Fixes for the App Role guide.

vault_cert_renew.py

@@ -16,6 +16,11 @@ parser.add_argument(
     action="store_true",
     help="read a response wrapping token and store the unwrapped secret ID",
 )
+parser.add_argument(
+    "--login-test",
+    action="store_true",
+    help="log in with AppRole, print the token policies and lifetime, and exit",
+)
 args = parser.parse_args()
 
 
@@ -50,6 +55,15 @@ def api(path, body=None, token=None):
 role_id_file = setting("ROLE_ID_FILE", "/etc/vault-cert/role_id")
 secret_id_file = setting("SECRET_ID_FILE", "/etc/vault-cert/secret_id")
 
+
+def login():
+    with open(role_id_file) as file:
+        role_id = file.read().strip()
+    with open(secret_id_file) as file:
+        secret_id = file.read().strip()
+    return api("auth/approle/login", {"role_id": role_id, "secret_id": secret_id})["auth"]
+
+
 # Store the secret ID that is wrapped in a single use response wrapping token.
 if args.unwrap:
     wrapping_token = getpass.getpass("Wrapping token: ")
@@ -61,6 +75,12 @@ if args.unwrap:
     print(f"The secret ID was written to {secret_id_file}")
     sys.exit(0)
 
+# Check the AppRole credentials without issuing a certificate.
+if args.login_test:
+    auth = login()
+    print(f"Login succeeded: token type {auth['token_type']}, policies {auth['token_policies']}, valid for {auth['lease_duration']} seconds")
+    sys.exit(0)
+
 cert_dir = setting("CERT_DIR", "/var/lib/vault-cert")
 common_name = setting("CERT_CN")
 sign_path = setting("SIGN_PATH", "pki_int/sign/wif-client")
@@ -88,11 +108,7 @@ with tempfile.TemporaryDirectory(dir=cert_dir, prefix=".renew.") as workdir:
     csr_file = os.path.join(workdir, "client.csr")
 
     print("Logging in to Vault with AppRole")
-    with open(role_id_file) as file:
-        role_id = file.read().strip()
-    with open(secret_id_file) as file:
-        secret_id = file.read().strip()
-    token = api("auth/approle/login", {"role_id": role_id, "secret_id": secret_id})["auth"]["client_token"]
+    token = login()["client_token"]
 
     print(f"Generating the key and the CSR for {common_name}")
     subprocess.run(
@@ -135,5 +151,8 @@ end_date = subprocess.run(
 print(f"The certificate was renewed, it expires on {end_date}")
 
 if hook:
-    print(f"Running the hook {hook}")
-    subprocess.run([hook], env={**os.environ, "CERT_FILE": cert, "KEY_FILE": key}, check=True)
+    if os.access(hook, os.X_OK) and os.path.isfile(hook):
+        print(f"Running the hook {hook}")
+        subprocess.run([hook], env={**os.environ, "CERT_FILE": cert, "KEY_FILE": key}, check=True)
+    else:
+        print(f"The hook {hook} is not an executable file, skipping it", file=sys.stderr)