Skip to content

Commit 5b3b7a1

Browse files
lewismiddletonrussozfelixfontein
authored
github_app_access_token: add support for private key fact (#8989)
* github_app_access_token: add support for private key fact Adds support for specifying the GitHub App private key via an ansible fact instead of a path to a file. This is useful when you want to generate registration tokens for a remote host but don't want to put secrets on the host. * Add license file * Fix pep8 formatting * Add changelog fragment * Run sanity tests on changelog * Apply suggestions from code review Co-authored-by: Alexei Znamensky <[email protected]> Co-authored-by: Felix Fontein <[email protected]> * Add input validation check * Add import * Apply suggestions from code review Co-authored-by: Felix Fontein <[email protected]> * Add error for mutually exclusive options * Update plugins/lookup/github_app_access_token.py Co-authored-by: Felix Fontein <[email protected]> --------- Co-authored-by: Alexei Znamensky <[email protected]> Co-authored-by: Felix Fontein <[email protected]>
1 parent 9fb686f commit 5b3b7a1

File tree

7 files changed

+106
-6
lines changed

7 files changed

+106
-6
lines changed

‎changelogs/fragments/8989-github-app-token-from-fact.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
minor_changes:
2+
- github_app_access_token lookup plugin - adds new ``private_key`` parameter (https://github.com/ansible-collections/community.general/pull/8989).

‎plugins/lookup/github_app_access_token.py

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
key_path:
2020
description:
2121
- Path to your private key.
22-
required: true
22+
- Either O(key_path) or O(private_key) must be specified.
2323
type: path
2424
app_id:
2525
description:
@@ -34,6 +34,12 @@
3434
- Alternatively, you can use PyGithub (U(https://github.com/PyGithub/PyGithub)) to get your installation ID.
3535
required: true
3636
type: str
37+
private_key:
38+
description:
39+
- GitHub App private key in PEM file format as string.
40+
- Either O(key_path) or O(private_key) must be specified.
41+
type: str
42+
version_added: 10.0.0
3743
token_expiry:
3844
description:
3945
- How long the token should last for in seconds.
@@ -71,7 +77,7 @@
7177
import json
7278
from ansible.module_utils.urls import open_url
7379
from ansible.module_utils.six.moves.urllib.error import HTTPError
74-
from ansible.errors import AnsibleError
80+
from ansible.errors import AnsibleError, AnsibleOptionsError
7581
from ansible.plugins.lookup import LookupBase
7682
from ansible.utils.display import Display
7783

@@ -84,8 +90,10 @@
8490
display = Display()
8591

8692

87-
def read_key(path):
93+
def read_key(path, private_key=None):
8894
try:
95+
if private_key:
96+
return jwk_from_pem(private_key.encode('utf-8'))
8997
with open(path, 'rb') as pem_file:
9098
return jwk_from_pem(pem_file.read())
9199
except Exception as e:
@@ -132,8 +140,8 @@ def post_request(generated_jwt, installation_id):
132140
return json_data.get('token')
133141

134142

135-
def get_token(key_path, app_id, installation_id, expiry=600):
136-
jwk = read_key(key_path)
143+
def get_token(key_path, app_id, installation_id, private_key, expiry=600):
144+
jwk = read_key(key_path, private_key)
137145
generated_jwt = encode_jwt(app_id, jwk, exp=expiry)
138146
return post_request(generated_jwt, installation_id)
139147

@@ -146,10 +154,16 @@ def run(self, terms, variables=None, **kwargs):
146154

147155
self.set_options(var_options=variables, direct=kwargs)
148156

157+
if not (self.get_option("key_path") or self.get_option("private_key")):
158+
raise AnsibleOptionsError("One of key_path or private_key is required")
159+
if self.get_option("key_path") and self.get_option("private_key"):
160+
raise AnsibleOptionsError("key_path and private_key are mutually exclusive")
161+
149162
t = get_token(
150163
self.get_option('key_path'),
151164
self.get_option('app_id'),
152165
self.get_option('installation_id'),
166+
self.get_option('private_key'),
153167
self.get_option('token_expiry'),
154168
)
155169

