Skip to content
This repository was archived by the owner on Jun 19, 2025. It is now read-only.

Commit 92eac4f

Browse files
ramondekleinramondeklein
committed
Use verbose flag
1 parent 5e86735 commit 92eac4f

File tree

15 files changed

+44
-43
lines changed

15 files changed

+44
-43
lines changed

‎cmd/kes/migrate.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func migrate(args []string) {
109109
srcConf, err := kesconf.ReadFile(fromPath)
110110
cli.Assert(err == nil, err)
111111

112-
src, err := srcConf.KeyStore.Connect(ctx)
112+
src, err := srcConf.KeyStore.Connect(ctx, false)
113113
cli.Assert(err == nil, err)
114114

115115
iter := &kes.ListIter[string]{
@@ -121,7 +121,7 @@ func migrate(args []string) {
121121
dstConf, err := kesconf.ReadFile(toPath)
122122
cli.Assert(err == nil, err)
123123

124-
dst, err := dstConf.KeyStore.Connect(ctx)
124+
dst, err := dstConf.KeyStore.Connect(ctx, false)
125125
cli.Assert(err == nil, err)
126126

127127
var (

‎cmd/kes/server.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,13 +79,15 @@ func serverCmd(args []string) {
7979
tlsCertFlag string
8080
mtlsAuthFlag string
8181
devFlag bool
82+
verboseFlag bool
8283
)
8384
cmd.StringVar(&addrFlag, "addr", "", "The address of the server")
8485
cmd.StringVar(&configFlag, "config", "", "Path to the server configuration file")
8586
cmd.StringVar(&tlsKeyFlag, "key", "", "Path to the TLS private key")
8687
cmd.StringVar(&tlsCertFlag, "cert", "", "Path to the TLS certificate")
8788
cmd.StringVar(&mtlsAuthFlag, "auth", "", "Controls how the server handles mTLS authentication")
8889
cmd.BoolVar(&devFlag, "dev", false, "Start the KES server in development mode")
90+
cmd.BoolVar(&verboseFlag, "verbose", false, "Log verbose output (Vault only)")
8991
if err := cmd.Parse(args[1:]); err != nil {
9092
if errors.Is(err, flag.ErrHelp) {
9193
os.Exit(2)
@@ -122,12 +124,12 @@ func serverCmd(args []string) {
122124
return
123125
}
124126

125-
if err := startServer(addrFlag, configFlag); err != nil {
127+
if err := startServer(addrFlag, configFlag, verboseFlag); err != nil {
126128
cli.Fatal(err)
127129
}
128130
}
129131

130-
func startServer(addrFlag, configFlag string) error {
132+
func startServer(addrFlag, configFlag string, verbose bool) error {
131133
var memLocked bool
132134
if runtime.GOOS == "linux" {
133135
memLocked = mlockall() == nil
@@ -174,7 +176,7 @@ func startServer(addrFlag, configFlag string) error {
174176
ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
175177
defer cancel()
176178

177-
conf, err := rawConfig.Config(ctx)
179+
conf, err := rawConfig.Config(ctx, verbose)
178180
if err != nil {
179181
return err
180182
}
@@ -238,7 +240,7 @@ func startServer(addrFlag, configFlag string) error {
238240
fmt.Fprintf(os.Stderr, "Failed to reload server config: %v\n", err)
239241
continue
240242
}
241-
config, err := file.Config(ctx)
243+
config, err := file.Config(ctx, verbose)
242244
if err != nil {
243245
fmt.Fprintf(os.Stderr, "Failed to reload server config: %v\n", err)
244246
continue

‎internal/http/log.go

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,22 @@ package http
33
import (
44
"log/slog"
55
"net/http"
6+
"slices"
67
"time"
78
)
89

910
// LoggingTransport is an http.RoundTripper that logs the request and response.
1011
type LoggingTransport struct {
1112
http.RoundTripper
13+
skipPaths []string
14+
}
15+
16+
// NewLoggingTransport creates an http.RoundTripper that logs the request and response.
17+
func NewLoggingTransport(rt http.RoundTripper, skipPaths ...string) *LoggingTransport {
18+
return &LoggingTransport{
19+
RoundTripper: rt,
20+
skipPaths: skipPaths,
21+
}
1222
}
1323

1424
// RoundTrip implements the RoundTripper interface.
@@ -22,7 +32,7 @@ func (lt *LoggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
2232
resp, err := rt.RoundTrip(req)
2333

2434
// don't log health checks
25-
if req.URL.Path != "/v1/sys/health" {
35+
if !slices.Contains(lt.skipPaths, req.URL.Path) {
2636
switch {
2737
case err != nil:
2838
slog.Info("HTTP error",

‎internal/keystore/vault/config.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -220,9 +220,6 @@ type Config struct {
220220
// host's root CA set is used.
221221
CAPath string
222222

223-
// Flag to enable logging of all Vault HTTP requests
224-
Verbose bool
225-
226223
lock sync.RWMutex
227224
}
228225

