{"action":"created","comment":{"url":"https://api.github.com/repos/hashicorp/nomad/pulls/comments/76475738","id":76475738,"diff_hunk":"@@ -0,0 +1,933 @@\n+package vaultclient\n+\n+import (\n+\t\"container/heap\"\n+\t\"fmt\"\n+\t\"log\"\n+\t\"math/rand\"\n+\t\"sync\"\n+\t\"time\"\n+\n+\t\"github.com/hashicorp/go-multierror\"\n+\tclientconfig \"github.com/hashicorp/nomad/client/config\"\n+\t\"github.com/hashicorp/nomad/client/rpcproxy\"\n+\t\"github.com/hashicorp/nomad/nomad\"\n+\t\"github.com/hashicorp/nomad/nomad/structs\"\n+\t\"github.com/hashicorp/nomad/nomad/structs/config\"\n+\tvaultapi \"github.com/hashicorp/vault/api\"\n+\t\"github.com/mitchellh/mapstructure\"\n+)\n+\n+// The interface which nomad client uses to interact with vault and\n+// periodically renews the tokens and secrets.\n+type VaultClient interface {\n+\t// Starts the renewal loop of tokens and secrets\n+\tStart()\n+\n+\t// Stops the renewal loop for tokens and secrets\n+\tStop()\n+\n+\t// Contacts the nomad server and fetches wrapped tokens for a set of\n+\t// tasks. The wrapped tokens will be unwrapped using vault and\n+\t// returned.\n+\tDeriveToken(*structs.Allocation, []string) (map[string]string, error)\n+\n+\t// Fetch the Consul ACL token required for the task\n+\tGetConsulACL(string, string) (*vaultapi.Secret, error)\n+\n+\t// Renews a token with the given increment and adds it to the min-heap\n+\t// for periodic renewal.\n+\tRenewToken(string, int) <-chan error\n+\n+\t// Removes the token from the min-heap, stopping its renewal.\n+\tStopRenewToken(string) error\n+\n+\t// Renews a vault secret's lease and add the lease identifier to the\n+\t// min-heap for periodic renewal.\n+\tRenewLease(string, int) <-chan error\n+\n+\t// Removes a secret's lease ID from the min-heap, stopping its renewal.\n+\tStopRenewLease(string) error\n+}\n+\n+// Implementation of VaultClient interface to interact with vault and perform\n+// token and lease renewals periodically.\n+type vaultClient struct {\n+\t// Client's region\n+\tregion string\n+\n+\t// The node in which this vault client is running in\n+\tnode *structs.Node\n+\n+\t// running indicates if the renewal loop is active or not\n+\trunning bool\n+\n+\t// connEstablished marks whether the connection to vault was successful\n+\t// or not\n+\tconnEstablished bool\n+\n+\t// tokenData is the data of the passed VaultClient token\n+\ttoken *tokenData\n+\n+\t// API client to interact with vault\n+\tclient *vaultapi.Client\n+\n+\t// Channel to notify heap modifications to the renewal loop\n+\tupdateCh chan struct{}\n+\n+\t// Channel to trigger termination of renewal loop\n+\tstopCh chan struct{}\n+\n+\t// Min-Heap to keep track of both tokens and leases\n+\theap *vaultClientHeap\n+\n+\t// Configuration to connect to vault\n+\tconfig *config.VaultConfig\n+\n+\tlock   sync.RWMutex\n+\tlogger *log.Logger\n+\n+\trpcHandler clientconfig.RPCHandler\n+\trpcProxy   *rpcproxy.RPCProxy\n+\tconnPool   *nomad.ConnPool\n+}\n+\n+// tokenData holds the relevant information about the Vault token passed to the\n+// client.\n+type tokenData struct {\n+\tCreationTTL int      `mapstructure:\"creation_ttl\"`\n+\tTTL         int      `mapstructure:\"ttl\"`\n+\tRenewable   bool     `mapstructure:\"renewable\"`\n+\tPolicies    []string `mapstructure:\"policies\"`\n+\tRole        string   `mapstructure:\"role\"`\n+\tRoot        bool\n+}\n+\n+// Request object for renewals. This can be used for both token renewals and\n+// secret's lease renewals.\n+type vaultClientRenewalRequest struct {\n+\t// Channel into which any renewal error will be sent down to\n+\terrCh chan error\n+\n+\t// This can either be a token or a lease identifier\n+\tid string\n+\n+\t// Duration for which the token or lease should be renewed for\n+\tincrement int\n+\n+\t// Indicates whether the 'id' field is a token or not\n+\tisToken bool\n+}\n+\n+// Element representing an entry in the renewal heap\n+type vaultClientHeapEntry struct {\n+\treq   *vaultClientRenewalRequest\n+\tnext  time.Time\n+\tindex int\n+}\n+\n+// Wrapper around the actual heap to provide additional symantics on top of\n+// functions provided by the heap interface. In order to achieve that, an\n+// additional map is placed beside the actual heap. This map can be used to\n+// check if an entry is already present in the heap.\n+type vaultClientHeap struct {\n+\theapMap map[string]*vaultClientHeapEntry\n+\theap    vaultDataHeapImp\n+}\n+\n+// Data type of the heap\n+type vaultDataHeapImp []*vaultClientHeapEntry\n+\n+// NewVaultClient returns a new vault client from the given config.