b55303eddb
* Add priority queue to sdk * fix issue of storing pointers and now copy * update to use copy structure * Remove file, put Item struct def. into other file * add link * clean up docs * refactor internal data structure to hide heap method implementations. Other cleanup after feedback * rename PushItem and PopItem to just Push/Pop, after encapsulating the heap methods * updates after feedback * refactoring/renaming * guard against pushing a nil item * minor updates after feedback * Add SetCredentials, GenerateCredentials gRPC methods to combined database backend gPRC * Initial Combined database backend implementation of static accounts and automatic rotation * vendor updates * initial implementation of static accounts with Combined database backend, starting with PostgreSQL implementation * add lock and setup of rotation queue * vendor the queue * rebase on new method signature of queue * remove mongo tests for now * update default role sql * gofmt after rebase * cleanup after rebasing to remove checks for ErrNotFound error * rebase cdcr-priority-queue * vendor dependencies with 'go mod vendor' * website database docs for Static Role support * document the rotate-role API endpoint * postgres specific static role docs * use constants for paths * updates from review * remove dead code * combine and clarify error message for older plugins * Update builtin/logical/database/backend.go Co-Authored-By: Jim Kalafut <jim@kalafut.net> * cleanups from feedback * code and comment cleanups * move db.RLock higher to protect db.GenerateCredentials call * Return output with WALID if we failed to delete the WAL * Update builtin/logical/database/path_creds_create.go Co-Authored-By: Jim Kalafut <jim@kalafut.net> * updates after running 'make fmt' * update after running 'make proto' * Update builtin/logical/database/path_roles.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * Update builtin/logical/database/path_roles.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * update comment and remove and rearrange some dead code * Update website/source/api/secret/databases/index.html.md Co-Authored-By: Jim Kalafut <jim@kalafut.net> * cleanups after review * Update sdk/database/dbplugin/grpc_transport.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * code cleanup after feedback * remove PasswordLastSet; it's not used * document GenerateCredentials and SetCredentials * Update builtin/logical/database/path_rotate_credentials.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * wrap pop and popbykey in backend methods to protect against nil cred rotation queue * use strings.HasPrefix instead of direct equality check for path * Forgot to commit this * updates after feedback * re-purpose an outdated test to now check that static and dynamic roles cannot share a name * check for unique name across dynamic and static roles * refactor loadStaticWALs to return a map of name/setCredentialsWAL struct to consolidate where we're calling set credentials * remove commented out code * refactor to have loadstaticwals filter out wals for roles that no longer exist * return error if nil input given * add nil check for input into setStaticAccount * Update builtin/logical/database/path_roles.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * add constant for queue tick time in seconds, used for comparrison in updates * Update builtin/logical/database/path_roles.go Co-Authored-By: Jim Kalafut <jim@kalafut.net> * code cleanup after review * remove misplaced code comment * remove commented out code * create a queue in the Factory method, even if it's never used * update path_roles to use a common set of fields, with specific overrides for dynamic/static roles by type * document new method * move rotation things into a specific file * rename test file and consolidate some static account tests * Update builtin/logical/database/path_roles.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * Update builtin/logical/database/rotation.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * Update builtin/logical/database/rotation.