You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "shreemaan-abhishek (via GitHub)" <gi...@apache.org> on 2023/02/15 08:56:32 UTC
[GitHub] [apisix] shreemaan-abhishek opened a new pull request, #8866: feat: use env var instead of plain text for vault token
shreemaan-abhishek opened a new pull request, #8866:
URL: https://github.com/apache/apisix/pull/8866
### Description
Currently, we use plain text to add `vault` as a secret resource. Like so:
```bash
curl http://127.0.0.1:9180/apisix/admin/secret/vault/1 \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "https://127.0.0.1:8200"，
"prefix": "apisix",
"token": "root"
}'
```
This PR implements a feature that would disallow usage of plain text in secret resource tokens and only allow the use of environment variables in the following format: `$ENV://NAME_OF_ENV_VAR`.
This is the final outcome:
```bash
curl http://127.0.0.1:9180/apisix/admin/secret/vault/1 \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"uri": "https://127.0.0.1:8200"，
"prefix": "apisix",
"token": "$ENV://VAULT_TOKEN"
}'
```
cc: @soulbird
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
<!--
Note
1. Mark the PR as draft until it's ready to be reviewed.
2. Always add/update tests for any changes unless you have a good reason.
3. Always update the documentation to reflect the changes made in the PR.
4. Make a new commit to resolve conversations instead of `push -f`.
5. To resolve merge conflicts, merge master instead of rebasing.
6. Use "request review" to notify the reviewer after making changes.
7. Only a reviewer can mark a conversation as resolved.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107961505
##########
t/config-center-yaml/secret.t:
##########
@@ -388,3 +392,131 @@ env secret=apisix;
GET /t
--- response_body
nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
Review Comment:
I just duplicated all the test cases containing the token with just one change: replace the token with the environment variable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107032277
##########
t/config-center-yaml/secret.t:
##########
@@ -61,7 +61,7 @@ __DATA__
secrets:
- id: vault/1
prefix: kv/apisix
- token: root
+ token: "$ENV://VAULT_TOKEN"
Review Comment:
Yes, we won't be able to use such a configuration.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander merged pull request #8866: feat: use env var instead of plain text for vault token
Posted by "spacewander (via GitHub)" <gi...@apache.org>.
spacewander merged PR #8866:
URL: https://github.com/apache/apisix/pull/8866
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on PR #8866:
URL: https://github.com/apache/apisix/pull/8866#issuecomment-1437035212
> > The test cases under t/plugin seem redundant, don't you think?
>
> I thought the same. But then I thought they would provide better safety from potential nasty bugs in the future.
ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on PR #8866:
URL: https://github.com/apache/apisix/pull/8866#issuecomment-1436184618
IMO, just adding a test case for t/secret/vault.t is enough. The test cases under t/plugin seem redundant, don't you think?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on pull request #8866: feat: use env var instead of plain text for vault token
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on PR #8866:
URL: https://github.com/apache/apisix/pull/8866#issuecomment-1436263486
> The test cases under t/plugin seem redundant, don't you think?
I thought the same. But then I thought they would provide better safety from potential nasty bugs in the future.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "spacewander (via GitHub)" <gi...@apache.org>.
spacewander commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1113733255
##########
apisix/secret/vault.lua:
##########
@@ -26,6 +26,7 @@ local norm_path = require("pl.path").normpath
local sub = core.string.sub
local rfind_char = core.string.rfind_char
Review Comment:
We can avoid the blank line here? Other files don't add a blank line among localized variables.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] spacewander commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "spacewander (via GitHub)" <gi...@apache.org>.
spacewander commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1112469413
##########
apisix/secret/vault.lua:
##########
@@ -26,6 +26,7 @@ local norm_path = require("pl.path").normpath
local sub = core.string.sub
local rfind_char = core.string.rfind_char
+local env = require("apisix.core.env")
Review Comment:
Can't we import it like `core.string.sub`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107024352
##########
t/config-center-yaml/secret.t:
##########
@@ -61,7 +61,7 @@ __DATA__
secrets:
- id: vault/1
prefix: kv/apisix
- token: root
+ token: "$ENV://VAULT_TOKEN"
Review Comment:
So we can no longer use such a configuration?
```
token: root
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107032277
##########
t/config-center-yaml/secret.t:
##########
@@ -61,7 +61,7 @@ __DATA__
secrets:
- id: vault/1
prefix: kv/apisix
- token: root
+ token: "$ENV://VAULT_TOKEN"
Review Comment:
Yes, we won't be able to use such a configuration. Let me fix that quickly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1112801340
##########
apisix/secret/vault.lua:
##########
@@ -53,10 +54,15 @@ local function make_request_to_vault(conf, method, key, data)
local req_addr = conf.uri .. norm_path("/v1/"
.. conf.prefix .. "/" .. key)
+ local token, _ = env.fetch_by_uri(conf.token)
Review Comment:
Just use `core.env.fetch_by_uri`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1111378314
##########
t/config-center-yaml/secret.t:
##########
@@ -14,6 +14,10 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
+BEGIN {
+ $ENV{VAULT_TOKEN} = "root";
Review Comment:
Why was this added?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1112810367
##########
apisix/secret/vault.lua:
##########
@@ -53,10 +54,15 @@ local function make_request_to_vault(conf, method, key, data)
local req_addr = conf.uri .. norm_path("/v1/"
.. conf.prefix .. "/" .. key)
+ local token, _ = env.fetch_by_uri(conf.token)
Review Comment:
I think it's okay to import using `require` and use because if in the future we need to use the env module again in this file then we won't have to re-import using `require`.
