* feat: update retry logic for validation call
- update validation for service account validation call to use `select` instead of `sleep`
- add `validateServiceAccountKeyTimeout` to config. This makes it easier to control the timeout from tests so tests do not have to run for long with the default timeout
* feat: enhance service account key rotation with validation callback
- add validation callback will enable the host service to validate the newly created key before the deleting the old key
- wrapped both the call to validate permissions and validate callback in a retry because sometimes it takes some time for the newly created key to be active on GCP services. This throws an error and prevents host catalog creation
* test: add e2e tests
Spin up GCP resources for testing dynamic host catalogs. The resources are tested with tests that focus on credential changes and rotation for host catalog and host set creation and updates using labels.
- The tests all depend on each other so they need to run in order. - The test can also only be executed locally for now.
- The resources are cleaned up after the test as part of the test.
* fix: Cred rotation
- fix bug where the rotated service account key was not read. The response needs to be unmarshalled to pull out the values from th fields
- fix bug where the time stamp was not getting updated after rotating credentials
- fix bug where updates without setting a new secret fails
* feat: OnUpdateSet
Add support for OnUpdateSet with validation. OnUpdateSet will validate he attributes passed to it and run a dryRunValidation with the new set
* feat: ListHosts (#14)
- Update list hosts to only support listing instances
- Update host client to support Instances API
- Add reading IPV6 Address by `Ipv6AccessConfigs`
- Add internal DNS which is the hostname
Add support for onCreateSet with validation.
- If a filter is not provided or a status is not set, a default filter of `status = running` is used.
- update `filters` field to be a slice instead of a string
- add dryRunValidation call to validate fields
* feat: NormalizeSetData & NormalizeCatalogData
- Add support for always normalizing host set filters as an array. This implementation follows exactly what we do for AWS as well for consistency
- No-op for NormalizeCatalogData
* feat: OnCreateCatalog
- Update onCreateCatalog to support credential rotation. Service authentication type creds will be rotated since we will have the credentials for the base service account without sufficient permissions.
- `onCreateCatalog` will also do a dry run validation to validate the credentials.
- The secrets and last rotated time will be returned
* feat: Rotate Service Account Key
- Add support for rotating service account key
- Add a check to validate the permissions for the newly created service account key
- Remove `GetClient` for GCP config since HTTPClient is not an accepted form of authentication for all clients. Switching to using Google Credentials instead for authentication
* feat: GCP authentication
Add authentication support for:
- authentication with service account key
- authentication with impersonating service account key
- authentication with application default credentials which are read from the environment
A HTTP client with a token set will be returned and used for authentication with all clients. for example
```
gcpClient, err := gcpConfig.GetClient(ctx)
if err != nil {
log.Fatalf("Failed to get client: %v", err)
}
client, err := computeCloud.NewInstancesRESTClient(ctx, option.WithHTTPClient(gcpClient))
if err != nil {
log.Fatalf("Failed to create client: %v", err)
}
```
add support for google host attributes:
- project_id (Required): The project ID associated with the service account
- zone (Required): The deployment area within a region
disable_credential_rotation (Optional): Disables credential rotation by the plugin
- client_email (Optional): The email address associated with the service account. The email address used to uniquely identify the service account. It is required for authentication and authorization. If it is not set, authentication will fail.
- target_service_account_id (Optional): The unique identifier for the service account that will be impersonated.
- disable_credential_rotation (Optional): Disable the rotation of google service account key associated with the plugin
dependabot[bot]
adityawalvekar
oss-core-libraries-dashboard[bot]andhashicorp-copywrite[bot]
compliance-pr-automation-bot[bot]andcompliance-pr-automation[bot]
Elim Tsiagbey
Irena Rindos
David Kanney
Louis Ruch
Elim Tsiagbey
Rosemary Wang