feat: implement automatic hashicorp token renewal #3782

hamidonos · 2024-01-17T10:51:19Z

What this PR changes/adds

This PR adds an automatic token renewal mechanism to the Hashicorp Vault extension.

Why it does that

Currently the EDC uses the root token which is not suitable for production stage.

Further notes

Note that the Vault token does not rotate. It is renewed.

A token has a TTL. The TTL defines the interval in which the token has to be renewed, otherwise it will be invalidated forever. If a token expires for any reason the EDC will go into a unhealthy state. Currently there is no other way to recover from a invalid token other than restarting the EDC with a fresh token since the token is provided in the boot configurations.

Brief explanation of new configurations added:

VAULT_TOKEN_TTL: Defines the TTL of the token which is passed to the Vault upon renewal. The TTL might not be honored by the Vault (e.g. in the case of periodic tokens). Therefore the TTL value returned by the Vault should be respected for each renewal. Vault requires a minimum TTL of 5 seconds.
VAULT_TOKEN_RENEW_BUFFER: Buffer before a renewal is triggered to account for network issues etc. Has to be smaller than the TTL.
VAULT_TOKEN_SCHEDULED_RENEWAL_ENABLED: Whether the automatic renewal feature added by this PR is active or not. Defaults to true. This should be only set to false for development or testing cases.

Upon start the EDC validates the token by calling the Vault API. For non valid tokens a error message will be logged and the Connector will enter a unhealthy state. If the token is renewable it will be renewed instantly. If the renewal was successful a scheduled one-shot task is submitted. The task executes after a delay defined as TTL - VAULT_TOKEN_RENEW_BUFFER. If the renewal was successful the next task is scheduled again at TTL - VAULT_TOKEN_RENEW_BUFFER and so on. Http requests are retried if they are retryable. See Hashicorp status codes

For non-renewable but valid tokens the EDC will stay healthy until the token expires.

Tokens have a max TTL even if they're renewable (unless they're periodic). After the max ttl expires the token will be invalidated for ever. Further renewals will fail.
The max TTL can either be a system default config on Vault side, or a explicit max TTL set by the admin at token creation.

Periodic tokens can be renewed forever as long they're renewed within the TTL.

Linked Issue(s)

Closes #3610

_{Hamid Ahmetovic[email protected], Mercedes-Benz Tech Innovation GmbH, legal info/Impressum}

# Conflicts: # spi/common/core-spi/src/main/java/org/eclipse/edc/spi/monitor/Monitor.java # spi/common/core-spi/src/main/java/org/eclipse/edc/spi/monitor/PrefixMonitor.java

…t_add_token_rotation

…t_add_token_rotation # Conflicts: # extensions/common/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultExtension.java # extensions/common/vault/vault-hashicorp/src/test/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultExtensionTest.java

spi/common/core-spi/src/main/java/org/eclipse/edc/spi/system/configuration/ConfigImpl.java

github-actions · 2024-02-16T01:46:10Z

This pull request is stale because it has been open for 7 days with no activity.

...ault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultClient.java

+            return Result.success(isRenewable);
+        } catch (IllegalArgumentException e) {
+            var errMsgFormat = "Failed to parse renewable flag from token look up response %s with reason: %s";
+            monitor.warning(errMsgFormat.formatted(map, e.getStackTrace()));


...ault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultClient.java

+            return Result.success(ttl);
+        } catch (IllegalArgumentException e) {
+            var errMsgFormat = "Failed to parse ttl from token renewal response %s with reason: %s";
+            monitor.warning(errMsgFormat.formatted(map, e.getStackTrace()));


paullatzelsperger

just a minor naming nit, but once that is resolved I think we can merge this PR.

...ault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultClient.java

...t-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultHealthExtension.java

...vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultHealthCheck.java

github-actions · 2024-03-06T01:46:02Z

This pull request is stale because it has been open for 7 days with no activity.

paullatzelsperger · 2024-03-11T09:13:18Z

@hamidonos is any work being done on this? Seeing as the latest comments from @jimmarino are 2 weeks old.

paullatzelsperger · 2024-03-14T15:15:07Z

Notice: should this PR not receive any updates by Friday March 15 2024 5pm CET, I will close, adopt and re-submit it under my authorship.
The Copyright will remain with the original author.

