Skip to content

Commit 038e4e8

Browse files
author
Chris Every
authored
Merge pull request #198 from ovotech/add-atlas-location
Add atlas location
2 parents a5bd64d + cc925f2 commit 038e4e8

File tree

6 files changed

+105
-8
lines changed

6 files changed

+105
-8
lines changed

‎go.mod

+4-8
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module github.com/ovotech/cloud-key-rotator
33
go 1.12
44

55
require (
6+
github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a
67
cloud.google.com/go v0.49.0 // indirect
78
cloud.google.com/go/bigquery v1.3.0 // indirect
89
cloud.google.com/go/pubsub v1.1.0 // indirect
@@ -12,33 +13,27 @@ require (
1213
github.com/beamly/go-gocd v0.0.0-20190719193049-383d56afbf92
1314
github.com/creack/pty v1.1.9 // indirect
1415
github.com/envoyproxy/go-control-plane v0.9.1 // indirect
15-
github.com/golang/groupcache v0.0.0-20191027212112-611e8accdfc9 // indirect
16-
github.com/google/go-cmp v0.3.1 // indirect
1716
github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf // indirect
1817
github.com/google/pprof v0.0.0-20191105193234-27840fff0d09 // indirect
1918
github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d // indirect
2019
github.com/hashicorp/golang-lru v0.5.3 // indirect
2120
github.com/json-iterator/go v0.0.0-20180701071628-ab8a2e0c74be // indirect
22-
github.com/jstemmer/go-junit-report v0.9.1 // indirect
2321
github.com/jszwedko/go-circleci v0.3.0
2422
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
2523
github.com/modern-go/reflect2 v1.0.1 // indirect
24+
github.com/mongodb/go-client-mongodb-atlas v0.1.3
2625
github.com/ovotech/cloud-key-client v0.0.0-20191119224032-d4d5f5354584
2726
github.com/ovotech/mantle v0.0.0-20190313113039-b525d8003135
2827
github.com/rogpeppe/go-internal v1.5.0 // indirect
2928
github.com/spf13/cobra v0.0.6
3029
github.com/spf13/viper v1.6.2
31-
go.opencensus.io v0.22.2 // indirect
3230
go.uber.org/atomic v1.5.1 // indirect
3331
go.uber.org/multierr v1.4.0 // indirect
3432
go.uber.org/zap v1.14.0
3533
golang.org/x/crypto v0.0.0-20191119213627-4f8c1d86b1ba
3634
golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8 // indirect
3735
golang.org/x/mobile v0.0.0-20191115022231-f0c40035f2ba // indirect
38-
golang.org/x/net v0.0.0-20191119073136-fc4aabc6c914 // indirect
39-
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
40-
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e // indirect
41-
golang.org/x/sys v0.0.0-20191119195528-f068ffe820e4 // indirect
36+
golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6
4237
golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
4338
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e // indirect
4439
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898 // indirect
@@ -48,6 +43,7 @@ require (
4843
google.golang.org/grpc v1.25.1 // indirect
4944
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
5045
gopkg.in/inf.v0 v0.9.0 // indirect
46+
gopkg.in/ini.v1 v1.51.0
5147
gopkg.in/src-d/go-git.v4 v4.13.1
5248
gopkg.in/yaml.v2 v2.2.7 // indirect
5349
k8s.io/api v0.0.0-20190313235455-40a48860b5ab

‎go.sum

+11
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
4747
github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc=
4848
github.com/Netflix/go-expect v0.0.0-20180928190340-9d1f4485533b/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc=
4949
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
50+
github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a h1:KFHLI4QGttB0i7M3qOkAo8Zn/GSsxwwCnInFqBaYtkM=
51+
github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a/go.mod h1:D73UAuEPckrDorYZdtlCu2ySOLuPB5W4rhIkmmc/XbI=
5052
github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7 h1:uSoVVbwJiQipAclBbw+8quDsfcvFjOpI5iCf4p/cqCs=
5153
github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=
5254
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
@@ -126,6 +128,7 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
126128
github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
127129
github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
128130
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
131+
github.com/go-test/deep v1.0.1/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
129132
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
130133
github.com/gogo/protobuf v1.2.1 h1:/s5zKNz0uPFCZ5hddgPdo2TK2TVrUNMn0OOX8/aZMTE=
131134
github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
@@ -160,6 +163,8 @@ github.com/google/go-cmp v0.3.0 h1:crn/baboCvb5fXaQ0IJ1SGTsTVrWpDsCWC8EGETZijY=
160163
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
161164
github.com/google/go-cmp v0.3.1 h1:Xye71clBPdm5HgqGwUkwhbynsUJZhDbS20FvLhQ2izg=
162165
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
166+
github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
167+
github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
163168
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
164169
github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf h1:+RRA9JqSOZFfKrOeqr2z77+8R2RKyh8PG66dcu1V0ck=
165170
github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
@@ -248,6 +253,10 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
248253
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
249254
github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
250255
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
256+
github.com/mongodb/go-client-mongodb-atlas v0.1.3 h1:/l36BomZ93+YTQhqcnJLhgphP5+/VGqbmwAVQlWKhng=
257+
github.com/mongodb/go-client-mongodb-atlas v0.1.3/go.mod h1:LS8O0YLkA+sbtOb3fZLF10yY3tJM+1xATXMJ3oU35LU=
258+
github.com/mwielbut/pointy v1.1.0 h1:U5/YEfoIkaGCHv0St3CgjduqXID4FNRoyZgLM1kY9vg=
259+
github.com/mwielbut/pointy v1.1.0/go.mod h1:MvvO+uMFj9T5DMda33HlvogsFBX7pWWKAkFIn4teYwY=
251260
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
252261
github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
253262
github.com/ovotech/cloud-key-client v0.0.0-20191009092017-7cf0d3273c04 h1:I6tBGiEJaOL+SLrWXflS6Fik3y2HUtZE4SYkksdZ6QQ=
@@ -389,6 +398,7 @@ golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc h1:c0o/qxkaO2LF5t6fQrT4b5
389398
golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
390399
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550 h1:ObdrDkeb4kJdCP557AjRjq69pTHfNouLtWZG7j9rPN8=
391400
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
401+
golang.org/x/crypto v0.0.0-20191119213627-4f8c1d86b1ba h1:9bFeDpN3gTqNanMVqNcoR/pJQuP5uroC3t1D7eXozTE=
392402
golang.org/x/crypto v0.0.0-20191119213627-4f8c1d86b1ba/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
393403
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
394404
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -532,6 +542,7 @@ golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZe
532542
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
533543
golang.org/x/time v0.0.0-20190921001708-c4c64cad1fd0 h1:xQwXv67TxFo9nC1GJFyab5eq/5B590r6RlnL/G8Sz7w=
534544
golang.org/x/time v0.0.0-20190921001708-c4c64cad1fd0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
545+
golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
535546
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
536547
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
537548
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎pkg/config/config.go

+1
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ type Filter struct {
6969
type KeyLocations struct {
7070
RotationAgeThresholdMins int
7171
ServiceAccountName string
72+
Atlas []location.Atlas
7273
CircleCI []location.CircleCI
7374
GCS []location.Gcs
7475
Git location.Git

‎pkg/cred/creds.go

+7
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ type Credentials struct {
2222
AkrPath string
2323
KmsKey string
2424
GocdServer GocdServer
25+
AtlasKeys AtlasKeys
2526
}
2627

2728
// GitAccount type
@@ -38,3 +39,9 @@ type GocdServer struct {
3839
Username string
3940
Password string
4041
}
42+
43+
// AtlasKeys type
44+
type AtlasKeys struct {
45+
PublicKey string
46+
PrivateKey string
47+
}

‎pkg/location/atlas.go

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
// Copyright 2019 OVO Technology
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package location
16+
17+
import (
18+
"context"
19+
"time"
20+
21+
"github.com/Sectorbob/mlab-ns2/gae/ns/digest"
22+
"github.com/mongodb/go-client-mongodb-atlas/mongodbatlas"
23+
"github.com/ovotech/cloud-key-rotator/pkg/cred"
24+
)
25+
26+
const (
27+
secretAccessKeyWaitSecs = 20
28+
)
29+
30+
// Atlas type
31+
type Atlas struct {
32+
ProjectID string
33+
}
34+
35+
func newClient(publicKey, privateKey string) (*mongodbatlas.Client, error) {
36+
37+
//Setup a transport to handle digest
38+
transport := digest.NewTransport(publicKey, privateKey)
39+
40+
//Initialize the client
41+
client, err := transport.Client()
42+
if err != nil {
43+
return nil, err
44+
}
45+
46+
//Initialize the MongoDB Atlas API Client.
47+
return mongodbatlas.NewClient(client), nil
48+
}
49+
50+
func (atlas Atlas) Write(serviceAccountName string, keyWrapper KeyWrapper,
51+
creds cred.Credentials) (updated UpdatedLocation, err error) {
52+
53+
var client *mongodbatlas.Client
54+
if client, err = newClient(creds.AtlasKeys.PublicKey, creds.AtlasKeys.PrivateKey); err != nil {
55+
return
56+
}
57+
58+
provider := keyWrapper.KeyProvider
59+
60+
switch provider {
61+
case "aws":
62+
err = writeAws(client, keyWrapper.KeyID, keyWrapper.Key, atlas.ProjectID)
63+
}
64+
return
65+
}
66+
67+
func writeAws(client *mongodbatlas.Client, accessKeyID, secretAccessKey, projectID string) (err error) {
68+
time.Sleep(secretAccessKeyWaitSecs * time.Second)
69+
createRequest := &mongodbatlas.EncryptionAtRest{
70+
GroupID: projectID,
71+
AwsKms: mongodbatlas.AwsKms{
72+
AccessKeyID: accessKeyID,
73+
SecretAccessKey: secretAccessKey,
74+
},
75+
}
76+
_, _, err = client.EncryptionsAtRest.Create(context.Background(), createRequest)
77+
return
78+
}

‎pkg/rotate/rotatekeys.go

+4
Original file line numberDiff line numberDiff line change
@@ -282,6 +282,10 @@ func locationsToUpdate(keyLocation config.KeyLocations) (kws []location.KeyWrite
282282
var googleAppCredsRequired bool
283283

284284
// read locations
285+
for _, atlas := range keyLocation.Atlas {
286+
kws = append(kws, atlas)
287+
}
288+
285289
for _, circleCI := range keyLocation.CircleCI {
286290
kws = append(kws, circleCI)
287291
}

0 commit comments

Comments
 (0)