build(deps): bump github.com/open-policy-agent/opa from 0.62.1 to 0.64.1
Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.62.1 to 0.64.1. - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-policy-agent/opa/compare/v0.62.1...v0.64.1) --- updated-dependencies: - dependency-name: github.com/open-policy-agent/opa dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
This commit is contained in:
dependabot[bot]
committed by
Ralf Haferkamp
Ralf Haferkamp
parent
237623178a
commit
2623d6cc75
+14
@@ -541,6 +541,7 @@ func (ap *oauth2ClientCredentialsAuthPlugin) requestToken(ctx context.Context) (
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer response.Body.Close()
|
||||
|
||||
bodyRaw, err := io.ReadAll(response.Body)
|
||||
if err != nil {
|
||||
@@ -700,6 +701,7 @@ func (ap *clientTLSAuthPlugin) Prepare(req *http.Request) error {
|
||||
type awsSigningAuthPlugin struct {
|
||||
AWSEnvironmentCredentials *awsEnvironmentCredentialService `json:"environment_credentials,omitempty"`
|
||||
AWSMetadataCredentials *awsMetadataCredentialService `json:"metadata_credentials,omitempty"`
|
||||
AWSAssumeRoleCredentials *awsAssumeRoleCredentialService `json:"assume_role_credentials,omitempty"`
|
||||
AWSWebIdentityCredentials *awsWebIdentityCredentialService `json:"web_identity_credentials,omitempty"`
|
||||
AWSProfileCredentials *awsProfileCredentialService `json:"profile_credentials,omitempty"`
|
||||
|
||||
@@ -796,6 +798,11 @@ func (ap *awsSigningAuthPlugin) awsCredentialService() awsCredentialService {
|
||||
chain.addService(ap.AWSEnvironmentCredentials)
|
||||
}
|
||||
|
||||
if ap.AWSAssumeRoleCredentials != nil {
|
||||
ap.AWSAssumeRoleCredentials.logger = ap.logger
|
||||
chain.addService(ap.AWSAssumeRoleCredentials)
|
||||
}
|
||||
|
||||
if ap.AWSWebIdentityCredentials != nil {
|
||||
ap.AWSWebIdentityCredentials.logger = ap.logger
|
||||
chain.addService(ap.AWSWebIdentityCredentials)
|
||||
@@ -851,6 +858,7 @@ func (ap *awsSigningAuthPlugin) validateAndSetDefaults(serviceType string) error
|
||||
cfgs := map[bool]int{}
|
||||
cfgs[ap.AWSEnvironmentCredentials != nil]++
|
||||
cfgs[ap.AWSMetadataCredentials != nil]++
|
||||
cfgs[ap.AWSAssumeRoleCredentials != nil]++
|
||||
cfgs[ap.AWSWebIdentityCredentials != nil]++
|
||||
cfgs[ap.AWSProfileCredentials != nil]++
|
||||
|
||||
@@ -864,6 +872,12 @@ func (ap *awsSigningAuthPlugin) validateAndSetDefaults(serviceType string) error
|
||||
}
|
||||
}
|
||||
|
||||
if ap.AWSAssumeRoleCredentials != nil {
|
||||
if err := ap.AWSAssumeRoleCredentials.populateFromEnv(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if ap.AWSWebIdentityCredentials != nil {
|
||||
if err := ap.AWSWebIdentityCredentials.populateFromEnv(); err != nil {
|
||||
return err
|
||||
|
||||
+184
-17
@@ -318,6 +318,169 @@ func (cs *awsMetadataCredentialService) credentials(ctx context.Context) (aws.Cr
|
||||
return cs.creds, nil
|
||||
}
|
||||
|
||||
// awsAssumeRoleCredentialService represents a STS credential service that uses active IAM credentials
|
||||
// to obtain temporary security credentials generated by AWS STS via AssumeRole API operation
|
||||
type awsAssumeRoleCredentialService struct {
|
||||
RegionName string `json:"aws_region"`
|
||||
RoleArn string `json:"iam_role_arn"`
|
||||
SessionName string `json:"session_name"`
|
||||
Domain string `json:"aws_domain"`
|
||||
AWSSigningPlugin *awsSigningAuthPlugin `json:"aws_signing,omitempty"`
