-
Notifications
You must be signed in to change notification settings - Fork 4.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'oss/master' into okta-lib-baseurl
* oss/master: Fix navigation and prameters in the 'gcp' auth backend docs. (#3317) changelog++ Adding latency injector option to -dev mode for storage operations (#3289)
- Loading branch information
Showing
6 changed files
with
119 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| package physical | ||
|
|
||
| import ( | ||
| "math/rand" | ||
| "time" | ||
|
|
||
| log "github.com/mgutz/logxi/v1" | ||
| ) | ||
|
|
||
| const ( | ||
| // DefaultJitterPercent is used if no cache size is specified for NewCache | ||
| DefaultJitterPercent = 20 | ||
| ) | ||
|
|
||
| // LatencyInjector is used to add latency into underlying physical requests | ||
| type LatencyInjector struct { | ||
| backend Backend | ||
| latency time.Duration | ||
| jitterPercent int | ||
| random *rand.Rand | ||
| } | ||
|
|
||
| // TransactionalLatencyInjector is the transactional version of the latency | ||
| // injector | ||
| type TransactionalLatencyInjector struct { | ||
| *LatencyInjector | ||
| Transactional | ||
| } | ||
|
|
||
| // NewLatencyInjector returns a wrapped physical backend to simulate latency | ||
| func NewLatencyInjector(b Backend, latency time.Duration, jitter int, logger log.Logger) *LatencyInjector { | ||
| if jitter < 0 || jitter > 100 { | ||
| jitter = DefaultJitterPercent | ||
| } | ||
| logger.Info("physical/latency: creating latency injector") | ||
|
|
||
| return &LatencyInjector{ | ||
| backend: b, | ||
| latency: latency, | ||
| jitterPercent: jitter, | ||
| random: rand.New(rand.NewSource(int64(time.Now().Nanosecond()))), | ||
| } | ||
| } | ||
|
|
||
| // NewTransactionalLatencyInjector creates a new transactional LatencyInjector | ||
| func NewTransactionalLatencyInjector(b Backend, latency time.Duration, jitter int, logger log.Logger) *TransactionalLatencyInjector { | ||
| return &TransactionalLatencyInjector{ | ||
| LatencyInjector: NewLatencyInjector(b, latency, jitter, logger), | ||
| Transactional: b.(Transactional), | ||
| } | ||
| } | ||
|
|
||
| func (l *LatencyInjector) addLatency() { | ||
| // Calculate a value between 1 +- jitter% | ||
| min := 100 - l.jitterPercent | ||
| max := 100 + l.jitterPercent | ||
| percent := l.random.Intn(max-min) + min | ||
| latencyDuration := time.Duration(int(l.latency) * percent / 100) | ||
| time.Sleep(latencyDuration) | ||
| } | ||
|
|
||
| // Put is a latent put request | ||
| func (l *LatencyInjector) Put(entry *Entry) error { | ||
| l.addLatency() | ||
| return l.backend.Put(entry) | ||
| } | ||
|
|
||
| // Get is a latent get request | ||
| func (l *LatencyInjector) Get(key string) (*Entry, error) { | ||
| l.addLatency() | ||
| return l.backend.Get(key) | ||
| } | ||
|
|
||
| // Delete is a latent delete request | ||
| func (l *LatencyInjector) Delete(key string) error { | ||
| l.addLatency() | ||
| return l.backend.Delete(key) | ||
| } | ||
|
|
||
| // List is a latent list request | ||
| func (l *LatencyInjector) List(prefix string) ([]string, error) { | ||
| l.addLatency() | ||
| return l.backend.List(prefix) | ||
| } | ||
|
|
||
| // Transaction is a latent transaction request | ||
| func (l *TransactionalLatencyInjector) Transaction(txns []TxnEntry) error { | ||
| l.addLatency() | ||
| return l.Transactional.Transaction(txns) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,10 +33,10 @@ v0.8.0+ to use plugins. | |
|
|
||
| The Vault authentication workflow for IAM service accounts is as follows: | ||
|
|
||
| 1. A client with IAM service account credentials generates a signed JWT using the IAM [projects.serviceAccounts.signJwt](https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt) method. See [usage](#iam-authentication-token) for the expected format and example code. | ||
| 1. A client with IAM service account credentials generates a signed JWT using the IAM [projects.serviceAccounts.signJwt](https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt) method. See [usage](#the-iam-authentication-token) for the expected format and example code. | ||
| 2. The client sends this JWT to Vault in a login request with a role name. This role should have type `iam` | ||
| 3. Vault grabs the `kid` header value, which contains the ID of the key-pair used to generate the JWT, and the `sub` ID/email to find the service account key. If the service account does not exist or the key is not linked to the service account, Vault will deny authentication. | ||
| 4. Vault authorizes the confirmed service account against the given role. See [authorization section](#authorization) to see how each type of role handles authorization. | ||
| 4. Vault authorizes the confirmed service account against the given role. See [authorization section](#authorization-workflow) to see how each type of role handles authorization. | ||
|
|
||
| [](/assets/images/vault-gcp-iam-auth-workflow.svg) | ||
|
|
||
|
|
@@ -241,7 +241,7 @@ to learn more about parameters. | |
| ``` | ||
| $ vault write auth/gcp/role/dev-role \ | ||
| type="iam" \ | ||
| project="project-123456" \ | ||
| project_id="project-123456" \ | ||
| policies="prod,dev" \ | ||
| service_accounts="[email protected],uuid123,..." | ||
| ... | ||
|
|
@@ -300,12 +300,12 @@ $ curl $VAULT_ADDR/v1/auth/gcp/config \ | |
|
|
||
| ``` | ||
| $ curl $VAULT_ADDR/v1/auth/gcp/role/dev-role \ | ||
| -d '{ "type": "iam", "project": "project-123456", ...}' | ||
| -d '{ "type": "iam", "project_id": "project-123456", ...}' | ||
| ``` | ||
|
|
||
| #### Login to get a Vault Token | ||
|
|
||
| The endpoint for the GitHub login is `auth/gcp/login`. | ||
| The endpoint for the GCP login is `auth/gcp/login`. | ||
|
|
||
| The `gcp` mountpoint value in the url is the default mountpoint value. | ||
| If you have mounted the `gcp` backend with a different mountpoint, use that value. | ||
|
|
||