\n+func NewVaultClient(node *structs.Node, region string, config *config.VaultConfig,\n+\tlogger *log.Logger, rpcHandler clientconfig.RPCHandler, connPool *nomad.ConnPool,\n+\trpcProxy *rpcproxy.RPCProxy) (*vaultClient, error) {\n+\tif !config.Enabled {\n+\t\treturn nil, nil\n+\t}\n+\n+\tif node == nil {\n+\t\treturn nil, fmt.Errorf(\"nil node\")\n+\t}\n+\n+\tif region == \"\" {\n+\t\treturn nil, fmt.Errorf(\"missing region\")\n+\t}\n+\n+\tif config == nil {\n+\t\treturn nil, fmt.Errorf(\"nil vault config\")\n+\t}\n+\n+\t// Creation of a vault client requires a token","path":"client/vaultclient/vaultclient.go","position":161,"original_position":161,"commit_id":"04fab3bc8189336939b96e918a94fcf915574a8b","original_commit_id":"04fab3bc8189336939b96e918a94fcf915574a8b","user":{"login":"dadgar","id":1047914,"avatar_url":"https://avatars.githubusercontent.com/u/1047914?v=3","gravatar_id":"","url":"https://api.github.com/users/dadgar","html_url":"https://github.com/dadgar","followers_url":"https://api.github.com/users/dadgar/followers","following_url":"https://api.github.com/users/dadgar/following{/other_user}","gists_url":"https://api.github.com/users/dadgar/gists{/gist_id}","starred_url":"https://api.github.com/users/dadgar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dadgar/subscriptions","organizations_url":"https://api.github.com/users/dadgar/orgs","repos_url":"https://api.github.com/users/dadgar/repos","events_url":"https://api.github.com/users/dadgar/events{/privacy}","received_events_url":"https://api.github.com/users/dadgar/received_events","type":"User","site_admin":false},"body":"The client shouldn't need to be given a Vault token. Unwrapping doesn't require a token and then when it is renewing it can set the token to be that of the unwrapped token","created_at":"2016-08-26T19:35:49Z","updated_at":"2016-08-26T19:35:49Z","html_url":"https://github.com/hashicorp/nomad/pull/1606#discussion_r76475738","pull_request_url":"https://api.github.com/repos/hashicorp/nomad/pulls/1606","_links":{"self":{"href":"https://api.github.com/repos/hashicorp/nomad/pulls/comments/76475738"},"html":{"href":"https://github.com/hashicorp/nomad/pull/1606#discussion_r76475738"},"pull_request":{"href":"https://api.github.com/repos/hashicorp/nomad/pulls/1606"}}},"pull_request":{"url":"https://api.github.com/repos/hashicorp/nomad/pulls/1606","id":81611324,"html_url":"https://github.com/hashicorp/nomad/pull/1606","diff_url":"https://github.com/hashicorp/nomad/pull/1606.diff","patch_url":"https://github.com/hashicorp/nomad/pull/1606.patch","issue_url":"https://api.github.com/repos/hashicorp/nomad/issues/1606","number":1606,"state":"open","locked":false,"title":"VaultClient for Nomad client's interactions with Vault","user":{"login":"vishalnayak","id":3053672,"avatar_url":"https://avatars.githubusercontent.com/u/3053672?v=3","gravatar_id":"","url":"https://api.github.com/users/vishalnayak","html_url":"https://github.com/vishalnayak","followers_url":"https://api.github.com/users/vishalnayak/followers","following_url":"https://api.github.com/users/vishalnayak/following{/other_user}","gists_url":"https://api.github.com/users/vishalnayak/gists{/gist_id}","starred_url":"https://api.github.com/users/vishalnayak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishalnayak/subscriptions","organizations_url":"https://api.github.com/users/vishalnayak/orgs","repos_url":"https://api.github.com/users/vishalnayak/repos","events_url":"https://api.github.com/users/vishalnayak/events{/privacy}","received_events_url":"https://api.github.com/users/vishalnayak/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-08-17T09:33:31Z","updated_at":"2016-08-26T19:35:49Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dbe3d260374cb0489a1c1cd1619a6bb3a0cfed46","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/hashicorp/nomad/pulls/1606/commits","review_comments_url":"https://api.github.com/repos/hashicorp/nomad/pulls/1606/comments","review_comment_url":"https://api.github.com/repos/hashicorp/nomad/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hashicorp/nomad/issues/1606/comments","statuses_url":"https://api.github.com/repos/hashicorp/nomad/statuses/04fab3bc8189336939b96e918a94fcf915574a8b","head":{"label":"hashicorp:f-vault-client","ref":"f-vault-client","sha":"04fab3bc8189336939b96e918a94fcf915574a8b","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":36653430,"name":"nomad","full_name":"hashicorp/nomad","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/nomad","description":"A Distributed, Highly Available, Datacenter-Aware Scheduler","fork":false,"url":"https://api.github.com/repos/hashicorp/nomad","forks_url":"https://api.github.com/repos/hashicorp/nomad/forks","keys_url":"https://api.github.com/repos/hashicorp/nomad/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/nomad/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/nomad/teams","hooks_url":"https://api.github.com/repos/hashicorp/nomad/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/nomad/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/nomad/events","assignees_url":"https://api.github.com/repos/hashicorp/nomad/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/nomad/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/nomad/tags","blobs_url":"https://api.github.com/repos/hashicorp/nomad/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/nomad/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/nomad/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/nomad/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/nomad/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/nomad/languages","stargazers_url":"https://api.github.com/repos/hashicorp/nomad/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/nomad/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/nomad/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/nomad/subscription","commits_url":"https://api.github.com/repos/hashicorp/nomad/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/nomad/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