From 67f9815c643924d645999e03f9aa2f996547ccb3 Mon Sep 17 00:00:00 2001 From: Michael Li Date: Mon, 16 Mar 2026 10:24:32 -0400 Subject: [PATCH] chore(e2e): Remove need to modify `/etc/hosts` (#6486) * ce: chore(e2e): Remove need for /etc/hosts modifications (cherry picked from commit df230ea09af3d006db006487ebd644a0d3dd76f2) * ce: test(e2e): Fix test that was failing (cherry picked from commit 310ebf2a9b6c7427c1ff6c1c9e9045c1deb13a40) --- .github/workflows/enos-run.yml | 15 ++ .../enos-scenario-e2e-docker-base-connect.hcl | 6 +- enos/enos-scenario-e2e-docker-base-plus.hcl | 5 +- ...enos-scenario-e2e-docker-base-with-gcp.hcl | 6 +- ...os-scenario-e2e-docker-base-with-vault.hcl | 9 +- ...io-e2e-docker-base-with-worker-version.hcl | 7 +- ...s-scenario-e2e-docker-base-with-worker.hcl | 7 +- enos/enos-scenario-e2e-docker-base.hcl | 6 +- ...ker-worker-registration-controller-led.hcl | 9 +- ...-docker-worker-registration-worker-led.hcl | 9 +- enos/enos-scenario-e2e-ui-docker.hcl | 6 +- .../docker_boundary/boundary-config-bsr.hcl | 12 +- .../docker_boundary/boundary-config-init.hcl | 1 + .../boundary-config-rate-limit.hcl | 10 +- .../docker_boundary/boundary-config.hcl | 12 +- enos/modules/docker_boundary/main.tf | 21 +-- enos/modules/docker_vault/main.tf | 13 +- enos/modules/docker_worker/main.tf | 7 +- .../worker-config-bsr-downstream.hcl | 9 +- .../docker_worker/worker-config-bsr.hcl | 2 +- .../worker-config-controller-led.hcl | 2 +- .../worker-config-downstream.hcl | 9 +- .../worker-config-worker-led.hcl | 2 +- enos/modules/docker_worker/worker-config.hcl | 2 +- enos/modules/test_e2e_docker/main.tf | 8 +- enos/modules/test_e2e_docker/test.sh | 132 ------------------ enos/modules/test_e2e_docker/test_runner.sh | 74 ---------- enos/modules/test_e2e_ui/main.tf | 6 + ...et_tcp_connect_session_max_seconds_test.go | 2 +- .../auth_method_oidc_vault_test.go | 8 +- .../credential_library_vault_ldap_test.go | 4 +- .../base_with_vault/credential_store_test.go | 4 +- .../e2e/tests/base_with_vault/env_test.go | 9 +- .../paginate_credential_library_test.go | 4 +- ..._vault_generic_connect_authz_token_test.go | 2 +- ...rget_tcp_vault_generic_connect_ssh_test.go | 2 +- .../target_tcp_vault_generic_connect_test.go | 2 +- .../target_tcp_worker_connect_ssh_test.go | 2 +- 38 files changed, 138 insertions(+), 308 deletions(-) delete mode 100755 enos/modules/test_e2e_docker/test.sh delete mode 100644 enos/modules/test_e2e_docker/test_runner.sh diff --git a/.github/workflows/enos-run.yml b/.github/workflows/enos-run.yml index 61876f93f..f620fd4d6 100644 --- a/.github/workflows/enos-run.yml +++ b/.github/workflows/enos-run.yml @@ -233,6 +233,21 @@ jobs: if: contains(matrix.filter, 'e2e_docker') run: | mv ${{ steps.download-docker.outputs.download-path }}/*.tar enos/support/boundary_docker_image.tar + - name: Install other test dependencies + if: contains(matrix.filter, 'e2e_docker_base_plus') + run: | + # mongosh + wget -q https://github.com/mongodb-js/mongosh/releases/download/v2.7.0/mongosh-2.7.0-linux-x64.tgz -O /tmp/mongosh.tgz + tar -xzf /tmp/mongosh.tgz -C "$HOME" + echo "$HOME/mongosh-2.7.0-linux-x64/bin" >> "$GITHUB_PATH" + + # cqlsh (cassandra CLI) + wget -q https://downloads.apache.org/cassandra/4.1.10/apache-cassandra-4.1.10-bin.tar.gz -O /tmp/cassandra.tar.gz + tar -xzf /tmp/cassandra.tar.gz -C "$HOME" + echo "$HOME/apache-cassandra-4.1.10/bin" >> "$GITHUB_PATH" + + # redis + sudo apt update && sudo apt install -y redis-tools mysql-client - name: Output Terraform version info run: | mkdir -p ./enos/terraform-plugin-cache diff --git a/enos/enos-scenario-e2e-docker-base-connect.hcl b/enos/enos-scenario-e2e-docker-base-connect.hcl index 1c0dc6e03..d32681161 100644 --- a/enos/enos-scenario-e2e-docker-base-connect.hcl +++ b/enos/enos-scenario-e2e-docker-base-connect.hcl @@ -1,9 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary - scenario "e2e_docker_base_connect" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -17,6 +14,7 @@ scenario "e2e_docker_base_connect" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -116,7 +114,7 @@ scenario "e2e_docker_base_connect" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-docker-base-plus.hcl b/enos/enos-scenario-e2e-docker-base-plus.hcl index 795b5b548..5103a49c9 100644 --- a/enos/enos-scenario-e2e-docker-base-plus.hcl +++ b/enos/enos-scenario-e2e-docker-base-plus.hcl @@ -1,8 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary scenario "e2e_docker_base_plus" { terraform_cli = terraform_cli.default @@ -17,6 +15,7 @@ scenario "e2e_docker_base_plus" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -129,7 +128,7 @@ scenario "e2e_docker_base_plus" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-docker-base-with-gcp.hcl b/enos/enos-scenario-e2e-docker-base-with-gcp.hcl index e8858c71a..7bde35d6d 100644 --- a/enos/enos-scenario-e2e-docker-base-with-gcp.hcl +++ b/enos/enos-scenario-e2e-docker-base-with-gcp.hcl @@ -1,9 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary - scenario "e2e_docker_base_with_gcp" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -17,6 +14,7 @@ scenario "e2e_docker_base_with_gcp" { } locals { + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -123,7 +121,7 @@ scenario "e2e_docker_base_with_gcp" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir gcp_host_set_filter1 = step.create_gcp_target.filter_label1 gcp_host_set_filter2 = step.create_gcp_target.filter_label2 diff --git a/enos/enos-scenario-e2e-docker-base-with-vault.hcl b/enos/enos-scenario-e2e-docker-base-with-vault.hcl index 