Populate internal representation of remote
        Vault resource contents
488911
def fetch(self, vault_client):
        """"""
        result = self.read(vault_client)
        if result:
            if isinstance(result, dict) and 'data' in result:
                self.existing = result['data']
            else:
                self.existing = result
        else:
            self.existing = None
318037
def process_remote_sources(self):
    """"""
    unpacked_sources = self.context.products.get_data(UnpackedArchives)
    remote_sources_targets = self.context.targets(predicate=lambda t: isinstance(t, RemoteSources))
    if not remote_sources_targets:
      return

    snapshot_specs = []
    filespecs = []
    unpack_dirs = []
    for target in remote_sources_targets:
      unpacked_archive = unpacked_sources[target.sources_target]
      sources = unpacked_archive.found_files
      rel_unpack_dir = unpacked_archive.rel_unpack_dir
      self.context.log.debug('target: {}, rel_unpack_dir: {}, sources: {}'
                             .format(target, rel_unpack_dir, sources))
      sources_in_dir = tuple(os.path.join(rel_unpack_dir, source) for source in sources)
      snapshot_specs.append(PathGlobsAndRoot(
        PathGlobs(sources_in_dir),
        get_buildroot(),
      ))
      filespecs.append({'globs': sources_in_dir})
      unpack_dirs.append(rel_unpack_dir)

    snapshots = self.context._scheduler.capture_snapshots(tuple(snapshot_specs))
    for target, snapshot, filespec, rel_unpack_dir in \
      zip(remote_sources_targets, snapshots, filespecs, unpack_dirs):
      synthetic_target = self.context.add_new_target(
        address=Address(os.path.relpath(self.workdir, get_buildroot()), target.id),
        target_type=target.destination_target_type,
        dependencies=target.dependencies,
        sources=EagerFilesetWithSpec(rel_unpack_dir, filespec, snapshot),
        derived_from=target,
        **target.destination_target_args
      )
      self.context.log.debug('synthetic_target: {}'.format(synthetic_target))
      for dependent in self.context.build_graph.dependents_of(target.address):
        self.context.build_graph.inject_dependency(dependent, synthetic_target.address)
85932
def create(options = {})
      options = options.merge(
        vault_name: @name,
        account_id: @account_id
      )
      resp = @client.create_vault(options)
      resp.data
    end
219105
def write_raw(path, raw):
    '''
    
    '''
    log.debug('Writing vault secrets for %s at %s', __grains__['id'], path)
    try:
        url = 'v1/{0}'.format(path)
        response = __utils__['vault.make_request']('POST', url, json=raw)
        if response.status_code == 200:
            return response.json()['data']
        elif response.status_code != 204:
            response.raise_for_status()
        return True
    except Exception as err:
        log.error('Failed to write secret! %s: %s', type(err).__name__, err)
        return False
215583
def reload(self):
        """"""
        self._source = self._fetch_secrets(self._vault_url, self._path, self._token)
1291481
def raw_file(client, src, dest, opt):
    """"""
    path, key = path_pieces(src)
    resp = client.read(path)
    if not resp:
        client.revoke_self_token()
        raise aomi.exceptions.VaultData("Unable to retrieve %s" % path)
    else:
        if 'data' in resp and key in resp['data']:
            secret = resp['data'][key]
            if is_base64(secret):
                LOG.debug('decoding base64 entry')
                secret = portable_b64decode(secret)

            if is_aws(resp['data']) and 'sts' not in path:
                renew_secret(client, resp, opt)

            write_raw_file(secret, dest)
        else:
            client.revoke_self_token()
            e_msg = "Key %s not found in %s" % (key, path)
            raise aomi.exceptions.VaultData(e_msg)
905945
def mount_for_path(path, client):
    """"""
    backend_data = client.list_secret_backends()['data']
    backends = [mnt for mnt in backend_data.keys()]
    path_bits = path.split('/')
    if len(path_bits) == 1:
        vault_path = "%s/" % path
        if vault_path in backends:
            return vault_path[0:len(vault_path) - 1]
    else:
        for i in range(1, len(path_bits) + 1):
            vault_path = "%s/" % '/'.join(path_bits[0:i])
            if vault_path in backends:
                return vault_path[0:len(vault_path) - 1]

    return None
559460
def update_generic_password(client, path):
    """"""
    vault_path, key = path_pieces(path)
    mount = mount_for_path(vault_path, client)
    if not mount:
        client.revoke_self_token()
        raise aomi.exceptions.VaultConstraint('invalid path')

    if backend_type(mount, client) != 'generic':
        client.revoke_self_token()
        raise aomi.exceptions.AomiData("Unsupported backend type")

