forked from CCCHH/ansible-infra
Vendor Galaxy Roles and Collections
This commit is contained in:
parent
c1e1897cda
commit
2aed20393f
3553 changed files with 387444 additions and 2 deletions
|
|
@ -0,0 +1,53 @@
|
|||
# Copyright (c), Yanis Guenane <yanis+ansible@guenane.org>, 2016
|
||||
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||
# SPDX-License-Identifier: GPL-3.0-or-later
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
import os
|
||||
import tempfile
|
||||
|
||||
|
||||
# This is taken from community.crypto
|
||||
|
||||
def write_file(module, content):
|
||||
'''
|
||||
Writes content into destination file as securely as possible.
|
||||
Uses file arguments from module.
|
||||
'''
|
||||
# Find out parameters for file
|
||||
file_args = module.load_file_common_arguments(module.params)
|
||||
# Create tempfile name
|
||||
tmp_fd, tmp_name = tempfile.mkstemp(prefix=b'.ansible_tmp')
|
||||
try:
|
||||
os.close(tmp_fd)
|
||||
except Exception:
|
||||
pass
|
||||
module.add_cleanup_file(tmp_name) # if we fail, let Ansible try to remove the file
|
||||
try:
|
||||
try:
|
||||
# Create tempfile
|
||||
file = os.open(tmp_name, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
|
||||
os.write(file, content)
|
||||
os.close(file)
|
||||
except Exception as e:
|
||||
try:
|
||||
os.remove(tmp_name)
|
||||
except Exception:
|
||||
pass
|
||||
module.fail_json(msg='Error while writing result into temporary file: {0}'.format(e))
|
||||
# Update destination to wanted permissions
|
||||
if os.path.exists(file_args['path']):
|
||||
module.set_fs_attributes_if_different(file_args, False)
|
||||
# Move tempfile to final destination
|
||||
module.atomic_move(os.path.abspath(tmp_name), os.path.abspath(file_args['path']))
|
||||
# Try to update permissions again
|
||||
module.set_fs_attributes_if_different(file_args, False)
|
||||
except Exception as e:
|
||||
try:
|
||||
os.remove(tmp_name)
|
||||
except Exception:
|
||||
pass
|
||||
module.fail_json(msg='Error while writing result: {0}'.format(e))
|
||||
436
ansible_collections/community/sops/plugins/module_utils/sops.py
Normal file
436
ansible_collections/community/sops/plugins/module_utils/sops.py
Normal file
|
|
@ -0,0 +1,436 @@
|
|||
# Copyright (c), Edoardo Tenani <e.tenani@arduino.cc>, 2018-2020
|
||||
# Simplified BSD License (see LICENSES/BSD-2-Clause.txt or https://opensource.org/licenses/BSD-2-Clause)
|
||||
# SPDX-License-Identifier: BSD-2-Clause
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
__metaclass__ = type
|
||||
|
||||
|
||||
import collections
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
|
||||
from ansible.module_utils.common.text.converters import to_text, to_native
|
||||
|
||||
# Since this is used both by plugins and modules, we need subprocess in case the `module` parameter is not used
|
||||
from subprocess import Popen, PIPE
|
||||
|
||||
|
||||
# From https://github.com/getsops/sops/blob/master/cmd/sops/codes/codes.go
|
||||
# Should be manually updated
|
||||
SOPS_ERROR_CODES = {
|
||||
1: "ErrorGeneric",
|
||||
2: "CouldNotReadInputFile",
|
||||
3: "CouldNotWriteOutputFile",
|
||||
4: "ErrorDumpingTree",
|
||||
5: "ErrorReadingConfig",
|
||||
6: "ErrorInvalidKMSEncryptionContextFormat",
|
||||
7: "ErrorInvalidSetFormat",
|
||||
8: "ErrorConflictingParameters",
|
||||
21: "ErrorEncryptingMac",
|
||||
23: "ErrorEncryptingTree",
|
||||
24: "ErrorDecryptingMac",
|
||||
25: "ErrorDecryptingTree",
|
||||
49: "CannotChangeKeysFromNonExistentFile",
|
||||
51: "MacMismatch",
|
||||
