From 5ec75924df1334935b460c311ec7445db2282893 Mon Sep 17 00:00:00 2001 From: Michael Li Date: Thu, 23 Feb 2023 12:05:06 -0500 Subject: [PATCH] refact(e2e): Set up variables to prepare for docker implementation (#2992) * refact(e2e): Explicitly define port used for targets To maintain consistency for how we define ports, this change explicitly defines the port used in the enos scenario as opposed to relying on a "default" value. This change is in support of work that attempts to spin up test infrastructure using docker. The openssh-server image uses Port 2222, which needs to be passed to the test suite. * refact(e2e): Add optional "Internal" Vault Address parameter This change enables scenarios that need two different Vault addresses, one used by the Vault CLI and one by the Boundary server instance. In the case when using a Docker container, the Boundary server needs the Vault address "internal" to the Docker network, whereas the Vault CLI running outside of the network needs a different address. --- enos/enos-scenario-e2e-aws.hcl | 1 + enos/enos-scenario-e2e-static-with-vault.hcl | 1 + enos/enos-scenario-e2e-static.hcl | 1 + enos/modules/test_e2e/main.tf | 15 ++++++++++++++- testing/internal/e2e/tests/aws/env_test.go | 2 +- .../internal/e2e/tests/database/migration_test.go | 2 +- testing/internal/e2e/tests/static/env_test.go | 2 +- .../static_with_vault/connect_authz_token_test.go | 4 ++-- .../tests/static_with_vault/connect_ssh_test.go | 4 ++-- .../e2e/tests/static_with_vault/connect_test.go | 4 ++-- .../static_with_vault/credential_store_test.go | 8 ++++---- .../e2e/tests/static_with_vault/env_test.go | 6 ++++-- testing/internal/e2e/vault/env.go | 1 + testing/internal/e2e/vault/vault.go | 6 +----- 14 files changed, 36 insertions(+), 21 deletions(-) diff --git a/enos/enos-scenario-e2e-aws.hcl b/enos/enos-scenario-e2e-aws.hcl index 1d76c2774..c2185a9c9 100644 --- a/enos/enos-scenario-e2e-aws.hcl +++ b/enos/enos-scenario-e2e-aws.hcl @@ -179,6 +179,7 @@ scenario "e2e_aws" { local_boundary_dir = local.local_boundary_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_user = "ubuntu" + target_port = "22" aws_access_key_id = step.iam_setup.access_key_id aws_secret_access_key = step.iam_setup.secret_access_key aws_host_set_filter1 = step.create_tag1_inputs.tag_string diff --git a/enos/enos-scenario-e2e-static-with-vault.hcl b/enos/enos-scenario-e2e-static-with-vault.hcl index 1fd25d610..ddcfe6874 100644 --- a/enos/enos-scenario-e2e-static-with-vault.hcl +++ b/enos/enos-scenario-e2e-static-with-vault.hcl @@ -136,6 +136,7 @@ scenario "e2e_static_with_vault" { aws_ssh_private_key_path = local.aws_ssh_private_key_path target_ip = step.create_target.target_ips[0] target_user = "ubuntu" + target_port = "22" vault_addr = step.create_vault_cluster.instance_public_ips[0] vault_root_token = step.create_vault_cluster.vault_root_token } diff --git a/enos/enos-scenario-e2e-static.hcl b/enos/enos-scenario-e2e-static.hcl index 8a640f128..97e2c0f33 100644 --- a/enos/enos-scenario-e2e-static.hcl +++ b/enos/enos-scenario-e2e-static.hcl @@ -113,6 +113,7 @@ scenario "e2e_static" { aws_ssh_private_key_path = local.aws_ssh_private_key_path target_ip = step.create_target.target_ips[0] target_user = "ubuntu" + target_port = "22" } } diff --git a/enos/modules/test_e2e/main.tf b/enos/modules/test_e2e/main.tf index f3651ca4a..7a53c7bac 100644 --- a/enos/modules/test_e2e/main.tf +++ b/enos/modules/test_e2e/main.tf @@ -52,8 +52,18 @@ variable "target_ip" { type = string default = "" } +variable "target_port" { + description = "Port of target" + type = string + default = "" +} variable "vault_addr" { - description = "URL of Vault instance" + description = "External network address of Vault. Will be converted to a URL below" + type = string + default = "" +} +variable "vault_addr_internal" { + description = "Internal network address of Vault (i.e. within a docker network). Will be converted to a URL below" type = string default = "" } @@ -101,6 +111,7 @@ variable "aws_host_set_ips2" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) vault_addr = var.vault_addr != "" ? "http://${var.vault_addr}:8200" : "" + vault_addr_internal = var.vault_addr_internal != "" ? "http://${var.vault_addr_internal}:8200" : local.vault_addr aws_host_set_ips1 = jsonencode(var.aws_host_set_ips1) aws_host_set_ips2 = jsonencode(var.aws_host_set_ips2) package_name = reverse(split("/", var.test_package))[0] @@ -115,9 +126,11 @@ resource "enos_local_exec" "run_e2e_test" { E2E_PASSWORD_ADMIN_PASSWORD = var.auth_password, E2E_TARGET_IP = var.target_ip, E2E_SSH_USER = var.target_user, + E2E_SSH_PORT = var.target_port, E2E_SSH_KEY_PATH = local.aws_ssh_private_key_path, VAULT_ADDR = local.vault_addr, VAULT_TOKEN = var.vault_root_token, + E2E_VAULT_ADDR = local.vault_addr_internal, E2E_AWS_ACCESS_KEY_ID = var.aws_access_key_id, E2E_AWS_SECRET_ACCESS_KEY = var.aws_secret_access_key, E2E_AWS_HOST_SET_FILTER = var.aws_host_set_filter1, diff --git a/testing/internal/e2e/tests/aws/env_test.go b/testing/internal/e2e/tests/aws/env_test.go index b9a9313f1..8ac3ab920 100644 --- a/testing/internal/e2e/tests/aws/env_test.go +++ b/testing/internal/e2e/tests/aws/env_test.go @@ -14,7 +14,7 @@ type config struct { AwsHostSetIps2 string `envconfig:"E2E_AWS_HOST_SET_IPS2" required:"true"` // e.g. "[\"1.2.3.4\"]" TargetSshKeyPath string `envconfig:"E2E_SSH_KEY_PATH" required:"true"` // e.g. "/Users/username/key.pem" TargetSshUser string `envconfig:"E2E_SSH_USER" required:"true"` // e.g. "ubuntu" - TargetPort string `envconfig:"E2E_SSH_PORT" default:"22"` + TargetPort string `envconfig:"E2E_SSH_PORT" required:"true"` } func loadConfig() (*config, error) { diff --git a/testing/internal/e2e/tests/database/migration_test.go b/testing/internal/e2e/tests/database/migration_test.go index d827d8b99..0ef322a6b 100644 --- a/testing/internal/e2e/tests/database/migration_test.go +++ b/testing/internal/e2e/tests/database/migration_test.go @@ -224,7 +224,7 @@ func populateBoundaryDatabase(t testing.TB, ctx context.Context, c *config, te T boundary.AddCredentialSourceToTargetCli(t, ctx, newTargetId, newCredentialsId) // Create vault credentials - _, boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) + boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) output := e2e.RunCommand(ctx, "vault", e2e.WithArgs("secrets", "enable", "-path="+c.VaultSecretPath, "kv-v2"), ) diff --git a/testing/internal/e2e/tests/static/env_test.go b/testing/internal/e2e/tests/static/env_test.go index a057fac98..4b6a2a7a4 100644 --- a/testing/internal/e2e/tests/static/env_test.go +++ b/testing/internal/e2e/tests/static/env_test.go @@ -9,7 +9,7 @@ type config struct { TargetIp string `envconfig:"E2E_TARGET_IP" required:"true"` // e.g. 192.168.0.1 TargetSshKeyPath string `envconfig:"E2E_SSH_KEY_PATH" required:"true"` // e.g. /Users/username/key.pem TargetSshUser string `envconfig:"E2E_SSH_USER" required:"true"` // e.g. ubuntu - TargetPort string `envconfig:"E2E_SSH_PORT" default:"22"` + TargetPort string `envconfig:"E2E_SSH_PORT" required:"true"` } func loadConfig() (*config, error) { diff --git a/testing/internal/e2e/tests/static_with_vault/connect_authz_token_test.go b/testing/internal/e2e/tests/static_with_vault/connect_authz_token_test.go index