Skip to content

Commit c829eac

Browse files
dafyddjdafyddj
committed
simplify shasums signature verification; move setcap to server state
1 parent c391faa commit c829eac

File tree

7 files changed

+80
-80
lines changed

7 files changed

+80
-80
lines changed

‎.kitchen.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ suites:
5252
vault:
5353
# version: 0.11.1 # test upgrades by doing a double-converge, changing the version pillar between each one
5454
version: 0.11.2
55+
secure_download: false
5556

5657
- name: dev_server
5758
provisioner:

‎test/integration/prod_server/vault_spec.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@
44
its(:stdout) { should match(/^Vault v[0-9\.]+ \('[0-9a-f]+'\)/) }
55
end
66

7+
describe command('getcap $(readlink -f /usr/local/bin/vault)') do
8+
its(:exit_status) { should eq 0 }
9+
its(:stderr) { should be_empty }
10+
its(:stdout) { should match(/\/vault = cap_ipc_lock\+ep$/) }
11+
end
12+
713
describe file('/etc/vault/config/server.hcl') do
814
it { should be_a_file }
915
end

‎vault/defaults.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ vault:
1515
path: /var/lib/vault/data
1616
dev_mode: true
1717
secure_download: true
18+
gpg_pkg: gnupg
1819
user: root
1920
group: root
2021
hashicorp_gpg_key: |

‎vault/init.sls‎

Lines changed: 51 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,60 @@
11
{% from "vault/map.jinja" import vault with context %}
2-
# using archive.extracted causes: 'Comment: Failed to cache https://releases.hashicorp.com/vault/0.7.0/vault_0.7.0_linux_amd64.zip: [Errno 1] _ssl.c:493: error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version'
3-
#vault packages:
4-
# pkg.installed:
5-
# - names:
6-
# - unzip
7-
# - curl
8-
# {% if vault.secure_download %}
9-
# {% if grains['os'] == 'CentOS' or grains['os'] == 'Amazon' %}
10-
# - gnupg2
11-
# - perl-Digest-SHA
12-
# {% elif grains['os'] == 'Ubuntu' %}
13-
# - gnupg
14-
# - libdigest-sha-perl
15-
# {% endif %}
16-
# {% endif %}
17-
/opt/vault/{{ vault.version }}/bin:
2+
3+
{% set version = vault.version %}
4+
5+
/opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS:
6+
file.managed:
7+
- source: https://releases.hashicorp.com/vault/{{ version }}/vault_{{ version }}_SHA256SUMS
8+
- makedirs: true
9+
- skip_verify: true
10+
11+
/opt/vault/{{ version }}/bin:
1812
archive.extracted:
19-
- source: https://releases.hashicorp.com/vault/{{ vault.version }}/vault_{{ vault.version }}_linux_amd64.zip
20-
- source_hash: https://releases.hashicorp.com/vault/{{ vault.version }}/vault_{{ vault.version }}_SHA256SUMS
13+
- source: https://releases.hashicorp.com/vault/{{ version }}/vault_{{ version }}_linux_amd64.zip
14+
- source_hash: /opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS
2115
- enforce_toplevel: false
16+
- require:
17+
- /opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS
2218
2319
/usr/local/bin/vault:
2420
file.symlink:
25-
- target: /opt/vault/{{ vault.version }}/bin/vault
21+
- target: /opt/vault/{{ version }}/bin/vault
2622
- force: true
2723
- require:
28-
- /opt/vault/{{ vault.version }}/bin
24+
- /opt/vault/{{ version }}/bin
25+
26+
{% if vault.secure_download -%}
27+
/opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS.sig:
28+
file.managed:
29+
- source: https://releases.hashicorp.com/vault/{{ version }}/vault_{{ version }}_SHA256SUMS.sig
30+
- skip_verify: true
31+
- require:
32+
- /opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS
2933
30-
#{% if vault.secure_download %}
31-
#download shasums:
32-
# cmd.run:
33-
# - name: curl --silent -L https://releases.hashicorp.com/vault/{{ vault.version }}/vault_{{ vault.version }}_SHA256SUMS -o /tmp/vault_{{ vault.version }}_SHA256SUMS
34-
# - creates: /tmp/vault_{{ vault.version }}_SHA256SUMS
35-
#
36-
#download shasums sig:
37-
# cmd.run:
38-
# - name: curl --silent -L https://releases.hashicorp.com/vault/{{ vault.version }}/vault_{{ vault.version }}_SHA256SUMS.sig -o /tmp/vault_{{ vault.version }}_SHA256SUMS.sig
39-
# - creates: /tmp/vault_{{ vault.version }}_SHA256SUMS.sig
40-
#
41-
#/tmp/hashicorp.asc:
42-
# file.managed:
43-
# - source: salt://vault/files/hashicorp.asc.jinja
44-
# - template: jinja
45-
#
46-
#import key:
47-
# cmd.run:
48-
# - name: gpg --import /tmp/hashicorp.asc
49-
# - unless: gpg --list-keys {{ vault.hashicorp_key_id }}
50-
# - requires:
51-
# - file: /tmp/hashicorp.asc
52-
# - cmd: vault packages
53-
#
54-
#verify shasums sig:
55-
# cmd.run:
56-
# - name: gpg --verify /tmp/vault_{{ vault.version }}_SHA256SUMS.sig /tmp/vault_{{ vault.version }}_SHA256SUMS
57-
# - require:
58-
# - cmd: download shasums
59-
# - cmd: import key
60-
#
61-
#verify vault:
62-
# cmd.run:
63-
# - name: "shasum -a 256 -c vault_{{ vault.version }}_SHA256SUMS 2>&1 | grep -q \"vault_{{ vault.version }}_linux_amd64.zip: OK\""
64-
# - cwd: /tmp
65-
# - require:
66-
# - cmd: download vault
67-
# - cmd: verify shasums sig
68-
#{% endif %}
69-
#
70-
#install vault:
71-
# cmd.run:
72-
# - name: unzip /tmp/vault_{{ vault.version }}_linux_amd64.zip -d /usr/local/bin && chmod 0755 /usr/local/bin/vault && chown root:root /usr/local/bin/vault
73-
# - require:
74-
# - cmd: download vault
75-
# - pkg: unzip
76-
# {% if vault.secure_download %}
77-
# - cmd: verify vault
78-
# {% endif %}
79-
# - creates: /usr/local/bin/vault
80-
#
81-
#vault set cap mlock:
82-
# cmd.run:
83-
# - name: "setcap cap_ipc_lock=+ep /usr/local/bin/vault"
84-
# - onchanges:
85-
# - cmd: install vault
34+
35+
/tmp/hashicorp.asc:
36+
file.managed:
37+
- source: salt://vault/files/hashicorp.asc.jinja
38+
- template: jinja
39+
40+
vault_gpg_pkg:
41+
pkg.installed:
42+
- name: {{ vault.gpg_pkg }}
43+
44+
import key:
45+
cmd.run:
46+
- name: gpg --import /tmp/hashicorp.asc
47+
- unless: gpg --list-keys {{ vault.hashicorp_key_id }}
48+
- require:
49+
- /tmp/hashicorp.asc
50+
- vault_gpg_pkg
51+
52+
verify shasums sig:
53+
cmd.run:
54+
- name: gpg --verify /opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS.sig /opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS
55+
- require:
56+
- /opt/vault/{{ version }}/vault_{{ version }}_SHA256SUMS.sig
57+
- import key
58+
- prereq:
59+
- /usr/local/bin/vault
60+
{%- endif %}