|
||||
stsURL string
|
||||
creds aws.Credentials
|
||||
expiration time.Time
|
||||
logger logging.Logger
|
||||
}
|
||||
|
||||
func (cs *awsAssumeRoleCredentialService) populateFromEnv() error {
|
||||
if cs.AWSSigningPlugin == nil {
|
||||
return errors.New("a AWS signing plugin must be specified when AssumeRole credential provider is enabled")
|
||||
}
|
||||
|
||||
switch {
|
||||
case cs.AWSSigningPlugin.AWSEnvironmentCredentials != nil:
|
||||
case cs.AWSSigningPlugin.AWSProfileCredentials != nil:
|
||||
case cs.AWSSigningPlugin.AWSMetadataCredentials != nil:
|
||||
default:
|
||||
return errors.New("unsupported AWS signing plugin with AssumeRole credential provider")
|
||||
}
|
||||
|
||||
if cs.AWSSigningPlugin.AWSMetadataCredentials != nil {
|
||||
if cs.AWSSigningPlugin.AWSMetadataCredentials.RegionName == "" {
|
||||
if cs.AWSSigningPlugin.AWSMetadataCredentials.RegionName = os.Getenv(awsRegionEnvVar); cs.AWSSigningPlugin.AWSMetadataCredentials.RegionName == "" {
|
||||
return errors.New("no " + awsRegionEnvVar + " set in environment or configuration")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if cs.AWSSigningPlugin.AWSSignatureVersion == "" {
|
||||
cs.AWSSigningPlugin.AWSSignatureVersion = "4"
|
||||
}
|
||||
|
||||
if cs.Domain == "" {
|
||||
cs.Domain = os.Getenv(awsDomainEnvVar)
|
||||
}
|
||||
|
||||
if cs.RegionName == "" {
|
||||
if cs.RegionName = os.Getenv(awsRegionEnvVar); cs.RegionName == "" {
|
||||
return errors.New("no " + awsRegionEnvVar + " set in environment or configuration")
|
||||
}
|
||||
}
|
||||
|
||||
if cs.RoleArn == "" {
|
||||
if cs.RoleArn = os.Getenv(awsRoleArnEnvVar); cs.RoleArn == "" {
|
||||
return errors.New("no " + awsRoleArnEnvVar + " set in environment or configuration")
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (cs *awsAssumeRoleCredentialService) signingCredentials(ctx context.Context) (aws.Credentials, error) {
|
||||
if cs.AWSSigningPlugin.AWSEnvironmentCredentials != nil {
|
||||
cs.AWSSigningPlugin.AWSEnvironmentCredentials.logger = cs.logger
|
||||
return cs.AWSSigningPlugin.AWSEnvironmentCredentials.credentials(ctx)
|
||||
}
|
||||
|
||||
if cs.AWSSigningPlugin.AWSProfileCredentials != nil {
|
||||
cs.AWSSigningPlugin.AWSProfileCredentials.logger = cs.logger
|
||||
return cs.AWSSigningPlugin.AWSProfileCredentials.credentials(ctx)
|
||||
}
|
||||
|
||||
cs.AWSSigningPlugin.AWSMetadataCredentials.logger = cs.logger
|
||||
return cs.AWSSigningPlugin.AWSMetadataCredentials.credentials(ctx)
|
||||
}
|
||||
|
||||
func (cs *awsAssumeRoleCredentialService) stsPath() string {
|
||||
return getSTSPath(cs.Domain, cs.stsURL, cs.RegionName)
|
||||
}
|
||||
|
||||
func (cs *awsAssumeRoleCredentialService) refreshFromService(ctx context.Context) error {
|
||||
// define the expected JSON payload from the EC2 credential service
|
||||
// ref. https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
|
||||
type responsePayload struct {
|
||||
Result struct {
|
||||
Credentials struct {
|
||||
SessionToken string
|
||||
SecretAccessKey string
|
||||
Expiration time.Time
|
||||
AccessKeyID string `xml:"AccessKeyId"`
|
||||
}
|
||||
} `xml:"AssumeRoleResult"`
|
||||
}
|
||||
|
||||
// short circuit if a reasonable amount of time until credential expiration remains
|
||||
if time.Now().Add(time.Minute * 5).Before(cs.expiration) {
|
||||
cs.logger.Debug("Credentials previously obtained from sts service still valid.")