Also, at that time in the future, we will not have to replace `core.env.fetch_by_uri` with `env.fetch_by_uri`. WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107906512
##########
ci/centos7-ci.sh:
##########
@@ -84,6 +84,7 @@ run_case() {
export_or_prefix
make init
set_coredns
+ export VAULT_TOKEN="root"
Review Comment:
refer: https://github.com/apache/apisix/blob/master/t/core/env.t#L17-L20
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107941614
##########
t/config-center-yaml/secret.t:
##########
@@ -388,3 +392,131 @@ env secret=apisix;
GET /t
--- response_body
nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
+
+
+
+=== TEST 18: validate secrets with the token in an env var: manager not exits
+--- apisix_yaml
+secrets:
+ - id: hhh/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+secret manager not exits
+
+
+
+=== TEST 19: load config normal with the token in an env var
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: http://127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say("len: ", #values)
+
+ ngx.say("id: ", values[1].value.id)
+ ngx.say("prefix: ", values[1].value.prefix)
+ ngx.say("token: ", values[1].value.token)
+ ngx.say("uri: ", values[1].value.uri)
+ }
+ }
+--- request
+GET /t
+--- response_body
+len: 1
+id: vault/1
+prefix: kv/apisix
+token: $ENV://VAULT_TOKEN
+uri: http://127.0.0.1:8200
+
Review Comment:
There is no need to add this test
##########
t/config-center-yaml/secret.t:
##########
@@ -388,3 +392,131 @@ env secret=apisix;
GET /t
--- response_body
nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
Review Comment:
Why add this test case? It doesn't look like it has anything to do with your modification？
##########
t/config-center-yaml/secret.t:
##########
@@ -388,3 +392,131 @@ env secret=apisix;
GET /t
--- response_body
nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
+
+
+
+=== TEST 18: validate secrets with the token in an env var: manager not exits
+--- apisix_yaml
+secrets:
+ - id: hhh/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+secret manager not exits
Review Comment:
ditto
##########
t/config-center-yaml/secret.t:
##########
@@ -388,3 +392,131 @@ env secret=apisix;
GET /t
--- response_body
nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
+
+
+
+=== TEST 18: validate secrets with the token in an env var: manager not exits
+--- apisix_yaml
+secrets:
+ - id: hhh/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+secret manager not exits
+
+
+
+=== TEST 19: load config normal with the token in an env var
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: http://127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say("len: ", #values)
+
+ ngx.say("id: ", values[1].value.id)
+ ngx.say("prefix: ", values[1].value.prefix)
+ ngx.say("token: ", values[1].value.token)
+ ngx.say("uri: ", values[1].value.uri)
+ }
+ }
+--- request
+GET /t
+--- response_body
+len: 1
+id: vault/1
+prefix: kv/apisix
+token: $ENV://VAULT_TOKEN
+uri: http://127.0.0.1:8200
+
+
+
+=== TEST 20: secret.fetch_by_uri with the token in an env var: start with $secret://
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: http://127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local value = secret.fetch_by_uri("$secret://vault/1/apisix-key/key")
+ ngx.say(value)
+ }
+ }
+--- request
+GET /t
+--- response_body
+value
+
+
+
+=== TEST 21: secret.fetch_by_uri, no sub key value with the token in an env var
Review Comment:
This test case already exists
##########
t/plugin/basic-auth.t:
##########
@@ -540,3 +544,73 @@ GET /echo
Authorization: Basic Zm9vOmJhcg==
--- response_headers
Authorization: Basic Zm9vOmJhcg==
+
+
+
+=== TEST 25: set basic-auth conf with the token in an env var: password uses secret ref
+--- request
+GET /t
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ -- put secret vault config
+ local code, body = t('/apisix/admin/secrets/vault/test1',
+ ngx.HTTP_PUT,
+ [[{
+ "uri": "http://127.0.0.1:8200",
+ "prefix" : "kv/apisix",
+ "token" : "$ENV://VAULT_TOKEN"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ return ngx.say(body)
+ end
+
+ -- change consumer with secrets ref: vault
+ code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "foo",
+ "plugins": {
+ "basic-auth": {
+ "username": "foo",
+ "password": "$secret://vault/test1/foo/passwd"
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ return ngx.say(body)
+ end
+
+ -- set route
+ code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "basic-auth": {
+ "hide_credentials": false
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/echo"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
Review Comment:
You only configured the route, you also need to verify whether the route is effective
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] shreemaan-abhishek commented on a diff in pull request #8866: feat: use env var instead of plain text for vault token
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on code in PR #8866:
URL: https://github.com/apache/apisix/pull/8866#discussion_r1107961505
##########
t/config-center-yaml/secret.t:
##########
@@ -388,3 +392,131 @@ env secret=apisix;
GET /t
--- response_body
nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+ - id: vault/1
+ prefix: kv/apisix
+ token: "$ENV://VAULT_TOKEN"
+ uri: 127.0.0.1:8200
+#END
+--- config
+ location /t {
+ content_by_lua_block {
+ local secret = require("apisix.secret")
+ local values = secret.secrets()
+ ngx.say(#values)
+ }
+ }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
Review Comment:
I just duplicated all the test cases containing the token with just one change: replace the token with the environment variable. Let me do something better. 😂
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org