lyft / python-confidant-client

Client library and CLI for Confidant

confidant-client

A client for confidant.

Docs

• Installation
• Configuration
• Usage
• Contribution

Reporting security vulnerabilities

If you've found a vulnerability or a potential vulnerability in Confidant please let us know at [email protected]. We'll send a confirmation email to acknowledge your report, and we'll send an additional email when we've identified the issue positively or negatively.

Getting support or asking questions

We have a mailing list for discussion, and a low volume list for announcements:

• https://groups.google.com/forum/#!forum/confidant-users
• https://groups.google.com/forum/#!forum/confidant-announce

We also have an IRC channel on freenode and a Gitter channel:

• #confidant
• lyft/confidant on Gitter

Feel free to drop into either Gitter or the IRC channel for any reason, even if just to chat. It doesn't matter which one you join, the messages are sync'd between the two.

python-confidant-client's Issues

Version is tracked in multiple places in the code

Version is in setup.py and in __init__.py, leading to confusion.

Python 3 support

Seeing as Django, Flask, and many other mainstream projects support Python 3, I was curious about why this didn't. What dependencies prevent this package from supporting Python 3?

ImportError: No module named confidant_client.cli

This seems to be an issue with my local env although I've attempted on a brand new box that only has Confidant installed also.

Debian 8.5
Linux fusioncore 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2+deb8u3 (2016-07-02) x86_64 GNU/Linux

(venv)[russmac@fusioncore python-confidant-client]$ confidant
Traceback (most recent call last):
  File "/home/russmac/Documents/python-confidant-client/venv/bin/confidant", line 9, in <module>
    load_entry_point('confidant-client==1.1.15', 'console_scripts', 'confidant')()
  File "/home/russmac/Documents/python-confidant-client/venv/local/lib/python2.7/site-packages/pkg_resources.py", line 356, in load_entry_point
    return get_distribution(dist).load_entry_point(group, name)
  File "/home/russmac/Documents/python-confidant-client/venv/local/lib/python2.7/site-packages/pkg_resources.py", line 2476, in load_entry_point
    return ep.load()
  File "/home/russmac/Documents/python-confidant-client/venv/local/lib/python2.7/site-packages/pkg_resources.py", line 2190, in load
    ['__name__'])
ImportError: No module named confidant_client.cli

The only way I could get it to run was to SL the path from bin. Same for formatter.

Theirs a couple of doc improvements that would be worthwhile Ill try to find time to commit, The readme for the client links to the generic doc page rather then the client page , The client page implies you only need to install confidant through pip and not clone the repo first (although it may be obvious to most)

(venv)[russmac@fusioncore bin]$ ln -s $PYTHONPATH
(venv)[russmac@fusioncore python-confidant-client]$ confidant
usage: confidant [-h] [--config-files CONFIG_FILES] [--profile PROFILE]

I also had to install these seperately

pip install "futures==3.0.2"
pip install "botocore==1.4.53"

Grepping didn't reveal them anywhere in file tree so It might not be env specific.

"Unrecognized arguments" in CLI Example

From the example in the 'confidant help' command, this:

confidant get_service -u "https://confidant-production.example.com" -k "alias/authnz-production" --from myservice-production --to confidant-production --user_type service --region us-west-2 --service myservice-production

yields the error

confidant: error: unrecognized arguments: -u https://confidant-production.example.com -k alias/authnz-production --from myservice-production --to confidant-production --user_type service --region us-west-2

It should yield a url unreachable or kms auth error, not an argument error if the example is correct.

Add aws_profile attribute to confidant client configuration

When calling the confidant client, it's often necessary to use
AWS_PROFILE=my_profile. It would be ideal if the client config could specify an aws profile in the confidant profile, so that you can just pass in --profile to the client and it'll auto-configure itself.

Moved from lyft/confidant#88

Add a no-auth option to the client for development purposes

The confidant server has a no-auth option for development and testing. We should support this from the client.

PyPI GitHub Homepage 404

While searching for the confidant-client on PyPI I noticed that the Homepage link is broken with a 404 error. This id due to the url="https://github.com/lyft/confidant-client" in the setup.py file, any reason for not having url="https://github.com/lyft/python-confidant-client"?

403 Forbidden error when trying to access service

• I have auth_key confidant and encryption_key confidant_at_rest. These have the policies from the configuration guide.
• My confidant role is systemsmanager. It has full IAM permissions.
• I have a confidant service prod2.
• All of my ec2 machines are assigned the corresponding prod2 IAM role.
• The AWS account keys used by the ec2 machines are for a user staging with full admin permissions (for debugging)

When I make this request from my ec2 machines:

confidant --url "https://our-confidant-url.com" -k alias/confidant --from prod2 --to systemsmanager --user-type service --region us-west-2 get_service --service prod2

It fails with:

2017-12-08 00:34:46,032 root: ERROR API error (response code 403): <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>403 Forbidden</title>
<h1>Forbidden</h1>
<p>You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.</p>

{
    "result": false
}

The server error says

ERROR:root:Failed to validate token.
ERROR:root:Failed to decrypt authentication token.
WARNING:root:Access denied for prod2. Authentication Failed.

Are the directions up to date?