284 lines
11 KiB
Go
284 lines
11 KiB
Go
// Copyright IBM Corp. 2020, 2026
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package provider
|
|
|
|
import (
|
|
"context"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/api/credentialstores"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
|
|
"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
|
|
"repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/internal/testing/vault"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/crypto/blake2b"
|
|
)
|
|
|
|
const (
|
|
vaultCredStoreResc = "boundary_credential_store_vault.example"
|
|
vaultCredStoreName = "foo"
|
|
vaultCredStoreDesc = "the foo"
|
|
vaultCredStoreNamespace = "default"
|
|
vaultCredStoreUpdate = "_random"
|
|
)
|
|
|
|
func vaultCredStoreResource(vc *vault.TestVaultServer, name, description, namespace, tlsServer, token string, skipVerify bool) string {
|
|
caCert := fmt.Sprintf("\"%s\"", strings.Replace(string(vc.CaCert), "\n", `\n`, -1))
|
|
clientCert := fmt.Sprintf("\"%s\"", strings.Replace(string(vc.ClientCert), "\n", `\n`, -1))
|
|
clientKey := fmt.Sprintf("\"%s\"", strings.Replace(string(vc.ClientKey), "\n", `\n`, -1))
|
|
|
|
return fmt.Sprintf(`
|
|
resource "boundary_credential_store_vault" "example" {
|
|
name = "%s"
|
|
description = "%s"
|
|
scope_id = boundary_scope.proj1.id
|
|
address = "%s"
|
|
namespace = "%s"
|
|
ca_cert = %s
|
|
tls_server_name = "%s"
|
|
tls_skip_verify = "%v"
|
|
token = "%s"
|
|
client_certificate = %s
|
|
client_certificate_key = %s
|
|
depends_on = [boundary_role.proj1_admin]
|
|
}`, name,
|
|
description,
|
|
vc.Addr,
|
|
namespace,
|
|
caCert,
|
|
tlsServer,
|
|
skipVerify,
|
|
token,
|
|
clientCert,
|
|
clientKey)
|
|
}
|
|
|
|
func tokenHmac(token, accessor string) string {
|
|
key := blake2b.Sum256([]byte(accessor))
|
|
mac := hmac.New(sha256.New, key[:])
|
|
_, _ = mac.Write([]byte(token))
|
|
hmac := mac.Sum(nil)
|
|
return base64.RawURLEncoding.EncodeToString(hmac)
|
|
}
|
|
|
|
func TestSetFromVaultCredentialStoreResponseMapReadsWorkerFilterFromAttributes(t *testing.T) {
|
|
data := schema.TestResourceDataRaw(t, resourceCredentialStoreVault().Schema, map[string]interface{}{})
|
|
|
|
raw := map[string]interface{}{
|
|
"id": "cs_1234567890",
|
|
NameKey: vaultCredStoreName,
|
|
DescriptionKey: vaultCredStoreDesc,
|
|
ScopeIdKey: "p_1234567890",
|
|
"attributes": map[string]interface{}{
|
|
credentialStoreVaultAddressKey: "https://vault.example.com",
|
|
credentialStoreVaultNamespaceKey: vaultCredStoreNamespace,
|
|
credentialStoreVaultCaCertKey: "ca-cert",
|
|
credentialStoreVaultTlsServerNameKey: "vault.example.com",
|
|
credentialStoreVaultTlsSkipVerifyKey: false,
|
|
credentialStoreVaultClientCertificateKey: "client-cert",
|
|
credentialStoreVaultWorkerFilterKey: "\"prod\" in \"/tags/env\"",
|
|
credentialStoreVaultTokenHmacKey: "token-hmac",
|
|
credentialStoreVaultClientCertificateKeyHmacKey: "client-key-hmac",
|
|
},
|
|
}
|
|
|
|
diags := setFromVaultCredentialStoreResponseMap(data, raw, false)
|
|
if diags.HasError() {
|
|
t.Fatalf("unexpected diagnostics: %#v", diags)
|
|
}
|
|
|
|
if got := data.Get(credentialStoreVaultWorkerFilterKey); got != raw["attributes"].(map[string]interface{})[credentialStoreVaultWorkerFilterKey] {
|
|
t.Fatalf("worker_filter mismatch: got %v want %v", got, raw["attributes"].(map[string]interface{})[credentialStoreVaultWorkerFilterKey])
|
|
}
|
|
}
|
|
|
|
func TestAccCredentialStoreVault(t *testing.T) {
|
|
cfg, err := loadTestConfig()
|
|
require.NoError(t, err)
|
|
suffix := id.UniqueId()
|
|
url := cfg.BoundaryAddr
|
|
|
|
vc := vault.NewTestVaultServer(t)
|
|
secret, token := vc.CreateToken(t)
|
|
tHmac := tokenHmac(token, secret.Auth.Accessor)
|
|
res := vaultCredStoreResource(vc,
|
|
vaultCredStoreName,
|
|
vaultCredStoreDesc,
|
|
vaultCredStoreNamespace,
|
|
"www.original.com",
|
|
token,
|
|
true)
|
|
|
|
vcUpdate := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
|
|
secret, tokenUpdate := vcUpdate.CreateToken(t)
|
|
tHmacUpdate := tokenHmac(tokenUpdate, secret.Auth.Accessor)
|
|
resUpdate := vaultCredStoreResource(vcUpdate,
|
|
vaultCredStoreName+vaultCredStoreUpdate,
|
|
vaultCredStoreDesc+vaultCredStoreUpdate,
|
|
vaultCredStoreNamespace+vaultCredStoreUpdate,
|
|
"localhost",
|
|
tokenUpdate,
|
|
false)
|
|
|
|
var provider *schema.Provider
|
|
resource.Test(t, resource.TestCase{
|
|
ProviderFactories: providerFactories(&provider),
|
|
CheckDestroy: testAccCheckCredentialStoreResourceDestroy(t, provider, vaultStoreCredentialStoreType),
|
|
Steps: []resource.TestStep{
|
|
{
|
|
// create
|
|
Config: testConfig(url, fooOrg(suffix), firstProjectFoo, res),
|
|
Check: resource.ComposeTestCheckFunc(
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, NameKey, vaultCredStoreName),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, DescriptionKey, vaultCredStoreDesc),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultAddressKey, vc.Addr),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultNamespaceKey, vaultCredStoreNamespace),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultCaCertKey, ""),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTlsServerNameKey, "www.original.com"),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTlsSkipVerifyKey, "true"),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTokenKey, token),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTokenHmacKey, tHmac),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, ""),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, ""),
|
|
|
|
testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
|
|
),
|
|
},
|
|
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
|
|
{
|
|
// update
|
|
Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
|
|
Check: resource.ComposeTestCheckFunc(
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, NameKey, vaultCredStoreName+vaultCredStoreUpdate),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, DescriptionKey, vaultCredStoreDesc+vaultCredStoreUpdate),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultAddressKey, vcUpdate.Addr),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultNamespaceKey, vaultCredStoreNamespace+vaultCredStoreUpdate),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultCaCertKey, string(vcUpdate.CaCert)),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTlsServerNameKey, "localhost"),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTlsSkipVerifyKey, "false"),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTokenKey, tokenUpdate),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultTokenHmacKey, tHmacUpdate),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKey, string(vcUpdate.ClientCert)),
|
|
resource.TestCheckResourceAttr(vaultCredStoreResc, credentialStoreVaultClientCertificateKeyKey, string(vcUpdate.ClientKey)),
|
|
|
|
testAccCheckCredentialStoreResourceExists(provider, vaultCredStoreResc),
|
|
),
|
|
},
|
|
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
|
|
{
|
|
// Run a plan only update and verify no changes
|
|
PlanOnly: true,
|
|
Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
|
|
},
|
|
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
|
|
{
|
|
// update again but apply a preConfig to externally update resource
|
|
// TODO: Boundary currently causes an error on moving back to a previously
|
|
// used token, for now verify that a plan only step had changes
|
|
PreConfig: func() { externalUpdate(t, provider) },
|
|
PlanOnly: true,
|
|
ExpectNonEmptyPlan: true,
|
|
Config: testConfig(url, fooOrg(suffix), firstProjectFoo, resUpdate),
|
|
},
|
|
importStep(vaultCredStoreResc, credentialStoreVaultTokenKey, credentialStoreVaultClientCertificateKeyKey),
|
|
},
|
|
})
|
|
}
|
|
|
|
var storeId string
|
|
|
|
// externalUpdate uses the global storeId, therefore this function cannot be called until
|
|
// a previous test step that calls testAccCheckCredentialStoreVaultResourceExists has completed.
