rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Parameter Store to bootstrap resolver

Browse Source 
probod-bootstrap could only resolve aws:// Secrets Manager refs.
Add awsps:// for SSM Parameter Store (GetParameter with decryption)
and awssm:// as an explicit Secrets Manager prefix. Keep aws:// for
backward compatibility. Values are cached per run per backend.
Update Helm, .env.example, and probod-bootstrap changelog.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-29 11:41:18 +02:00
parent ba1c9fccfa
commit 5cff72ce5b
9 changed files with 255 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

187
pkg/bootstrap/resolver.go
View File

@@ -24,27 +24,24 @@ import (
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
"github.com/aws/aws-sdk-go-v2/service/ssm"
)
const awsSecretRefPrefix = "aws://"
type (
SecretsManagerClient interface {
GetSecretValue(
ctx context.Context,
params *secretsmanager.GetSecretValueInput,
optFns ...func(*secretsmanager.Options),
) (*secretsmanager.GetSecretValueOutput, error)
}
Resolver struct {
lookup EnvGetter
secretsManagerClient SecretsManagerClient
smCache map[string]string
err error
}
const (
awsSecretsManagerRefPrefix = "awssm://"
awsSecretsManagerLegacyRefPrefix = "aws://"
awsParameterStoreRefPrefix = "awsps://"
)
type Resolver struct {
lookup EnvGetter
smClient *secretsmanager.Client
psClient *ssm.Client
smCache map[string]string
psCache map[string]string
err error
}
func NewResolver(lookup EnvGetter) *Resolver {
if lookup == nil {
lookup = os.Getenv
@@ -133,17 +130,29 @@ func (r *Resolver) getEnvBoolOrDefault(key string, defaultValue bool) bool {
func (r *Resolver) resolve(key string) (string, error) {
raw := r.lookup(key)
secretID, ok := parseAWSSecretRef(raw)
if !ok {
return raw, nil
if prefix, empty := emptyAWSRefPrefix(raw); empty {
return "", fmt.Errorf("cannot resolve %s: empty AWS reference after %s", key, prefix)
}
value, err := r.loadPlaintextSecret(secretID)
if err != nil {
return "", fmt.Errorf("cannot resolve %s: %w", key, err)
if secretID, ok := parseAWSSecretsManagerRef(raw); ok {
value, err := r.loadPlaintextSecret(secretID)
if err != nil {
return "", fmt.Errorf("cannot resolve %s: %w", key, err)
}
return value, nil
}
return value, nil
if paramName, ok := parseAWSRef(raw, awsParameterStoreRefPrefix); ok {
value, err := r.loadParameter(paramName)
if err != nil {
return "", fmt.Errorf("cannot resolve %s: %w", key, err)
}
return value, nil
}
return raw, nil
}
func (r *Resolver) loadPlaintextSecret(secretID string) (string, error) {
@@ -153,17 +162,24 @@ func (r *Resolver) loadPlaintextSecret(secretID string) (string, error) {
}
}
value, err := fetchPlaintextSecret(
context.Background(),
secretsManagerOptions{
SecretID: secretID,
Client: r.secretsManagerClient,
},
)
client, err := r.secretsManagerClient(context.Background())
if err != nil {
return "", err
}
out, err := client.GetSecretValue(context.Background(), &secretsmanager.GetSecretValueInput{
SecretId: aws.String(secretID),
})
if err != nil {
return "", fmt.Errorf("cannot load secret from AWS Secrets Manager: %w", err)
}
if out.SecretString == nil || *out.SecretString == "" {
return "", fmt.Errorf("secret %q has an empty SecretString", secretID)
}
value := *out.SecretString
if r.smCache == nil {
r.smCache = make(map[string]string)
}