52: "MacNotFound",
|
||||
61: "ConfigFileNotFound",
|
||||
85: "KeyboardInterrupt",
|
||||
91: "InvalidTreePathFormat",
|
||||
100: "NoFileSpecified",
|
||||
128: "CouldNotRetrieveKey",
|
||||
111: "NoEncryptionKeyFound",
|
||||
200: "FileHasNotBeenModified",
|
||||
201: "NoEditorFound",
|
||||
202: "FailedToCompareVersions",
|
||||
203: "FileAlreadyEncrypted"
|
||||
}
|
||||
|
||||
_SOPS_VERSION = re.compile(r'^sops ([0-9]+)\.([0-9]+)\.([0-9]+)')
|
||||
|
||||
|
||||
def _add_argument(arguments_pre, arguments_post, *args, **kwargs):
|
||||
pre = kwargs.pop('pre', False)
|
||||
(arguments_pre if pre else arguments_post).extend(args)
|
||||
|
||||
|
||||
def _create_single_arg(argument_name, pre=False):
|
||||
def f(value, arguments_pre, arguments_post, env, version):
|
||||
_add_argument(arguments_pre, arguments_post, argument_name, to_native(value), pre=pre)
|
||||
|
||||
return f
|
||||
|
||||
|
||||
def _create_comma_separated(argument_name, pre=False):
|
||||
def f(value, arguments_pre, arguments_post, env, version):
|
||||
value = ','.join([to_native(v) for v in value])
|
||||
_add_argument(arguments_pre, arguments_post, argument_name, value, pre=pre)
|
||||
|
||||
return f
|
||||
|
||||
|
||||
def _create_repeated(argument_name, pre=False):
|
||||
def f(value, arguments_pre, arguments_post, env, version):
|
||||
for v in value:
|
||||
_add_argument(arguments_pre, arguments_post, argument_name, to_native(v), pre=pre)
|
||||
|
||||
return f
|
||||
|
||||
|
||||
def _create_boolean(argument_name, pre=False, invert=False):
|
||||
def f(value, arguments_pre, arguments_post, env, version):
|
||||
if value ^ invert:
|
||||
_add_argument(arguments_pre, arguments_post, argument_name, pre=pre)
|
||||
|
||||
return f
|
||||
|
||||
|
||||
def _create_env_variable(argument_name):
|
||||
def f(value, arguments_pre, arguments_post, env, version):
|
||||
env[argument_name] = value
|
||||
|
||||
return f
|
||||
|
||||
|
||||
GENERAL_OPTIONS = {
|
||||
'age_key': _create_env_variable('SOPS_AGE_KEY'),
|
||||
'age_keyfile': _create_env_variable('SOPS_AGE_KEY_FILE'),
|
||||
'age_ssh_private_keyfile': _create_env_variable('SOPS_AGE_SSH_PRIVATE_KEY_FILE'),
|
||||
'aws_profile': _create_single_arg('--aws-profile'),
|
||||
'aws_access_key_id': _create_env_variable('AWS_ACCESS_KEY_ID'),
|
||||
'aws_secret_access_key': _create_env_variable('AWS_SECRET_ACCESS_KEY'),
|
||||
'aws_session_token': _create_env_variable('AWS_SESSION_TOKEN'),
|
||||
'config_path': _create_single_arg('--config', pre=True),
|
||||
'enable_local_keyservice': _create_boolean('--enable-local-keyservice=false', invert=True),
|
||||
'keyservice': _create_repeated('--keyservice'),
|
||||
}
|
||||
|
||||
|
||||
ENCRYPT_OPTIONS = {
|
||||
'age': _create_comma_separated('--age'),
|
||||
'kms': _create_comma_separated('--kms'),
|
||||
'gcp_kms': _create_comma_separated('--gcp-kms'),
|
||||
'azure_kv': _create_comma_separated('--azure-kv'),
|
||||
'hc_vault_transit': _create_comma_separated('--hc-vault-transit'),
|
||||
'pgp': _create_comma_separated('--pgp'),
|
||||
'unencrypted_suffix': _create_single_arg('--unencrypted-suffix'),
|
||||
'encrypted_suffix': _create_single_arg('--encrypted-suffix'),
|
||||
'unencrypted_regex': _create_single_arg('--unencrypted-regex'),
|
||||
'encrypted_regex': _create_single_arg('--encrypted-regex'),
|
||||
'encryption_context': _create_comma_separated('--encryption-context'),
|
||||
'shamir_secret_sharing_threshold': _create_single_arg('--shamir-secret-sharing-threshold'),
|
||||
}
|
||||
|
||||