/nomad/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/nomad/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/nomad/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/nomad/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/nomad/merges","archive_url":"https://api.github.com/repos/hashicorp/nomad/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/nomad/downloads","issues_url":"https://api.github.com/repos/hashicorp/nomad/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/nomad/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/nomad/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/nomad/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/nomad/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/nomad/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/nomad/deployments","created_at":"2015-06-01T10:21:00Z","updated_at":"2016-08-26T13:17:08Z","pushed_at":"2016-08-26T18:45:52Z","git_url":"git://github.com/hashicorp/nomad.git","ssh_url":"git@github.com:hashicorp/nomad.git","clone_url":"https://github.com/hashicorp/nomad.git","svn_url":"https://github.com/hashicorp/nomad","homepage":"https://www.nomadproject.io/","size":30785,"stargazers_count":1802,"watchers_count":1802,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":284,"mirror_url":null,"open_issues_count":151,"forks":284,"open_issues":151,"watchers":1802,"default_branch":"master"}},"base":{"label":"hashicorp:master","ref":"master","sha":"72b7e89864f7f9503f93b778fe4ebda80ea5fb18","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":36653430,"name":"nomad","full_name":"hashicorp/nomad","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/nomad","description":"A Distributed, Highly Available, Datacenter-Aware Scheduler","fork":false,"url":"https://api.github.com/repos/hashicorp/nomad","forks_url":"https://api.github.com/repos/hashicorp/nomad/forks","keys_url":"https://api.github.com/repos/hashicorp/nomad/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/nomad/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/nomad/teams","hooks_url":"https://api.github.com/repos/hashicorp/nomad/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/nomad/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/nomad/events","assignees_url":"https://api.github.com/repos/hashicorp/nomad/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/nomad/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/nomad/tags","blobs_url":"https://api.github.com/repos/hashicorp/nomad/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/nomad/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/nomad/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/nomad/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/nomad/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/nomad/languages","stargazers_url":"https://api.github.com/repos/hashicorp/nomad/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/nomad/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/nomad/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/nomad/subscription","commits_url":"https://api.github.com/repos/hashicorp/nomad/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/nomad/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/nomad/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/nomad/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/nomad/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/nomad/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/nomad/merges","archive_url":"https://api.github.com/repos/hashicorp/nomad/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/nomad/downloads","issues_url":"https://api.github.com/repos/hashicorp/nomad/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/nomad/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/nomad/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/nomad/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/nomad/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/nomad/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/nomad/deployments","created_at":"2015-06-01T10:21:00Z","updated_at":"2016-08-26T13:17:08Z","pushed_at":"2016-08-26T18:45:52Z","git_url":"git://github.com/hashicorp/nomad.git","ssh_url":"git@github.com:hashicorp/nomad.git","clone_url":"https://github.com/hashicorp/nomad.git","svn_url":"https://github.com/hashicorp/nomad","homepage":"https://www.nomadproject.io/","size":30785,"stargazers_count":1802,"watchers_count":1802,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":284,"mirror_url":null,"open_issues_count":151,"forks":284,"open_issues":151,"watchers":1802,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/hashicorp/nomad/pulls/1606"},"html":{"href":"https://github.com/hashicorp/nomad/pull/1606"},"issue":{"href":"https://api.github.com/repos/hashicorp/nomad/issues/1606"},"comments":{"href":"https://api.github.com/repos/hashicorp/nomad/issues/1606/comments"},"review_comments":{"href":"https://api.github.com/repos/hashicorp/nomad/pulls/1606/comments"},"review_comment":{"href":"https://api.github.com/repos/hashicorp/nomad/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hashicorp/nomad/pulls/1606/commits"},"statuses":{"href":"https://api.github.com/repos/hashicorp/nomad/statuses/04fab3bc8189336939b96e918a94fcf915574a8b"}}}}
{"actor":{"display_login":"dadgar"}}