    LOG.debug("Updating generic password at %s", path)
    existing = client.read(vault_path)
    if not existing or 'data' not in existing:
        LOG.debug("Nothing exists yet at %s!", vault_path)
        existing = {}
    else:
        LOG.debug("Updating %s at %s", key, vault_path)
        existing = existing['data']

    new_password = get_password()
    if key in existing and existing[key] == new_password:
        client.revoke_self_token()
        raise aomi.exceptions.AomiData("Password is same as existing")

    existing[key] = new_password
    client.write(vault_path, **existing)
516428
def get_vaults(self):
        """"""
        # Implemented from kitosid template for -
        # osid.resource.BinLookupSession.get_bins_template
        catalogs = self._get_provider_session('vault_lookup_session').get_vaults()
        cat_list = []
        for cat in catalogs:
            cat_list.append(Vault(self._provider_manager, cat, self._runtime, self._proxy))
        return VaultList(cat_list)
379237
def collect_internal_data(self):
        '''
        
        '''
        section = 'configuration'
        self.out.put(section)
        self.collector.add(section)
        self.out.put('Saving config', indent=2)
        self.collector.write('General Configuration', self.config)
        self.out.put('Saving pillars', indent=2)
        self.collector.write('Active Pillars', self._local_call({'fun': 'pillar.items'}))

        section = 'highstate'
        self.out.put(section)
        self.collector.add(section)
        self.out.put('Saving highstate', indent=2)
        self.collector.write('Rendered highstate', self._local_call({'fun': 'state.show_highstate'}))
785002
def fetch(self, vault_client, backends):
        """"""
        if not is_mounted(self.backend, self.path, backends) or \
           self.tune_prefix is None:
            return

        backend_details = get_backend(self.backend, self.path, backends)
        self.existing = backend_details['config']
        if backend_details['description']:
            self.existing['description'] = backend_details['description']

        if vault_client.version is None:
            return

        if not self.managed:
            return

        a_prefix = self.tune_prefix
        if self.tune_prefix:
            a_prefix = "%s/" % self.tune_prefix

        v_path = "sys/mounts/%s%s/tune" % (a_prefix, self.path)
        t_resp = vault_client.read(v_path)
        if 'data' not in t_resp:
            e_msg = "Unable to retrieve tuning info for %s" % self
            raise aomi_excep.VaultData(e_msg)

        e_obj = t_resp['data']
        e_obj['description'] = None
        n_path = normalize_vault_path(self.path)
        if n_path in backends:
            a_mount = backends[n_path]
            if 'description' in a_mount and a_mount['description']:
                e_obj['description'] = a_mount['description']

        self.existing = e_obj
406857
def _construct_mongod(self, dbpath, logpath, port, replset=None, extra=''):
        """"""
        rs_param = ''
        if replset:
            rs_param = '--replSet %s' % replset

        auth_param = ''
        if self.args['auth']:
            key_path = os.path.abspath(os.path.join(self.dir, 'keyfile'))
            auth_param = '--keyFile %s' % key_path

        if self.unknown_args:
            config = '--configsvr' in extra
            extra = self._filter_valid_arguments(self.unknown_args, "mongod",
                                                 config=config) + ' ' + extra

        # set WiredTiger cache size to 1 GB by default
        if ('--wiredTigerCacheSizeGB' not in extra and
                self._filter_valid_arguments(['--wiredTigerCacheSizeGB'],
                                             'mongod')):
            extra += ' --wiredTigerCacheSizeGB 1 '

        current_version = self.getMongoDVersion()