|
||||
class SopsError(Exception):
|
||||
''' Extend Exception class with sops specific information '''
|
||||
|
||||
def __init__(self, filename, exit_code, message, decryption=True, operation=None):
|
||||
if operation is None:
|
||||
operation = 'decrypt' if decryption else 'encrypt'
|
||||
if exit_code in SOPS_ERROR_CODES:
|
||||
exception_name = SOPS_ERROR_CODES[exit_code]
|
||||
message = "error with file %s: %s exited with code %d: %s" % (
|
||||
filename, exception_name, exit_code, to_native(message))
|
||||
else:
|
||||
message = "could not %s file %s; Unknown sops error code: %s; message: %s" % (
|
||||
operation, filename, exit_code, to_native(message))
|
||||
super(SopsError, self).__init__(message)
|
||||
|
||||
|
||||
SopsFileStatus = collections.namedtuple('SopsFileStatus', ['encrypted'])
|
||||
|
||||
|
||||
class SopsRunner(object):
|
||||
def _add_options(self, command_pre, command_post, env, get_option_value, options):
|
||||
if get_option_value is None:
|
||||
return
|
||||
for option, f in options.items():
|
||||
v = get_option_value(option)
|
||||
if v is not None:
|
||||
f(v, command_pre, command_post, env, self.version)
|
||||
|
||||
def _debug(self, message):
|
||||
if self.display:
|
||||
self.display.vvvv(message)
|
||||
elif self.module:
|
||||
self.module.debug(message)
|
||||
|
||||
def _warn(self, message):
|
||||
if self.display:
|
||||
self.display.warning(message)
|
||||
elif self.module:
|
||||
self.module.warn(message)
|
||||
|
||||
def __init__(self, binary, module=None, display=None):
|
||||
self.binary = binary
|
||||
self.module = module
|
||||
self.display = display
|
||||
|
||||
self.version = (3, 7, 3) # if --disable-version-check is not supported, this is version 3.7.3 or older
|
||||
self.version_string = '(before 3.8.0)'
|
||||
|
||||
exit_code, output, err = self._run_command([self.binary, '--version', '--disable-version-check'])
|
||||
if exit_code == 0:
|
||||
m = _SOPS_VERSION.match(output.decode('utf-8'))
|
||||
if m:
|
||||
self.version = int(m.group(1)), int(m.group(2)), int(m.group(3))
|
||||
self.version_string = '%d.%d.%d' % self.version
|
||||
self._debug('SOPS version detected as %s' % (self.version, ))
|
||||
else:
|
||||
self._warn('Cannot extract SOPS version from: %s' % repr(output))
|
||||
else:
|
||||
self._debug('Cannot detect SOPS version efficiently, likely a version before 3.8.0')
|
||||
|
||||
def _run_command(self, command, env=None, data=None, cwd=None):
|
||||
if self.module:
|
||||
return self.module.run_command(command, environ_update=env, cwd=cwd, encoding=None, data=data, binary_data=True)
|
||||
|
||||
process = Popen(command, stdin=None if data is None else PIPE, stdout=PIPE, stderr=PIPE, cwd=cwd, env=env)
|
||||
output, err = process.communicate(input=data)
|
||||
return process.returncode, output, err
|
||||
|
||||
def decrypt(self, encrypted_file, content=None,
|
||||
decode_output=True, rstrip=True, input_type=None, output_type=None, get_option_value=None, extract=None):
|
||||
# Run sops directly, python module is deprecated
|
||||
command = [self.binary]
|
||||
command_post = []
|
||||
env = os.environ.copy()
|
||||
self._add_options(command, command_post, env, get_option_value, GENERAL_OPTIONS)
|
||||
if self.version >= (3, 9, 0):
|
||||
command.append("decrypt")
|
||||
command.extend(command_post)
|
||||
if input_type is not None:
|
||||
command.extend(["--input-type", input_type])
|
||||
if output_type is not None:
|
||||
command.extend(["--output-type", output_type])
|
||||