@@ -249,6 +246,5 @@ func (c *Config) Clone() *Config {
249246
PrivateKey: c.PrivateKey,
250247
Certificate: c.Certificate,
251248
CAPath: c.CAPath,
252-
Verbose: c.Verbose,
253249
}
254250
}

‎internal/keystore/vault/vault.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ import (
2727
"aead.dev/mem"
2828
vaultapi "github.com/hashicorp/vault/api"
2929
"github.com/minio/kes"
30-
internalhttp "github.com/minio/kes/internal/http"
30+
xhttp "github.com/minio/kes/internal/http"
3131
"github.com/minio/kes/internal/keystore"
3232
kesdk "github.com/minio/kms-go/kes"
3333
)
@@ -41,7 +41,7 @@ type Store struct {
4141

4242
// Connect connects to a Hashicorp Vault server with
4343
// the given configuration.
44-
func Connect(ctx context.Context, c *Config) (*Store, error) {
44+
func Connect(ctx context.Context, c *Config, verbose bool) (*Store, error) {
4545
c = c.Clone()
4646

4747
if c.Engine == "" {
@@ -114,8 +114,8 @@ func Connect(ctx context.Context, c *Config) (*Store, error) {
114114
tr.DisableKeepAlives = true
115115
tr.MaxIdleConnsPerHost = -1
116116
}
117-
if c.Verbose {
118-
config.HttpClient.Transport = &internalhttp.LoggingTransport{RoundTripper: config.HttpClient.Transport}
117+
if verbose {
118+
config.HttpClient.Transport = xhttp.NewLoggingTransport(config.HttpClient.Transport, "/v1/sys/health")
119119
}
120120
vaultClient, err := vaultapi.NewClient(config)
121121
if err != nil {
@@ -150,7 +150,7 @@ func Connect(ctx context.Context, c *Config) (*Store, error) {
150150
lastAuthSuccess = false
151151
}
152152
} else {
153-
if c.Verbose {
153+
if verbose {
154154
obfuscatedToken := secret.Auth.ClientToken
155155
if len(obfuscatedToken) > 10 {
156156
obfuscatedToken = obfuscatedToken[:2] + "***" + obfuscatedToken[len(obfuscatedToken)-4:]

‎kesconf/aws_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestAWS(t *testing.T) {
2929
ctx, cancel := testingContext(t)
3030
defer cancel()
3131

32-
store, err := config.KeyStore.Connect(ctx)
32+
store, err := config.KeyStore.Connect(ctx, false)
3333
if err != nil {
3434
t.Fatal(err)
3535
}

‎kesconf/azure_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ func TestAzure(t *testing.T) {
3535
ctx, cancel := testingContext(t)
3636
defer cancel()
3737

38-
store, err := config.KeyStore.Connect(ctx)
38+
store, err := config.KeyStore.Connect(ctx, false)
3939
if err != nil {
4040
t.Fatal(err)
4141
}

‎kesconf/config.go

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,6 @@ type ymlFile struct {
121121
Status struct {
122122
Ping env[time.Duration] `yaml:"ping"`
123123
} `yaml:"status"`
124-
125-
Verbose env[bool] `yaml:"verbose"`
126124
} `yaml:"vault"`
127125

128126
Fortanix *struct {
@@ -478,7 +476,6 @@ func ymlToKeyStore(y *ymlFile) (KeyStore, error) {
478476
Certificate: y.KeyStore.Vault.TLS.Certificate.Value,
479477
CAPath: y.KeyStore.Vault.TLS.CAPath.Value,
480478
StatusPing: y.KeyStore.Vault.Status.Ping.Value,
481-
Verbose: y.KeyStore.Vault.Verbose.Value,
482479
}
483480
if y.KeyStore.Vault.AppRole != nil {
484481
s.AppRole = &VaultAppRoleAuth{

‎kesconf/file.go

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ func (f *File) TLSConfig() (*tls.Config, error) {
159159
// Config returns a new KES configuration as specified by
160160
// the File. It connects to the KeyStore using the given
161161
// context.
162-
func (f *File) Config(ctx context.Context) (*kes.Config, error) {
162+
func (f *File) Config(ctx context.Context, verbose bool) (*kes.Config, error) {
163163
conf := &kes.Config{
164164
Admin: f.Admin,
165165
}
@@ -211,7 +211,7 @@ func (f *File) Config(ctx context.Context) (*kes.Config, error) {
211211
}
212212

213213
if f.KeyStore != nil {
214-
keystore, err := f.KeyStore.Connect(ctx)
214+
keystore, err := f.KeyStore.Connect(ctx, verbose)
215215
if err != nil {
216216
return nil, err
217217
}
@@ -365,7 +365,7 @@ type Key struct {
365365
type KeyStore interface {
366366
// Connect establishes and returns a new connection
367367
// to the keystore.
368-
Connect(ctx context.Context) (kes.KeyStore, error)
368+
Connect(ctx context.Context, verbose bool) (kes.KeyStore, error)
369369
}
370370

371371
// FSKeyStore is a structure containing the configuration
@@ -382,7 +382,7 @@ type FSKeyStore struct {
382382
}
383383

