@@ -3,22 +3,31 @@ package backends
33import (
44 "context"
55 "fmt"
6- "github.com/Azure/azure-sdk-for-go/profiles/latest/keyvault/keyvault"
6+ "github.com/Azure/azure-sdk-for-go/sdk/azcore"
7+ "github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime"
8+ "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets"
79 "github.com/argoproj-labs/argocd-vault-plugin/pkg/utils"
8- "path"
9- "strings"
1010 "time"
1111)
1212
1313// AzureKeyVault is a struct for working with an Azure Key Vault backend
1414type AzureKeyVault struct {
15- Client keyvault.BaseClient
15+ Credential azcore.TokenCredential
16+ ClientBuilder func (vaultURL string , credential azcore.TokenCredential , options * azsecrets.ClientOptions ) (AzSecretsClient , error )
17+ }
18+
19+ type AzSecretsClient interface {
20+ GetSecret (ctx context.Context , name string , version string , options * azsecrets.GetSecretOptions ) (azsecrets.GetSecretResponse , error )
21+ NewListSecretPropertiesPager (options * azsecrets.ListSecretPropertiesOptions ) * runtime.Pager [azsecrets.ListSecretPropertiesResponse ]
1622}
1723
1824// NewAzureKeyVaultBackend initializes a new Azure Key Vault backend
19- func NewAzureKeyVaultBackend (client keyvault. BaseClient ) * AzureKeyVault {
25+ func NewAzureKeyVaultBackend (credential azcore. TokenCredential , clientBuilder func ( vaultURL string , credential azcore. TokenCredential , options * azsecrets. ClientOptions ) ( * azsecrets. Client , error ) ) * AzureKeyVault {
2026 return & AzureKeyVault {
21- Client : client ,
27+ Credential : credential ,
28+ ClientBuilder : func (vaultURL string , credential azcore.TokenCredential , options * azsecrets.ClientOptions ) (AzSecretsClient , error ) {
29+ return clientBuilder (vaultURL , credential , options )
30+ },
2231 }
2332}
2433
@@ -29,59 +38,55 @@ func (a *AzureKeyVault) Login() error {
2938
3039// GetSecrets gets secrets from Azure Key Vault and returns the formatted data
3140// For Azure Key Vault, `kvpath` is the unique name of your vault
41+ // For Azure use the version here not make really sens as each secret have a different version but let support it
3242func (a * AzureKeyVault ) GetSecrets (kvpath string , version string , _ map [string ]string ) (map [string ]interface {}, error ) {
3343 kvpath = fmt .Sprintf ("https://%s.vault.azure.net" , kvpath )
3444
3545 ctx , cancel := context .WithTimeout (context .Background (), 10 * time .Second )
3646 defer cancel ()
3747
38- data := make ( map [ string ] interface {} )
48+ verboseOptionalVersion ( "Azure Key Vault list all secrets from vault %s" , version , kvpath )
3949
40- utils .VerboseToStdErr ("Azure Key Vault listing secrets in vault %v" , kvpath )
41- secretList , err := a .Client .GetSecretsComplete (ctx , kvpath , nil )
50+ client , err := a .ClientBuilder (kvpath , a .Credential , nil )
4251 if err != nil {
4352 return nil , err
4453 }
4554
46- utils .VerboseToStdErr ("Azure Key Vault list secrets response %v" , secretList )
47- // Gather all secrets in Key Vault
48-
49- for ; secretList .NotDone (); secretList .NextWithContext (ctx ) {
50- secret := path .Base (* secretList .Value ().ID )
51- if version == "" {
52- utils .VerboseToStdErr ("Azure Key Vault getting secret %s from vault %s" , secret , kvpath )
53- secretResp , err := a .Client .GetSecret (ctx , kvpath , secret , "" )
54- if err != nil {
55- return nil , err
56- }
55+ data := make (map [string ]interface {})
5756
58- utils .VerboseToStdErr ("Azure Key Vault get unversioned secret response %v" , secretResp )
59- data [secret ] = * secretResp .Value
60- continue
57+ pager := client .NewListSecretPropertiesPager (nil )
58+ for pager .More () {
59+ page , err := pager .NextPage (ctx )
60+ if err != nil {
61+ return nil , err
6162 }
62- // In Azure Key Vault the versions of a secret is first shown after running GetSecretVersions. So we need
63- // to loop through the versions for each secret in order to find the secret that has the specific version.
