Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
raises=exceptions.InternalServerError,
exception_message='* not a compact JWS'
)
])
def test_configure(self, label, kubernetes_ca_cert=None, token_reviewer_jwt=None, pem_keys=None,
raises=None, exception_message=''):
kubernetes_host = 'https://192.168.99.100:8443'
if raises:
with self.assertRaises(raises) as cm:
self.client.auth.kubernetes.configure(
kubernetes_host=kubernetes_host,
kubernetes_ca_cert=kubernetes_ca_cert,
token_reviewer_jwt=token_reviewer_jwt,
pem_keys=pem_keys,
mount_point=self.TEST_MOUNT_POINT
)
self.assertIn(
kubernetes_host=test_host,
pem_keys=[certificate],
mount_point=test_mount_point,
)
self.client.create_kubernetes_role(
name=test_role_name,
bound_service_account_names='*',
bound_service_account_namespaces='vault_test',
mount_point=test_mount_point,
)
# Test that we can authenticate
with open(utils.get_config_file_path('example.jwt')) as fp:
test_jwt = fp.read()
with self.assertRaises(exceptions.InternalServerError) as assertRaisesContext:
# we don't actually have a valid JWT to provide, so this method will throw an exception
self.client.auth_kubernetes(
role=test_role_name,
jwt=test_jwt,
mount_point=test_mount_point,
)
expected_exception_message = 'claim "iss" is invalid'
actual_exception_message = str(assertRaisesContext.exception)
self.assertEqual(expected_exception_message, actual_exception_message)
# Reset integration test state
self.client.disable_auth_backend(mount_point=test_mount_point)
try:
yield
except json.decoder.JSONDecodeError as exc:
raise exceptions.VaultNonJsonResponse(errors=[str(exc)])
except hvac.exceptions.InvalidRequest as exc:
raise exceptions.VaultInvalidRequest(errors=exc.errors) from exc
except hvac.exceptions.Unauthorized as exc:
raise exceptions.VaultUnauthorized(errors=exc.errors) from exc
except hvac.exceptions.Forbidden as exc:
raise exceptions.VaultForbidden(errors=exc.errors) from exc
except hvac.exceptions.InternalServerError as exc:
raise exceptions.VaultInternalServerError(errors=exc.errors) from exc
except hvac.exceptions.VaultDown as exc:
raise exceptions.VaultSealed(errors=exc.errors) from exc
except hvac.exceptions.UnexpectedError as exc:
raise exceptions.VaultAPIException(errors=exc.errors) from exc
hvac.exceptions.InvalidPath | hvac.exceptions.RateLimitExceeded | hvac.exceptions.InternalServerError |
hvac.exceptions.VaultNotInitialized | hvac.exceptions.VaultDown | hvac.exceptions.UnexpectedError
"""
if status_code == 400:
raise exceptions.InvalidRequest(message, errors=errors)
elif status_code == 401:
raise exceptions.Unauthorized(message, errors=errors)
elif status_code == 403:
raise exceptions.Forbidden(message, errors=errors)
elif status_code == 404:
raise exceptions.InvalidPath(message, errors=errors)
elif status_code == 429:
raise exceptions.RateLimitExceeded(message, errors=errors)
elif status_code == 500:
raise exceptions.InternalServerError(message, errors=errors)
elif status_code == 501:
raise exceptions.VaultNotInitialized(message, errors=errors)
elif status_code == 503:
raise exceptions.VaultDown(message, errors=errors)
else:
raise exceptions.UnexpectedError(message)
def __raise_error(self, status_code, message=None, errors=None):
if status_code == 400:
raise exceptions.InvalidRequest(message, errors=errors)
elif status_code == 401:
raise exceptions.Unauthorized(message, errors=errors)
elif status_code == 403:
raise exceptions.Forbidden(message, errors=errors)
elif status_code == 404:
raise exceptions.InvalidPath(message, errors=errors)
elif status_code == 429:
raise exceptions.RateLimitExceeded(message, errors=errors)
elif status_code == 500:
raise exceptions.InternalServerError(message, errors=errors)
elif status_code == 501:
raise exceptions.VaultNotInitialized(message, errors=errors)
elif status_code == 503:
raise exceptions.VaultDown(message, errors=errors)
else:
raise exceptions.UnexpectedError(message)
def read(self, client):
try:
return client.get_role_secret_id(self.role_name,
self.obj()['secret_id'])
except hvac.exceptions.InvalidPath:
return None
except hvac.exceptions.InternalServerError as vault_excep:
e_msg = vault_excep.errors[0]
if "role %s does not exist" % self.role_name in e_msg:
return None
raise
except ValueError as an_excep:
if str(an_excep).startswith('No JSON object'):
return None
raise
def aws(client, path, opt):
"""Renders a shell environment snippet with AWS information"""
try:
creds = client.read(path)
except (hvac.exceptions.InternalServerError) as vault_exception:
# this is how old vault behaves
if vault_exception.errors[0].find('unsupported path') > 0:
error_output("Invalid AWS path. Did you forget the"
" credential type and role?", opt)
else:
raise
# this is how new vault behaves
if not creds:
error_output("Invalid AWS path. Did you forget the"
" credential type and role?", opt)
renew_secret(client, creds, opt)
if creds and 'data' in creds:
print("AWS_ACCESS_KEY_ID=\"%s\"" % creds['data']['access_key'])