DominikPinsel · 2024-03-14T15:32:09Z

Notice: should this PR not receive any updates by Friday March 15 2024 5pm CET, I will close, adopt and re-submit it under my authorship. The Copyright will remain with the original author.

We kindly request reconsideration of the one-day response time, as your team member, Hamid, will be out of the office until Friday. Adjusting the response timeframe would greatly aid in maintaining workflow efficiency.

paullatzelsperger · 2024-03-14T15:52:56Z

@DominikPinsel this PR has been open forever, and no activity was visible for two weeks after the latest comments. We have a release scheduled for March 27 which should have this feature in it.

If it is a matter of a few days, then I'm sure we can accomodate, but we shouldn't wait too long. Shall we say +1week, i.e. Friday March 22nd then.

DominikPinsel · 2024-03-14T16:08:06Z

@DominikPinsel this PR has been open forever, and no activity was visible for two weeks after the latest comments. We have a release scheduled for March 27 which should have this feature in it.

If it is a matter of a few days, then I'm sure we can accomodate, but we shouldn't wait too long. Shall we say +1week, i.e. Friday March 22nd then.

This would be great! :)

…t_add_token_rotation

ndr-brt · 2024-03-19T13:46:41Z

hey @hamidonos we had some changes that conflicted with this PR, please solve conflicts and then we'll be ready to merge

…t_add_token_rotation # Conflicts: # extensions/common/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultClientConfig.java # extensions/common/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultConfig.java # extensions/common/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultExtension.java # extensions/common/vault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultHealthExtension.java # extensions/common/vault/vault-hashicorp/src/test/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultExtensionTest.java # extensions/common/vault/vault-hashicorp/src/test/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultIntegrationTest.java

codecov-commenter · 2024-03-20T11:35:09Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 90.07937% with 25 lines in your changes missing coverage. Please review.

Project coverage is 73.96%. Comparing base (7f20ba5) to head (f379945).
Report is 533 commits behind head on main.

Files with missing lines	Patch %	Lines
...ipse/edc/vault/hashicorp/HashicorpVaultClient.java	84.34%	11 Missing and 7 partials ⚠️
.../vault/hashicorp/HashicorpVaultTokenRenewTask.java	89.47%	1 Missing and 3 partials ⚠️
...vault/hashicorp/HashicorpVaultHealthExtension.java	81.81%	1 Missing and 1 partial ⚠️
...lipse/edc/spi/system/health/HealthCheckResult.java	0.00%	1 Missing ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3782      +/-   ##
==========================================
+ Coverage   71.74%   73.96%   +2.22%     
==========================================
  Files         919      984      +65     
  Lines       18457    20008    +1551     
  Branches     1037     1127      +90     
==========================================
+ Hits        13242    14799    +1557     
+ Misses       4756     4726      -30     
- Partials      459      483      +24

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

hamidonos and others added 26 commits November 14, 2023 14:05

feat: add PrefixMonitor (eclipse-edc#3510)

b27df54

Merge remote-tracking branch 'upstream/main'

b1567fc

Merge remote-tracking branch 'origin/main'

d8a378a

Merge remote-tracking branch 'upstream/main'

4dbc1a6

# Conflicts: # spi/common/core-spi/src/main/java/org/eclipse/edc/spi/monitor/Monitor.java # spi/common/core-spi/src/main/java/org/eclipse/edc/spi/monitor/PrefixMonitor.java

Merge remote-tracking branch 'upstream/main'

357576a

feat: add token rotation mechanism

9564908

Merge remote-tracking branch 'upstream/main' into feat/hashicorp_vaul…

a2d626b

…t_add_token_rotation

test: adding tests for hashicorp token rotation

a998033

Merge remote-tracking branch 'upstream/main' into feat/hashicorp_vaul…

25b8c10

…t_add_token_rotation

Merge remote-tracking branch 'upstream/main'

135422f

fix: fix checkstyle errors

75f2415

fix: set empty list when policies null

fc68484

docs: update DEPENDENCIES

9d2ca7b

fix: pr comments

dc4b869

fix: pr comments

d3ad64a

fix: pr comments

1f506a1

Merge remote-tracking branch 'upstream/main' into feat/hashicorp_vaul…

0ec48a5

…t_add_token_rotation

add custom retry mechanism to token renewal

f0529f9

merge upstream main

53a68ac

Merge remote-tracking branch 'upstream/main'