384384
// Connect returns a kv.Store that stores key-value pairs in a path on the filesystem.
385-
func (s *FSKeyStore) Connect(context.Context) (kes.KeyStore, error) {
385+
func (s *FSKeyStore) Connect(context.Context, bool) (kes.KeyStore, error) {
386386
return fs.NewStore(s.Path)
387387
}
388388

@@ -455,9 +455,6 @@ type VaultKeyStore struct {
455455
// is checked.
456456
// If not set, defaults to 10s.
457457
StatusPing time.Duration
458-
459-
// Verbose enables logging of all HTTP requests to Vault
460-
Verbose bool
461458
}
462459

463460
// VaultAppRoleAuth is a structure containing the configuration
@@ -531,7 +528,7 @@ type VaultTransit struct {
531528
}
532529

533530
// Connect returns a kv.Store that stores key-value pairs on a Hashicorp Vault server.
534-
func (s *VaultKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
531+
func (s *VaultKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
535532
if s.AppRole == nil && s.Kubernetes == nil {
536533
return nil, errors.New("edge: failed to connect to hashicorp vault: no authentication method specified")
537534
}
@@ -548,7 +545,6 @@ func (s *VaultKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
548545
Certificate: s.Certificate,
549546
CAPath: s.CAPath,
550547
StatusPingAfter: s.StatusPing,
551-
Verbose: s.Verbose,
552548
}
553549
if s.AppRole != nil {
554550
c.AppRole = &vault.AppRole{
@@ -572,7 +568,7 @@ func (s *VaultKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
572568
KeyName: s.Transit.KeyName,
573569
}
574570
}
575-
return vault.Connect(ctx, c)
571+
return vault.Connect(ctx, c, verbose)
576572
}
577573

578574
// FortanixKeyStore is a structure containing the
@@ -598,7 +594,7 @@ type FortanixKeyStore struct {
598594
}
599595

600596
// Connect returns a kv.Store that stores key-value pairs on a Fortanix SDKMS server.
601-
func (s *FortanixKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
597+
func (s *FortanixKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
602598
return fortanix.Connect(ctx, &fortanix.Config{
603599
Endpoint: s.Endpoint,
604600
GroupID: s.GroupID,
@@ -633,7 +629,7 @@ type KeySecureKeyStore struct {
633629
}
634630

635631
// Connect returns a kv.Store that stores key-value pairs on a Gemalto KeySecure instance.
636-
func (s *KeySecureKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
632+
func (s *KeySecureKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
637633
return gemalto.Connect(ctx, &gemalto.Config{
638634
Endpoint: s.Endpoint,
639635
CAPath: s.CAPath,
@@ -682,7 +678,7 @@ type GCPSecretManagerKeyStore struct {
682678
}
683679

684680
// Connect returns a kv.Store that stores key-value pairs on GCP SecretManager.
685-
func (s *GCPSecretManagerKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
681+
func (s *GCPSecretManagerKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
686682
return gcp.Connect(ctx, &gcp.Config{
687683
Endpoint: s.Endpoint,
688684
ProjectID: s.ProjectID,
@@ -726,7 +722,7 @@ type AWSSecretsManagerKeyStore struct {
726722
}
727723

728724
// Connect returns a kv.Store that stores key-value pairs on AWS SecretsManager.
729-
func (s *AWSSecretsManagerKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
725+
func (s *AWSSecretsManagerKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
730726
return aws.Connect(ctx, &aws.Config{
731727
Addr: s.Endpoint,
732728
Region: s.Region,
@@ -762,7 +758,7 @@ type AzureKeyVaultKeyStore struct {
762758
}
763759

764760
// Connect returns a kv.Store that stores key-value pairs on Azure KeyVault.
765-
func (s *AzureKeyVaultKeyStore) Connect(_ context.Context) (kes.KeyStore, error) {
761+
func (s *AzureKeyVaultKeyStore) Connect(_ context.Context, verbose bool) (kes.KeyStore, error) {
766762
if (s.TenantID != "" || s.ClientID != "" || s.ClientSecret != "") && s.ManagedIdentityClientID != "" {
767763
return nil, errors.New("edge: failed to connect to Azure KeyVault: more than one authentication method specified")
768764
}
@@ -812,7 +808,7 @@ type EntrustKeyControlKeyStore struct {
812808
}
813809

814810
// Connect returns a kv.Store that stores key-value pairs on Entrust KeyControl.
815-
func (s *EntrustKeyControlKeyStore) Connect(ctx context.Context) (kes.KeyStore, error) {
811+
func (s *EntrustKeyControlKeyStore) Connect(ctx context.Context, verbose bool) (kes.KeyStore, error) {
816812
var rootCAs *x509.CertPool
817813
if s.CAPath != "" {
818814
ca, err := https.CertPoolFromFile(s.CAPath)

‎kesconf/fortanix_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func TestFortanix(t *testing.T) {
3030
ctx, cancel := testingContext(t)
3131
defer cancel()
3232

33-
store, err := config.KeyStore.Connect(ctx)
33+
store, err := config.KeyStore.Connect(ctx, false)
3434
if err != nil {
3535
t.Fatal(err)
3636
}

0 commit comments

Comments
 (0)