64- secretVersions , _ := a .Client .GetSecretVersionsComplete (ctx , kvpath , secret , nil )
65- for ; secretVersions .NotDone (); secretVersions .NextWithContext (ctx ) {
66- secretVersion := secretVersions .Value ()
63+ for _ , secretVersion := range page .Value {
6764 // Azure Key Vault has ability to enable/disable a secret, so lets honour that
6865 if ! * secretVersion .Attributes .Enabled {
6966 continue
7067 }
71- // Secret version matched given version
72- if strings .Contains (* secretVersion .ID , version ) {
73- utils .VerboseToStdErr ("Azure Key Vault getting secret %s from vault %s at version %s" , secret , kvpath , version )
74- secretResp , err := a .Client .GetSecret (ctx , kvpath , secret , version )
68+ name := secretVersion .ID .Name ()
69+ // Secret version matched given version ?
70+ if version == "" || secretVersion .ID .Version () == version {
71+ verboseOptionalVersion ("Azure Key Vault getting secret %s from vault %s" , version , name , kvpath )
72+ secret , err := client .GetSecret (ctx , name , version , nil )
7573 if err != nil {
7674 return nil , err
7775 }
78-
79- utils .VerboseToStdErr ("Azure Key Vault get versioned secret response %v" , secretResp )
80- data [secret ] = * secretResp .Value
76+ utils .VerboseToStdErr ("Azure Key Vault get secret response %v" , secret )
77+ data [name ] = * secret .Value
78+ } else {
79+ verboseOptionalVersion ("Azure Key Vault getting secret %s from vault %s" , version , name , kvpath )
80+ secret , err := client .GetSecret (ctx , name , version , nil )
81+ if err != nil || ! * secretVersion .Attributes .Enabled {
82+ utils .VerboseToStdErr ("Azure Key Vault get versioned secret not found %s" , err )
83+ continue
84+ }
85+ utils .VerboseToStdErr ("Azure Key Vault get versioned secret response %v" , secret )
86+ data [name ] = * secret .Value
8187 }
8288 }
8389 }
84-
8590 return data , nil
8691}
8792
@@ -92,15 +97,28 @@ func (a *AzureKeyVault) GetIndividualSecret(kvpath, secret, version string, anno
9297 ctx , cancel := context .WithTimeout (context .Background (), 10 * time .Second )
9398 defer cancel ()
9499
95- utils . VerboseToStdErr ("Azure Key Vault getting secret %s from vault %s at version %s" , secret , kvpath , version )
100+ verboseOptionalVersion ("Azure Key Vault getting individual secret %s from vault %s" , version , secret , kvpath )
96101
97102 kvpath = fmt .Sprintf ("https://%s.vault.azure.net" , kvpath )
98- data , err := a .Client .GetSecret (ctx , kvpath , secret , version )
103+ client , err := a .ClientBuilder (kvpath , a .Credential , nil )
104+ if err != nil {
105+ return nil , err
106+ }
107+
108+ data , err := client .GetSecret (ctx , secret , version , nil )
99109 if err != nil {
100110 return nil , err
101111 }
102112
103- utils .VerboseToStdErr ("Azure Key Vault get versioned secret response %v" , data )
113+ utils .VerboseToStdErr ("Azure Key Vault get individual secret response %v" , data )
104114
105115 return * data .Value , nil
106116}
117+
118+ func verboseOptionalVersion (format string , version string , message ... interface {}) {
119+ if version == "" {
120+ utils .VerboseToStdErr (format , message ... )
121+ } else {
122+ utils .VerboseToStdErr (format + " at version %s" , append (message , version )... )
123+ }
124+ }
0 commit comments