‎tests/integration/targets/github_app_access_token/files/app-private-key.pem

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIEogIBAAKCAQEAr/EjKUujUdliSX79ZlDwq/+RCnOF1JCrekWGOOK4YGqgfJBM
3+
Z/CLHYTW+BQAH172NTEwLlegwJpXtalae9WVhyMs4sFm7nxSZsFjRK7Gof1tuFbD
4+
i4+GGlu4kci7xVcxzoZoVvswX4Xw/9MCg/Je35H8xbugwsWYg+ou79e0wx0fYU4d
5+
dwiUte8K+/d1l5acMQuqcnUfJLRmXvw3w7hyemB51EPTGqkpcA4KmYns1W12ianD
6+
Zo9/d2kLC2mcyxDkHmqWCv9vfUVrKB7yIC8DU5uY/acFtBaVE1yyvI+1lCCkxNWX
7+
5IDbpP/xRJk68B0WXKaU2IdFUVYSD48u3nSZoQIDAQABAoIBAGLL9KOevqIagK+m
8+
qKKItuzOgOKuhisb5b6uRbWx0jkKBv6LhOwkzemQi6oYiQ0UpQqviU+sky80PCZd
9+
Z9r7z5Bn9y+JzMQEeb0LwTNzNUUHa1JFHl9DA9nPQXBTmOUyllxTa0nUmZA6RV9S
10+
XSo8snu2nYtnVdmpXYBNw3eY1/9rb1blXEZHLJbCTaTX3MuWDYuJ4G0K6EArjSwG
11+
DDGhOWIWfkk3zZAHqdsrJxgqXIx2Cv9m40hmC0XMwqh8/H3j4kZZhdglJhNbvnBM
12+
8ZKRzpMOP1hbGATmi9A1HU+o6BpdIl1dyMRiod3WjSS7CKvs8BVR0XMK/SXDV9Wl
13+
Jy6kwYUCgYEA4HwzV/YT+cTb61VL5ICj871m5VMaGJD96dOrnX33QYRNw5aLRc35
14+
HMaJ1t5Bp0d2J5h0mPoQkSvQxuPYfaytTYknSUE/bObYNMEnII3XeTmA8ILlG7kV
15+
8OQah66GMKjyHocie2PxUuu9BWtuPvZJDrOuR9Pmw5aH6+oiXBSM0YcCgYEAyKRW
16+
FHtDGC8ZHgBaytaGvlbVo3RTKboQgYqzf9HdvzWHlSbeZVuCk6MWtSNU+5+26RBK
17+
FCI8FTBxqY/vai9zRgp/1u3jY3N1WIsowBgBV7C84IP6gEr/FAJlx++Eqzfmx1W7
18+
lU3/0IJ/jYS7D6C4aADifo4aGF0mFHFBk7sfpZcCgYBaIyTOnf15XgVcIjy9/LVY
19+
amXFkS+6S4XY/Og87dZ5VTGQZoN3vPPZDRNN1qKQE46q6Xlv74D1eZ10Lwq/s7VG
20+
m9rNfEiGZs7Lp/8ZADtT7rYKXNS35AKeXkkU0AwLv9qwTVyYJRJCVGvqoC99UpEV
21+
OSqyprBTOr9LCBFR3eKJQwKBgHXRqoqUZy3IWmN3qdj6aF1U+Fbnc/5IuHCZVhZ0
22+
0lX5xQgcrvOt7NttJWRwvvKTMwFhA18XS1jV/aioUNp1yqcSe0dmoeRAZGP+M4u5
23+
jPBFZGQim/LCF09UqRfi2nEAfpAHFAP0rYdvWh9sFbxzkFXiTx4pq8Eq0bWnW+64
24+
Lzk5AoGAVeV9KgqJZLbl2Vbii3bJOuvtNeHOkIYPIoU6kgox9qp1derccWuMtwLT
25+
PjhnWuCAX5dN1d7Rve4EovkjvuomDuZy6NCQlmLA6ff2pxtcJAkGy8Blc5VQeWs9
26+
i9DUFz2Sx6olEO7MDykj4B6O2YNlAwb8xq1oivE24laZPufprwI=
27+
-----END RSA PRIVATE KEY-----

‎tests/integration/targets/github_app_access_token/files/app-private-key.pem.license

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Copyright (c) Ansible Project
2+
GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
SPDX-License-Identifier: GPL-3.0-or-later

‎tests/integration/targets/github_app_access_token/tasks/main.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
####################################################################
2+
# WARNING: These are designed specifically for Ansible tests #
3+
# and should not be used as examples of how to write Ansible roles #
4+
####################################################################
5+
6+
# Test code for the github_app_access_token plugin.
7+
#
8+
# Copyright (c) 2017-2018, Abhijeet Kasurde <[email protected]>
9+
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
10+
# SPDX-License-Identifier: GPL-3.0-or-later
11+
12+
- name: Install JWT
13+
ansible.builtin.pip:
14+
name:
15+
- jwt
16+
17+
- name: Read file
18+
ansible.builtin.set_fact:
19+
github_app_private_key: "{{ lookup('ansible.builtin.file', 'app-private-key.pem') }}"
20+
21+
- name: Generate Github App Token
22+
register: github_app_access_token
23+
ignore_errors: true
24+
ansible.builtin.set_fact:
25+
github_app_token: "{{ lookup('community.general.github_app_access_token', app_id=github_app_id, installation_id=github_app_installation_id, private_key=github_app_private_key) }}"
26+
27+
- assert:
28+
that:
29+
- github_app_access_token is failed
30+
- '"Github return error" in github_app_access_token.msg'

‎tests/integration/targets/github_app_access_token/vars/main.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Copyright (c) Ansible Project
2+
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
3+
# SPDX-License-Identifier: GPL-3.0-or-later
4+
5+
github_app_id: 123456
6+
github_app_installation_id: 123456

‎tests/unit/plugins/lookup/test_github_app_access_token.py

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ def read(self):
3232

3333
class TestLookupModule(unittest.TestCase):
3434

35-
def test_get_token(self):
35+
def test_get_token_with_file(self):
3636
with patch.multiple("ansible_collections.community.general.plugins.lookup.github_app_access_token",
3737
open=mock_open(read_data="foo_bar"),
3838
open_url=MagicMock(return_value=MockResponse()),
@@ -50,3 +50,21 @@ def test_get_token(self):
5050
token_expiry=600
5151
)
5252
)
53+
54+
def test_get_token_with_fact(self):
55+
with patch.multiple("ansible_collections.community.general.plugins.lookup.github_app_access_token",
56+
open_url=MagicMock(return_value=MockResponse()),
57+
jwk_from_pem=MagicMock(return_value='private_key'),
58+
jwt_instance=MockJWT(),
59+
HAS_JWT=True):
60+
lookup = lookup_loader.get('community.general.github_app_access_token')
61+
self.assertListEqual(
62+
[MockResponse.response_token],
63+
lookup.run(
64+
[],
65+
app_id="app_id",
66+
installation_id="installation_id",
67+
private_key="foo_bar",
68+
token_expiry=600
69+
)
70+
)

0 commit comments

Comments
 (0)