mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-07 07:07:05 +02:00
07e76196ba
Implements running plugins in containers to give them some degree of isolation from the main Vault process and other plugins. It only supports running on Linux initially, where it is easiest to manage unix socket communication across the container boundary. Additionally * Adds -env arg to vault plugin register. * Don't return env from 'vault plugin info' Historically it's been omitted, and it could conceivably have secret information in it, so if we want to return it in the response, it should probably only be via explicit opt-in. Skipping for now though as it's not the main purpose of the commit.
141 lines
3.2 KiB
Go
141 lines
3.2 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package command
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/hashicorp/vault/api"
|
|
"github.com/mitchellh/cli"
|
|
"github.com/posener/complete"
|
|
)
|
|
|
|
var (
|
|
_ cli.Command = (*PluginInfoCommand)(nil)
|
|
_ cli.CommandAutocomplete = (*PluginInfoCommand)(nil)
|
|
)
|
|
|
|
type PluginInfoCommand struct {
|
|
*BaseCommand
|
|
|
|
flagVersion string
|
|
}
|
|
|
|
func (c *PluginInfoCommand) Synopsis() string {
|
|
return "Read information about a plugin in the catalog"
|
|
}
|
|
|
|
func (c *PluginInfoCommand) Help() string {
|
|
helpText := `
|
|
Usage: vault plugin info [options] TYPE NAME
|
|
|
|
Displays information about a plugin in the catalog with the given name. If
|
|
the plugin does not exist, an error is returned. The argument of type
|
|
takes "auth", "database", or "secret".
|
|
|
|
Get info about a plugin:
|
|
|
|
$ vault plugin info database mysql-database-plugin
|
|
|
|
` + c.Flags().Help()
|
|
|
|
return strings.TrimSpace(helpText)
|
|
}
|
|
|
|
func (c *PluginInfoCommand) Flags() *FlagSets {
|
|
set := c.flagSet(FlagSetHTTP | FlagSetOutputField | FlagSetOutputFormat)
|
|
|
|
f := set.NewFlagSet("Command Options")
|
|
|
|
f.StringVar(&StringVar{
|
|
Name: "version",
|
|
Target: &c.flagVersion,
|
|
Completion: complete.PredictAnything,
|
|
Usage: "Semantic version of the plugin. Optional.",
|
|
})
|
|
|
|
return set
|
|
}
|
|
|
|
func (c *PluginInfoCommand) AutocompleteArgs() complete.Predictor {
|
|
return c.PredictVaultPlugins(api.PluginTypeUnknown)
|
|
}
|
|
|
|
func (c *PluginInfoCommand) AutocompleteFlags() complete.Flags {
|
|
return c.Flags().Completions()
|
|
}
|
|
|
|
func (c *PluginInfoCommand) Run(args []string) int {
|
|
f := c.Flags()
|
|
|
|
if err := f.Parse(args); err != nil {
|
|
c.UI.Error(err.Error())
|
|
return 1
|
|
}
|
|
|
|
var pluginNameRaw, pluginTypeRaw string
|
|
args = f.Args()
|
|
switch {
|
|
case len(args) < 1:
|
|
c.UI.Error(fmt.Sprintf("Not enough arguments (expected 1 or 2, got %d)", len(args)))
|
|
return 1
|
|
case len(args) > 2:
|
|
c.UI.Error(fmt.Sprintf("Too many arguments (expected 1 or 2, got %d)", len(args)))
|
|
return 1
|
|
|
|
// These cases should come after invalid cases have been checked
|
|
case len(args) == 1:
|
|
pluginTypeRaw = "unknown"
|
|
pluginNameRaw = args[0]
|
|
case len(args) == 2:
|
|
pluginTypeRaw = args[0]
|
|
pluginNameRaw = args[1]
|
|
}
|
|
|
|
client, err := c.Client()
|
|
if err != nil {
|
|
c.UI.Error(err.Error())
|
|
return 2
|
|
}
|
|
|
|
pluginType, err := api.ParsePluginType(strings.TrimSpace(pluginTypeRaw))
|
|
if err != nil {
|
|
c.UI.Error(err.Error())
|
|
return 2
|
|
}
|
|
pluginName := strings.TrimSpace(pluginNameRaw)
|
|
|
|
resp, err := client.Sys().GetPlugin(&api.GetPluginInput{
|
|
Name: pluginName,
|
|
Type: pluginType,
|
|
Version: c.flagVersion,
|
|
})
|
|
if err != nil {
|
|
c.UI.Error(fmt.Sprintf("Error reading plugin named %s: %s", pluginName, err))
|
|
return 2
|
|
}
|
|
|
|
if resp == nil {
|
|
c.UI.Error(fmt.Sprintf("No value found for plugin %q", pluginName))
|
|
return 2
|
|
}
|
|
|
|
data := map[string]interface{}{
|
|
"args": resp.Args,
|
|
"builtin": resp.Builtin,
|
|
"command": resp.Command,
|
|
"oci_image": resp.OCIImage,
|
|
"name": resp.Name,
|
|
"sha256": resp.SHA256,
|
|
"deprecation_status": resp.DeprecationStatus,
|
|
"version": resp.Version,
|
|
}
|
|
|
|
if c.flagField != "" {
|
|
return PrintRawField(c.UI, data, c.flagField)
|
|
}
|
|
return OutputData(c.UI, data)
|
|
}
|