feat: use env var instead of plain text for vault token

apisix/secret/vault.lua

@@ -26,6 +26,7 @@ local norm_path = require("pl.path").normpath
 local sub        = core.string.sub
 local rfind_char = core.string.rfind_char
 
+local env        = require("apisix.core.env")
 
 local schema = {
     type = "object",
@@ -53,10 +54,15 @@ local function make_request_to_vault(conf, method, key, data)
     local req_addr = conf.uri .. norm_path("/v1/"
                 .. conf.prefix .. "/" .. key)
 
+    local token, _ = env.fetch_by_uri(conf.token)
+    if not token then
+        token = conf.token
+    end
+
     local res, err = httpc:request_uri(req_addr, {
         method = method,
         headers = {
-            ["X-Vault-Token"] = conf.token
+            ["X-Vault-Token"] = token
         },
         body = core.json.encode(data or {}, true)
     })

t/config-center-yaml/secret.t

@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+BEGIN {
+    $ENV{VAULT_TOKEN} = "root";
+}
+
 use t::APISIX 'no_plan';
 
 repeat_each(1);
@@ -388,3 +392,131 @@ env secret=apisix;
 GET /t
 --- response_body
 nil
+
+
+
+=== TEST 17: validate secret/vault with the token in an env var: wrong schema
+--- apisix_yaml
+secrets:
+  - id: vault/1
+    prefix: kv/apisix
+    token: "$ENV://VAULT_TOKEN"
+    uri: 127.0.0.1:8200
+#END
+--- config
+    location /t {
+        content_by_lua_block {
+            local secret = require("apisix.secret")
+            local values = secret.secrets()
+            ngx.say(#values)
+        }
+    }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+property "uri" validation failed: failed to match pattern "^[^\\/]+:\\/\\/([\\da-zA-Z.-]+|\\[[\\da-fA-F:]+\\])(:\\d+)?"
+
+
+
+=== TEST 18: validate secrets with the token in an env var: manager not exits
+--- apisix_yaml
+secrets:
+  - id: hhh/1
+    prefix: kv/apisix
+    token: "$ENV://VAULT_TOKEN"
+    uri: 127.0.0.1:8200
+#END
+--- config
+    location /t {
+        content_by_lua_block {
+            local secret = require("apisix.secret")
+            local values = secret.secrets()
+            ngx.say(#values)
+        }
+    }
+--- request
+GET /t
+--- response_body
+0
+--- error_log
+secret manager not exits
+
+
+
+=== TEST 19: load config normal with the token in an env var
+--- apisix_yaml
+secrets:
+  - id: vault/1
+    prefix: kv/apisix
+    token: "$ENV://VAULT_TOKEN"
+    uri: http://127.0.0.1:8200
+#END
+--- config
+    location /t {
+        content_by_lua_block {
+            local secret = require("apisix.secret")
+            local values = secret.secrets()
+            ngx.say("len: ", #values)
+
+            ngx.say("id: ", values[1].value.id)
+            ngx.say("prefix: ", values[1].value.prefix)
+            ngx.say("token: ", values[1].value.token)
+            ngx.say("uri: ", values[1].value.uri)
+        }
+    }
+--- request
+GET /t
+--- response_body
+len: 1
+id: vault/1
+prefix: kv/apisix
+token: $ENV://VAULT_TOKEN
+uri: http://127.0.0.1:8200
+
+
+
+=== TEST 20: secret.fetch_by_uri with the token in an env var: start with $secret://
+--- apisix_yaml
+secrets:
+  - id: vault/1
+    prefix: kv/apisix
+    token: "$ENV://VAULT_TOKEN"
+    uri: http://127.0.0.1:8200
+#END
+--- config
+    location /t {
+        content_by_lua_block {
+            local secret = require("apisix.secret")
+            local value = secret.fetch_by_uri("$secret://vault/1/apisix-key/key")
+            ngx.say(value)
+        }
+    }
+--- request
+GET /t
+--- response_body
+value
+
+
+
+=== TEST 21: secret.fetch_by_uri, no sub key value with the token in an env var
+--- apisix_yaml
+secrets:
+  - id: vault/1
+    prefix: kv/apisix
+    token: "$ENV://VAULT_TOKEN"
+    uri: http://127.0.0.1:8200
+#END
+--- config
+    location /t {
+        content_by_lua_block {
+            local secret = require("apisix.secret")
+            local value = secret.fetch_by_uri("$secret://vault/1/apisix-key/bar")
+            ngx.say(value)
+        }
+    }
+--- request
+GET /t
+--- response_body
+nil

t/plugin/basic-auth.t

@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+BEGIN {
+    $ENV{VAULT_TOKEN} = "root";
+}
+
 use t::APISIX 'no_plan';
 
 repeat_each(2);
@@ -540,3 +544,73 @@ GET /echo
 Authorization: Basic Zm9vOmJhcg==
 --- response_headers
 Authorization: Basic Zm9vOmJhcg==
+
+
+
+=== TEST 25: set basic-auth conf with the token in an env var: password uses secret ref
+--- request
+GET /t
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            -- put secret vault config
+            local code, body = t('/apisix/admin/secrets/vault/test1',
+                ngx.HTTP_PUT,
+                [[{
+                    "uri": "http://127.0.0.1:8200",
+                    "prefix" : "kv/apisix",
+                    "token" : "$ENV://VAULT_TOKEN"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+                return ngx.say(body)
+            end
+
+            -- change consumer with secrets ref: vault
+            code, body = t('/apisix/admin/consumers',
+                ngx.HTTP_PUT,
+                [[{
+                    "username": "foo",
+                    "plugins": {
+                        "basic-auth": {
+                            "username": "foo",
+                            "password": "$secret://vault/test1/foo/passwd"
+                        }
+                    }
+                }]]
+                )
+            if code >= 300 then
+                ngx.status = code
+                return ngx.say(body)
+            end
+
+            -- set route
+            code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "basic-auth": {
+                            "hide_credentials": false
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/echo"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed

t/plugin/hmac-auth4.t

@@ -14,6 +14,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+BEGIN {
+    $ENV{VAULT_TOKEN} = "root";
+}
 
 use t::APISIX 'no_plan';
 
@@ -166,3 +169,69 @@ location /t {
 }
 --- response_body
 passed
+
+
+
+=== TEST 4: set hmac-auth conf with the token in an env var: secret_key uses secret ref
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            -- put secret vault config
+            local code, body = t('/apisix/admin/secrets/vault/test1',
+                ngx.HTTP_PUT,
+                [[{
+                    "uri": "http://127.0.0.1:8200",
+                    "prefix" : "kv/apisix",
+                    "token" : "$ENV://VAULT_TOKEN"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+                return ngx.say(body)
+            end
+
+            -- change consumer with secrets ref: vault
+            code, body = t('/apisix/admin/consumers',
+                ngx.HTTP_PUT,
+                [[{
+                    "username": "jack",
+                    "plugins": {
+                        "hmac-auth": {
+                            "access_key": "my-access-key",
+                            "secret_key": "$secret://vault/test1/jack/secret_key"
+                        }
+                    }
+                }]]
+                )
+            if code >= 300 then
+                ngx.status = code
+                return ngx.say(body)
+            end
+
+            -- set route
+            code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "hmac-auth": {}
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed