From e10007ef7b135eff08dea58b6b542dbb36ec72e3 Mon Sep 17 00:00:00 2001
From: Ryan DeShone <rfdeshon@gmail.com>
Date: Fri, 29 Mar 2019 10:32:49 -0400
Subject: [PATCH] Add support for Vault KV API v2

This adds the ability to target KV API v1 or v2.
---
 lemur/plugins/lemur_vault_dest/plugin.py | 29 +++++++++++++++++++-----
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/lemur/plugins/lemur_vault_dest/plugin.py b/lemur/plugins/lemur_vault_dest/plugin.py
index 91f6a07a..6868b7b0 100644
--- a/lemur/plugins/lemur_vault_dest/plugin.py
+++ b/lemur/plugins/lemur_vault_dest/plugin.py
@@ -37,6 +37,17 @@ class VaultDestinationPlugin(DestinationPlugin):
             'validation': '^https?://[a-zA-Z0-9.:-]+$',
             'helpMessage': 'Valid URL to Hashi Vault instance'
         },
+        {
+            'name': 'vaultKvApiVersion',
+            'type': 'select',
+            'value': '2',
+            'available': [
+                '1',
+                '2'
+            ],
+            'required': True,
+            'helpMessage': 'Version of the Vault KV API to use'
+        },
         {
             'name': 'vaultAuthTokenFile',
             'type': 'str',
@@ -98,17 +109,20 @@ class VaultDestinationPlugin(DestinationPlugin):
         path = self.get_option('vaultPath', options)
         bundle = self.get_option('bundleChain', options)
         obj_name = self.get_option('objectName', options)
+        api_version = self.get_option('vaultKvApiVersion', options)
 
         with open(token_file, 'r') as file:
             token = file.readline().rstrip('\n')
 
         client = hvac.Client(url=url, token=token)
+        client.secrets.kv.default_kv_version = api_version
+
         if obj_name:
             path = '{0}/{1}'.format(path, obj_name)
         else:
             path = '{0}/{1}'.format(path, cname)
 
-        secret = get_secret(url, token, mount, path)
+        secret = get_secret(client, mount, path)
         secret['data'][cname] = {}
 
         if bundle == 'Nginx' and cert_chain:
@@ -123,8 +137,9 @@ class VaultDestinationPlugin(DestinationPlugin):
         if isinstance(san_list, list):
             secret['data'][cname]['san'] = san_list
         try:
-            client.secrets.kv.v1.create_or_update_secret(
-                path=path, mount_point=mount, secret=secret['data'])
+            client.secrets.kv.create_or_update_secret(
+                path=path, mount_point=mount, secret=secret['data']
+            )
         except ConnectionError as err:
             current_app.logger.exception(
                 "Exception uploading secret to vault: {0}".format(err), exc_info=True)
@@ -144,12 +159,14 @@ def get_san_list(body):
         return san_list
 
 
-def get_secret(url, token, mount, path):
+def get_secret(client, mount, path):
     """ retreiive existing data from mount path and return dictionary """
     result = {'data': {}}
     try:
-        client = hvac.Client(url=url, token=token)
-        result = client.secrets.kv.v1.read_secret(path=path, mount_point=mount)
+        if client.secrets.kv.default_kv_version == '1':
+            result = client.secrets.kv.v1.read_secret(path=path, mount_point=mount)
+        else:
+            result = client.secrets.kv.v2.read_secret_version(path=path, mount_point=mount)
     except ConnectionError:
         pass
     finally: