Class: Makit::Secrets::AzureSecrets

Inherits:
Object
  • Object
show all
Defined in:
lib/makit/secrets/azure_secrets.rb

Overview

Azure Key Vault adapter that implements the LocalSecrets interface Uses Azure CLI to store and retrieve individual secrets

Instance Method Summary collapse

Constructor Details

#initialize(keyvault_name: nil, secret_prefix: nil) ⇒ AzureSecrets

Returns a new instance of AzureSecrets.



10
11
12
13
14
 
# File 'lib/makit/secrets/azure_secrets.rb', line 10

def initialize(keyvault_name: nil, secret_prefix: nil)
  @keyvault_name = keyvault_name || AzureKeyVault.keyvault_name
  @secret_prefix = secret_prefix || AzureKeyVault.secret_prefix
  raise "Azure Key Vault name is required" if @keyvault_name.nil? || @keyvault_name.empty?
end

Instance Method Details

#add(key, value) ⇒ Object 



16
17
18
 
# File 'lib/makit/secrets/azure_secrets.rb', line 16

def add(key, value)
  set(key, value)
end

#get(key) ⇒ Object 



50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
 
# File 'lib/makit/secrets/azure_secrets.rb', line 50

def get(key)
  secret_name = build_secret_name(key)
  return nil unless secret_exists?(secret_name)

  unless AzureKeyVault.azure_cli_authenticated?
    raise "Azure CLI is not authenticated. Run 'az login' first"
  end

  cmd = [
    "az keyvault secret show",
    "--vault-name '#{@keyvault_name}'",
    "--name '#{secret_name}'",
    "--query value",
    "-o tsv",
    "2>&1"
  ].join(" ")

  output = `#{cmd}`.strip
  exit_code = $?.exitstatus

  if exit_code != 0
    nil
  else
    output
  end
end

#get_secrets_filename ⇒ Object 



82
83
84
 
# File 'lib/makit/secrets/azure_secrets.rb', line 82

def get_secrets_filename
  "#{@keyvault_name}/secrets"
end

#get_secrets_hash ⇒ Object 



86
87
88
89
90
91
 
# File 'lib/makit/secrets/azure_secrets.rb', line 86

def get_secrets_hash
  # Load all secrets from Azure Key Vault
  # This is a simplified version - in practice, you might want to list all secrets
  # For now, we'll return an empty hash and let individual get() calls retrieve secrets
  {}
end

#has_key?(key) ⇒ Boolean

Returns:

  • (Boolean) 


45
46
47
48
 
# File 'lib/makit/secrets/azure_secrets.rb', line 45

def has_key?(key)
  secret_name = build_secret_name(key)
  secret_exists?(secret_name)
end

#info ⇒ Object 



100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
 
# File 'lib/makit/secrets/azure_secrets.rb', line 100

def info
  unless AzureKeyVault.azure_cli_authenticated?
    puts "  Azure CLI is not authenticated. Run 'az login' first"
    return
  end

  cmd = [
    "az keyvault secret list",
    "--vault-name '#{@keyvault_name}'",
    "--query '[].name'",
    "-o tsv",
    "2>&1"
  ].join(" ")

  output = `#{cmd}`.strip
  exit_code = $?.exitstatus

  if exit_code != 0
    # Check if it's a permission error
    if output.include?("Forbidden") || output.include?("ForbiddenByRbac")
      puts "  Error: Insufficient permissions to list secrets from Azure Key Vault"
      puts "  The authenticated identity does not have the required RBAC permissions."
      puts "  Required permission: 'Microsoft.KeyVault/vaults/secrets/readMetadata/action'"
      puts "  Required role: 'Key Vault Secrets User' or 'Key Vault Secrets Officer'"
      puts "  Vault: #{@keyvault_name}"
      puts ""
      puts "  To fix this, ask your Azure administrator to grant you one of these roles:"
      puts "    - Key Vault Secrets User (read-only access to secret names and values)"
      puts "    - Key Vault Secrets Officer (full access to secrets)"
    else
      puts "  Error: Failed to list secrets from Azure Key Vault"
      puts "  #{output}"
    end
    return
  end

  secret_names = output.split("\n").map(&:strip).reject(&:empty?)

  if @secret_prefix
    # Filter secrets that match the prefix and remove the prefix
    filtered_secrets = secret_names.select { |name| name.start_with?("#{@secret_prefix}-") }
                                   .map { |name| name.sub(/^#{Regexp.escape(@secret_prefix)}-/, "") }
  else
    filtered_secrets = secret_names
  end

  if filtered_secrets.empty?
    puts "  No secrets found"
  else
    puts "  Available secrets (#{filtered_secrets.count}):"
    filtered_secrets.sort.each do |key|
      puts "    - #{key}"
    end
  end
end

#remove(key) ⇒ Object 



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/makit/secrets/azure_secrets.rb', line 20

def remove(key)
  secret_name = build_secret_name(key)
  return true unless secret_exists?(secret_name)

  unless AzureKeyVault.azure_cli_authenticated?
    raise "Azure CLI is not authenticated. Run 'az login' first"
  end

  cmd = [
    "az keyvault secret delete",
    "--vault-name '#{@keyvault_name}'",
    "--name '#{secret_name}'",
    "2>&1"
  ].join(" ")

  output = `#{cmd}`
  exit_code = $?.exitstatus

  if exit_code != 0
    raise "Failed to delete secret '#{secret_name}': #{output}"
  end

  true
end

#save_secrets_hash(hash) ⇒ Object 



93
94
95
96
97
98
 
# File 'lib/makit/secrets/azure_secrets.rb', line 93

def save_secrets_hash(hash)
  # Save all secrets from hash to Azure Key Vault
  hash.each do |key, value|
    set(key, value)
  end
end

#set(key, value) ⇒ Object 



77
78
79
80
 
# File 'lib/makit/secrets/azure_secrets.rb', line 77

def set(key, value)
  secret_name = build_secret_name(key)
  AzureKeyVault.set(secret_name, value.to_s, keyvault_name: @keyvault_name)
end