Skip to content

Commit bdf4d36

Browse files
tcardonnetcardonne
authored
refactor(vault): update dev environment and sample Vault config (#3547)
Signed-off-by: Thomas Cardonne <t.cardonne@gmail.com>
1 parent 8eff6ee commit bdf4d36

File tree

11 files changed

+1279
-170
lines changed

11 files changed

+1279
-170
lines changed

‎workspaces/vault/.changeset/lovely-insects-exist.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
'@backstage-community/plugin-vault-backend': patch
3+
'@backstage-community/plugin-vault': patch
4+
---
5+
6+
Add catalog plugins in devDependencies for development purposes.

‎workspaces/vault/README.md

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,34 @@
1-
# [Backstage](https://backstage.io)
1+
# Vault plugin for Backstage
22

3-
This is your newly scaffolded Backstage App, Good Luck!
3+
The [Vault](https://www.vaultproject.io/) Backstage plugin allows you to display a list of secrets in a certain path inside your Vault instance. There are also some useful links to edit and/or view them using the official UI.
44

5-
To start the app, run:
5+
## Plugins
6+
7+
This plugin is composed of several packages:
8+
9+
- [vault](./plugins/vault/README.md) - The frontend plugin that provides the UI components and pages.
10+
- [vault-backend](./plugins/vault-backend/README.md) - The backend plugin that provides the REST API.
11+
- [vault-node](./plugins/vault-node/README.md) - A node library containing reusable service logic.
12+
13+
## Quick start
14+
15+
You will find detailed installation instructions in each plugin's readme file.
16+
17+
## Developing
18+
19+
To test the plugin locally, you can start the development environment:
620

721
```sh
822
yarn install
923
yarn dev
1024
```
25+
26+
The sample dev app uses a Vault instance on `localhost:8200`, which you can setup in a separate terminal with:
27+
28+
```sh
29+
# Start a Vault server, using "root" as the root token
30+
vault server -dev -dev-root-token-id=root
31+
32+
# Configures sample data in Vault (secrets engine and secrets inside)
33+
./scripts/configure-dev-vault.sh
34+
```

‎workspaces/vault/app-config.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
app:
2+
title: Vault Backstage App
3+
baseUrl: http://localhost:3000
4+
5+
backend:
6+
baseUrl: http://localhost:7007
7+
listen:
8+
port: 7007
9+
csp:
10+
connect-src: ["'self'", 'http:', 'https:']
11+
cors:
12+
origin: http://localhost:3000
13+
methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
14+
credentials: true
15+
database:
16+
client: better-sqlite3
17+
connection: ':memory:'
18+
19+
auth:
20+
providers:
21+
guest: {}
22+
23+
catalog:
24+
import:
25+
entityFilename: catalog-info.yaml
26+
pullRequestBranchName: backstage-integration
27+
rules:
28+
- allow: [Component, System, API, Resource, Location]
29+
locations:
30+
# Local example data, file locations are relative to the backend process, typically `packages/backend`
31+
- type: file
32+
target: ../../examples/entities.yaml
33+
34+
# Local example organizational data
35+
- type: file
36+
target: ../../examples/org.yaml
37+
rules:
38+
- allow: [User, Group]
39+
40+
vault:
41+
baseUrl: http://localhost:8200
42+
publicUrl: http://localhost:8200
43+
auth:
44+
type: static
45+
secret: root
46+
secretEngine: 'secrets-v1' # Optional. By default it uses 'secrets'. Can be overwritten by the annotation of the entity
47+
kvVersion: 1 # Optional. The K/V version that your instance is using. The available options are '1' or '2'
48+
schedule: # Optional. If the token renewal is enabled this schedule will be used instead of the hourly one
49+
frequency: { hours: 1 }
50+
timeout: { hours: 1 }

