obervinov / vault-package Goto Github PK

https://github.com/obervinov/vault-package/blob/main/vault/vault.py#L485

Now the data from the generated approle by this module is simply returned to the variable.
You need to add support for saving to the system keystore, by analogy with init-data.

https://github.com/obervinov/vault-package/blob/v2.0.0/vault/vault.py#L396-L406

Workflow link: https://github.com/obervinov/_templates/blob/v1.0.3/.github/workflows/verify.package.yml

Because in Release Notes and Github Web preview links don't work and it doesn't look readable and understandable

• After testing the new version of the package, you need to add more working examples and structure to README.md
• It is also necessary to add additional information about the operating modes of this module.

Adding dependencies between tasks (for fix errors here and here)
Maybe add to templates or specified workflow
https://github.com/obervinov/users-package/blob/main/.github/workflows/release.yml

typos

[2024-01-29 09:00:49,675] WARNING [logger.logger.init_instance:255] [class.VaultClient] the vault instance was successfully initialized: but sensitive information could not be written to the system keystore. They will be written to a temporary file /tmp/vault-package-init-data.json. Please, move this file to a safe place.

correct version

[2024-01-29 09:00:49,675] WARNING [logger.logger.init_instance:255] [class.VaultClient] the vault instance was successfully initialized, but sensitive information could not be written to the system keystore. They will be written to a temporary file /tmp/vault-package-init-data.json. Please, move this file to a safe place.

https://developer.hashicorp.com/vault/docs/secrets/databases

added new string in template

**full changelog**: https://github.com/obervinov/vault-package/compare/1...2 by @ obervinov https://github.com/obervinov/vault-package/pull/1

To determine that the token has expired, the methods use a simple exception hvac.exceptions.Forbidden.

Since the exception is too general, there may be a situation when, for example, an incorrectly configured policy for approle and the module accesses a secret to which it does not have access.
Thus, we get into an infinite loop in which the token will be reissued indefinitely due to incorrectly configured rights.

https://github.com/obervinov/vault-package/blob/main/vault/vault.py#L472

Describe the dependencies that are used in the project (or consider dependency graph as an alternative)

Add working examples with the capabilities of the module:

• Setting up a new storage instance
• Secrets of reading/writing

https://developer.hashicorp.com/vault/docs/auth/kubernetes

Is your feature request related to a problem? Please describe.
Now if you try to get a list of secrets on a path that doesn't exist - it will raise an exception. Some situations require more controlled handling of such exceptions.

Describe the solution you'd like
Return None if the path does not exist when the list_secrets() method is called.

Describe alternatives you've considered
You may also consider adding custom exceptions or importing existing exceptions from hvac.

Additional context
https://github.com/obervinov/vault-package/blob/main/vault/vault.py#L591

• VAULT_ADDR
• VAULT_TOKEN
• VAULT_APPROLE_ID
• VAULT_APPROLE_SECRETID

• fix install_requires

    install_requires=[
        'logger @ git+https://github.com/obervinov/[email protected]',
    ]

• remove dependency_links

• fix requirements.txt

logger @ git+https://github.com/obervinov/[email protected]

• update topics in classifiers

    classifiers=[
        "License :: OSI Approved :: MIT License",
        "Programming Language :: Python :: 3.10",
        "Operating System :: OS Independent",
        "Intended Audience :: Developers",
        "Topic :: Software Development"
    ]

for example

name: Test, Build and create relese

on:
  push:
    branches:    
      - '*'
      - '*/*'
      - '**'

env:
  PROJECT_DESCRIPTION: "This project is a telegram bot that allows you to create backups of content from your Instagram profile to Dropbox or Mega clouds, as well as in the local file system."


jobs:
  pylint:
    uses: obervinov/_templates/.github/workflows/[email protected]
  verify-changelog:
    uses: obervinov/_templates/.github/workflows/[email protected]
  pytest:
    uses: obervinov/_templates/.github/workflows/[email protected]
  build-release:
    uses: obervinov/_templates/.github/workflows/build.docker.yml@release/v1.0.5
    needs: [pylint, verify-changelog, pytest]

Docs:

• https://docs.pytest.org/en/7 .2.x/
• https://realpython.com/pytest-python-testing/

Сoverage:

• tests for initializing a new vault instance
• tests for configuring an existing vault instance
• tests for working with secrets

Tests should:

• to cover the situation when there is a real instance of vault
• add a new workflow with a supported storage service

or VAULT_PROJECT_NAME to determine the mount point

Goal: Automate the process of creating new vault instances or customizing existing ones for my projects
The expected behavior of the module looks like this::

• Reading environment variables VAULT_ADDR and VAULT_TOKEN for authorization in the vault instance
• Writing a policy from the local repository vault/policy.hcl to the vault instance
• Creating a new namespace
• Creating a new approle for the project
• Initialize and unseal if the instance is launched for the first time
• Added example to README.md

Goal:
Reduce the default setting for the lifetime of the approle token for vault instances.
To do this, you need to implement a mechanism that can recognize when a token has expired and issue a new one.
It is assumed that the lifetime of the token will be 1 hours.

https://pypi.org/project/keyring/

module.prepare_environment.null_resource.remote-commands (remote-exec): [2023-07-13 11:00:45,071] WARNING [root.create_approle:423] [class.VaultClient] confidential vault login data via approle was not saved.
module.prepare_environment.null_resource.remote-commands (remote-exec): [2023-07-13 11:00:45,007] WARNING [root.init_instance:241] [class.VaultClient] the vault instance was successfully initialized: but sensitive data for managing this instance was not saved.

• fix saving to the keystore for ubuntu
• add an alternative method for saving init data if it was not possible to save in the keystore

https://github.com/marketplace/actions/python-poetry-action
https://python-poetry.org

• remove setup.py
• set the pyproject.toml file to the form https://github.com/obervinov/messages-package/blob/main/pyproject.toml
• switch dependabot to poetry
• update workflows from https://github.com/obervinov/messages-package/tree/main/.github/workflows