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * Update builtin/logical/database/rotation.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * Update builtin/logical/database/rotation.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * Update builtin/logical/database/rotation.go Co-Authored-By: Brian Kassouf <briankassouf@users.noreply.github.com> * update code comments, method names, and move more methods into rotation.go * update comments to be capitalized * remove the item from the queue before we try to destroy it * findStaticWAL returns an error * use lowercase keys when encoding WAL entries * small cleanups * remove vestigial static account check * remove redundant DeleteWAL call in populate queue * if we error on loading role, push back to queue with 10 second backoff * poll in initqueue to make sure the backend is setup and can write/delete data * add revoke_user_on_delete flag to allow users to opt-in to revoking the static database user on delete of the Vault role. Default false * add code comments on read-only loop * code comment updates * re-push if error returned from find static wal * add locksutil and acquire locks when pop'ing from the queue * grab exclusive locks for updating static roles * Add SetCredentials and GenerateCredentials stubs to mockPlugin * add a switch in initQueue to listen for cancelation * remove guard on zero time, it should have no affect * create a new context in Factory to pass on and use for closing the backend queue * restore master copy of vendor dir
194 lines
5.9 KiB
Go
194 lines
5.9 KiB
Go
// Package queue provides Vault plugins with a Priority Queue. It can be used
|
|
// as an in-memory list of queue.Item sorted by their priority, and offers
|
|
// methods to find or remove items by their key. Internally it uses
|
|
// container/heap; see Example Priority Queue:
|
|
// https://golang.org/pkg/container/heap/#example__priorityQueue
|
|
package queue
|
|
|
|
import (
|
|
"container/heap"
|
|
"errors"
|
|
"sync"
|
|
|
|
"github.com/mitchellh/copystructure"
|
|
)
|
|
|
|
// ErrEmpty is returned for queues with no items
|
|
var ErrEmpty = errors.New("queue is empty")
|
|
|
|
// ErrDuplicateItem is returned when the queue attmepts to push an item to a key that
|
|
// already exists. The queue does not attempt to update, instead returns this
|
|
// error. If an Item needs to be updated or replaced, pop the item first.
|
|
var ErrDuplicateItem = errors.New("duplicate item")
|
|
|
|
// New initializes the internal data structures and returns a new
|
|
// PriorityQueue
|
|
func New() *PriorityQueue {
|
|
pq := PriorityQueue{
|
|
data: make(queue, 0),
|
|
dataMap: make(map[string]*Item),
|
|
}
|
|
heap.Init(&pq.data)
|
|
return &pq
|
|
}
|
|
|
|
// PriorityQueue facilitates queue of Items, providing Push, Pop, and
|
|
// PopByKey convenience methods. The ordering (priority) is an int64 value
|
|
// with the smallest value is the highest priority. PriorityQueue maintains both
|
|
// an internal slice for the queue as well as a map of the same items with their
|
|
// keys as the index. This enables users to find specific items by key. The map
|
|
// must be kept in sync with the data slice.
|
|
// See https://golang.org/pkg/container/heap/#example__priorityQueue
|
|
type PriorityQueue struct {
|
|
// data is the internal structure that holds the queue, and is operated on by
|
|
// heap functions
|
|
data queue
|
|
|
|
// dataMap represents all the items in the queue, with unique indexes, used
|
|
// for finding specific items. dataMap is kept in sync with the data slice
|
|
dataMap map[string]*Item
|
|
|
|
// lock is a read/write mutex, and used to facilitate read/write locks on the
|
|
// data and dataMap fields
|
|
lock sync.RWMutex
|
|
}
|
|
|
|
// queue is the internal data structure used to satisfy heap.Interface. This
|
|
// prevents users from calling Pop and Push heap methods directly
|
|
type queue []*Item
|
|
|
|
// Item is something managed in the priority queue
|
|
type Item struct {
|
|
// Key is a unique string used to identify items in the internal data map
|
|
Key string
|
|
// Value is an unspecified type that implementations can use to store
