func newVaultClient(opts *config) (*api.Client, error) {
	var err error
	var token string

	config := api.DefaultConfig()
	config.Address = opts.vaultURL

	config.HttpClient.Transport, err = buildHTTPTransport(opts)
	if err != nil {
		return nil, err
	}

	// step: create the actual client
	client, err := api.NewClient(config)
	if err != nil {
		return nil, err
	}

	plugin := opts.vaultAuthOptions.Method
	switch plugin {
	case "userpass":
		token, err = NewUserPassPlugin(client).Create(opts.vaultAuthOptions)
	case "approle":
		token, err = NewAppRolePlugin(client).Create(opts.vaultAuthOptions)
	case "aws-ec2":
		token, err = NewAWSEC2Plugin(client).Create(opts.vaultAuthOptions)
	case "gcp-gce":
		token, err = NewGCPGCEPlugin(client).Create(opts.vaultAuthOptions)
	case "kubernetes":
		token, err = NewKubernetesPlugin(client).Create(opts.vaultAuthOptions)
	case "token":
		opts.vaultAuthOptions.FileName = options.vaultAuthFile
		opts.vaultAuthOptions.FileFormat = options.vaultAuthFileFormat
		token, err = NewUserTokenPlugin(client).Create(opts.vaultAuthOptions)
	default:
		return nil, fmt.Errorf("unsupported authentication plugin: %s", plugin)
	}
	if err != nil {
		return nil, err
	}

	// step: set the token for the client
	client.SetToken(token)

	if opts.vaultRenewToken {
		tokeninfo, err := client.Auth().Token().LookupSelf()
		if err != nil {
			return nil, fmt.Errorf("failed to lookup token info: %s", err)
		}

		tokenttl, err := tokeninfo.TokenTTL()
		if err != nil {
			return nil, fmt.Errorf("failed to lookup token ttl: %s", err)
		}
		glog.Infof("token ttl is %v", tokenttl)
		renewPeriod := tokenttl / 2
		go func() {
			for {
				if renewPeriod < 1*time.Second {
					glog.Fatalf("fatal: token renew period is <1s, aborting")
				}
				glog.Infof("scheduling token renew in %v", renewPeriod)
				<-time.After(renewPeriod)

				glog.Infof("attempting token renew")
				newtokeninfo, err := client.Auth().Token().RenewSelf(0)
				if err != nil {
					renewPeriod = renewPeriod / 2
					glog.Warningf("error: failed to renew token, retrying in %v: %v", renewPeriod, err)
					continue
				}

				tokenttl, err := newtokeninfo.TokenTTL()
				if err != nil {
					glog.Warningf("error: failed to get new token ttl, using previous value %s: %s", renewPeriod, err)
				} else {
					glog.Infof("token ttl is %v", tokenttl)
					renewPeriod = tokenttl / 2
				}
			}
		}()
	}

