66 lines
2.4 KiB
Python
66 lines
2.4 KiB
Python
#!/usr/bin/env python3
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import os
|
|
import sys
|
|
|
|
import hvac
|
|
|
|
|
|
def hashicorp_vault_client(vault_namespace, vault_addr, vault_role_id,
|
|
vault_secret_id, vault_token, vault_cacert):
|
|
"""Connect to a Vault sever and create a client.
|
|
|
|
:param vault_namespace: Vault namespace (enterprise only).
|
|
:param vault_addr: Address to connect to an existing Hashicorp Vault.
|
|
:param vault_role_id: Role-ID to authenticate to Vault. This must be used
|
|
in conjunction with --secret-id.
|
|
:param vault_secret_id: Secret-ID to authenticate to Vault. This must be
|
|
used in conjunction with --role-id.
|
|
:param vault_token: Vault token to authenticate to Vault.
|
|
:param vault_cacert: Path to CA certificate file.
|
|
:returns: Hashicorp Vault Client (hvac.Client).
|
|
"""
|
|
|
|
if any([vault_role_id, vault_secret_id]):
|
|
if vault_token:
|
|
print("ERROR: Vault token cannot be used at the same time as "
|
|
"role-id and secret-id")
|
|
sys.exit(1)
|
|
if not all([vault_role_id, vault_secret_id]):
|
|
print("ERROR: role-id and secret-id must be provided together")
|
|
sys.exit(1)
|
|
elif not vault_token:
|
|
print("ERROR: You must provide either a Vault token or role-id and "
|
|
"secret-id")
|
|
sys.exit(1)
|
|
|
|
# Authenticate to Hashicorp Vault
|
|
if vault_cacert != "":
|
|
os.environ['REQUESTS_CA_BUNDLE'] = vault_cacert
|
|
|
|
if vault_token != "": # nosec
|
|
client = hvac.Client(url=vault_addr, token=vault_token,
|
|
namespace=vault_namespace)
|
|
else:
|
|
client = hvac.Client(url=vault_addr, namespace=vault_namespace)
|
|
client.auth.approle.login(role_id=vault_role_id,
|
|
secret_id=vault_secret_id)
|
|
|
|
if not client.is_authenticated():
|
|
print('Failed to authenticate to vault')
|
|
sys.exit(1)
|
|
|
|
return client
|