if self.version < (3, 9, 0):
|
||||
command.append("--decrypt")
|
||||
if extract is not None:
|
||||
command.extend(["--extract", extract])
|
||||
if content is not None:
|
||||
encrypted_file = '/dev/stdin'
|
||||
command.append(encrypted_file)
|
||||
|
||||
exit_code, output, err = self._run_command(command, env=env, data=content)
|
||||
|
||||
if decode_output:
|
||||
# output is binary, we want UTF-8 string
|
||||
output = to_text(output, errors='surrogate_or_strict')
|
||||
# the process output is the decrypted secret; be cautious
|
||||
|
||||
# sops logs always to stderr, as stdout is used for
|
||||
# file content
|
||||
if err:
|
||||
self._debug(u'Unexpected stderr:\n' + to_text(err, errors='surrogate_or_strict'))
|
||||
|
||||
if exit_code != 0:
|
||||
raise SopsError(encrypted_file, exit_code, err, decryption=True)
|
||||
|
||||
if rstrip:
|
||||
output = output.rstrip()
|
||||
|
||||
return output
|
||||
|
||||
def encrypt(self, data, cwd=None, input_type=None, output_type=None, filename=None, get_option_value=None):
|
||||
# Run sops directly, python module is deprecated
|
||||
command = [self.binary]
|
||||
command_post = []
|
||||
env = os.environ.copy()
|
||||
self._add_options(command, command_post, env, get_option_value, GENERAL_OPTIONS)
|
||||
self._add_options(command, command_post, env, get_option_value, ENCRYPT_OPTIONS)
|
||||
if self.version >= (3, 9, 0):
|
||||
command.append("encrypt")
|
||||
command.extend(command_post)
|
||||
if input_type is not None:
|
||||
command.extend(["--input-type", input_type])
|
||||
if output_type is not None:
|
||||
command.extend(["--output-type", output_type])
|
||||
if self.version < (3, 9, 0):
|
||||
command.append("--encrypt")
|
||||
if self.version >= (3, 9, 0) and filename:
|
||||
command.extend(["--filename-override", filename])
|
||||
command.append("/dev/stdin")
|
||||
|
||||
exit_code, output, err = self._run_command(command, env=env, data=data, cwd=cwd)
|
||||
|
||||
# sops logs always to stderr, as stdout is used for
|
||||
# file content
|
||||
if err:
|
||||
self._debug(u'Unexpected stderr:\n' + to_text(err, errors='surrogate_or_strict'))
|
||||
|
||||
if exit_code != 0:
|
||||
raise SopsError('to stdout', exit_code, err, decryption=False)
|
||||
|
||||
return output
|
||||
|
||||
def has_filestatus(self):
|
||||
return self.version >= (3, 9, 0)
|
||||
|
||||
def get_filestatus(self, path):
|
||||
command = [self.binary, 'filestatus', path]
|
||||
|
||||
exit_code, output, err = self._run_command(command)
|
||||
|
||||
# sops logs always to stderr, as stdout is used for
|
||||
# file content
|
||||
if err:
|
||||
self._debug(u'Unexpected stderr:\n' + to_text(err, errors='surrogate_or_strict'))
|
||||
|
||||
if exit_code != 0:
|
||||
raise SopsError(path, exit_code, err, operation='inspect')
|
||||
|
||||
try:
|
||||
result = json.loads(output)
|
||||
return SopsFileStatus(result['encrypted'])
|
||||
except Exception as exc:
|
||||
self._debug(u'Unexpected stdout:\n' + to_text(output, errors='surrogate_or_strict'))
|
||||
raise SopsError(path, 0, 'Cannot decode filestatus result: %s' % exc, operation='inspect')
|
||||
|
||||
|
||||
_SOPS_RUNNER_CACHE = dict()
|
||||
|
||||
|
||||
class Sops():
|
||||
''' Utility class to perform sops CLI actions '''
|
||||
|
||||
@staticmethod
|
||||
def get_sops_binary(get_option_value):
|
||||
cmd = get_option_value('sops_binary') if get_option_value else None
|
||||
if cmd is None:
|
||||
cmd = 'sops'
|
||||
return cmd
|
||||
|
||||
@staticmethod
|
||||
