hashicorp-vault-plugin
hashicorp-vault-plugin copied to clipboard
Feature decoding ssh key
- [x] Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
- [ ] Ensure that the pull request title represents the desired changelog entry
- [ ] Please describe what you did
- [ ] Link to relevant issues in GitHub or Jira
- [ ] Link to relevant pull requests, esp. upstream and downstream changes
- [ ] Ensure you have provided tests - that demonstrates feature works or fixes the issue
I'm not sure this fix should go in as-is, the decode from base64 is only needed if you put the ssh into vault as a base64 encoded string. That's not how I've done it and I'm sure I'm not alone in this. This could be useful, but I think it would need to be available as an option.
I just thought it would be good to store the key as a base64 string to avoid dealing with newlines and to not send the certificate as is to Vault And I think if the plugin follows the same approach it'd be fine, because the Vault certificate credential is expecting a base64 string from Vault at: https://github.com/jenkinsci/hashicorp-vault-plugin/blob/182c0fbaaeb77e222d49822656e29b8c40422f7f/src/main/java/com/datapipe/jenkins/vault/credentials/common/VaultCertificateCredentialsImpl.java#L82 which is not the case for SSH Certificate
Take a look to this link for a more complex example of storing an SSL Certificate: https://discuss.hashicorp.com/t/store-ssl-certificates-in-vault/30180/6
Would be best to check whether the string was base64 encoded or not.