53b0daf28..fe6d61133 100644 --- a/enos/enos-scenario-e2e-docker-base-with-vault.hcl +++ b/enos/enos-scenario-e2e-docker-base-with-vault.hcl @@ -1,11 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary -# 127.0.0.1 localhost worker -# 127.0.0.1 localhost vault - scenario "e2e_docker_base_with_vault" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -19,6 +14,7 @@ scenario "e2e_docker_base_with_vault" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -141,7 +137,7 @@ scenario "e2e_docker_base_with_vault" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address @@ -149,6 +145,7 @@ scenario "e2e_docker_base_with_vault" { target_user = "ubuntu" vault_addr_public = step.create_vault.address_public vault_addr_private = step.create_vault.address_private + vault_addr_unified = step.create_vault.address_unified vault_root_token = step.create_vault.token vault_port = step.create_vault.port max_page_size = step.create_boundary.max_page_size diff --git a/enos/enos-scenario-e2e-docker-base-with-worker-version.hcl b/enos/enos-scenario-e2e-docker-base-with-worker-version.hcl index 5d959550e..2d02ebb1d 100644 --- a/enos/enos-scenario-e2e-docker-base-with-worker-version.hcl +++ b/enos/enos-scenario-e2e-docker-base-with-worker-version.hcl @@ -1,10 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary -# 127.0.0.1 localhost worker - scenario "e2e_docker_base_with_worker_version" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -18,6 +14,7 @@ scenario "e2e_docker_base_with_worker_version" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -176,7 +173,7 @@ scenario "e2e_docker_base_with_worker_version" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-docker-base-with-worker.hcl b/enos/enos-scenario-e2e-docker-base-with-worker.hcl index 52bc7c416..00c66e38e 100644 --- a/enos/enos-scenario-e2e-docker-base-with-worker.hcl +++ b/enos/enos-scenario-e2e-docker-base-with-worker.hcl @@ -1,10 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary -# 127.0.0.1 localhost worker - scenario "e2e_docker_base_with_worker" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -18,6 +14,7 @@ scenario "e2e_docker_base_with_worker" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -171,7 +168,7 @@ scenario "e2e_docker_base_with_worker" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-docker-base.hcl b/enos/enos-scenario-e2e-docker-base.hcl index 373c95c40..f4d369da5 100644 --- a/enos/enos-scenario-e2e-docker-base.hcl +++ b/enos/enos-scenario-e2e-docker-base.hcl @@ -1,9 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary - scenario "e2e_docker_base" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -17,6 +14,7 @@ scenario "e2e_docker_base" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -116,7 +114,7 @@ scenario "e2e_docker_base" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-docker-worker-registration-controller-led.hcl b/enos/enos-scenario-e2e-docker-worker-registration-controller-led.hcl index f13179c56..ce1050e63 100644 --- a/enos/enos-scenario-e2e-docker-worker-registration-controller-led.hcl +++ b/enos/enos-scenario-e2e-docker-worker-registration-controller-led.hcl @@ -1,10 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary -# 127.0.0.1 localhost worker - scenario "e2e_docker_worker_registration_controller_led" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -18,6 +14,7 @@ scenario "e2e_docker_worker_registration_controller_led" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -111,7 +108,7 @@ scenario "e2e_docker_worker_registration_controller_led" { module = module.docker_boundary_cmd depends_on = [step.create_boundary] variables { - address = step.create_boundary.address + address = step.create_boundary.container_address image_name = step.build_boundary_docker_image.image_name network_name = local.network_cluster login_name = step.create_boundary.login_name @@ -186,7 +183,7 @@ scenario "e2e_docker_worker_registration_controller_led" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-docker-worker-registration-worker-led.hcl b/enos/enos-scenario-e2e-docker-worker-registration-worker-led.hcl index 2ba296a64..86bd4b1a3 100644 --- a/enos/enos-scenario-e2e-docker-worker-registration-worker-led.hcl +++ b/enos/enos-scenario-e2e-docker-worker-registration-worker-led.hcl @@ -1,10 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary -# 127.0.0.1 localhost worker - scenario "e2e_docker_worker_registration_worker_led" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -18,6 +14,7 @@ scenario "e2e_docker_worker_registration_worker_led" { locals { aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path) + local_boundary_dir = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null local_boundary_src_dir = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null boundary_docker_image_file = abspath(var.boundary_docker_image_file) license_path = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic")) @@ -163,7 +160,7 @@ scenario "e2e_docker_worker_registration_worker_led" { step.create_worker, ] variables { - address = step.create_boundary.address + address = step.create_boundary.container_address image_name = step.build_boundary_docker_image.image_name network_name = local.network_cluster login_name = step.create_boundary.login_name @@ -201,7 +198,7 @@ scenario "e2e_docker_worker_registration_worker_led" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_src_dir = local.local_boundary_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address diff --git a/enos/enos-scenario-e2e-ui-docker.hcl b/enos/enos-scenario-e2e-ui-docker.hcl index 