def get_sops_runner_from_binary(sops_binary, module=None, display=None):
|
||||
candidates = _SOPS_RUNNER_CACHE.get(sops_binary, [])
|
||||
for cand_module, cand_runner in candidates:
|
||||
if cand_runner is module:
|
||||
return cand_runner
|
||||
runner = SopsRunner(sops_binary, module=module, display=display)
|
||||
candidates.append((module, runner))
|
||||
_SOPS_RUNNER_CACHE[sops_binary] = candidates
|
||||
return runner
|
||||
|
||||
@staticmethod
|
||||
def get_sops_runner_from_options(get_option_value, module=None, display=None):
|
||||
return Sops.get_sops_runner_from_binary(Sops.get_sops_binary(get_option_value), module=module, display=display)
|
||||
|
||||
@staticmethod
|
||||
def decrypt(encrypted_file, content=None,
|
||||
display=None, decode_output=True, rstrip=True, input_type=None, output_type=None, get_option_value=None, module=None, extract=None):
|
||||
runner = Sops.get_sops_runner_from_options(get_option_value, module=module, display=display)
|
||||
return runner.decrypt(
|
||||
encrypted_file,
|
||||
content=content,
|
||||
decode_output=decode_output,
|
||||
rstrip=rstrip,
|
||||
input_type=input_type,
|
||||
output_type=output_type,
|
||||
get_option_value=get_option_value,
|
||||
extract=extract,
|
||||
)
|
||||
|
||||
@staticmethod
|
||||
def encrypt(data, display=None, cwd=None, input_type=None, output_type=None, get_option_value=None, module=None, filename=None):
|
||||
runner = Sops.get_sops_runner_from_options(get_option_value, module=module, display=display)
|
||||
return runner.encrypt(
|
||||
data,
|
||||
cwd=cwd,
|
||||
input_type=input_type,
|
||||
output_type=output_type,
|
||||
get_option_value=get_option_value,
|
||||
filename=filename,
|
||||
)
|
||||
|
||||
|
||||
def get_sops_argument_spec(add_encrypt_specific=False):
|
||||
argument_spec = {
|
||||
'sops_binary': {
|
||||
'type': 'path',
|
||||
},
|
||||
'age_key': {
|
||||
'type': 'str',
|
||||
'no_log': True,
|
||||
},
|
||||
'age_keyfile': {
|
||||
'type': 'path',
|
||||
},
|
||||
'age_ssh_private_keyfile': {
|
||||
'type': 'path',
|
||||
},
|
||||
'aws_profile': {
|
||||
'type': 'str',
|
||||
},
|
||||
'aws_access_key_id': {
|
||||
'type': 'str',
|
||||
},
|
||||
'aws_secret_access_key': {
|
||||
'type': 'str',
|
||||
'no_log': True,
|
||||
},
|
||||
'aws_session_token': {
|
||||
'type': 'str',
|
||||
'no_log': True,
|
||||
},
|
||||
'config_path': {
|
||||
'type': 'path',
|
||||
},
|
||||
'enable_local_keyservice': {
|
||||
'type': 'bool',
|
||||
'default': True,
|
||||
},
|
||||
'keyservice': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
}
|
||||
if add_encrypt_specific:
|
||||
argument_spec.update({
|
||||
'age': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'kms': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'gcp_kms': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'azure_kv': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'hc_vault_transit': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'pgp': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'unencrypted_suffix': {
|
||||
'type': 'str',
|
||||
},
|
||||
'encrypted_suffix': {
|
||||
'type': 'str',
|
||||
},
|
||||
'unencrypted_regex': {
|
||||
'type': 'str',
|
||||
},
|
||||
'encrypted_regex': {
|
||||
'type': 'str',
|
||||
},
|
||||
'encryption_context': {
|
||||
'type': 'list',
|
||||
'elements': 'str',
|
||||
},
|
||||
'shamir_secret_sharing_threshold': {
|
||||
'type': 'int',
|
||||
'no_log': False,
|
||||
},
|
||||
})
|
||||
return argument_spec
|
||||
Loading…
Add table
Add a link
Reference in a new issue