@@ -173,47 +189,44 @@ func (r *Resolver) loadPlaintextSecret(secretID string) (string, error) {
return value, nil
}
func parseAWSSecretRef(value string) (string, bool) {
if !strings.HasPrefix(value, awsSecretRefPrefix) {
return "", false
func (r *Resolver) loadParameter(name string) (string, error) {
if r.psCache != nil {
if value, ok := r.psCache[name]; ok {
return value, nil
}
}
secretID := strings.TrimPrefix(value, awsSecretRefPrefix)
if secretID == "" {
return "", false
}
return secretID, true
}
type secretsManagerOptions struct {
SecretID string
Client SecretsManagerClient
}
func fetchPlaintextSecret(ctx context.Context, opts secretsManagerOptions) (string, error) {
client, err := secretsManagerClient(ctx, opts)
client, err := r.parameterStoreClient(context.Background())
if err != nil {
return "", err
}
out, err := client.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
SecretId: aws.String(opts.SecretID),
out, err := client.GetParameter(context.Background(), &ssm.GetParameterInput{
Name: aws.String(name),
WithDecryption: aws.Bool(true),
})
if err != nil {
return "", fmt.Errorf("cannot load secret from AWS Secrets Manager: %w", err)
return "", fmt.Errorf("cannot load parameter from AWS Systems Manager Parameter Store: %w", err)
}
if out.SecretString == nil || *out.SecretString == "" {
return "", fmt.Errorf("secret %q has an empty SecretString", opts.SecretID)
if out.Parameter == nil || out.Parameter.Value == nil || *out.Parameter.Value == "" {
return "", fmt.Errorf("parameter %q has an empty value", name)
}
return *out.SecretString, nil
value := *out.Parameter.Value
if r.psCache == nil {
r.psCache = make(map[string]string)
}
r.psCache[name] = value
return value, nil
}
func secretsManagerClient(ctx context.Context, opts secretsManagerOptions) (SecretsManagerClient, error) {
if opts.Client != nil {
return opts.Client, nil
func (r *Resolver) secretsManagerClient(ctx context.Context) (*secretsmanager.Client, error) {
if r.smClient != nil {
return r.smClient, nil
}
cfg, err := config.LoadDefaultConfig(ctx)
@@ -221,5 +234,61 @@ func secretsManagerClient(ctx context.Context, opts secretsManagerOptions) (Secr
return nil, fmt.Errorf("cannot load AWS config: %w", err)
}
return secretsmanager.NewFromConfig(cfg), nil
r.smClient = secretsmanager.NewFromConfig(cfg)
return r.smClient, nil
}
func (r *Resolver) parameterStoreClient(ctx context.Context) (*ssm.Client, error) {
if r.psClient != nil {
return r.psClient, nil
}
cfg, err := config.LoadDefaultConfig(ctx)
if err != nil {
return nil, fmt.Errorf("cannot load AWS config: %w", err)
}
r.psClient = ssm.NewFromConfig(cfg)
return r.psClient, nil
}
func parseAWSRef(value, prefix string) (string, bool) {
if !strings.HasPrefix(value, prefix) {
return "", false
}
ref := strings.TrimPrefix(value, prefix)
if ref == "" {
return "", false
}
return ref, true
}
func emptyAWSRefPrefix(value string) (string, bool) {
for _, prefix := range []string{
awsSecretsManagerRefPrefix,
awsSecretsManagerLegacyRefPrefix,
awsParameterStoreRefPrefix,
} {
if strings.HasPrefix(value, prefix) && strings.TrimPrefix(value, prefix) == "" {
return prefix, true
}
}
return "", false
}
func parseAWSSecretsManagerRef(value string) (string, bool) {
if secretID, ok := parseAWSRef(value, awsSecretsManagerRefPrefix); ok {
return secretID, true
}
return parseAWSRef(value, awsSecretsManagerLegacyRefPrefix)
}
