Signed-off-by: Christian Heimes <cheimes@redhat.com>

This patch adds a special authorization plugin that verifies the
identity of the node as well as checking that the node is authorized
to make a request on behalf of the pod for which it is asking secrets.

If all checks pass the path is rewritten to point to the proper secrets
namespace for the pod. By rewriting paths, in case of catastrophic
failure of the plugin no secret can be found as the path matches nothing.

Signed-off-by: Simo Sorce <simo@redhat.com>

This authentication module connects to docker to figure out the pod
name associated to the PID requesting the service by ay of discovering
the container id via the process cgroup namespace.

The pod name as set in the metadata label named 'io.kubernetes.pod.name'
is then used as the 'remote_user' attribute on the request.

Signed-off-by: Simo Sorce <simo@redhat.com>

custodia.client library now logs requests and responses.

The auditfile argument of setup_logging() can be set to None to
configure client logging without audit file.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>

This allows to easily use end-to-end encrypted requests and replies
to fetch secrets.

Signed-off-by: Simo Sorce <simo@redhat.com>

Use the term secret and not key to refer to .. well .. secrets.

Store the last response instead of returning it to the caller, this
way there is a consistent way to get access to it and only as needed.

Change the name to CustodiaSimpleClient in preparaion for extending the
support to other Secret types.

Signed-off-by: Simo Sorce <simo@redhat.com>

The payload was not being set with the provided value when a PUT
operation token was parsed. This resulted in attempting to store
an empty value instead of the provided secret.

Signed-off-by: Simo Sorce <simo@redhat.com>

All authorization modules need to be executed, we cannot bail at the
first one that returns a positive answer. Some authz modules attach
data to the requst as a side effect and they need to be run even if
others also authorize access.
Additionally if a later module returns an explicit Deny, then that
must override any previous granted access.

Signed-off-by: Simo Sorce <simo@redhat.com>

In the server case auditlog is used in the pipeline too, so make it public.

Signed-off-by: Simo Sorce <simo@redhat.com>

Signed-off-by: Simo Sorce <simo@redhat.com>