forked from ValFadeev/rundeck-vault-plugin
-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Aquire new token if current token is about to expire
This fixes the edge case when the communication to vault is very slow and the passed token is about to expire, it can happen that the call to lookup self returns success but the following vault calls still run into an error as the token just expired. This change will fix this by calculating the maximal time, a call to vault will take. This is capped to 60 seconds as the documentation for the read and open timeout parameters were wrong. As the previous documentation stated that the timout paramter are ms valued, they are actually seconds. This could cause users to have high values in these paramters. To prevent continues token refreshing in that case, the maximal guaranteed token validity is capped to 60 seconds.
- Loading branch information
Showing
3 changed files
with
184 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
155 changes: 155 additions & 0 deletions
155
src/test/java/io/github/valfadeev/rundeck/plugin/vault/VaultStoragePluginTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,155 @@ | ||
| package io.github.valfadeev.rundeck.plugin.vault; | ||
|
|
||
| import com.bettercloud.vault.Vault; | ||
| import com.bettercloud.vault.VaultException; | ||
| import com.bettercloud.vault.api.Auth; | ||
| import com.bettercloud.vault.api.Logical; | ||
| import com.bettercloud.vault.response.LookupResponse; | ||
| import com.dtolabs.rundeck.core.plugins.configuration.ConfigurationException; | ||
| import org.junit.Test; | ||
| import org.mockito.Spy; | ||
|
|
||
| import java.util.Properties; | ||
|
|
||
| import static io.github.valfadeev.rundeck.plugin.vault.ConfigOptions.*; | ||
| import static org.mockito.Mockito.*; | ||
|
|
||
| import static org.junit.Assert.*; | ||
| import static org.hamcrest.CoreMatchers.*; | ||
|
|
||
| public class VaultStoragePluginTest { | ||
|
|
||
| @Spy | ||
| private VaultStoragePlugin vaultStoragePlugin = new VaultStoragePlugin(); | ||
|
|
||
| @Test | ||
| public void guaranteedTokenValidity_returnsCalculatedValue() { | ||
| Properties properties = mock(Properties.class); | ||
|
|
||
| doReturn("5").when(properties).getProperty(VAULT_MAX_RETRIES); | ||
| doReturn("2").when(properties).getProperty(VAULT_READ_TIMEOUT); | ||
| doReturn("2").when(properties).getProperty(VAULT_OPEN_TIMEOUT); | ||
| doReturn("1000").when(properties).getProperty(VAULT_RETRY_INTERVAL_MILLISECONDS); | ||
|
|
||
| int validity = vaultStoragePlugin.calculateGuaranteedTokenValidity(properties); | ||
|
|
||
| assertThat(validity, is(25)); | ||
| } | ||
|
|
||
| @Test | ||
| public void guaranteedTokenValidity_returnMaxCapedValue() { | ||
| Properties properties = mock(Properties.class); | ||
|
|
||
| doReturn("5").when(properties).getProperty(VAULT_MAX_RETRIES); | ||
| doReturn("20").when(properties).getProperty(VAULT_READ_TIMEOUT); | ||
| doReturn("20").when(properties).getProperty(VAULT_OPEN_TIMEOUT); | ||
| doReturn("1000").when(properties).getProperty(VAULT_RETRY_INTERVAL_MILLISECONDS); | ||
|
|
||
| int validity = vaultStoragePlugin.calculateGuaranteedTokenValidity(properties); | ||
|
|
||
| assertThat(validity, is(VaultStoragePlugin.MAX_GUARANTEED_VALIDITY_SECONDS)); | ||
| } | ||
|
|
||
| @Test | ||
| public void lookUp_passes_when_tokenIsValid() throws ConfigurationException, VaultException { | ||
| VaultStoragePlugin vaultStoragePlugin = spy(new VaultStoragePlugin()); | ||
| Properties properties = mock(Properties.class); | ||
| VaultClientProvider vaultClientProvider = mock(VaultClientProvider.class); | ||
| Vault vault = mock(Vault.class); | ||
| Logical logical = mock(Logical.class); | ||
| Auth auth = mock(Auth.class); | ||
| LookupResponse response = mock(LookupResponse.class); | ||
|
|
||
| doReturn(vaultClientProvider).when(vaultStoragePlugin).getVaultClientProvider(properties); | ||
| doReturn(vault).when(vaultClientProvider).getVaultClient(); | ||
| doReturn(logical).when(vault).logical(); | ||
|
|
||
| doReturn(auth).when(vault).auth(); | ||
| doReturn(response).when(auth).lookupSelf(); | ||
| doReturn(1312L).when(response).getTTL(); | ||
|
|
||
| doReturn("rundeck").when(properties).getProperty(VAULT_PREFIX); | ||
| doReturn("approle").when(properties).getProperty(VAULT_SECRET_BACKEND); | ||
| doReturn("vault").when(properties).getProperty(VAULT_STORAGE_BEHAVIOUR); | ||
|
|
||
| doReturn("5").when(properties).getProperty(VAULT_MAX_RETRIES); | ||
| doReturn("2").when(properties).getProperty(VAULT_READ_TIMEOUT); | ||
| doReturn("2").when(properties).getProperty(VAULT_OPEN_TIMEOUT); | ||
| doReturn("1000").when(properties).getProperty(VAULT_RETRY_INTERVAL_MILLISECONDS); | ||
|
|
||
| vaultStoragePlugin.configure(properties); | ||
| clearInvocations(vaultClientProvider); | ||
|
|
||
| vaultStoragePlugin.lookup(); | ||
|
|
||
| verify(vaultClientProvider, times(0)).getVaultClient(); | ||
| } | ||
|
|
||
| @Test | ||
| public void lookUp_refreshesToken_when_currentTokenIsAboutToExpire() throws ConfigurationException, VaultException { | ||
| VaultStoragePlugin vaultStoragePlugin = spy(new VaultStoragePlugin()); | ||
| Properties properties = mock(Properties.class); | ||
| VaultClientProvider vaultClientProvider = mock(VaultClientProvider.class); | ||
| Vault vault = mock(Vault.class); | ||
| Logical logical = mock(Logical.class); | ||
| Auth auth = mock(Auth.class); | ||
| LookupResponse response = mock(LookupResponse.class); | ||
|
|
||
| doReturn(vaultClientProvider).when(vaultStoragePlugin).getVaultClientProvider(properties); | ||
| doReturn(vault).when(vaultClientProvider).getVaultClient(); | ||
| doReturn(logical).when(vault).logical(); | ||
|
|
||
| doReturn(auth).when(vault).auth(); | ||
| doReturn(response).when(auth).lookupSelf(); | ||
| doReturn(20L).when(response).getTTL(); | ||
|
|
||
| doReturn("rundeck").when(properties).getProperty(VAULT_PREFIX); | ||
| doReturn("approle").when(properties).getProperty(VAULT_SECRET_BACKEND); | ||
| doReturn("vault").when(properties).getProperty(VAULT_STORAGE_BEHAVIOUR); | ||
|
|
||
| doReturn("5").when(properties).getProperty(VAULT_MAX_RETRIES); | ||
| doReturn("2").when(properties).getProperty(VAULT_READ_TIMEOUT); | ||
| doReturn("2").when(properties).getProperty(VAULT_OPEN_TIMEOUT); | ||
| doReturn("1000").when(properties).getProperty(VAULT_RETRY_INTERVAL_MILLISECONDS); | ||
|
|
||
| vaultStoragePlugin.configure(properties); | ||
| clearInvocations(vaultClientProvider); | ||
|
|
||
| vaultStoragePlugin.lookup(); | ||
|
|
||
| verify(vaultClientProvider).getVaultClient(); | ||
| } | ||
|
|
||
| @Test | ||
| public void lookUp_refreshesToken_when_tokenIsExpired() throws ConfigurationException, VaultException { | ||
| VaultStoragePlugin vaultStoragePlugin = spy(new VaultStoragePlugin()); | ||
| Properties properties = mock(Properties.class); | ||
| VaultClientProvider vaultClientProvider = mock(VaultClientProvider.class); | ||
| Vault vault = mock(Vault.class); | ||
| Logical logical = mock(Logical.class); | ||
| Auth auth = mock(Auth.class); | ||
|
|
||
| doReturn(vaultClientProvider).when(vaultStoragePlugin).getVaultClientProvider(properties); | ||
| doReturn(vault).when(vaultClientProvider).getVaultClient(); | ||
| doReturn(logical).when(vault).logical(); | ||
|
|
||
| doReturn(auth).when(vault).auth(); | ||
| doThrow(new VaultException("Forbidden", 403)).when(auth).lookupSelf(); | ||
|
|
||
| doReturn("rundeck").when(properties).getProperty(VAULT_PREFIX); | ||
| doReturn("approle").when(properties).getProperty(VAULT_SECRET_BACKEND); | ||
| doReturn("vault").when(properties).getProperty(VAULT_STORAGE_BEHAVIOUR); | ||
|
|
||
| doReturn("5").when(properties).getProperty(VAULT_MAX_RETRIES); | ||
| doReturn("2").when(properties).getProperty(VAULT_READ_TIMEOUT); | ||
| doReturn("2").when(properties).getProperty(VAULT_OPEN_TIMEOUT); | ||
| doReturn("1000").when(properties).getProperty(VAULT_RETRY_INTERVAL_MILLISECONDS); | ||
|
|
||
| vaultStoragePlugin.configure(properties); | ||
| clearInvocations(vaultClientProvider); | ||
|
|
||
| vaultStoragePlugin.lookup(); | ||
|
|
||
| verify(vaultClientProvider).getVaultClient(); | ||
| } | ||
| } |