	return client, nil
}
// newVaultClient creates and authenticates a vault client
newVaultClient creates and authenticates a vault client
// newVaultClient creates and authenticates a vault client
func newVaultClient(opts *config) (*api.Client, error) {
	var err error
	var token string
	config := api.DefaultConfig()
	config.Address = opts.vaultURL
	config.HttpClient.Transport, err = buildHTTPTransport(opts)
	if err != nil {
		return nil, err
	}
	client, err := api.NewClient(config)
	if err != nil {
		return nil, err
	}
	plugin := opts.vaultAuthOptions.Method
	switch plugin {
	case "userpass":
		token, err = NewUserPassPlugin(client).Create(opts.vaultAuthOptions)
	case "approle":
		token, err = NewAppRolePlugin(client).Create(opts.vaultAuthOptions)
	case "aws-ec2":
		token, err = NewAWSEC2Plugin(client).Create(opts.vaultAuthOptions)
	case "gcp-gce":
		token, err = NewGCPGCEPlugin(client).Create(opts.vaultAuthOptions)
	case "kubernetes":
		token, err = NewKubernetesPlugin(client).Create(opts.vaultAuthOptions)
	case "token":
		opts.vaultAuthOptions.FileName = options.vaultAuthFile
		opts.vaultAuthOptions.FileFormat = options.vaultAuthFileFormat
		token, err = NewUserTokenPlugin(client).Create(opts.vaultAuthOptions)
	default:
		return nil, fmt.Errorf("unsupported authentication plugin: %s", plugin)
	}
	if err != nil {
		return nil, err
	}
	client.SetToken(token)
	if opts.vaultRenewToken {
		tokeninfo, err := client.Auth().Token().LookupSelf()
		if err != nil {
			return nil, fmt.Errorf("failed to lookup token info: %s", err)
		}
		tokenttl, err := tokeninfo.TokenTTL()
		if err != nil {
			return nil, fmt.Errorf("failed to lookup token ttl: %s", err)
		}
		glog.Infof("token ttl is %v", tokenttl)
		renewPeriod := tokenttl / 2
		go func() {
			for {
				if renewPeriod < 1*time.Second {
					glog.Fatalf("fatal: token renew period is <1s, aborting")
				}
				glog.Infof("scheduling token renew in %v", renewPeriod)
				<-time.After(renewPeriod)
				glog.Infof("attempting token renew")
				newtokeninfo, err := client.Auth().Token().RenewSelf(0)
				if err != nil {
					renewPeriod = renewPeriod / 2
					glog.Warningf("error: failed to renew token, retrying in %v: %v", renewPeriod, err)
					continue
				}
				tokenttl, err := newtokeninfo.TokenTTL()
				if err != nil {
					glog.Warningf("error: failed to get new token ttl, using previous value %s: %s", renewPeriod, err)
				} else {
					glog.Infof("token ttl is %v", tokenttl)
					renewPeriod = tokenttl / 2
				}
			}
		}()
	}
	return client, nil
}
func newVaultClient ( opts * config ) ( * api . Client , error ) { var err error var token string config := api . DefaultConfig ( ) config . Address = opts . vaultURL config . HttpClient . Transport , err = buildHTTPTransport ( opts ) if err != nil { return nil , err } client , err := api . NewClient ( config ) if err != nil { return nil , err } plugin := opts . vaultAuthOptions . Method switch plugin { case " " : token , err = NewUserPassPlugin ( client ) . Create ( opts . vaultAuthOptions ) case " " : token , err = NewAppRolePlugin ( client ) . Create ( opts . vaultAuthOptions ) case " " : token , err = NewAWSEC2Plugin ( client ) . Create ( opts . vaultAuthOptions ) case " " : token , err = NewGCPGCEPlugin ( client ) . Create ( opts . vaultAuthOptions ) case " " : token , err = NewKubernetesPlugin ( client ) . Create ( opts . vaultAuthOptions ) case " " : opts . vaultAuthOptions . FileName = options . vaultAuthFile opts . vaultAuthOptions . FileFormat = options . vaultAuthFileFormat token , err = NewUserTokenPlugin ( client ) . Create ( opts . vaultAuthOptions ) default : return nil , fmt . Errorf ( " " , plugin ) } if err != nil { return nil , err } client . SetToken ( token ) if opts . vaultRenewToken { tokeninfo , err := client . Auth ( ) . Token ( ) . LookupSelf ( ) if err != nil { return nil , fmt . Errorf ( " " , err ) } tokenttl , err := tokeninfo . TokenTTL ( ) if err != nil { return nil , fmt . Errorf ( " " , err ) } glog . Infof ( " " , tokenttl ) renewPeriod := tokenttl / 2 go func ( ) { for { if renewPeriod < 1 * time . Second { glog . Fatalf ( " " ) } glog . Infof ( " " , renewPeriod ) <- time . After ( renewPeriod ) glog . Infof ( " " ) newtokeninfo , err := client . Auth ( ) . Token ( ) . RenewSelf ( 0 ) if err != nil { renewPeriod = renewPeriod / 2 glog . Warningf ( " " , renewPeriod , err ) continue } tokenttl , err := newtokeninfo . TokenTTL ( ) if err != nil { glog . Warningf ( " " , renewPeriod , err ) } else { glog . Infof ( " " , tokenttl ) renewPeriod = tokenttl / 2 } } } ( ) } return client , nil }
newVaultClient creates and authenticates a vault client
newVaultClient creates and authenticates a vault client
// step: create the actual client // step: set the token for the client