1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
package vaultlayout
import (
"fmt"
"regexp"
"strings"
)
const (
CertAuthPath = "cert"
NodeRolePrefix = "node-"
NodePolicyPrefix = "node-secret-"
NodeSecretPrefix = "secret/data/k3s/node/"
RoleESO = "eso-openbao"
PolicyESO = "eso-openbao-read"
PathESODemo = "secret/data/k3s/eso-demo"
PathTokenLookupSelf = "auth/token/lookup-self"
PathTokenRevokeSelf = "auth/token/revoke-self"
)
var certIdentityPattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]*[a-z0-9])?$`)
func NodeSecretPath(node string) string {
return NodeSecretPrefix + strings.ToLower(node)
}
func NodeCertRoleName(node string) string {
return NodeRolePrefix + strings.ToLower(node)
}
func NodePolicyName(node string) string {
return NodePolicyPrefix + strings.ToLower(node)
}
func ValidateCertIdentity(name string) error {
if len(name) > 63 || !certIdentityPattern.MatchString(name) {
return fmt.Errorf(
"vaultlayout: %q is not a lower-case DNS-1123 label, and a certificate identity is "+
"used at once as a common name, a cert role name and a per-node secret path "+
"segment. OpenBao lower-cases policy and role names, so a name that is not already "+
"lower-case binds the certificate to a role the caller did not write, and a name "+
"holding a slash reads from a different secret path than the policy grants", name)
}
return nil
}
func NodeCertPolicyHCL(node string) string {
return readPolicy(NodeSecretPath(node))
}
func ESOCertPolicyHCL() string {
return readPolicy(PathTokenLookupSelf, PathESODemo) + updatePolicy(PathTokenRevokeSelf)
}
func updatePolicy(paths ...string) string {
var b strings.Builder
for _, p := range paths {
fmt.Fprintf(&b, "path \"%s\" {\n capabilities = [\"update\"]\n}\n", p)
}
return b.String()
}
