From 67cce6c5eb56f050eacf13767ef87a18d3a4fe4f Mon Sep 17 00:00:00 2001 From: Geoff Wilson Date: Mon, 23 Sep 2024 10:43:01 -0400 Subject: [PATCH] Move vault client methods into separate files --- app/lib/clients/vault.rb | 100 ++------------------------- app/lib/clients/vault/certificate.rb | 87 +++++++++++++++++++++++ app/lib/clients/vault/key_value.rb | 30 ++++++++ 3 files changed, 123 insertions(+), 94 deletions(-) create mode 100644 app/lib/clients/vault/certificate.rb create mode 100644 app/lib/clients/vault/key_value.rb diff --git a/app/lib/clients/vault.rb b/app/lib/clients/vault.rb index ea78ef1..6c73276 100644 --- a/app/lib/clients/vault.rb +++ b/app/lib/clients/vault.rb @@ -1,35 +1,12 @@ module Clients class Vault class << self - def issue_cert(cert_issue_request) - enable_ca - opts = cert_issue_request.attributes - # Generate the TLS certificate using the intermediate CA - tls_cert = client.logical.write(cert_path, opts) - OpenStruct.new tls_cert.data - end - - def kv_read(path) - client.kv(kv_mount).read(path) - end - - def kv_write(path, data) - unless client.sys.mounts.key?(kv_mount.to_sym) - enable_engine(kv_mount, "kv-v2") - end - client.logical.write("#{kv_mount}/data/#{path}", data: data) - end - - def kv_delete(path) - client.logical.delete("#{kv_mount}/data/#{path}") - end - private def client ::Vault::Client.new( address: vault_address, - token: Rails.configuration.astral[:vault_token] + token: vault_token ) end @@ -37,81 +14,16 @@ def vault_address Rails.configuration.astral[:vault_addr] end - def kv_mount - "kv_astral" - end - - def intermediate_ca_mount - "pki_astral" - end - - def cert_path - "#{intermediate_ca_mount}/issue/astral" - end - - def root_ca_ref - Rails.configuration.astral[:vault_root_ca_ref] - end - - def root_ca_mount - Rails.configuration.astral[:vault_root_ca_mount] + def vault_token + Rails.configuration.astral[:vault_token] end def enable_engine(mount, type) client.sys.mount(mount, type, "#{type} secrets engine") end - - def enable_ca - # if mount exists, assume configuration is done - if client.sys.mounts.key?(intermediate_ca_mount.to_sym) - return - end - - # create the mount - enable_engine(intermediate_ca_mount, "pki") - - # Generate intermediate CSR - intermediate_csr = client.logical.write("#{intermediate_ca_mount}/intermediate/generate/internal", - common_name: "astral.internal Intermediate Authority", - issuer_name: "astral-intermediate").data[:csr] - - # Save the intermediate CSR - File.write("tmp/pki_intermediate.csr", intermediate_csr) - - # Sign the intermediate certificate with the root CA - intermediate_cert = client.logical.write("#{root_ca_mount}/root/sign-intermediate", - issuer_ref: root_ca_ref, - csr: intermediate_csr, - format: "pem_bundle", - ttl: "43800h").data[:certificate] - - # Save the signed intermediate certificate - File.write("tmp/intermediate.cert.pem", intermediate_cert) - - # Set the signed intermediate certificate - client.logical.write("#{intermediate_ca_mount}/intermediate/set-signed", certificate: intermediate_cert) - - # Configure the intermediate CA - client.logical.write("#{intermediate_ca_mount}/config/cluster", - path: "#{vault_address}/v1/#{intermediate_ca_mount}", - aia_path: "#{vault_address}/v1/#{intermediate_ca_mount}") - - # Configure the role for issuing certs - issuer_ref = client.logical.read("#{intermediate_ca_mount}/config/issuers").data[:default] - client.logical.write("#{intermediate_ca_mount}/roles/astral", - issuer_ref: issuer_ref, - allow_any_name: true, - max_ttl: "720h", - no_store: false) - - client.logical.write("#{intermediate_ca_mount}/config/urls", - issuing_certificates: "{{cluster_aia_path}}/issuer/{{issuer_id}}/der", - crl_distribution_points: "{{cluster_aia_path}}/issuer/{{issuer_id}}/crl/der", - ocsp_servers: "{{cluster_path}}/ocsp", - enable_templating: true) - rescue ::Vault::HTTPError => e - Rails.logger.error "Unable to configure intermediate_cert: #{e}" - end end end + + require_relative "vault/key_value" + require_relative "vault/certificate" end diff --git a/app/lib/clients/vault/certificate.rb b/app/lib/clients/vault/certificate.rb new file mode 100644 index 0000000..a59d964 --- /dev/null +++ b/app/lib/clients/vault/certificate.rb @@ -0,0 +1,87 @@ +module Clients + class Vault + class << self + def issue_cert(cert_issue_request) + enable_ca + opts = cert_issue_request.attributes + # Generate the TLS certificate using the intermediate CA + tls_cert = client.logical.write(cert_path, opts) + OpenStruct.new tls_cert.data + end + + private + + def intermediate_ca_mount + "pki_astral" + end + + def cert_path + "#{intermediate_ca_mount}/issue/astral" + end + + def root_ca_ref + Rails.configuration.astral[:vault_root_ca_ref] + end + + def root_ca_mount + Rails.configuration.astral[:vault_root_ca_mount] + end + + def cert_engine_type + "pki" + end + + def enable_ca + # if mount exists, assume configuration is done + if client.sys.mounts.key?(intermediate_ca_mount.to_sym) + return + end + + # create the mount + enable_engine(intermediate_ca_mount, cert_engine_type) + + # Generate intermediate CSR + intermediate_csr = client.logical.write("#{intermediate_ca_mount}/intermediate/generate/internal", + common_name: "astral.internal Intermediate Authority", + issuer_name: "astral-intermediate").data[:csr] + + # Save the intermediate CSR + File.write("tmp/pki_intermediate.csr", intermediate_csr) + + # Sign the intermediate certificate with the root CA + intermediate_cert = client.logical.write("#{root_ca_mount}/root/sign-intermediate", + issuer_ref: root_ca_ref, + csr: intermediate_csr, + format: "pem_bundle", + ttl: "43800h").data[:certificate] + + # Save the signed intermediate certificate + File.write("tmp/intermediate.cert.pem", intermediate_cert) + + # Set the signed intermediate certificate + client.logical.write("#{intermediate_ca_mount}/intermediate/set-signed", certificate: intermediate_cert) + + # Configure the intermediate CA + client.logical.write("#{intermediate_ca_mount}/config/cluster", + path: "#{vault_address}/v1/#{intermediate_ca_mount}", + aia_path: "#{vault_address}/v1/#{intermediate_ca_mount}") + + # Configure the role for issuing certs + issuer_ref = client.logical.read("#{intermediate_ca_mount}/config/issuers").data[:default] + client.logical.write("#{intermediate_ca_mount}/roles/astral", + issuer_ref: issuer_ref, + allow_any_name: true, + max_ttl: "720h", + no_store: false) + + client.logical.write("#{intermediate_ca_mount}/config/urls", + issuing_certificates: "{{cluster_aia_path}}/issuer/{{issuer_id}}/der", + crl_distribution_points: "{{cluster_aia_path}}/issuer/{{issuer_id}}/crl/der", + ocsp_servers: "{{cluster_path}}/ocsp", + enable_templating: true) + rescue ::Vault::HTTPError => e + Rails.logger.error "Unable to configure intermediate_cert: #{e}" + end + end + end +end diff --git a/app/lib/clients/vault/key_value.rb b/app/lib/clients/vault/key_value.rb new file mode 100644 index 0000000..503df90 --- /dev/null +++ b/app/lib/clients/vault/key_value.rb @@ -0,0 +1,30 @@ +module Clients + class Vault + class << self + def kv_read(path) + client.kv(kv_mount).read(path) + end + + def kv_write(path, data) + unless client.sys.mounts.key?(kv_mount.to_sym) + enable_engine(kv_mount, kv_engine_type) + end + client.logical.write("#{kv_mount}/data/#{path}", data: data) + end + + def kv_delete(path) + client.logical.delete("#{kv_mount}/data/#{path}") + end + + private + + def kv_mount + "kv_astral" + end + + def kv_engine_type + "kv-v2" + end + end + end +end