‎workspaces/vault/examples/entities.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-system
3+
apiVersion: backstage.io/v1alpha1
4+
kind: System
5+
metadata:
6+
name: examples
7+
spec:
8+
owner: guests
9+
---
10+
# https://backstage.io/docs/features/software-catalog/descriptor-format#kind-component
11+
apiVersion: backstage.io/v1alpha1
12+
kind: Component
13+
metadata:
14+
name: example-website
15+
annotations:
16+
vault.io/secrets-path: website-v1
17+
vault.io/secrets-engine: secrets-v1 # Optional. By default it uses the 'secretEngine' value from your app-config.
18+
spec:
19+
type: website
20+
lifecycle: experimental
21+
owner: guests
22+
system: examples

‎workspaces/vault/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"node": "18 || 20"
77
},
88
"scripts": {
9+
"dev": "yarn workspaces foreach -A --include @backstage-community/plugin-vault --include @backstage-community/plugin-vault-backend --parallel -v -i run start",
910
"tsc": "tsc",
1011
"tsc:full": "tsc --skipLibCheck false --incremental false",
1112
"build:all": "backstage-cli repo build --all",

‎workspaces/vault/plugins/vault-backend/dev/index.ts

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,13 @@ import { createBackend } from '@backstage/backend-defaults';
1717

1818
const backend = createBackend();
1919

20+
// the auth plugin is needed to setup a fully authenticated backend for the catalog backend
2021
backend.add(import('@backstage/plugin-auth-backend'));
2122
backend.add(import('@backstage/plugin-auth-backend-module-guest-provider'));
23+
24+
// We need the catalog plugin to get the example entities and make the front entity page functional
25+
backend.add(import('@backstage/plugin-catalog-backend'));
26+
2227
backend.add(import('../src'));
2328

2429
backend.start();

‎workspaces/vault/plugins/vault-backend/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@
6565
"@backstage/cli": "^0.31.0",
6666
"@backstage/plugin-auth-backend": "^0.24.4",
6767
"@backstage/plugin-auth-backend-module-guest-provider": "^0.2.6",
68+
"@backstage/plugin-catalog-backend": "^1.32.0",
6869
"@types/compression": "^1.7.2",
6970
"@types/node-fetch": "^2.5.12",
7071
"@types/supertest": "^6.0.0",

‎workspaces/vault/plugins/vault/dev/index.tsx

Lines changed: 42 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -14,74 +14,55 @@
1414
* limitations under the License.
1515
*/
1616

17-
import { Entity } from '@backstage/catalog-model';
18-
import { Content, Header, HeaderLabel, Page } from '@backstage/core-components';
1917
import { createDevApp } from '@backstage/dev-utils';
20-
import { EntityProvider } from '@backstage/plugin-catalog-react';
21-
import { TestApiProvider } from '@backstage/test-utils';
22-
import Box from '@material-ui/core/Box';
23-
import Typography from '@material-ui/core/Typography';
24-
import SomeIcon from '@material-ui/icons/Storage';
25-
import React from 'react';
26-
import { VaultApi, vaultApiRef } from '../src/api';
18+
import {
19+
CatalogEntityPage,
20+
CatalogIndexPage,
21+
catalogPlugin,
22+
EntityAboutCard,
23+
EntityHasSubcomponentsCard,
24+
EntityLayout,
25+
} from '@backstage/plugin-catalog';
26+
import Grid from '@material-ui/core/Grid';
27+
import React, { PropsWithChildren } from 'react';
2728
import { EntityVaultCard } from '../src/components/EntityVaultCard';
28-
import { EntityVaultTable } from '../src/components/EntityVaultTable';
29-
import { VAULT_SECRET_PATH_ANNOTATION } from '../src/constants';
3029
import { vaultPlugin } from '../src/plugin';
3130

