feat: allow to override vault secret engine in entity level

Signed-off-by: Ilya Katlinski <ilya.katlinsky@gmail.com>

plugins/vault-backend/README.md

@@ -66,7 +66,7 @@ To get started, first you need a running instance of Vault. You can follow [this
      baseUrl: http://your-internal-vault-url.svc
      publicUrl: https://your-vault-url.example.com
      token: <VAULT_TOKEN>
-     secretEngine: 'customSecretEngine' # Optional. By default it uses 'secrets'
+     secretEngine: 'customSecretEngine' # Optional. By default it uses 'secrets'. Can be overwritten by the annotation of the entity
      kvVersion: <kv-version> # Optional. The K/V version that your instance is using. The available options are '1' or '2'
    ```
 
@@ -106,6 +106,20 @@ The path is relative to your secrets engine folder. So if you want to get the se
 
 You will set the `vault.io/secret-path` to `test/backstage`. If the folder `backstage` contains other sub-folders, the plugin will fetch the secrets inside them and adapt the **View** and **Edit** URLs to point to the correct place.
 
+In case you need to support different secret engines for entities of the catalog you can proivde optional annotion to the entity in `catalog-info.yaml`:
+
+```diff
+ apiVersion: backstage.io/v1alpha1
+ kind: Component
+ metadata:
+   # ...
+   annotations:
+     vault.io/secrets-path: path/to/secrets
++    vault.io/secret-engine: customSecretEngine # Optional. By default it uses 'secertEngine' value from configuration.
+```
+
+That will overwrite the default secret engine from the configuration.
+
 ## Renew token
 
 In a secure Vault instance, it's usual that the tokens are refreshed after some time. In order to always have a valid token to fetch the secrets, it might be necessary to execute a renew action after some time. By default this is deactivated, but it can be easily activated and configured to be executed periodically (hourly by default, but customizable by the user). In order to do that, modify your `src/plugins/vault.ts` file to look like this one:
@@ -138,6 +152,7 @@ export default async function createPlugin(
 ## Features
 
 - List the secrets present in a certain path
+- Use different secret engines for different components
 - Open a link to view the secret
 - Open a link to edit the secret
 - Renew the token automatically with a defined periodicity

plugins/vault-backend/src/service/VaultBuilder.ts

@@ -140,11 +140,16 @@ export class VaultBuilder {
 
     router.get('/v1/secrets/:path', async (req, res) => {
       const { path } = req.params;
+      const { engine } = req.query;
+
       if (typeof path !== 'string') {
         throw new InputError(`Invalid path: ${path}`);
       }
+      if (engine && typeof engine !== 'string') {
+        throw new InputError(`Invalid engine: ${engine}`);
+      }
 
-      const secrets = await vaultApi.listSecrets(path);
+      const secrets = await vaultApi.listSecrets(path, engine);
       res.json({ items: secrets });
     });
 

plugins/vault-backend/src/service/vaultApi.ts

@@ -59,11 +59,17 @@ export interface VaultApi {
    * Returns the URL to access the Vault UI with the defined config.
    */
   getFrontendSecretsUrl(): string;
+
   /**
    * Returns a list of secrets used to show in a table.
    * @param secretPath - The path where the secrets are stored in Vault
+   * @param secretMount - The mount point of the secrets engine, optional, overrides default secret engine
    */
-  listSecrets(secretPath: string): Promise<VaultSecret[]>;
+  listSecrets(
+    secretPath: string,
+    secretMount?: string | undefined,
+  ): Promise<VaultSecret[]>;
+
   /**
    * Optional, to renew the token used to list the secrets. Throws an
    * error if the token renewal went wrong.
@@ -115,11 +121,16 @@ export class VaultClient implements VaultApi {
     return `${this.vaultConfig.baseUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}`;
   }
 
-  async listSecrets(secretPath: string): Promise<VaultSecret[]> {
+  async listSecrets(
+    secretPath: string,
+    secretEngine?: string | undefined,
+  ): Promise<VaultSecret[]> {
+    const mount = secretEngine || this.vaultConfig.secretEngine;
+
     const listUrl =
       this.vaultConfig.kvVersion === 2
-        ? `v1/${this.vaultConfig.secretEngine}/metadata/${secretPath}`
-        : `v1/${this.vaultConfig.secretEngine}/${secretPath}`;
+        ? `v1/${mount}/metadata/${secretPath}`
+        : `v1/${mount}/${secretPath}`;
     const result = await this.limit(() =>
       this.callApi<VaultSecretList>(listUrl, { list: true }),
     );
@@ -131,7 +142,7 @@ export class VaultClient implements VaultApi {
         if (secret.endsWith('/')) {
           secrets.push(
             ...(await this.limit(() =>
-              this.listSecrets(`${secretPath}/${secret.slice(0, -1)}`),
+              this.listSecrets(`${secretPath}/${secret.slice(0, -1)}`, mount),
             )),
           );
         } else {
@@ -140,8 +151,8 @@ export class VaultClient implements VaultApi {
           secrets.push({
             name: secret,
             path: secretPath,
-            editUrl: `${vaultUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/edit/${secretPath}/${secret}`,
-            showUrl: `${vaultUrl}/ui/vault/secrets/${this.vaultConfig.secretEngine}/show/${secretPath}/${secret}`,
+            editUrl: `${vaultUrl}/ui/vault/secrets/${mount}/edit/${secretPath}/${secret}`,
+            showUrl: `${vaultUrl}/ui/vault/secrets/${mount}/show/${secretPath}/${secret}`,
           });
         }
       }),