Vault for twilio

cmd/sachet/config.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"github.com/messagebird/sachet/vault"
 	"io/ioutil"
 
 	"github.com/prometheus/alertmanager/template"
@@ -81,6 +82,7 @@ var config struct {
 
 	Receivers []ReceiverConf
 	Templates []string
+	Vault     vault.Config
 }
 var tmpl *template.Template
 

cmd/sachet/main.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"flag"
 	"fmt"
+	"github.com/messagebird/sachet/vault"
 	"log"
 	"net/http"
 	"os"
@@ -97,7 +98,7 @@ func providerByName(name string) (sachet.Provider, error) {
 	case "nexmo":
 		return nexmo.NewNexmo(config.Providers.Nexmo)
 	case "twilio":
-		return twilio.NewTwilio(config.Providers.Twilio), nil
+		return twilio.NewTwilio(config.Providers.Twilio, &vault.KVv2SecretsProvider{Config: config.Vault})
 	case "infobip":
 		return infobip.NewInfobip(config.Providers.Infobip), nil
 	case "kannel":

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/common v1.0.239
 	github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/sms v1.0.239
 	github.com/xconstruct/go-pushbullet v0.0.0-20171206132031-67759df45fbb
-	golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf // indirect
+	golang.org/x/sys v0.5.0 // indirect
 	google.golang.org/protobuf v1.27.1 // indirect
 	gopkg.in/DATA-DOG/go-sqlmock.v1 v1.3.0 // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
@@ -40,21 +40,40 @@ require github.com/textmagic/textmagic-rest-go-v2/v2 v2.0.1816
 require (
 	github.com/antihax/optional v1.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.6.6 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/vault/api v1.9.2 // indirect
+	github.com/hashicorp/vault/api/auth/kubernetes v0.4.1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.11 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 // indirect
 	github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546 // indirect
 	github.com/stretchr/testify v1.7.0 // indirect
-	golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985 // indirect
+	golang.org/x/crypto v0.6.0 // indirect
+	golang.org/x/net v0.7.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c // indirect
+	golang.org/x/text v0.7.0 // indirect
+	golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 // indirect
 	google.golang.org/appengine v1.6.6 // indirect
 	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
 )

provider/twilio/twilio.go

@@ -2,7 +2,6 @@ package twilio
 
 import (
 	"github.com/carlosdp/twiliogo"
-
 	"github.com/messagebird/sachet"
 )
 
@@ -17,8 +16,23 @@ type Twilio struct {
 	client twiliogo.Client
 }
 
-func NewTwilio(config Config) *Twilio {
-	return &Twilio{client: twiliogo.NewClient(config.AccountSID, config.AuthToken)}
+const (
+	accountSIDVaultKey = "TWILIO_ACCOUNT_SID"
+	authTokenVaultKey  = "TWILIO_AUTH_TOKEN"
+)
+
+func NewTwilio(config Config, secretsProvider sachet.SecureSecretsProvider) (*Twilio, error) {
+	var accountSID, authToken string
+	if config.AccountSID == accountSIDVaultKey && config.AuthToken == authTokenVaultKey {
+		secrets, err := secretsProvider.GetSecrets(accountSIDVaultKey, authTokenVaultKey)
+		if err != nil {
+			return nil, err
+		}
+		accountSID, authToken = secrets[accountSIDVaultKey], secrets[authTokenVaultKey]
+	} else {
+		accountSID, authToken = config.AccountSID, config.AuthToken
+	}
+	return &Twilio{client: twiliogo.NewClient(accountSID, authToken)}, nil
 }
 
 func (tw *Twilio) Send(message sachet.Message) error {

sachet.go

@@ -10,3 +10,7 @@ type Message struct {
 	Text string
 	Type string
 }
+
+type SecureSecretsProvider interface {
+	GetSecrets(secrets ...string) (map[string]string, error)
+}

vault/vault.go

@@ -0,0 +1,70 @@
+package vault
+
+import (
+	"context"
+	"fmt"
+
+	vaultApi "github.com/hashicorp/vault/api"
+	vaultAuth "github.com/hashicorp/vault/api/auth/kubernetes"
+)
+
+type Config struct {
+	Address                string
+	ServiceAccountTokePath string
+	Role                   string
+	KVv2MountPath          string
+	KVv2SecretPath         string
+}
+
+type KVv2SecretsProvider struct {
+	Config Config
+}
+
+func (p *KVv2SecretsProvider) GetSecrets(secrets ...string) (map[string]string, error) {
+	client, err := p.getVaultApiClient()
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string]string)
+	for _, secretKey := range secrets {
+		secret, err := client.KVv2(p.Config.KVv2MountPath).Get(context.Background(), p.Config.KVv2SecretPath)
+		if err != nil {
+			return nil, fmt.Errorf("unable to read secret: %w", err)
+		}
+		value, ok := secret.Data[secretKey]
+		if !ok {
+			return nil, fmt.Errorf("unable to get secret value for key: %s", secretKey)
+		}
+		secretValue, ok := value.(string)
+		if !ok {
+			return nil, fmt.Errorf("value type assertion failed: %T %#v", value, value)
+		}
+		result[secretKey] = secretValue
+	}
+	return result, nil
+}
+
+func (p *KVv2SecretsProvider) getVaultApiClient() (*vaultApi.Client, error) {
+	vaultDefaultConfig := vaultApi.DefaultConfig()
+	vaultDefaultConfig.Address = p.Config.Address
+
+	client, err := vaultApi.NewClient(vaultDefaultConfig)
+	if err != nil {
+		return nil, fmt.Errorf("unable to initialize Vault client: %w", err)
+	}
+	k8sAuth, err := vaultAuth.NewKubernetesAuth(p.Config.Role,
+		vaultAuth.WithServiceAccountTokenPath(p.Config.ServiceAccountTokePath))
+	if err != nil {
+		return nil, fmt.Errorf("unable to initialize Kubernetes auth method: %w", err)
+	}
+
+	authInfo, err := client.Auth().Login(context.TODO(), k8sAuth)
+	if err != nil {
+		return nil, fmt.Errorf("unable to log in with Kubernetes auth: %w", err)
+	}
+	if authInfo == nil {
+		return nil, fmt.Errorf("no auth info was returned after login")
+	}
+	return client, nil
+}