func parseAWSParameterStoreRef(value string) (string, bool) {
return parseAWSRef(value, awsParameterStoreRefPrefix)
}

182
pkg/bootstrap/resolver_test.go
View File

@@ -15,46 +15,12 @@
package bootstrap
import (
"context"
"fmt"
"testing"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
type mockSecretsManagerClient struct {
secrets map[string]string
called []string
}
func (m *mockSecretsManagerClient) GetSecretValue(
_ context.Context,
params *secretsmanager.GetSecretValueInput,
_ ...func(*secretsmanager.Options),
) (*secretsmanager.GetSecretValueOutput, error) {
secretID := aws.ToString(params.SecretId)
m.called = append(m.called, secretID)
value, ok := m.secrets[secretID]
if !ok {
return nil, fmt.Errorf("secret %q not found", secretID)
}
return &secretsmanager.GetSecretValueOutput{
SecretString: aws.String(value),
}, nil
}
func testResolver(env map[string]string, client SecretsManagerClient) *Resolver {
r := NewResolver(mockEnv(env))
r.secretsManagerClient = client
return r
}
func TestResolver_ResolveLiteralEnv(t *testing.T) {
t.Parallel()
@@ -63,117 +29,79 @@ func TestResolver_ResolveLiteralEnv(t *testing.T) {
require.NoError(t, r.Err())
}
func TestBuilder_Build_ResolvesAWSSecretRefs(t *testing.T) {
func TestResolver_ResolveEmptyAWSSecretsManagerRef(t *testing.T) {
t.Parallel()
client := &mockSecretsManagerClient{
secrets: map[string]string{
"probo/sandbox/probod/encryption_key": "test-encryption-key-32-bytes-long",
"probo/sandbox/probod/cookie_secret": "test-cookie-secret-32-bytes-long!",
"probo/sandbox/probod/password_pepper": "test-password-pepper-32-bytes-lo",
"probo/sandbox/probod/oauth2_signing_key": "test-oauth2-signing-key",
},
for _, value := range []string{"awssm://", "aws://"} {
t.Run(value, func(t *testing.T) {
t.Parallel()
r := NewResolver(mockEnv(map[string]string{
"PROBOD_ENCRYPTION_KEY": value,
}))
assert.Empty(t, r.getEnv("PROBOD_ENCRYPTION_KEY"))
require.Error(t, r.Err())
assert.Contains(t, r.Err().Error(), "cannot resolve PROBOD_ENCRYPTION_KEY")
assert.Contains(t, r.Err().Error(), "empty AWS reference")
})
}
env := map[string]string{
"PROBOD_ENCRYPTION_KEY": "aws://probo/sandbox/probod/encryption_key",
"PROBOD_AUTH_COOKIE_SECRET": "aws://probo/sandbox/probod/cookie_secret",
"PROBOD_AUTH_PASSWORD_PEPPER": "aws://probo/sandbox/probod/password_pepper",
"PROBOD_OAUTH2_SERVER_SIGNING_KEY": "aws://probo/sandbox/probod/oauth2_signing_key",
"PROBOD_BASE_URL": "https://app.example.com",
}
b := NewBuilder(testResolver(env, client))
cfg, err := b.Build()
require.NoError(t, err)
require.Len(t, client.called, 4)
assert.Equal(t, "test-encryption-key-32-bytes-long", cfg.Probod.EncryptionKey)
assert.Equal(t, "https://app.example.com", cfg.Probod.BaseURL)
}
func TestResolver_ResolveAWSSecretRefsCachesBySecretID(t *testing.T) {
func TestResolver_ResolveEmptyAWSParameterStoreRef(t *testing.T) {
t.Parallel()
client := &mockSecretsManagerClient{
secrets: map[string]string{
"probo/sandbox/probod/encryption_key": "secret-value",
},
}
r := testResolver(map[string]string{
"PROBOD_ENCRYPTION_KEY": "aws://probo/sandbox/probod/encryption_key",
"PROBOD_AUTH_COOKIE_SECRET": "aws://probo/sandbox/probod/encryption_key",
"PROBOD_AUTH_PASSWORD_PEPPER": "plaintext-pepper",
"PROBOD_OAUTH2_SERVER_SIGNING_KEY": "plaintext-oauth2",
}, client)
assert.Equal(t, "secret-value", r.getEnv("PROBOD_ENCRYPTION_KEY"))
