Adding a Couchbase database plugin

[fhitchen]

Hi,

please could you take a look at this custom plugin. We use Couchbase extensively and I wanted to learn more about how Vault worked so ...

It handles credential rotation and dynamic and static roles.

I still need to clean up the testing code, add support for client certificate authentication and I think the object locking on Close is missing and write some description of how to configure vault and the accounts and roles that need to be created in Couchbase for the tests to work.

Please excuse the go code, it is my first attempt at writing anything serious in it so it is probably not as idiomatic as it should be. The go package is also pointing to my own repo where I initially created the plugin.

Example Vault configuration and roles to use the plugin.

$ SHA256=$(shasum -a 256 plugins/couchbase-database-plugin | cut -d' ' -f1)

$ vault secrets enable database

$ vault write sys/plugins/catalog/database/couchbase-database-plugin sha256=$SHA256 command=couchbase-database-plugin

Get self signed CA cert out of the DB.

BASE64PEM=$(openssl s_client -connect localhost:18091 -showcerts </dev/null 2>/dev/null|openssl x509 -outform PEM | base64 -w 0)

TLS encrypted connection

vault write database/config/my-couchbase plugin_name="couchbase-database-plugin" hosts="couchbases://localhost" username=Administrator password=Admin123
tls=true insecure_tls=true base64pem=${BASE64PEM} allowed_roles=my-couchbase-admin-role,my-couchbase-bucket-role

vault write database/roles/my-couchbase-admin-role db_name=my-couchbase default_ttl="5m" max_ttl="1h" creation_statements='[{"name":"admin"}]' revocation_statements="nil statement"

vault write database/roles/my-couchbase-bucket-role db_name=my-couchbase default_ttl="5m" max_ttl="1h" creation_statements='[{"name":"ro_admin"},{"name":"bucket_admin","bucket":"foo"}]' revocation_statements="nil statement"

Plain text connection

vault write database/config/other-couchbase plugin_name="couchbase-database-plugin" hosts="chanchan2" username=root password=rootpassword allowed_roles=other-couchbase-admin-role,other-couchbase-bucket-role,education

vault write database/static-roles/education db_name=other-couchbase username=vault-edu rotation_statements="nil statement" rotation_period="5m"

[hashicorp-cla]

All committers have signed the CLA.

[ncabatoff]

Hi @fhitchen,

Thank you for the contribution!

This looks good - I don't think it's quite ready to go yet but it seems to be on the right track. New database plugins generally get their own repo (e.g. vault-plugin-database-mongodbatlas), then get bundled into the Vault binary using go modules. You're of course welcome to continue working on this PR here, but ultimately we'll ask you to create a new PR against the new repo once it's created.

Let me know if you want a review now or you'd rather continue to improve the tests first. I also suggest looking at existing database plugin tests in Vault that you might hook into - for example, you could create your own version of TestBackend_StaticRole_Rotations_PostgreSQL to validate the rotation behaviour of your plugin.

[fhitchen]

Sure, let me add some more tests and then we can review. I have also asked the Couchbase folks to take a look at it and when I get their feedback I will make whatever changes they suggest and contact you through a comment here?

[ncabatoff]

Sure, let me add some more tests and then we can review. I have also asked the Couchbase folks to take a look at it and when I get their feedback I will make whatever changes they suggest and contact you through a comment here?

Sounds good!

[fhitchen]

Hi, i just looked at the TestBackend_StaticRole_Rotations_PostgreSQL and had a question. Is it testing the static role rotation through a running vault server, or is that simulated?

[ncabatoff]

Hi, i just looked at the TestBackend_StaticRole_Rotations_PostgreSQL and had a question. Is it testing the static role rotation through a running vault server, or is that simulated?

I guess sort of in between? It's an in-memory Vault instance for all intents and purposes. It's not invoking the Vault binary though, and there are some (mostly very minor) differences as a result. It's basically the test code invoking almost the same code that vault server does.

[fhitchen]

Hi, I got my code reviewed by the couchbase golang development team and they had a few suggestions that I have incorporated. I am still working on making the testing a better structured and will have that finished by the end of the week. I see that there is a hashicorp/vault-plugin-database-couchbase opened by kalafut. Can I fork that and add my work to it please? It is getting to be a pain keeping my own and the other hashicorp fork in sync. I also have managed to add couchbase support to the spring-boot-vault package so that a developer can whistle up couchbase credentials with a couple of annotated lines of code and a valid Vault token. regards, Francis.

[ncabatoff]

I see that there is a hashicorp/vault-plugin-database-couchbase opened by
kalafut. Can I fork that and add my work to it please? It is getting to be
a pain keeping my own and the other hashicorp fork in sync.

Yup, that's what it's there for.

[pbernal]

@fhitchen - do you mind if I close this in favor of your PR in the other repo: hashicorp/vault-plugin-database-couchbase#1 ?

[fhitchen]

Absolutely not a problem. Please go ahead and close it.

…

On Fri, Jun 26, 2020 at 12:18 PM Patrick Bernal ***@***.***> wrote: @fhitchen <https://github.com/fhitchen> - do you mind if I close this in favor of your PR in the other repo: hashicorp/vault-plugin-database-couchbase#1 <hashicorp/vault-plugin-database-couchbase#1> ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#9034 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABML24GXAKGB7B7CJQ5AZEDRYTJ5LANCNFSM4NFFTEBA> .

[fhitchen]

Hi, any idea when you will get around to having a look at my PR? I would like to finish it before I forget what I did. regards, Francis. On Fri, Jun 26, 2020 at 12:30 PM Francis Hitchens <fhitchen@gmail.com> wrote:

…

Absolutely not a problem. Please go ahead and close it. On Fri, Jun 26, 2020 at 12:18 PM Patrick Bernal ***@***.***> wrote: > @fhitchen <https://github.com/fhitchen> - do you mind if I close this in > favor of your PR in the other repo: > hashicorp/vault-plugin-database-couchbase#1 > <hashicorp/vault-plugin-database-couchbase#1> ? > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > <#9034 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ABML24GXAKGB7B7CJQ5AZEDRYTJ5LANCNFSM4NFFTEBA> > . >

[kalafut]

Hi @fhitchen. We'll be reviewing this soon. Thanks for your patience!

[fhitchen]

Hi Jim, Great, I have also added it to the Spring Cloud Vault Config project if you want to take a look at that too. spring-cloud/spring-cloud-vault#408 regards, Francis.

…

On Thu, Jul 9, 2020 at 11:49 PM Jim Kalafut ***@***.***> wrote: Hi @fhitchen <https://github.com/fhitchen>. We'll be reviewing this soon. Thanks for your patience! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#9034 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABML24GXUQYL2GGFM2YCDDDR22MUFANCNFSM4NFFTEBA> .

[pbernal]

Closing this, as the review is happening in the plugin repo.