‎vault/map.jinja‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,11 @@
11
{% import_yaml "vault/defaults.yaml" as defaults %}
2-
{% set vault = salt['pillar.get']('vault', default=defaults['vault'], merge=True) %}
2+
{% import_yaml "vault/osfamilymap.yaml" as osfamilymap %}
3+
4+
{% set vault = salt['grains.filter_by'](
5+
defaults,
6+
merge=salt['grains.filter_by'](
7+
osfamilymap,
8+
merge=salt['pillar.get']('vault', {}),
9+
),
10+
base='vault')
11+
%}

‎vault/osfamilymap.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
RedHat:
2+
gpg_pkg: gnupg2

‎vault/server.sls‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,13 @@ include:
2323
- watch_in:
2424
- service: vault
2525
26-
{%- if vault.self_signed_cert.enabled %}
26+
vault_set_cap_mlock:
27+
cmd.run:
28+
- name: setcap cap_ipc_lock=+ep $(readlink -f /usr/local/bin/vault)
29+
- onchanges:
30+
- /usr/local/bin/vault
31+
32+
{% if vault.self_signed_cert.enabled -%}
2733
openssl:
2834
pkg.installed
2935
@@ -39,8 +45,8 @@ generate self signed SSL certs:
3945
- /etc/vault/config
4046
- require_in:
4147
- service: vault
42-
{%- endif %}
43-
{% endif %}
48+
{% endif %}
49+
{%- endif %}
4450
4551
{%- if grains.init == 'systemd' %}
4652
/etc/systemd/system/vault.service:

0 commit comments

Comments
 (0)