        # Exit with error if hostname is specified but not bind_ip options
        if (self.args['hostname'] != 'localhost'
                and LooseVersion(current_version) >= LooseVersion("3.6.0")
                and (self.args['sharded'] or self.args['replicaset'])
                and '--bind_ip' not in extra):
            os.removedirs(dbpath)
            errmsg = " \n * If hostname is specified, please include "\
                "'--bind_ip_all' or '--bind_ip' options when deploying "\
                "replica sets or sharded cluster with MongoDB version 3.6.0 "\
                "or greater"
            raise SystemExit(errmsg)

        extra += self._get_ssl_server_args()

        path = self.args['binarypath'] or ''
        if os.name == 'nt':
            newdbpath = dbpath.replace('\\', '\\\\')
            newlogpath = logpath.replace('\\', '\\\\')
            command_str = ("start /b \"\" \"%s\" %s --dbpath \"%s\" "
                           " --logpath \"%s\" --port %i "
                           "%s %s" % (os.path.join(path, 'mongod.exe'),
                                      rs_param, newdbpath, newlogpath, port,
                                      auth_param, extra))
        else:
            command_str = ("\"%s\" %s --dbpath \"%s\" --logpath \"%s\" "
                           "--port %i --fork "
                           "%s %s" % (os.path.join(path, 'mongod'), rs_param,
                                      dbpath, logpath, port, auth_param,
                                      extra))

        # store parameters in startup_info
        self.startup_info[str(port)] = command_str
761378
def create_payload(self):
        """"""
        payload = super(HostCollection, self).create_payload()
        if 'system_ids' in payload:
            payload['system_uuids'] = payload.pop('system_ids')
        return payload
1245195
def template_runner(client, parser, args):
    """"""
    if args.builtin_list:
        aomi.template.builtin_list()
    elif args.builtin_info:
        aomi.template.builtin_info(args.builtin_info)
    elif args.template and args.destination and args.vault_paths:
        aomi.render.template(client, args.template,
                             args.destination,
                             args.vault_paths,
                             args)
    else:
        parser.print_usage()
        sys.exit(2)

    sys.exit(0)
18323
def sync_mounts(self, active_mounts, resources, vault_client):
        """"""
        # Create a resource set that is only explicit mounts
        # and sort so removals are first
        mounts = [x for x in resources
                  if isinstance(x, (Mount, AWS))]

        s_resources = sorted(mounts, key=absent_sort)
        # Iterate over explicit mounts only
        for resource in s_resources:
            active_mounts = self.actually_mount(vault_client,
                                                resource,
                                                active_mounts)

        # OK Now iterate over everything but make sure it is clear
        # that ad-hoc mountpoints are deprecated as per
        # https://github.com/Autodesk/aomi/issues/110
        for resource in [x for x in resources
                         if isinstance(x, Secret)]:
            n_mounts = self.actually_mount(vault_client,
                                           resource,
                                           active_mounts)
            if len(n_mounts) != len(active_mounts):
                LOG.warning("Ad-Hoc mount with %s. Please specify"
                            " explicit mountpoints.", resource)

            active_mounts = n_mounts

        return active_mounts, [x for x in resources
                               if not isinstance(x, (Mount))]
749390
def sync(self, vault_client, opt):
        """"""
        active_mounts = []
        for audit_log in self.logs():
            audit_log.sync(vault_client)

        # Handle policies only on the first pass. This allows us
        # to ensure that ACL's are in place prior to actually
        # making any changes.
        not_policies = self.sync_policies(vault_client)
        # Handle auth wrapper resources on the next path. The resources
        # may update a path on their own. They may also provide mount
        # tuning information.
        not_auth = self.sync_auth(vault_client, not_policies)
        # Handle mounts only on the next pass. This allows us to
        # ensure that everything is in order prior to actually
        # provisioning secrets. Note we handle removals before
        # anything else, allowing us to address mount conflicts.
        active_mounts, not_mounts = self.sync_mounts(active_mounts,
                                                     not_auth,
                                                     vault_client)
        # Now handle everything else. If "best practices" are being
        # adhered to then every generic mountpoint should exist by now.
        # We handle "child" resources after the first batch
        sorted_resources = sorted(not_mounts, key=childless_first)
        for resource in sorted_resources:
            resource.sync(vault_client)

        for mount in self.mounts():
            if not find_backend(mount.path, active_mounts):
                mount.unmount(vault_client)

        if opt.remove_unknown:
            self.prune(vault_client)
440362
def path_pieces(vault_path):
    """"""
    path_bits = vault_path.split('/')
    path = '/'.join(path_bits[0:len(path_bits) - 1])
    key = path_bits[len(path_bits) - 1]
    return path, key