|
|
// information
|
|
Value interface{}
|
|
|
|
// Priority determines ordering in the queue, with the lowest value being the
|
|
// highest priority
|
|
Priority int64
|
|
|
|
// index is an internal value used by the heap package, and should not be
|
|
// modified by any consumer of the priority queue
|
|
index int
|
|
}
|
|
|
|
// Len returns the count of items in the Priority Queue
|
|
func (pq *PriorityQueue) Len() int {
|
|
pq.lock.RLock()
|
|
defer pq.lock.RUnlock()
|
|
return pq.data.Len()
|
|
}
|
|
|
|
// Pop pops the highest priority item from the queue. This is a
|
|
// wrapper/convenience method that calls heap.Pop, so consumers do not need to
|
|
// invoke heap functions directly
|
|
func (pq *PriorityQueue) Pop() (*Item, error) {
|
|
if pq.Len() == 0 {
|
|
return nil, ErrEmpty
|
|
}
|
|
|
|
pq.lock.Lock()
|
|
defer pq.lock.Unlock()
|
|
|
|
item := heap.Pop(&pq.data).(*Item)
|
|
delete(pq.dataMap, item.Key)
|
|
return item, nil
|
|
}
|
|
|
|
// Push pushes an item on to the queue. This is a wrapper/convenience
|
|
// method that calls heap.Push, so consumers do not need to invoke heap
|
|
// functions directly. Items must have unique Keys, and Items in the queue
|
|
// cannot be updated. To modify an Item, users must first remove it and re-push
|
|
// it after modifications
|
|
func (pq *PriorityQueue) Push(i *Item) error {
|
|
if i == nil || i.Key == "" {
|
|
return errors.New("error adding item: Item Key is required")
|
|
}
|
|
|
|
pq.lock.Lock()
|
|
defer pq.lock.Unlock()
|
|
|
|
if _, ok := pq.dataMap[i.Key]; ok {
|
|
return ErrDuplicateItem
|
|
}
|
|
// Copy the item value(s) so that modifications to the source item does not
|
|
// affect the item on the queue
|
|
clone, err := copystructure.Copy(i)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
pq.dataMap[i.Key] = clone.(*Item)
|
|
heap.Push(&pq.data, clone)
|
|
return nil
|
|
}
|
|
|
|
// PopByKey searches the queue for an item with the given key and removes it
|
|
// from the queue if found. Returns nil if not found. This method must fix the
|
|
// queue after removing any key.
|
|
func (pq *PriorityQueue) PopByKey(key string) (*Item, error) {
|
|
pq.lock.Lock()
|
|
defer pq.lock.Unlock()
|
|
|
|
item, ok := pq.dataMap[key]
|
|
if !ok {
|
|
return nil, nil
|
|
}
|
|
|
|
// Remove the item the heap and delete it from the dataMap
|
|
itemRaw := heap.Remove(&pq.data, item.index)
|
|
delete(pq.dataMap, key)
|
|
|
|
if itemRaw != nil {
|
|
if i, ok := itemRaw.(*Item); ok {
|
|
return i, nil
|
|
}
|
|
}
|
|
|
|
return nil, nil
|
|
}
|
|
|
|
// Len returns the number of items in the queue data structure. Do not use this
|
|
// method directly on the queue, use PriorityQueue.Len() instead.
|
|
func (q queue) Len() int { return len(q) }
|
|
|
|
// Less returns whether the Item with index i should sort before the Item with
|
|
// index j in the queue. This method is used by the queue to determine priority
|
|
// internally; the Item with the lower value wins. (priority zero is higher
|
|
// priority than 1). The priority of Items with equal values is undetermined.
|
|
func (q queue) Less(i, j int) bool {
|
|
return q[i].Priority < q[j].Priority
|
|
}
|
|
|
|
// Swap swaps things in-place; part of sort.Interface
|
|
func (q queue) Swap(i, j int) {
|
|
q[i], q[j] = q[j], q[i]
|
|
q[i].index = i
|
|
q[j].index = j
|
|
}
|
|
|
|
// Push is used by heap.Interface to push items onto the heap. This method is
|
|
// invoked by container/heap, and should not be used directly.
|
|
// See: https://golang.org/pkg/container/heap/#Interface
|
|
func (q *queue) Push(x interface{}) {
|
|
n := len(*q)
|
|
item := x.(*Item)
|
|
item.index = n
|
|
*q = append(*q, item)
|
|
}
|
|
|
|
// Pop is used by heap.Interface to pop items off of the heap. This method is
|
|
// invoked by container/heap, and should not be used directly.
|
|
// See: https://golang.org/pkg/container/heap/#Interface
|
|
func (q *queue) Pop() interface{} {
|
|
old := *q
|
|
n := len(old)
|
|
item := old[n-1]
|
|
old[n-1] = nil // avoid memory leak
|
|
item.index = -1 // for safety
|
|
*q = old[0 : n-1]
|
|
return item
|
|
}
|