81cddc768..dc8e18214 100644 --- a/enos/enos-scenario-e2e-ui-docker.hcl +++ b/enos/enos-scenario-e2e-ui-docker.hcl @@ -1,9 +1,6 @@ # Copyright IBM Corp. 2020, 2025 # SPDX-License-Identifier: BUSL-1.1 -# For this scenario to work, add the following line to /etc/hosts -# 127.0.0.1 localhost boundary - scenario "e2e_ui_docker" { terraform_cli = terraform_cli.default terraform = terraform.default @@ -162,7 +159,7 @@ scenario "e2e_ui_docker" { auth_method_id = step.create_boundary.auth_method_id auth_login_name = step.create_boundary.login_name auth_password = step.create_boundary.password - local_boundary_dir = step.build_boundary_docker_image.cli_zip_path + local_boundary_dir = local.local_boundary_dir local_boundary_ui_src_dir = local.local_boundary_ui_src_dir aws_ssh_private_key_path = local.aws_ssh_private_key_path target_address = step.create_host.address @@ -172,6 +169,7 @@ scenario "e2e_ui_docker" { target_ca_key_public = step.create_host.ca_key_public vault_addr_public = step.create_vault.address_public vault_addr_private = step.create_vault.address_private + vault_addr_unified = step.create_vault.address_unified vault_root_token = step.create_vault.token vault_port = step.create_vault.port ldap_address = step.create_ldap_server.address diff --git a/enos/modules/docker_boundary/boundary-config-bsr.hcl b/enos/modules/docker_boundary/boundary-config-bsr.hcl index e4ceae000..a03b5357e 100644 --- a/enos/modules/docker_boundary/boundary-config-bsr.hcl +++ b/enos/modules/docker_boundary/boundary-config-bsr.hcl @@ -4,7 +4,8 @@ disable_mlock = true controller { - name = "docker-controller" + name = "docker-controller" + public_cluster_addr = "boundary:9201" max_page_size = ${max_page_size} @@ -16,7 +17,6 @@ controller { worker { name = "boundary-collocated-worker" description = "A worker that runs alongside the controller in the same process" - address = "boundary:9202" tags { type = ["${worker_type_tag}"] @@ -24,25 +24,25 @@ worker { } listener "tcp" { - address = "boundary:9200" + address = "0.0.0.0:9200" purpose = "api" tls_disable = true } listener "tcp" { - address = "boundary:9201" + address = "0.0.0.0:9201" purpose = "cluster" tls_disable = true } listener "tcp" { - address = "boundary:9202" + address = "0.0.0.0:9202" purpose = "proxy" tls_disable = true } listener "tcp" { - address = "boundary:9203" + address = "0.0.0.0:9203" purpose = "ops" tls_disable = true } diff --git a/enos/modules/docker_boundary/boundary-config-init.hcl b/enos/modules/docker_boundary/boundary-config-init.hcl index f250a391c..c825d227f 100644 --- a/enos/modules/docker_boundary/boundary-config-init.hcl +++ b/enos/modules/docker_boundary/boundary-config-init.hcl @@ -5,6 +5,7 @@ disable_mlock = true controller { name = "docker-controller" + public_cluster_addr = "boundary:9201" database { url = "env://BOUNDARY_POSTGRES_URL" diff --git a/enos/modules/docker_boundary/boundary-config-rate-limit.hcl b/enos/modules/docker_boundary/boundary-config-rate-limit.hcl index 9afdba0cc..ff139aefb 100644 --- a/enos/modules/docker_boundary/boundary-config-rate-limit.hcl +++ b/enos/modules/docker_boundary/boundary-config-rate-limit.hcl @@ -5,6 +5,7 @@ disable_mlock = true controller { name = "docker-controller" + public_cluster_addr = "boundary:9201" database { url = "env://BOUNDARY_POSTGRES_URL" @@ -45,7 +46,6 @@ controller { worker { name = "boundary-collocated-worker" description = "A worker that runs alongside the controller in the same process" - address = "boundary:9202" tags { type = ["${worker_type_tag}"] @@ -53,25 +53,25 @@ worker { } listener "tcp" { - address = "boundary:9200" + address = "0.0.0.0:9200" purpose = "api" tls_disable = true } listener "tcp" { - address = "boundary:9201" + address = "0.0.0.0:9201" purpose = "cluster" tls_disable = true } listener "tcp" { - address = "boundary:9202" + address = "0.0.0.0:9202" purpose = "proxy" tls_disable = true } listener "tcp" { - address = "boundary:9203" + address = "0.0.0.0:9203" purpose = "ops" tls_disable = true } diff --git a/enos/modules/docker_boundary/boundary-config.hcl b/enos/modules/docker_boundary/boundary-config.hcl index 5bfc6c8b9..45d518bd6 100644 --- a/enos/modules/docker_boundary/boundary-config.hcl +++ b/enos/modules/docker_boundary/boundary-config.hcl @@ -4,7 +4,8 @@ disable_mlock = true controller { - name = "docker-controller" + name = "docker-controller" + public_cluster_addr = "boundary:9201" max_page_size = ${max_page_size} @@ -16,7 +17,6 @@ controller { worker { name = "boundary-collocated-worker" description = "A worker that runs alongside the controller in the same process" - address = "boundary:9202" tags { type = ["${worker_type_tag}"] @@ -24,25 +24,25 @@ worker { } listener "tcp" { - address = "boundary:9200" + address = "0.0.0.0:9200" purpose = "api" tls_disable = true } listener "tcp" { - address = "boundary:9201" + address = "0.0.0.0:9201" purpose = "cluster" tls_disable = true } listener "tcp" { - address = "boundary:9202" + address = "0.0.0.0:9202" purpose = "proxy" tls_disable = true } listener "tcp" { - address = "boundary:9203" + address = "0.0.0.0:9203" purpose = "ops" tls_disable = true } diff --git a/enos/modules/docker_boundary/main.tf b/enos/modules/docker_boundary/main.tf index 22822fd15..1520e1839 100644 --- a/enos/modules/docker_boundary/main.tf +++ b/enos/modules/docker_boundary/main.tf @@ -77,11 +77,12 @@ resource "enos_local_exec" "init_database" { } locals { - db_init_info = jsondecode(enos_local_exec.init_database.stdout) - auth_method_id = local.db_init_info["auth_method"]["auth_method_id"] - login_name = local.db_init_info["auth_method"]["login_name"] - password = local.db_init_info["auth_method"]["password"] - address = "http://${var.container_name}:9200" + db_init_info = jsondecode(enos_local_exec.init_database.stdout) + auth_method_id = local.db_init_info["auth_method"]["auth_method_id"] + login_name = local.db_init_info["auth_method"]["login_name"] + password = local.db_init_info["auth_method"]["password"] + address = "http://127.0.0.1:9200" + container_address = "http://${var.container_name}:9200" } resource "docker_container" "boundary" { @@ -125,7 +126,7 @@ resource "docker_container" "boundary" { file = "/boundary/boundary-config.hcl" } healthcheck { - test = ["CMD", "wget", "--quiet", "-O", "/dev/null", "http://boundary:9203/health"] + test = ["CMD", "wget", "--quiet", "-O", "/dev/null", "http://127.0.0.1:9203/health"] interval = "3s" timeout = "5s" retries = 5 @@ -146,7 +147,7 @@ resource "enos_local_exec" "check_address" { docker_container.boundary ] - inline = ["timeout 10s bash -c 'until curl http://0.0.0.0:9200; do sleep 2; done'"] + inline = ["timeout 10s bash -c 'until curl http://127.0.0.1:9200; do sleep 2; done'"] } resource "enos_local_exec" "check_health" { @@ -154,13 +155,17 @@ resource "enos_local_exec" "check_health" { enos_local_exec.check_address ] - inline = ["timeout 10s bash -c 'until curl -i http://0.0.0.0:9203/health; do sleep 2; done'"] + inline = ["timeout 10s bash -c 'until curl -i http://127.0.0.1:9203/health; do sleep 2; done'"] } output "address" { value = local.address } +output "container_address" { + value = local.container_address +} + output "upstream_address" { value = "${var.container_name}:9201" } diff --git a/enos/modules/docker_vault/main.tf b/enos/modules/docker_vault/main.tf index 991943e8a..0d5c4e9f5 100644 --- a/enos/modules/docker_vault/main.tf +++ b/enos/modules/docker_vault/main.tf @@ -132,14 +132,25 @@ resource "enos_local_exec" "check_health" { inline = ["timeout 10s bash -c 'until vault status; do sleep 2; done'"] } +# Get the host machine's IP address +# Uses 'ip' (Linux) with fallback to 'ifconfig' (macOS) for cross-platform support +data "external" "host_ip" { + program = ["bash", "-c", "echo '{\"ip\":\"'$(command -v ip >/dev/null 2>&1 && ip -4 route get 8.8.8.8 | grep -oP 'src \\K[\\d.]+' | head -1 || ifconfig 2>/dev/null | grep 'inet ' | grep -v 127.0.0.1 | head -1 | awk '{print $2}')'\"}' "] +} + output "address_public" { - value = "http://${var.container_name}:${var.vault_port}" + value = "http://127.0.0.1:${var.vault_port}" } output "address_private" { value = "http://${var.container_name}:${var.vault_port_internal}" } +output "address_unified" { + description = "Unified address accessible from both host and containers" + value = "http://${data.external.host_ip.result.ip}:${var.vault_port}" +} + output "token" { value = local.root_token } diff --git a/enos/modules/docker_worker/main.tf b/enos/modules/docker_worker/main.tf index 0b50ef90d..db3d851c4 100644 --- a/enos/modules/docker_worker/main.tf +++ b/enos/modules/docker_worker/main.tf @@ -65,6 +65,11 @@ variable "worker_led_registration" { type = bool default = false } +variable "is_downstream_worker" { + description = "Whether this worker is a downstream worker, which affects its health check and registration process" + type = bool + default = false +} resource "docker_image" "boundary" { name = var.image_name @@ -139,7 +144,7 @@ resource "enos_local_exec" "get_worker_led_token" { } resource "enos_local_exec" "check_address" { - count = var.worker_led_registration ? 0 : 1 + count = var.worker_led_registration || var.is_downstream_worker ? 0 : 1 depends_on = [ docker_container.worker ] diff --git a/enos/modules/docker_worker/worker-config-bsr-downstream.hcl b/enos/modules/docker_worker/worker-config-bsr-downstream.hcl index 8ebb1cfb4..d64f60a31 100644 --- a/enos/modules/docker_worker/worker-config-bsr-downstream.hcl +++ b/enos/modules/docker_worker/worker-config-bsr-downstream.hcl @@ -4,20 +4,23 @@ disable_mlock = true listener "tcp" { - address = "0.0.0.0:${port}" + # setting to 127.0.0.1 so that it won't be accessible by the local machine + # outside of the container, which is a more realistic configuration for a downstream worker + address = "127.0.0.1:${port}" purpose = "proxy" tls_disable = true } listener "tcp" { - address = "0.0.0.0:${port_ops}" + # setting to 127.0.0.1 so that it won't be accessible by the local machine + # outside of the container, which is a more realistic configuration for a downstream worker + address = "127.0.0.1:${port_ops}" purpose = "ops" tls_disable = true } worker { name = "${worker_name}" - public_addr = "${worker_name}:${port}" initial_upstreams = ["${initial_upstream}"] tags { diff --git a/enos/modules/docker_worker/worker-config-bsr.hcl b/enos/modules/docker_worker/worker-config-bsr.hcl index 851156ec1..abafd01fe 100644 --- a/enos/modules/docker_worker/worker-config-bsr.hcl +++ b/enos/modules/docker_worker/worker-config-bsr.hcl @@ -17,7 +17,7 @@ listener "tcp" { worker { name = "${worker_name}" - public_addr = "${worker_name}:${port}" + public_addr = "127.0.0.1:${port}" initial_upstreams = ["${initial_upstream}"] tags { diff --git a/enos/modules/docker_worker/worker-config-controller-led.hcl b/enos/modules/docker_worker/worker-config-controller-led.hcl index 2eb0b327a..7c8901783 100644 --- a/enos/modules/docker_worker/worker-config-controller-led.hcl +++ b/enos/modules/docker_worker/worker-config-controller-led.hcl @@ -16,7 +16,7 @@ listener "tcp" { } worker { - public_addr = "${worker_name}:${port}" + public_addr = "127.0.0.1:${port}" initial_upstreams = ["${initial_upstream}"] controller_generated_activation_token = "${token}" diff --git a/enos/modules/docker_worker/worker-config-downstream.hcl b/enos/modules/docker_worker/worker-config-downstream.hcl index 45b6e8bcf..de3038fb5 100644 --- a/enos/modules/docker_worker/worker-config-downstream.hcl +++ b/enos/modules/docker_worker/worker-config-downstream.hcl @@ -4,20 +4,23 @@ disable_mlock = true listener "tcp" { - address = "0.0.0.0:${port}" + # setting to 127.0.0.1 so that it won't be accessible by the local machine + # outside of the container, which is a more realistic configuration for a downstream worker + address = "127.0.0.1:${port}" purpose = "proxy" tls_disable = true } listener "tcp" { - address = "0.0.0.0:${port_ops}" + # setting to 127.0.0.1 so that it won't be accessible by the local machine + # outside of the container, which is a more realistic configuration for a downstream worker + address = "127.0.0.1:${port_ops}" purpose = "ops" tls_disable = true } worker { name = "${worker_name}" - public_addr = "${worker_name}:${port}" initial_upstreams = ["${initial_upstream}"] tags { diff --git a/enos/modules/docker_worker/worker-config-worker-led.hcl b/enos/modules/docker_worker/worker-config-worker-led.hcl index b6230f33d..f21f712ae 100644 --- a/enos/modules/docker_worker/worker-config-worker-led.hcl +++ b/enos/modules/docker_worker/worker-config-worker-led.hcl @@ -16,7 +16,7 @@ listener "tcp" { } worker { - public_addr = "${worker_name}:${port}" + public_addr = "127.0.0.1:${port}" initial_upstreams = ["${initial_upstream}"] tags { diff --git a/enos/modules/docker_worker/worker-config.hcl b/enos/modules/docker_worker/worker-config.hcl index c83a83ee5..df14cdb09 100644 --- a/enos/modules/docker_worker/worker-config.hcl +++ b/enos/modules/docker_worker/worker-config.hcl @@ -17,7 +17,7 @@ listener "tcp" { worker { name = "${worker_name}" - public_addr = "${worker_name}:${port}" + public_addr = "127.0.0.1:${port}" initial_upstreams = ["${initial_upstream}"] tags { diff --git a/enos/modules/test_e2e_docker/main.tf b/enos/modules/test_e2e_docker/main.tf index d84503e65..cf21a926b 100644 --- a/enos/modules/test_e2e_docker/main.tf +++ b/enos/modules/test_e2e_docker/main.tf @@ -110,6 +110,11 @@ variable "vault_addr_private" { type = string default = "" } +variable "vault_addr_unified" { + description = "Unified address to a vault instance that can be used for both internal and external communication" + type = string + default = "" +} variable "vault_root_token" { description = "Root token for vault instance" type = string @@ -336,6 +341,7 @@ resource "enos_local_exec" "run_e2e_test" { VAULT_TOKEN = var.vault_root_token E2E_VAULT_ADDR_PUBLIC = var.vault_addr_public E2E_VAULT_ADDR_PRIVATE = var.vault_addr_private + E2E_VAULT_ADDR_UNIFIED = var.vault_addr_unified E2E_BUCKET_NAME = var.bucket_name E2E_BUCKET_ENDPOINT_URL = var.bucket_endpoint_url E2E_BUCKET_USER_ID = var.bucket_user_id @@ -375,6 +381,6 @@ resource "enos_local_exec" "run_e2e_test" { } inline = var.debug_no_run ? [""] : [ - "bash ./${path.module}/test_runner.sh" + "set -o pipefail; PATH=\"${var.local_boundary_dir}:$PATH\" go test -v ${var.test_package} -count=1 -timeout ${var.test_timeout} | tee ${path.module}/../../test-e2e-${local.package_name}.log" ] } diff --git a/enos/modules/test_e2e_docker/test.sh b/enos/modules/test_e2e_docker/test.sh deleted file mode 100755 index 90186b8cb..000000000 --- a/enos/modules/test_e2e_docker/test.sh +++ /dev/null @@ -1,132 +0,0 @@ -#!/usr/bin/env bash -# Copyright IBM Corp. 2020, 2025 -# SPDX-License-Identifier: BUSL-1.1 - -# This script is used for setting up and executing boundary e2e tests. It sets -# up `pass` as a password store (linux) so that boundary can use it to store -# auth tokens and installs the latest vault cli before executing the desired tests. - -set -eux -o pipefail - -# Install dependencies -apt update -# unzip is used to unzip boundary.zip -# pass is used to store the auth token from `boundary authenticate`` -# lsb-release is used for adding the hashicorp apt source -# postgresql-client is used for postgres tests -# default-mysql-client is used for mysql tests -# wget is used for downloading external dependencies and repository keys -# apt-transport-https enables HTTPS transport for APT repositories -# curl and ca-certificates are required for some repository setups (e.g., MongoDB). -apt install unzip pass lsb-release postgresql-client default-mysql-client wget apt-transport-https curl ca-certificates -y - -# Function to install Cassandra -install_cassandra() { - # Add Cassandra repository key - wget -O cassandra.keys https://www.apache.org/dist/cassandra/KEYS - - # Convert key to gpg format - gpg --no-default-keyring --keyring ./temp-keyring.gpg --import cassandra.keys - gpg --no-default-keyring --keyring ./temp-keyring.gpg --export --output cassandra.gpg - rm ./temp-keyring.gpg cassandra.keys - mv cassandra.gpg /etc/apt/keyrings/cassandra.gpg - - # Add Cassandra repository - echo "deb [signed-by=/etc/apt/keyrings/cassandra.gpg] https://debian.cassandra.apache.org 41x main" | tee -a /etc/apt/sources.list.d/cassandra.sources.list - - # Update package list and install Cassandra - apt update - apt install cassandra -y -} - -# Install Cassandra -install_cassandra - -# Install Redis -apt install redis-server -y - -# Create a GPG key -export KEY_PW=boundary -gpg --generate-key --batch <> ~/.gnupg/gpg-agent.conf -gpg-connect-agent reloadagent /bye &>/dev/null - -# Get information about the created keys -export