7f3d268

minor fixes

8c32fe3

extract hashicorp config value validation into separate class

d3dfb96

checkstyle fixes

1c7f407

remove vault timeout config

48bf002

clean up

202b2d9

hamidonos requested a review from paullatzelsperger as a code owner January 17, 2024 10:51

hamidonos self-assigned this Jan 17, 2024

hamidonos added the enhancement New feature or request label Jan 17, 2024

github-advanced-security bot found potential problems Jan 17, 2024

View reviewed changes

spi/common/core-spi/src/main/java/org/eclipse/edc/spi/system/configuration/ConfigImpl.java Fixed Show fixed Hide fixed

github-actions bot added the stale Open for x days with no activity label Feb 16, 2024

ndr-brt removed the stale Open for x days with no activity label Feb 16, 2024

update pr comments

8d446aa

github-advanced-security bot found potential problems Feb 16, 2024

View reviewed changes

hamidonos requested a review from paullatzelsperger February 16, 2024 19:10

paullatzelsperger approved these changes Feb 22, 2024

View reviewed changes

...ault/vault-hashicorp/src/main/java/org/eclipse/edc/vault/hashicorp/HashicorpVaultClient.java Outdated Show resolved Hide resolved

paullatzelsperger requested a review from jimmarino February 27, 2024 09:41

jimmarino requested changes Feb 27, 2024

View reviewed changes

github-actions bot added the stale Open for x days with no activity label Mar 6, 2024

ndr-brt removed the stale Open for x days with no activity label Mar 6, 2024

paullatzelsperger added this to the Milestone 14 milestone Mar 14, 2024

hamidonos added 3 commits March 18, 2024 16:15

Merge branch 'main' into feat/hashicorp_vault_add_token_rotation

2ecb81a

Merge remote-tracking branch 'upstream/main' into feat/hashicorp_vaul…

6a0beef

…t_add_token_rotation

update pr comments

1ea022b

hamidonos requested review from paullatzelsperger and jimmarino March 19, 2024 10:50

clean up merge

1a6c65f

jimmarino approved these changes Mar 19, 2024

View reviewed changes

hamidonos added 2 commits March 20, 2024 11:22

merge main into feature branch

f379945

ndr-brt merged commit 3cde990 into eclipse-edc:main Mar 20, 2024
16 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: implement automatic hashicorp token renewal #3782

feat: implement automatic hashicorp token renewal #3782

hamidonos commented Jan 17, 2024 •

edited

Loading

github-actions bot commented Feb 16, 2024

paullatzelsperger left a comment

github-actions bot commented Mar 6, 2024

paullatzelsperger commented Mar 11, 2024

paullatzelsperger commented Mar 14, 2024

DominikPinsel commented Mar 14, 2024

paullatzelsperger commented Mar 14, 2024 •

edited

Loading

DominikPinsel commented Mar 14, 2024

ndr-brt commented Mar 19, 2024

codecov-commenter commented Mar 20, 2024 •

edited

Loading

feat: implement automatic hashicorp token renewal #3782

feat: implement automatic hashicorp token renewal #3782

Conversation

hamidonos commented Jan 17, 2024 • edited Loading

What this PR changes/adds

Why it does that

Further notes

Linked Issue(s)

github-actions bot commented Feb 16, 2024

paullatzelsperger left a comment

Choose a reason for hiding this comment

github-actions bot commented Mar 6, 2024

paullatzelsperger commented Mar 11, 2024

paullatzelsperger commented Mar 14, 2024

DominikPinsel commented Mar 14, 2024

paullatzelsperger commented Mar 14, 2024 • edited Loading

DominikPinsel commented Mar 14, 2024

ndr-brt commented Mar 19, 2024

codecov-commenter commented Mar 20, 2024 • edited Loading

Codecov Report

hamidonos commented Jan 17, 2024 •

edited

Loading

paullatzelsperger commented Mar 14, 2024 •

edited

Loading

codecov-commenter commented Mar 20, 2024 •

edited

Loading