Add alias types for IAM and GCE logins #89

pcman312 · 2020-04-22T20:51:01Z

Overview

Allows users to specify an alias type field for IAM and GCE logins which will then switch between the current behavior (a unique ID for IAM, and the instance ID for GCE) and a newly created role_id field. The role_id is a UUID generated when the role is created. All existing roles without a role_id will have one generated and saved when the role is read or written.

Design of Change

Adds 3 fields to the role config:

role_id (generated)
iam_alias- "unique_id" (default) or "role_id"
gce_alias- "instance_id" (default) or "role_id"

If the alias field is specified as "role_id", the Vault alias will be the generated role_id rather than the current behavior of a unique ID (for IAM) or the instance ID (for GCE).

I've also utilized go's mocking library to mock the logical.SystemView and logical.Storage interfaces to improve testing coverage of some new tests. To generate the mocks, run make mocks.

The gcpRole struct and its associated functions have been pulled out into its own file: gcp_role.go since the path_role.go file was getting very large (1000+ lines).

Related Issues/Pull Requests

Test Output

$ make test
?   	github.com/hashicorp/vault-plugin-auth-gcp	[no test files]
ok  	github.com/hashicorp/vault-plugin-auth-gcp/plugin	2.946s
?   	github.com/hashicorp/vault-plugin-auth-gcp/plugin/cache	[no test files]

Contributor Checklist

Add relevant docs to upstream Vault repository, or sufficient reasoning why docs won’t be added yet
Add output for any tests not ran in CI to the PR description (eg, acceptance tests)
Backwards compatible

Resolves hashicorp/vault#8761 Allows users to specify an alias type field for IAM and GCE logins which will then switch between the current behavior (a unique ID for IAM, and the instance ID for GCE) and a newly created role_id field. The role_id is a UUID generated when the role is created. All existing roles without a role_id will have one generated and saved when the role is read or written.

catsby · 2020-04-22T21:32:04Z

plugin/path_role.go

-// role reads a gcpRole from storage. This assumes the caller has already obtained the role lock.
-func (b *GcpAuthBackend) role(ctx context.Context, s logical.Storage, name string) (*gcpRole, error) {
+// retrieveRole from storage. This assumes the caller has already obtained the role lock.
+func (b *GcpAuthBackend) retrieveRole(ctx context.Context, s logical.Storage, name string) (*gcpRole, error) {


Can you share the rational for renaming this method?

Generally I ascribe to the idea that function names should be read like verbs.

I don't necessarily disagree, however this breaks a common naming convention in most of our secret backends. I think Role is pretty Go idiomatic as well:

https://golang.org/doc/effective_go.html#Getters

I agree with the naming convention for getters, however I don't agree that this is a getter as described. This is retrieving the role from the storage backend, not returning an existing, unexported field on the GcpAuthBackend.

That's fair, it's not a true getter as described in that link. I do feel that role is consistent with most of our other secret backends as well as some other methods/functions in this plugin (Factory(), Backend(), IAMClient(),ComputeClient())

Changed back to role for consistency across plugins that I wasn't aware of previously.

plugin/path_role_test.go

tyrannosaurus-becks

Thanks for working on this @pcman312 , it looks great! I also black-box tested it in the command line, and it's working as expected. Just a couple of discussion questions around whether we should allow no selection, and how we should handle the performance impact that those selecting role_id might see.

plugin/gcp_role.go

plugin/path_role.go

plugin/path_login.go

plugin/aliasing.go

broamski · 2020-04-23T01:24:49Z

plugin/aliasing.go

+	allowedGCEAliasesSlice = gceMapKeyToSlice(allowedGCEAliases)
+)
+
+func iamMapKeyToSlice(m map[string]iamAliaser) (s []string) {


These could probably be reduced into a single function that accepts an interface and is type switched. Same with many of the get.. functions below.

Unfortunately it wouldn't really help here. The function would have the same code in it (including both versions of the for loop), but wrapped up into a single function rather than two. There isn't a generic map type that can be used as a variable type that would allow the type coercion needed here. Additionally it's generally frowned upon to pass the empty interface around unless necessary.

I have generally found the same thing as well - when I have tried that approach it read awkwardly, but just in a different way. I don't think there's any "perfect" answer here, but I do like the more direct approach taken here because type conversions can be expensive.