lines=$(gpg --list-secret-keys --with-colons --with-keygrip) -export KEY_ID="" -while read -r line -do - # Save the first key id to be used later - if [[ $line =~ "fpr"* ]]; then - if [[ $KEY_ID == "" ]]; then - KEY_ID="$(echo "$line" | sed -r 's/fpr|://g')" - fi - fi - - # Cache the passphrases for the keys so passwords do not need to be entered - if [[ $line =~ "grp"* ]]; then - export KEYGRIP_ID="$(echo "$line" | sed -r 's/grp|://g')" - /usr/lib/gnupg/gpg-preset-passphrase --preset -P $KEY_PW $KEYGRIP_ID - fi -done <<< $lines - -# Trust the key -touch /tmp/test.txt -gpg -a --encrypt -r $KEY_ID --trust-model always --batch --yes /tmp/test.txt -echo "trusted-key $KEY_ID" >> ~/.gnupg/gpg.conf - -# Initialize the password store -pass init $KEY_ID &>/dev/null - -# Install the vault cli -wget -O- https://apt.releases.hashicorp.com/gpg | gpg --batch --yes --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg -export lines=$(gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg --fingerprint --with-colons) -while read -r line -do - if [[ $line =~ "fpr"* ]]; then - if [[ "$(echo $line | sed -r 's/fpr|://g')" != "798AEC654E5C15428C8E42EEAA16FCBCA621E701" ]]; then - echo "HashiCorp key fingerprint does not match expected" - exit 1 - else - break - fi - fi -done <<< $lines -echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/hashicorp.list -apt update -apt install vault -y - -# Install the docker cli -wget -O- https://download.docker.com/linux/debian/gpg | gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg -echo \ - "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \ - $(lsb_release -cs) stable" | \ - tee /etc/apt/sources.list.d/docker.list > /dev/null -apt update -apt install docker-ce-cli -y - -# Install MongoDB client (mongosh) -# Reference: https://www.mongodb.com/docs/mongodb-shell/install/#debian -wget -qO- https://www.mongodb.org/static/pgp/server-8.0.asc | tee /etc/apt/trusted.gpg.d/server-8.0.asc -echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/trusted.gpg.d/server-8.0.asc] https://repo.mongodb.org/apt/debian bookworm/mongodb-org/8.0 main" | tee /etc/apt/sources.list.d/mongodb-org-8.0.list -apt update -apt install -y mongodb-mongosh - -# Run Tests -unzip /boundary.zip -d /usr/local/bin/ -cd /src/boundary -go test -v -count=1 $TEST_PACKAGE -timeout $TEST_TIMEOUT | tee /testlogs/test-e2e-${TEST_PACKAGE##*/}.log diff --git a/enos/modules/test_e2e_docker/test_runner.sh b/enos/modules/test_e2e_docker/test_runner.sh deleted file mode 100644 index f3e7bf696..000000000 --- a/enos/modules/test_e2e_docker/test_runner.sh +++ /dev/null @@ -1,74 +0,0 @@ -#!/usr/bin/env bash -# Copyright IBM Corp. 2020, 2025 -# SPDX-License-Identifier: BUSL-1.1 - -# This script sets up a docker container to serve as a test runner for boundary -# e2e tests - -set -eux -o pipefail - -docker run \ - --rm \ - --name test-runner \ - -e "TEST_PACKAGE=$TEST_PACKAGE" \ - -e "TEST_TIMEOUT=$TEST_TIMEOUT" \ - -e "E2E_TESTS=$E2E_TESTS" \ - -e "BOUNDARY_ADDR=$BOUNDARY_ADDR" \ - -e "E2E_PASSWORD_AUTH_METHOD_ID=$E2E_PASSWORD_AUTH_METHOD_ID" \ - -e "E2E_PASSWORD_ADMIN_LOGIN_NAME=$E2E_PASSWORD_ADMIN_LOGIN_NAME" \ - -e "E2E_PASSWORD_ADMIN_PASSWORD=$E2E_PASSWORD_ADMIN_PASSWORD" \ - -e "E2E_TARGET_CONTAINER_NAME=$E2E_TARGET_CONTAINER_NAME" \ - -e "E2E_TARGET_ADDRESS=$E2E_TARGET_ADDRESS" \ - -e "E2E_TARGET_PORT=$E2E_TARGET_PORT" \ - -e "E2E_SSH_USER=$E2E_SSH_USER" \ - -e "E2E_SSH_CA_KEY=$E2E_SSH_CA_KEY" \ - -e "E2E_SSH_KEY_PATH=/keys/target.pem" \ - -e "E2E_REGION=$E2E_REGION" \ - -e "E2E_BUCKET_NAME=$E2E_BUCKET_NAME" \ - -e "E2E_BUCKET_USER_ID=$E2E_BUCKET_USER_ID" \ - -e "E2E_BUCKET_ENDPOINT_URL=$E2E_BUCKET_ENDPOINT_URL" \ - -e "E2E_BUCKET_ACCESS_KEY_ID=$E2E_BUCKET_ACCESS_KEY_ID" \ - -e "E2E_BUCKET_SECRET_ACCESS_KEY=$E2E_BUCKET_SECRET_ACCESS_KEY" \ - -e "E2E_MINIO_ALIAS=$E2E_MINIO_ALIAS" \ - -e "VAULT_ADDR=$VAULT_ADDR_INTERNAL" \ - -e "VAULT_TOKEN=$VAULT_TOKEN" \ - -e "E2E_VAULT_ADDR_PUBLIC=$E2E_VAULT_ADDR_PUBLIC" \ - -e "E2E_VAULT_ADDR_PRIVATE=$E2E_VAULT_ADDR_PRIVATE" \ - -e "E2E_POSTGRES_USER=$E2E_POSTGRES_USER" \ - -e "E2E_POSTGRES_PASSWORD=$E2E_POSTGRES_PASSWORD" \ - -e "E2E_POSTGRES_DB_NAME=$E2E_POSTGRES_DB_NAME" \ - -e "E2E_POSTGRES_ADDRESS=$E2E_POSTGRES_ADDRESS" \ - -e "E2E_POSTGRES_PORT=$E2E_POSTGRES_PORT" \ - -e "E2E_WORKER_TAG_INGRESS=$E2E_WORKER_TAG_INGRESS" \ - -e "E2E_WORKER_TAG_EGRESS=$E2E_WORKER_TAG_EGRESS" \ - -e "E2E_WORKER_TAG_COLLOCATED=$E2E_WORKER_TAG_COLLOCATED" \ - -e "E2E_LDAP_ADDR=$E2E_LDAP_ADDR" \ - -e "E2E_LDAP_DOMAIN_DN=$E2E_LDAP_DOMAIN_DN" \ - -e "E2E_LDAP_ADMIN_DN=$E2E_LDAP_ADMIN_DN" \ - -e "E2E_LDAP_ADMIN_PASSWORD=$E2E_LDAP_ADMIN_PASSWORD" \ - -e "E2E_LDAP_USER_NAME=$E2E_LDAP_USER_NAME" \ - -e "E2E_LDAP_USER_PASSWORD=$E2E_LDAP_USER_PASSWORD" \ - -e "E2E_LDAP_GROUP_NAME=$E2E_LDAP_GROUP_NAME" \ - -e "E2E_GCP_PRIVATE_KEY_ID=$E2E_GCP_PRIVATE_KEY_ID" \ - -e "E2E_GCP_PRIVATE_KEY=$E2E_GCP_PRIVATE_KEY" \ - -e "E2E_GCP_CLIENT_EMAIL=$E2E_GCP_CLIENT_EMAIL" \ - -e "E2E_GCP_PROJECT_ID=$E2E_GCP_PROJECT_ID" \ - -e "E2E_GCP_ZONE=$E2E_GCP_ZONE" \ - -e "E2E_GCP_TARGET_SSH_KEY=$E2E_GCP_TARGET_SSH_KEY" \ - -e "E2E_GCP_HOST_SET_FILTER1=$E2E_GCP_HOST_SET_FILTER1" \ - -e "E2E_GCP_HOST_SET_FILTER2=$E2E_GCP_HOST_SET_FILTER2" \ - -e "E2E_GCP_HOST_SET_IPS=$E2E_GCP_HOST_SET_IPS" \ - -e "E2E_MAX_PAGE_SIZE=$E2E_MAX_PAGE_SIZE" \ - -e "E2E_CONTROLLER_CONTAINER_NAME=$E2E_CONTROLLER_CONTAINER_NAME" \ - --mount type=bind,src=$BOUNDARY_DIR,dst=/src/boundary/ \ - --mount type=bind,src=$MODULE_DIR/../..,dst=/testlogs \ - --mount type=bind,src=$(go env GOCACHE),dst=/root/.cache/go-build \ - --mount type=bind,src=$(go env GOMODCACHE),dst=/go/pkg/mod \ - -v "$MODULE_DIR/test.sh:/scripts/test.sh" \ - -v "$E2E_SSH_KEY_PATH:/keys/target.pem" \ - -v "$BOUNDARY_CLI_DIR:/boundary.zip" \ - -v "/var/run/docker.sock:/var/run/docker.sock" \ - --network $TEST_NETWORK_NAME \ - --cap-add=CAP_IPC_LOCK \ - $TEST_RUNNER_IMAGE \ - /bin/sh -c /scripts/test.sh diff --git a/enos/modules/test_e2e_ui/main.tf b/enos/modules/test_e2e_ui/main.tf index 239fab1c2..7079de8be 100644 --- a/enos/modules/test_e2e_ui/main.tf +++ b/enos/modules/test_e2e_ui/main.tf @@ -84,6 +84,11 @@ variable "vault_addr_private" { type = string default = "" } +variable "vault_addr_unified" { + description = "Unified address to a vault instance that can be used for both internal and external communication" + type = string + default = "" +} variable "vault_root_token" { description = "Root token for vault instance" type = string @@ -221,6 +226,7 @@ resource "enos_local_exec" "run_e2e_test" { VAULT_TOKEN = var.vault_root_token E2E_VAULT_ADDR_PUBLIC = var.vault_addr_public E2E_VAULT_ADDR_PRIVATE = var.vault_addr_private + E2E_VAULT_ADDR_UNIFIED = var.vault_addr_unified E2E_AWS_ACCESS_KEY_ID = var.aws_access_key_id E2E_AWS_SECRET_ACCESS_KEY = var.aws_secret_access_key E2E_AWS_HOST_SET_FILTER = var.aws_host_set_filter diff --git a/testing/internal/e2e/tests/base_connect/target_tcp_connect_session_max_seconds_test.go b/testing/internal/e2e/tests/base_connect/target_tcp_connect_session_max_seconds_test.go index 0e7005546..133711557 100644 --- a/testing/internal/e2e/tests/base_connect/target_tcp_connect_session_max_seconds_test.go +++ b/testing/internal/e2e/tests/base_connect/target_tcp_connect_session_max_seconds_test.go @@ -82,7 +82,7 @@ func TestCliTcpTargetConnectTargetWithSessionMaxSecondsTearDown(t *testing.T) { // Ensure that the session did not run for longer than the time limit // (plus a small buffer) end := time.Since(start).Seconds() - require.Less(t, end, float64(sessionMaxSeconds+2)) + require.Less(t, end, float64(sessionMaxSeconds+3)) require.Greater(t, end, float64(sessionMaxSeconds-1)) case <-time.After(time.Second * time.Duration(sessionMaxSeconds+5)): t.Fatal("Timed out waiting for session command to exit") diff --git a/testing/internal/e2e/tests/base_with_vault/auth_method_oidc_vault_test.go b/testing/internal/e2e/tests/base_with_vault/auth_method_oidc_vault_test.go index d46520a2b..e97383579 100644 --- a/testing/internal/e2e/tests/base_with_vault/auth_method_oidc_vault_test.go +++ b/testing/internal/e2e/tests/base_with_vault/auth_method_oidc_vault_test.go @@ -249,7 +249,7 @@ func TestAuthMethodOidcVault(t *testing.T) { fmt.Sprintf("identity/oidc/provider/%s", providerName), fmt.Sprintf("allowed_client_ids=%s", clientId), "scopes_supported=groups,user", - fmt.Sprintf("issuer=%s", c.VaultAddr), + fmt.Sprintf("issuer=%s", c.VaultAddrUnified), ), ) require.NoError(t, output.Err, string(output.Stderr)) @@ -258,7 +258,7 @@ func TestAuthMethodOidcVault(t *testing.T) { output = e2e.RunCommand(ctx, "curl", e2e.WithArgs( "-s", - fmt.Sprintf("%s/v1/identity/oidc/provider/%s/.well-known/openid-configuration", c.VaultAddr, providerName), + fmt.Sprintf("%s/v1/identity/oidc/provider/%s/.well-known/openid-configuration", c.VaultAddrUnified, providerName), ), ) require.NoError(t, output.Err, string(output.Stderr)) @@ -381,7 +381,7 @@ func TestAuthMethodOidcVault(t *testing.T) { // Vault: Authenticate to get a client token res, err = http.Post( - fmt.Sprintf("%s/v1/auth/userpass/login/%s", c.VaultAddr, userName), + fmt.Sprintf("%s/v1/auth/userpass/login/%s", c.VaultAddrUnified, userName), "application/json", strings.NewReader( fmt.Sprintf(`{"password": %q}`, userPassword), @@ -407,7 +407,7 @@ func TestAuthMethodOidcVault(t *testing.T) { http.MethodGet, fmt.Sprintf( "%s/v1/identity/oidc/provider/%s/authorize?scope=%s&response_type=%s&client_id=%s&redirect_uri=%s&state=%s&nonce=%s&max_age=20", - c.VaultAddr, + c.VaultAddrUnified, providerName, "openid+groups+user", "code", diff --git a/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go b/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go index eeec71090..b7d62f24d 100644 --- a/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go +++ b/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go @@ -114,7 +114,7 @@ func TestApiVaultLdapCredentialLibrary(t *testing.T) { // Create two Vault LDAP credential libraries: One with static, one with // dynamic creds. - storeId, err := boundary.CreateCredentialStoreVaultApi(t, t.Context(), client, projectId, c.VaultAddr, vaultToken) + storeId, err := boundary.CreateCredentialStoreVaultApi(t, t.Context(), client, projectId, c.VaultAddrPrivate, vaultToken) require.NoError(t, err) staticCredVclId, err := boundary.CreateVaultLdapCredentialLibraryApi(t, t.Context(), client, storeId, fmt.Sprintf("%s/static-cred/%s", c.VaultLdapPath, c.LdapUserName)) require.NoError(t, err) @@ -288,7 +288,7 @@ func TestCliVaultLdapCredentialLibrary(t *testing.T) { // Create two Vault LDAP credential libraries: One with static, one with // dynamic creds. - storeId, err := boundary.CreateCredentialStoreVaultCli(t, t.Context(), projectId, c.VaultAddr, vaultToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, t.Context(), projectId, c.VaultAddrPrivate, vaultToken) require.NoError(t, err) staticCredVclId, err := boundary.CreateVaultLdapCredentialLibraryCli(t, t.Context(), storeId, fmt.Sprintf("%s/static-cred/%s", c.VaultLdapPath, c.LdapUserName)) require.NoError(t, err) diff --git a/testing/internal/e2e/tests/base_with_vault/credential_store_test.go