assert.Equal(t, "secret-value", r.getEnv("PROBOD_AUTH_COOKIE_SECRET"))
require.NoError(t, r.Err())
require.Len(t, client.called, 1)
}
func TestBuilder_Build_MixedPlaintextAndAWSSecrets(t *testing.T) {
t.Parallel()
client := &mockSecretsManagerClient{
secrets: map[string]string{
"probo/sandbox/probod/encryption_key": "test-encryption-key-32-bytes-long",
},
}
b := NewBuilder(testResolver(map[string]string{
"PROBOD_ENCRYPTION_KEY": "aws://probo/sandbox/probod/encryption_key",
"PROBOD_AUTH_COOKIE_SECRET": "test-cookie-secret-32-bytes-long!",
"PROBOD_AUTH_PASSWORD_PEPPER": "test-password-pepper-32-bytes-lo",
"PROBOD_OAUTH2_SERVER_SIGNING_KEY": "test-oauth2-signing-key",
}, client))
cfg, err := b.Build()
require.NoError(t, err)
assert.Equal(t, "test-encryption-key-32-bytes-long", cfg.Probod.EncryptionKey)
assert.Equal(t, "test-cookie-secret-32-bytes-long!", cfg.Probod.Auth.Cookie.Secret)
}
func TestResolver_ResolveAWSSecretRefMissingSecret(t *testing.T) {
t.Parallel()
client := &mockSecretsManagerClient{secrets: map[string]string{}}
r := testResolver(map[string]string{
"PROBOD_ENCRYPTION_KEY": "aws://probo/sandbox/probod/encryption_key",
}, client)
r := NewResolver(mockEnv(map[string]string{
"PROBOD_ENCRYPTION_KEY": "awsps://",
}))
assert.Empty(t, r.getEnv("PROBOD_ENCRYPTION_KEY"))
require.Error(t, r.Err())
assert.Contains(t, r.Err().Error(), "cannot resolve PROBOD_ENCRYPTION_KEY")
assert.Contains(t, r.Err().Error(), "empty AWS reference")
}
func TestResolver_ResolveAWSSecretRefEmptySecretString(t *testing.T) {
func TestParseAWSSecretsManagerRef(t *testing.T) {
t.Parallel()
client := &mockSecretsManagerClient{
secrets: map[string]string{
"probo/sandbox/probod/encryption_key": "",
},
}
r := testResolver(map[string]string{
"PROBOD_ENCRYPTION_KEY": "aws://probo/sandbox/probod/encryption_key",
}, client)
assert.Empty(t, r.getEnv("PROBOD_ENCRYPTION_KEY"))
require.Error(t, r.Err())
assert.Contains(t, r.Err().Error(), "empty SecretString")
}
func TestParseAWSSecretRef(t *testing.T) {
t.Parallel()
secretID, ok := parseAWSSecretRef("aws://probo/sandbox/probod/encryption_key")
secretID, ok := parseAWSSecretsManagerRef("awssm://probo/probod/encryption_key")
require.True(t, ok)
assert.Equal(t, "probo/sandbox/probod/encryption_key", secretID)
assert.Equal(t, "probo/probod/encryption_key", secretID)
_, ok = parseAWSSecretRef("literal-value")
_, ok = parseAWSSecretsManagerRef("literal-value")
assert.False(t, ok)
_, ok = parseAWSSecretRef("aws://")
_, ok = parseAWSSecretsManagerRef("awssm://")
assert.False(t, ok)
legacySecretID, ok := parseAWSSecretsManagerRef("aws://probo/probod/encryption_key")
require.True(t, ok)
assert.Equal(t, "probo/probod/encryption_key", legacySecretID)
}
func TestParseAWSParameterStoreRef(t *testing.T) {
t.Parallel()
paramName, ok := parseAWSParameterStoreRef("awsps:///probo/probod/encryption_key")
require.True(t, ok)
assert.Equal(t, "/probo/probod/encryption_key", paramName)
_, ok = parseAWSParameterStoreRef("literal-value")
assert.False(t, ok)
_, ok = parseAWSParameterStoreRef("awsps://")
assert.False(t, ok)
}
func TestEmptyAWSRefPrefix(t *testing.T) {
t.Parallel()
for _, value := range []string{"awssm://", "aws://", "awsps://"} {
prefix, empty := emptyAWSRefPrefix(value)
require.True(t, empty)
assert.Equal(t, value, prefix)
}
_, empty := emptyAWSRefPrefix("awssm://probo/probod/encryption_key")
assert.False(t, empty)
}