|
||||
return nil
|
||||
}
|
||||
|
||||
cs.logger.Debug("Obtaining credentials from sts for role %s.", cs.RoleArn)
|
||||
|
||||
var sessionName string
|
||||
if cs.SessionName == "" {
|
||||
sessionName = "open-policy-agent"
|
||||
} else {
|
||||
sessionName = cs.SessionName
|
||||
}
|
||||
|
||||
queryVals := url.Values{
|
||||
"Action": []string{"AssumeRole"},
|
||||
"RoleSessionName": []string{sessionName},
|
||||
"RoleArn": []string{cs.RoleArn},
|
||||
"Version": []string{"2011-06-15"},
|
||||
}
|
||||
stsRequestURL, _ := url.Parse(cs.stsPath())
|
||||
|
||||
// construct an HTTP client with a reasonably short timeout
|
||||
client := &http.Client{Timeout: time.Second * 10}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, stsRequestURL.String(), strings.NewReader(queryVals.Encode()))
|
||||
if err != nil {
|
||||
return errors.New("unable to construct STS HTTP request: " + err.Error())
|
||||
}
|
||||
|
||||
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
|
||||
|
||||
// Note: Calls to AWS STS AssumeRole must be signed using the access key ID
|
||||
// and secret access key
|
||||
signingCreds, err := cs.signingCredentials(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = aws.SignRequest(req, "sts", signingCreds, time.Now(), cs.AWSSigningPlugin.AWSSignatureVersion)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
body, err := aws.DoRequestWithClient(req, client, "STS", cs.logger)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var payload responsePayload
|
||||
err = xml.Unmarshal(body, &payload)
|
||||
if err != nil {
|
||||
return errors.New("failed to parse credential response from STS service: " + err.Error())
|
||||
}
|
||||
|
||||
cs.expiration = payload.Result.Credentials.Expiration
|
||||
cs.creds.AccessKey = payload.Result.Credentials.AccessKeyID
|
||||
cs.creds.SecretKey = payload.Result.Credentials.SecretAccessKey
|
||||
cs.creds.SessionToken = payload.Result.Credentials.SessionToken
|
||||
cs.creds.RegionName = cs.RegionName
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (cs *awsAssumeRoleCredentialService) credentials(ctx context.Context) (aws.Credentials, error) {
|
||||
err := cs.refreshFromService(ctx)
|
||||
if err != nil {
|
||||
return cs.creds, err
|
||||
}
|
||||
return cs.creds, nil
|
||||
}
|
||||
|
||||
// awsWebIdentityCredentialService represents an STS WebIdentity credential services
|
||||
type awsWebIdentityCredentialService struct {
|
||||
RoleArn string
|
||||
@@ -354,23 +517,7 @@ func (cs *awsWebIdentityCredentialService) populateFromEnv() error {
|
||||
}
|
||||
|
||||
func (cs *awsWebIdentityCredentialService) stsPath() string {
|
||||
var domain string
|
||||
if cs.Domain != "" {
|
||||
domain = strings.ToLower(cs.Domain)
|
||||
} else {
|
||||
domain = stsDefaultDomain
|
||||
}
|
||||
|
||||
var stsPath string
|
||||
switch {
|
||||
case cs.stsURL != "":
|
||||
stsPath = cs.stsURL
|
||||
case cs.RegionName != "":
|
||||
stsPath = fmt.Sprintf(stsRegionPath, strings.ToLower(cs.RegionName), domain)
|
||||
default:
|
||||
stsPath = fmt.Sprintf(stsDefaultPath, domain)
|
||||
}
|
||||
return stsPath
|
||||
return getSTSPath(cs.Domain, cs.stsURL, cs.RegionName)
|
||||
}
|
||||
|
||||
func (cs *awsWebIdentityCredentialService) refreshFromService(ctx context.Context) error {
|
||||
@@ -555,3 +702,23 @@ func (ap *awsKMSSignPlugin) SignDigest(ctx context.Context, digest []byte, keyID
|
||||
|
||||
return signature, nil
|
||||
}
|
||||
|
||||
func getSTSPath(stsDomain, stsURL, regionName string) string {
|
||||
var domain string
|
||||
if stsDomain != "" {
|
||||
domain = strings.ToLower(stsDomain)
|
||||
} else {
|
||||
domain = stsDefaultDomain
|
||||
}
|
||||
|
||||
var stsPath string
|
||||
switch {
|
||||
case stsURL != "":
|
||||
stsPath = stsURL
|
||||
case regionName != "":
|
||||
stsPath = fmt.Sprintf(stsRegionPath, strings.ToLower(regionName), domain)
|
||||
default:
|
||||
stsPath = fmt.Sprintf(stsDefaultPath, domain)
|
||||
}
|
||||
return stsPath
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user