b/testing/internal/e2e/tests/base_with_vault/credential_store_test.go index b95124ec7..a02480146 100644 --- a/testing/internal/e2e/tests/base_with_vault/credential_store_test.go +++ b/testing/internal/e2e/tests/base_with_vault/credential_store_test.go @@ -128,7 +128,7 @@ func TestCliVaultCredentialStore(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create a credential library for the private key @@ -331,7 +331,7 @@ func TestApiVaultCredentialStore(t *testing.T) { // Create a credential store csClient := credentialstores.NewClient(client) newCredentialStoreResult, err := csClient.Create(ctx, "vault", projectId, - credentialstores.WithVaultCredentialStoreAddress(c.VaultAddr), + credentialstores.WithVaultCredentialStoreAddress(c.VaultAddrPrivate), credentialstores.WithVaultCredentialStoreToken(credStoreToken), ) require.NoError(t, err) diff --git a/testing/internal/e2e/tests/base_with_vault/env_test.go b/testing/internal/e2e/tests/base_with_vault/env_test.go index 0c7c57e0e..45691cb2f 100644 --- a/testing/internal/e2e/tests/base_with_vault/env_test.go +++ b/testing/internal/e2e/tests/base_with_vault/env_test.go @@ -12,9 +12,14 @@ type config struct { TargetPort string `envconfig:"E2E_TARGET_PORT" required:"true"` // e.g. 22 // Note: Key is base64 encoded TargetCaKey string `envconfig:"E2E_SSH_CA_KEY" required:"true"` - // VaultAddr is the address that the Boundary server uses to interact with the running Vault instance - VaultAddr string `envconfig:"E2E_VAULT_ADDR_PUBLIC" required:"true"` // e.g. "http://127.0.0.1:8200" + // VaultAddr is the address that the Vault CLI can use to interact with the Vault instance + VaultAddr string `envconfig:"E2E_VAULT_ADDR_PUBLIC" required:"true"` // e.g. "http://127.0.0.1:8200" + // VaultAddrPrivate is the address that the Boundary controller can reach Vault VaultAddrPrivate string `envconfig:"E2E_VAULT_ADDR_PRIVATE" required:"true"` // e.g. "http://10.10.10.10:8200" + // VaultAddrUnified is an address that can be used by both the local machine + // and the Boundary controller to interact with Vault. This is used for + // testing OIDC authentication where the Boundary controller needs to communicate with Vault using the same address as the CLI. + VaultAddrUnified string `envconfig:"E2E_VAULT_ADDR_UNIFIED" required:"true"` // e.g. "http://vault:8200" VaultSecretPath string `envconfig:"E2E_VAULT_SECRET_PATH" default:"e2e_secrets"` VaultLdapPath string `envconfig:"E2E_VAULT_LDAP_PATH" default:"e2e_ldap"` MaxPageSize int `envconfig:"E2E_MAX_PAGE_SIZE" default:"1000"` diff --git a/testing/internal/e2e/tests/base_with_vault/paginate_credential_library_test.go b/testing/internal/e2e/tests/base_with_vault/paginate_credential_library_test.go index 859cae852..a9ad3d808 100644 --- a/testing/internal/e2e/tests/base_with_vault/paginate_credential_library_test.go +++ b/testing/internal/e2e/tests/base_with_vault/paginate_credential_library_test.go @@ -93,7 +93,7 @@ func TestCliPaginateCredentialLibraries(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create enough credential libraries to overflow a single page. @@ -248,7 +248,7 @@ func TestApiPaginateCredentialLibraries(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultApi(t, ctx, client, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultApi(t, ctx, client, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create enough credential libraries to overflow a single page. diff --git a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_authz_token_test.go b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_authz_token_test.go index 20fad237c..951a672c8 100644 --- a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_authz_token_test.go +++ b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_authz_token_test.go @@ -106,7 +106,7 @@ func TestCliTcpTargetVaultGenericConnectTargetWithAuthzToken(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create a credential library diff --git a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_ssh_test.go b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_ssh_test.go index 52eb3598d..416addce7 100644 --- a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_ssh_test.go +++ b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_ssh_test.go @@ -106,7 +106,7 @@ func TestCliTcpTargetVaultGenericConnectTargetWithSsh(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create a credential library diff --git a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_test.go b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_test.go index f97d65c52..f829a1d21 100644 --- a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_test.go +++ b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_generic_connect_test.go @@ -107,7 +107,7 @@ func TestCliTcpTargetVaultGenericConnectTarget(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create a credential library diff --git a/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go b/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go index 4276087f5..9be2fd347 100644 --- a/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go +++ b/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go @@ -102,7 +102,7 @@ func TestCliTcpTargetWorkerConnectTarget(t *testing.T) { t.Log("Created Vault Cred Store Token") // Create a credential store - storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddr, credStoreToken) + storeId, err := boundary.CreateCredentialStoreVaultCli(t, ctx, projectId, c.VaultAddrPrivate, credStoreToken) require.NoError(t, err) // Create a credential library