token timer cache: support multiple vault servers

[pschulten]

No description provided.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[tillkuhn]

@pschulten switching between different VAULT_ADDR seems to work in general. But when you revoke the token of a session, it still shows the remaining time even though the token should be considered expired immediately. Not sure if this a bug, a cache issue or a missing feature :-)

# login np 6 minutes ago and pr 2 minutes ago (OK)
$ export VAULT_ADDR=$VAULTPAL_NP_URL
$ go run main.go timer
N 54m

# switch to pr, timer shows different value (OK)
$ export VAULT_ADDR=$VAULTPAL_PR_URL 
$ go run main.go timer
P 58m

# go back to np, timer is still alive (OK)
$ export VAULT_ADDR=$VAULTPAL_NP_URL
$ go run main.go timer
N 54m

# revoke current token (vault addr is still np)
$ vault token revoke -self
Success! Revoked token (if it existed)
$ vault token lookup
Error looking up token: Error making API request.
* permission denied

# check timer, it still shows remaining time (not OK?)
$ go run main.go timer
N 49m

[pschulten]

@tillkuhn it's by design. The main use-case for the timer (at least for me) is to render it into the shell prompt.
e.g. :

N 119m timer-cache vaultpal ❯ declare -f _ss_precmd
_ss_precmd () 
{ 
    export PRE_PROMPT=$(vaultpal timer; _kube_prompt);
    case $(vaultpal timer -q) in 
        green)
            export STARSHIP_CONFIG=~/.config/starship.toml
        ;;
        yellow)
            export STARSHIP_CONFIG=~/.config/starship.yellow.toml
        ;;
        red)
            STARSHIP_CONFIG=~/.config/starship.red.toml
        ;;
        *)
            unset STARSHIP_CONFIG
        ;;
    esac
}

If you do that, you want to have maximum performance, hence the cache to avoid the network round-trip. Users are supposed to reset the cache themselves on anything related to token manipulation. e.g.

 N 117m timer-cache vaultpal ❯ declare -f  get_token 
get_token () 
{ 
    t=$(vaultpal timer -q);
    case $t in 
        yellow | red)
            vault token renew -increment 2h > /dev/null 2>&1;
            vaultpal timer --clear-cache
        ;;
        green)

        ;;
        *)
            vault login -method oidc > /dev/null 2>&1;
            vault token renew -increment 2h > /dev/null 2>&1;
            vaultpal timer --clear-cache
        ;;
    esac
}

If you like, I can give you a demo :)