise_cli/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
)

VAULT_VALIDATORS_MOUNT_POINT = config(
"VAULT_VALIDATORS_MOUNT_POINT", default="validators"
"VAULT_VALIDATORS_MOUNT_POINT", default=""
)

IS_LEGACY = config("IS_LEGACY", default=False, cast=bool)
13 changes: 8 additions & 5 deletions stakewise_cli/storages/vault.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,9 @@ def __init__(
self.max_keys_per_validator = NETWORKS[network]["MAX_KEYS_PER_VALIDATOR"]
self.operator_address = operator
self.check_mnemonic()
global VAULT_VALIDATORS_MOUNT_POINT
if VAULT_VALIDATORS_MOUNT_POINT == "":
VAULT_VALIDATORS_MOUNT_POINT = namespace

@cached_property
def vault_validator_names(self) -> Set[str]:
Expand Down Expand Up @@ -341,8 +344,8 @@ def sync_vault_validators(self) -> None:
show_pos=True,
) as bar:
for validator_name in removed_validators:
self.vault_client.sys.delete_policy(validator_name)
self.vault_client.delete_kubernetes_role(validator_name)
self.vault_client.sys.delete_policy(f"{self.namespace}-{validator_name}")
self.vault_client.delete_kubernetes_role(f"{self.namespace}-{validator_name}")
self.vault_client.secrets.kv.delete_secret(
path=f"{validator_name}/password",
mount_point=VAULT_VALIDATORS_MOUNT_POINT,
Expand All @@ -355,13 +358,13 @@ def sync_vault_validators(self) -> None:

for validator_name in new_validators:
self.vault_client.sys.create_or_update_policy(
name=validator_name,
name=f"{self.namespace}-{validator_name}",
policy=VALIDATOR_POLICY
% (VAULT_VALIDATORS_MOUNT_POINT, validator_name),
)
self.vault_client.auth.kubernetes.create_role(
name=validator_name,
policies=[validator_name],
name=f"{self.namespace}-{validator_name}",
policies=[f"{self.namespace}-{validator_name}"],
bound_service_account_names=validator_name,
bound_service_account_namespaces=self.namespace,
)
Expand Down