Thank you for your review, by the way, broamski!

tyrannosaurus-becks

LGTM! Thanks for doing this while on the Sustaining team, I know you must be busy!

dustin-decker

Looks good. Is there a chance of a release including this being vendored into the 1.4.1 release of Vault?

kalafut · 2020-04-24T03:52:04Z

@dustin-decker This change and another one to provide some customization of metadata storage (PR very soon) are targeted for 1.4.1.

Resolves hashicorp/vault#8761 Allows users to specify an alias type field for IAM and GCE logins which will then switch between the current behavior (a unique ID for IAM, and the instance ID for GCE) and a newly created role_id field. The role_id is a UUID generated when the role is created. All existing roles without a role_id will have one generated and saved when the role is read or written.

pcman312 added bug enhancement labels Apr 22, 2020

pcman312 requested review from kalafut, tyrannosaurus-becks and a team April 22, 2020 20:52

Remove commented out code

6bb1c8f

dustin-decker mentioned this pull request Apr 22, 2020

Make identities less unique to improve performance #88

Closed

catsby reviewed Apr 22, 2020

View reviewed changes

tyrannosaurus-becks reviewed Apr 22, 2020

View reviewed changes

plugin/gcp_role.go Outdated Show resolved Hide resolved

plugin/gcp_role.go Outdated Show resolved Hide resolved

plugin/path_role.go Show resolved Hide resolved

plugin/path_login.go Show resolved Hide resolved

Removed unused variable

d0ab734

broamski reviewed Apr 23, 2020

View reviewed changes

plugin/aliasing.go Outdated Show resolved Hide resolved

broamski reviewed Apr 23, 2020

View reviewed changes

pcman312 mentioned this pull request Apr 23, 2020

Add 'iam_alias' and 'gce_alias' fields to API docs hashicorp/vault#8822

Merged

pcman312 added 2 commits April 23, 2020 10:49

Minor cleanup

275be17

retrieveRole -> role for consistency across plugins

c3ba638

tyrannosaurus-becks approved these changes Apr 23, 2020

View reviewed changes

dustin-decker approved these changes Apr 24, 2020

View reviewed changes

kalafut approved these changes Apr 24, 2020

View reviewed changes

pcman312 merged commit 49de61a into master Apr 24, 2020

pcman312 deleted the gcp_auth_alias branch April 24, 2020 20:52

pcman312 mentioned this pull request Apr 27, 2020

Replace role-based alias config with mount based alias config #91

Merged

3 tasks

pcman312 mentioned this pull request Apr 28, 2020

Backport PR#89 & #91 to 1.4.x (selecting alias types) #94

Closed

pcman312 mentioned this pull request Apr 28, 2020

Backport PR #89 (Add alias types for IAM and GCE logins) to release/vault-1.4.x #95

Merged

sarahethompson added the 1.4.x label Jun 23, 2020

austingebauer mentioned this pull request Jul 16, 2020

Changes the default alias names to role_id for both IAM and GCE authn #99

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add alias types for IAM and GCE logins #89

Add alias types for IAM and GCE logins #89

pcman312 commented Apr 22, 2020 •

edited

catsby Apr 22, 2020

pcman312 Apr 22, 2020

catsby Apr 22, 2020

pcman312 Apr 22, 2020

catsby Apr 23, 2020

pcman312 Apr 23, 2020

tyrannosaurus-becks left a comment

broamski Apr 23, 2020

pcman312 Apr 23, 2020

tyrannosaurus-becks Apr 23, 2020 •

edited

tyrannosaurus-becks left a comment

dustin-decker left a comment

kalafut commented Apr 24, 2020

Add alias types for IAM and GCE logins #89

Add alias types for IAM and GCE logins #89

Conversation

pcman312 commented Apr 22, 2020 • edited

Overview

Design of Change

Related Issues/Pull Requests

Test Output

Contributor Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tyrannosaurus-becks left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tyrannosaurus-becks Apr 23, 2020 • edited

Choose a reason for hiding this comment

tyrannosaurus-becks left a comment

Choose a reason for hiding this comment

dustin-decker left a comment

Choose a reason for hiding this comment

kalafut commented Apr 24, 2020

pcman312 commented Apr 22, 2020 •

edited

tyrannosaurus-becks Apr 23, 2020 •

edited