|
|
func externalUpdate(t *testing.T, testProvider *schema.Provider) {
|
|
if storeId == "" {
|
|
t.Fatal("storeId must be set before testing an external update")
|
|
}
|
|
vs := vault.NewTestVaultServer(t, vault.WithTestVaultTLS(vault.TestClientTLS))
|
|
_, token := vs.CreateToken(t)
|
|
|
|
md := testProvider.Meta().(*metaData)
|
|
c := credentialstores.NewClient(md.client)
|
|
cr, err := c.Read(context.Background(), storeId)
|
|
if err != nil {
|
|
t.Fatal(fmt.Errorf("got an error reading %q: %w", storeId, err))
|
|
}
|
|
|
|
// update Vault server to existing store
|
|
var opts []credentialstores.Option
|
|
opts = append(opts, credentialstores.WithVaultCredentialStoreToken(token))
|
|
opts = append(opts, credentialstores.WithVaultCredentialStoreAddress(vs.Addr))
|
|
opts = append(opts, credentialstores.WithVaultCredentialStoreCaCert(string(vs.CaCert)))
|
|
opts = append(opts, credentialstores.WithVaultCredentialStoreClientCertificate(string(vs.ClientCert)))
|
|
opts = append(opts, credentialstores.WithVaultCredentialStoreClientCertificateKey(string(vs.ClientKey)))
|
|
|
|
_, err = c.Update(context.Background(), cr.Item.Id, cr.Item.Version, opts...)
|
|
if err != nil {
|
|
t.Fatal(fmt.Errorf("got an error updating %q: %w", cr.Item.Id, err))
|
|
}
|
|
}
|
|
|
|
func testAccCheckCredentialStoreResourceExists(testProvider *schema.Provider, name string) resource.TestCheckFunc {
|
|
return func(s *terraform.State) error {
|
|
rs, ok := s.RootModule().Resources[name]
|
|
if !ok {
|
|
return fmt.Errorf("not found: %s", name)
|
|
}
|
|
|
|
id := rs.Primary.ID
|
|
if id == "" {
|
|
return fmt.Errorf("no ID is set")
|
|
}
|
|
storeId = id
|
|
|
|
md := testProvider.Meta().(*metaData)
|
|
c := credentialstores.NewClient(md.client)
|
|
if _, err := c.Read(context.Background(), id); err != nil {
|
|
return fmt.Errorf("got an error reading %q: %w", id, err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
}
|
|
|
|
type credentialDestroyStoreType string
|
|
|
|
const (
|
|
staticStoreCredentialStoreType credentialDestroyStoreType = "boundary_credential_store_static"
|
|
vaultStoreCredentialStoreType credentialDestroyStoreType = "boundary_credential_store_vault"
|
|
)
|
|
|
|
func testAccCheckCredentialStoreResourceDestroy(t *testing.T, testProvider *schema.Provider, typ credentialDestroyStoreType) resource.TestCheckFunc {
|
|
return func(s *terraform.State) error {
|
|
if testProvider.Meta() == nil {
|
|
t.Fatal("got nil provider metadata")
|
|
}
|
|
md := testProvider.Meta().(*metaData)
|
|
|
|
for _, rs := range s.RootModule().Resources {
|
|
switch rs.Type {
|
|
case string(typ):
|
|
id := rs.Primary.ID
|
|
|
|
c := credentialstores.NewClient(md.client)
|
|
_, err := c.Read(context.Background(), id)
|
|
if apiErr := api.AsServerError(err); apiErr == nil || apiErr.Response().StatusCode() != http.StatusNotFound {
|
|
return fmt.Errorf("didn't get a 404 when reading destroyed static credential store %q: %v", id, err)
|
|
}
|
|
default:
|
|
continue
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
}
|