32-
const entity: Entity = {
33-
apiVersion: 'backstage.io/v1alpha1',
34-
kind: 'Component',
35-
metadata: {
36-
name: 'backstage',
37-
annotations: { [VAULT_SECRET_PATH_ANNOTATION]: 'a/b' },
38-
},
39-
spec: {
40-
type: 'service',
41-
},
42-
};
43-
44-
const mockedApi: VaultApi = {
45-
async listSecrets() {
46-
return [
47-
{
48-
name: 'a::b',
49-
path: '',
50-
editUrl: 'https://example.com',
51-
showUrl: 'https://example.com',
52-
},
53-
{
54-
name: 'c::d',
55-
path: '',
56-
editUrl: 'https://example.com',
57-
showUrl: 'https://example.com',
58-
},
59-
];
60-
},
61-
};
31+
const SampleEntityPage = ({ children }: PropsWithChildren<{}>) => (
32+
<EntityLayout>
33+
<EntityLayout.Route path="/" title="Overview">
34+
<Grid container spacing={3} alignItems="stretch">
35+
<Grid item md={12}>
36+
<EntityAboutCard variant="gridItem" />
37+
</Grid>
38+
{children}
39+
<Grid item xs={12}>
40+
<EntityHasSubcomponentsCard variant="gridItem" />
41+
</Grid>
42+
</Grid>
43+
</EntityLayout.Route>
44+
</EntityLayout>
45+
);
6246

6347
createDevApp()
64-
.registerPlugin(vaultPlugin)
48+
// We need the catalog plugin to get the example entities and make the front entity page functional
49+
.registerPlugin(catalogPlugin)
6550
.addPage({
66-
element: (
67-
<TestApiProvider apis={[[vaultApiRef, mockedApi]]}>
68-
<EntityProvider entity={entity}>
69-
<Page themeId="service">
70-
<Header title="Mocked Vault">
71-
<HeaderLabel label="Mode" value="Development" />
72-
</Header>
73-
<Content>
74-
<Typography variant="h3">As a card</Typography>
75-
<EntityVaultCard />
76-
<Box mt={4} />
77-
<Typography variant="h3">As a table</Typography>
78-
<EntityVaultTable entity={entity} />
79-
</Content>
80-
</Page>
81-
</EntityProvider>
82-
</TestApiProvider>
51+
path: '/catalog',
52+
title: 'Catalog',
53+
element: <CatalogIndexPage />,
54+
})
55+
// We need the entity page experience to see the linguist card
56+
.addPage({
57+
path: '/catalog/:namespace/:kind/:name',
58+
element: <CatalogEntityPage />,
59+
children: (
60+
<SampleEntityPage>
61+
<Grid item md={12}>
62+
<EntityVaultCard />
63+
</Grid>
64+
</SampleEntityPage>
8365
),
84-
title: 'Vault',
85-
icon: SomeIcon,
8666
})
67+
.registerPlugin(vaultPlugin)
8768
.render();

‎workspaces/vault/plugins/vault/package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@
5858
"@backstage/cli": "^0.31.0",
5959
"@backstage/core-app-api": "^1.16.0",
6060
"@backstage/dev-utils": "^1.1.8",
61+
"@backstage/plugin-catalog": "^1.28.0",
6162
"@backstage/test-utils": "^1.7.6",
6263
"@testing-library/dom": "^10.0.0",
6364
"@testing-library/jest-dom": "^6.0.0",

‎workspaces/vault/scripts/configure-dev-vault.sh

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
3+
export VAULT_ADDR='http://127.0.0.1:8200'
4+
export VAULT_TOKEN='root'
5+
6+
# Create a kv v1 under secrets-v1/
7+
vault secrets enable -path=secrets-v1 -version=1 kv
8+
9+
# Create a kv v2 under secrets-v2/
10+
vault secrets enable -path=secrets-v2 -version=2 kv
11+
12+
# Create secrets for v1
13+
vault kv put secrets-v1/website-v1/prod/database username="user" password="it's a secret"
14+
vault kv put secrets-v1/website-v1/preprod/database username="user" password="it's a secret"
15+
16+
# Create secrets for v2
17+
vault kv put secrets-v2/website-v2/prod/database username="user" password="it's a secret"
18+
vault kv put secrets-v2/website-v2/preprod/database username="user" password="it's a secret"

0 commit comments

Comments
 (0)