premium-minds / datagrip-vault-plugin Goto Github PK

View Code? Open in Web Editor NEW

8.0 4.0 2.0 1.51 MB

Datagrip integration with Vault

License: Apache License 2.0

Kotlin 17.67% Java 76.55% Shell 5.78%

vault datagrip

datagrip-vault-plugin's Introduction

datagrip-vault-plugin

This plugin provides database credentials using Vault dynamic secrets.

Vault login is not handled by this plugin.

You should manually log in into Vault, which will, using the default Token Helper, create a Vault token file in $HOME/.vault-token.

The recommended way to use this plugin is with a Vault Agent, with Auto-Auth and cache enabled.

Installation

Using IDE built-in plugin system:

Settings/Preferences > Plugins > Marketplace > Search for "datagrip-vault-plugin" > Install Plugin
Manually:

Download the latest release and install it manually using Settings/Preferences > Plugins > ⚙️ > Install plugin from disk...

Screenshots

Vault Agent

This plugin will request new credentials everytime a connection is open to the database. To re-use already existing and valid credentials a Vault Agent is recommended.

This is an example, with AWS Authenticaton. Save it as vault-agent-datagrip.hcl and edit accordingly:

auto_auth {
    method "aws" {
        config = {
            type = "iam"
            role = "zzz"
            access_key = "xxx"
            secret_key = "yyy"
            header_value = "https://vault.example.com"
        }  
    }

    sink "file" {
        config = {
            path = "/opt/vault/vault-token-datagrip"
        }
    }
}

vault {
    address = "https://vault.example.com"
}

cache {  
    use_auto_auth_token = true
}

listener "tcp" {
    address = "127.0.0.1:8101"
    tls_disable = true
}

Launch the Vault Agent with vault agent -log-level=debug -config vault-agent-datagrip.hcl.

Configure a DataGrip database connection with:

Address: 127.0.0.1:8101
Token file: /opt/vault/vault-token-datagrip

Launching Vault Agent automatically

To skip launching the Vault Agent manually, you can configure your system manager to launch it on startup. For systemd create a ~/.config/systemd/user/vault-agent-datagrip.service with:

[Unit]
Description="Vault Agent to serve Tokens - DataGrip"

[Service]
SyslogIdentifier=vault-agent-datagrip
ExecStart=/usr/bin/vault agent -config=/opt/vault-agent-datagrip.hcl
Restart=always

[Install]
WantedBy=default.target

Enable the Vault system unit with systemctl --user enable vault-agent-datagrip and launch the Vault Agent with systemctl --user start vault-agent-datagrip.

Limitations

Support for parsing Vault config file from environment variable VAULT_CONFIG_PATH or default ~/.vault is restricted to JSON syntax only. It does not support native HCL syntax.

datagrip-vault-plugin's People

Contributors

Stargazers

Watchers

Forkers

cakasim localizedev

datagrip-vault-plugin's Issues

Retries for authentication failure

Since adding caching support in #14 I've managed to successfully use this plugin! Thanks!

One issue I've noticed is that it takes ~10 seconds for our replica's to have the credentials to authenticate which results in multiple login attempts to be able to query.

It would be nice if we could introduce some retry logic to handle this. Perhaps with some user controllable input to make it fail fast by default.

Plugin is not compatible with Vault token helper

If Vault is configured with a Vault token Helper, like https://github.com/joemiller/vault-token-helper, it will not be possible for the Dbeaver plugin to read the token file.

Possible solutions:

Adds another credentials type to use vault print token or use token_helper from .vault file directly with get argument
if token file is empty, use use token_helper from .vault file directly with get argument
- .vault file must respect VAULT_CONFIG_PATH environment variable
- .vault file is in HCL format which complicates parsing
  - https://github.com/bertramdev/hcl4j ?
premium-minds/dbeaver-vault#7

New Vault 1.10+ token format is not supported

Problem

The current plugin does not work with new vault 1.10+ tokens.

Env

Datagrip Vault Plugin 1.3.2
Vault 1.15+
Goland 2023.2

Steps to reproduce

Take new Vault 1.10+ instance
Configure the plugin to use it.
Authorize in Vault, get token.
Try to get credentials using the plugin.

Awaited

Got

Possible Reason

Since version 1.10 Vault has changed token format

Developer documentation on Tokens states, that:

Warning
Tokens are opaque values so their structure is undocumented and subject to change. Scripts and automations that rely on the internal structure of a token in scripts will break.

Infer Vault address from VAULT_ADDR env

Hi. Thanks for the awesome plugin. It's nice that it has the default setting for the Token file and I believe it will make the configuration even easier if it could read the Address from the VAULT_ADDR environment variable

Any plans for future updates?

The plugin has worked great for older versions of DataSpell and Pycharm (2021.3.3). Are there any plans to update it to be compatible with the most recent versions?

Plugin 'Datagrip-Vault' (version '1.0.0') is not compatible with the current version of the IDE, because it requires build 221.* or newer but the current build is DB-221.5787.39

Compatibility with DataGrip version DB-223.7571.180

Hey Filipe. Thanks for the amazing plugin!

Are there any planes for it to be updated for compatibility with the new 2022.3 release of DataGrip?

Plugin 'Datagrip-Vault' (version '1.0.1') is not compatible with the current version of the IDE, because it requires build 222.* or older but the current build is DB-223.7571.180

Cache users

~~Dbeaver~~ Datagrip uses multiple connections at the same time, leading to multiple requests to Vault and multiple temporary users created.

Additionally, this is a problem for read replica databases that may not process new users in time and reject the authentication