Robert D created NIFI-12080:
-------------------------------
Summary: HashiCorp Vault parameter context kv2 compatability.
Key: NIFI-12080
URL: https://issues.apache.org/jira/browse/NIFI-12080
Project: Apache NiFi
Issue Type: Improvement
Components: Core Framework
Affects Versions: 1.20.0
Environment: Tested on OpenShift 4.11 and local environment.
Reporter: Robert D
Attachments: image-2023-09-18-15-54-55-187.png,
image-2023-09-18-15-55-10-366.png
When trying to use hashicorp vault with a kv2 backend I can successfully
authenticate with vault but trying to use a parameter provider it can't list
any secrets.
I believe it's because {{KeyValueBackend.KV_1}} is hardcoded in the
{{listKeyValueSecrets}} function instead of using the member variable
{{{}keyValueBackend{}}}.
The code can be seen
[here|https://github.com/apache/nifi/blob/main/nifi-commons/nifi-hashicorp-vault/src/main/java/org/apache/nifi/vault/hashicorp/StandardHashiCorpVaultCommunicationService.java#L148].
!image-2023-09-18-15-54-55-187.png!
!image-2023-09-18-15-55-10-366.png!
After that is changed to {{keyValueBackend}} another issue that comes up is
that it can only list the top level secrets.
This is because {{listKeyValueSecrets}} hardcodes the path to the [root
path|https://github.com/apache/nifi/blob/main/nifi-commons/nifi-hashicorp-vault/src/main/java/org/apache/nifi/vault/hashicorp/StandardHashiCorpVaultCommunicationService.java#L149].
For example if there is a secret under the path {{shared/test}} it is
inaccessible.
Adding the {{shared}} path to the Key/Value path parameter also doesn't fix it
because Vault expects the metadata path after the kv engine.
A valid path would be {{/kv/metadata/shared/?list=true}} adding {{shared }}to
the Key/Value path makes a request to {{{}/kv/shared/metadata/?list=true{}}}.
Adding a parameter to the {{listKeyValueSecrets}} function to specify the
secret path fixes it.
In the parameter provider it says it's for Key/Value version 1 secrets but
after these changes I could use it with a kv2 backend. The only downside is
that it can only get the latest version of the secret but that is good enough
for my usecase.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