b1619599a..d5d31b01e 100644 --- a/testing/internal/e2e/tests/static_with_vault/connect_authz_token_test.go +++ b/testing/internal/e2e/tests/static_with_vault/connect_authz_token_test.go @@ -46,7 +46,7 @@ func TestCliVaultConnectTargetWithAuthzToken(t *testing.T) { boundary.AddHostSourceToTargetCli(t, ctx, newTargetId, newHostSetId) // Configure vault - vaultAddr, boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) + boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) t.Cleanup(func() { output := e2e.RunCommand(ctx, "vault", e2e.WithArgs("policy", "delete", boundaryPolicyName), @@ -97,7 +97,7 @@ func TestCliVaultConnectTargetWithAuthzToken(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, vaultAddr, credStoreToken) + newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, c.VaultAddr, credStoreToken) // Create a credential library output = e2e.RunCommand(ctx, "boundary", diff --git a/testing/internal/e2e/tests/static_with_vault/connect_ssh_test.go b/testing/internal/e2e/tests/static_with_vault/connect_ssh_test.go index 14ff5ffb2..7a754dd02 100644 --- a/testing/internal/e2e/tests/static_with_vault/connect_ssh_test.go +++ b/testing/internal/e2e/tests/static_with_vault/connect_ssh_test.go @@ -45,7 +45,7 @@ func TestCliVaultConnectTargetWithSsh(t *testing.T) { boundary.AddHostSourceToTargetCli(t, ctx, newTargetId, newHostSetId) // Configure vault - vaultAddr, boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) + boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) t.Cleanup(func() { output := e2e.RunCommand(ctx, "vault", e2e.WithArgs("policy", "delete", boundaryPolicyName), @@ -96,7 +96,7 @@ func TestCliVaultConnectTargetWithSsh(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, vaultAddr, credStoreToken) + newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, c.VaultAddr, credStoreToken) // Create a credential library output = e2e.RunCommand(ctx, "boundary", diff --git a/testing/internal/e2e/tests/static_with_vault/connect_test.go b/testing/internal/e2e/tests/static_with_vault/connect_test.go index b55dd5ca8..99f13862c 100644 --- a/testing/internal/e2e/tests/static_with_vault/connect_test.go +++ b/testing/internal/e2e/tests/static_with_vault/connect_test.go @@ -47,7 +47,7 @@ func TestCliVaultConnectTarget(t *testing.T) { boundary.AddHostSourceToTargetCli(t, ctx, newTargetId, newHostSetId) // Configure vault - vaultAddr, boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) + boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) t.Cleanup(func() { output := e2e.RunCommand(ctx, "vault", e2e.WithArgs("policy", "delete", boundaryPolicyName), @@ -98,7 +98,7 @@ func TestCliVaultConnectTarget(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, vaultAddr, credStoreToken) + newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, c.VaultAddr, credStoreToken) // Create a credential library output = e2e.RunCommand(ctx, "boundary", diff --git a/testing/internal/e2e/tests/static_with_vault/credential_store_test.go b/testing/internal/e2e/tests/static_with_vault/credential_store_test.go index 54ceccc6e..2664d1d68 100644 --- a/testing/internal/e2e/tests/static_with_vault/credential_store_test.go +++ b/testing/internal/e2e/tests/static_with_vault/credential_store_test.go @@ -45,7 +45,7 @@ func TestCliVaultCredentialStore(t *testing.T) { boundary.AddHostSourceToTargetCli(t, ctx, newTargetId, newHostSetId) // Configure vault - vaultAddr, boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) + boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) t.Cleanup(func() { output := e2e.RunCommand(ctx, "vault", e2e.WithArgs("policy", "delete", boundaryPolicyName), @@ -97,7 +97,7 @@ func TestCliVaultCredentialStore(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, vaultAddr, credStoreToken) + newCredentialStoreId := boundary.CreateNewCredentialStoreVaultCli(t, ctx, newProjectId, c.VaultAddr, credStoreToken) // Create a credential library for the private key output = e2e.RunCommand(ctx, "boundary", @@ -209,7 +209,7 @@ func TestApiVaultCredentialStore(t *testing.T) { boundary.AddHostSourceToTargetApi(t, ctx, client, newTargetId, newHostSetId) // Configure vault - vaultAddr, boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) + boundaryPolicyName, kvPolicyFilePath := vault.Setup(t) output := e2e.RunCommand(ctx, "vault", e2e.WithArgs("secrets", "enable", "-path="+c.VaultSecretPath, "kv-v2"), ) @@ -250,7 +250,7 @@ func TestApiVaultCredentialStore(t *testing.T) { // Create a credential store csClient := credentialstores.NewClient(client) newCredentialStoreResult, err := csClient.Create(ctx, "vault", newProjectId, - credentialstores.WithVaultCredentialStoreAddress(vaultAddr), + credentialstores.WithVaultCredentialStoreAddress(c.VaultAddr), credentialstores.WithVaultCredentialStoreToken(credStoreToken), ) require.NoError(t, err) diff --git a/testing/internal/e2e/tests/static_with_vault/env_test.go b/testing/internal/e2e/tests/static_with_vault/env_test.go index 7a80e875f..9bfc5bbe0 100644 --- a/testing/internal/e2e/tests/static_with_vault/env_test.go +++ b/testing/internal/e2e/tests/static_with_vault/env_test.go @@ -9,8 +9,10 @@ type config struct { TargetIp string `envconfig:"E2E_TARGET_IP" required:"true"` // e.g. 192.168.0.1 TargetSshUser string `envconfig:"E2E_SSH_USER" required:"true"` // e.g. ubuntu TargetSshKeyPath string `envconfig:"E2E_SSH_KEY_PATH" required:"true"` // e.g. /Users/username/key.pem - TargetPort string `envconfig:"E2E_SSH_PORT" default:"22"` - VaultSecretPath string `envconfig:"E2E_VAULT_SECRET_PATH" default:"e2e_secrets"` + TargetPort string `envconfig:"E2E_SSH_PORT" required:"true"` + // VaultAddr is the address that the Boundary server uses to interact with the running Vault instance + VaultAddr string `envconfig:"E2E_VAULT_ADDR" required:"true"` // e.g. "http://127.0.0.1:8200" + VaultSecretPath string `envconfig:"E2E_VAULT_SECRET_PATH" default:"e2e_secrets"` } func loadConfig() (*config, error) { diff --git a/testing/internal/e2e/vault/env.go b/testing/internal/e2e/vault/env.go index 32621a993..2f99ba483 100644 --- a/testing/internal/e2e/vault/env.go +++ b/testing/internal/e2e/vault/env.go @@ -6,6 +6,7 @@ package vault import "github.com/kelseyhightower/envconfig" type config struct { + // VaultAddr is the address that the Vault CLI uses to interact with the running Vault instance VaultAddr string `envconfig:"VAULT_ADDR" required:"true"` // e.g. "http://127.0.0.1:8200" VaultToken string `envconfig:"VAULT_TOKEN" required:"true"` } diff --git a/testing/internal/e2e/vault/vault.go b/testing/internal/e2e/vault/vault.go index 8da93e210..5a6f5f790 100644 --- a/testing/internal/e2e/vault/vault.go +++ b/testing/internal/e2e/vault/vault.go @@ -25,11 +25,7 @@ type CreateTokenResponse struct { // Setup verifies if appropriate credentials are set and adds the boundary controller // policy to vault. Returns the vault address. -func Setup(t testing.TB) (vaultAddr string, boundaryPolicyName string, kvPolicyFilePath string) { - c, err := loadConfig() - require.NoError(t, err) - vaultAddr = c.VaultAddr - +func Setup(t testing.TB) (boundaryPolicyName string, kvPolicyFilePath string) { // Set up boundary policy boundaryPolicyFilePath, err := filepath.Abs("testdata/boundary-controller-policy.hcl") require.NoError(t, err)