feat(cli): Add vault ssh certificate credential library

internal/cmd/commands.go

@@ -364,6 +364,18 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 				Func:    "create",
 			}, nil
 		},
+		"credential-libraries create vault-generic": func() (cli.Command, error) {
+			return &credentiallibrariescmd.VaultGenericCommand{
+				Command: base.NewCommand(ui),
+				Func:    "create",
+			}, nil
+		},
+		"credential-libraries create vault-ssh-certificate": func() (cli.Command, error) {
+			return &credentiallibrariescmd.VaultSshCertificateCommand{
+				Command: base.NewCommand(ui),
+				Func:    "create",
+			}, nil
+		},
 		"credential-libraries update": func() (cli.Command, error) {
 			return &credentiallibrariescmd.Command{
 				Command: base.NewCommand(ui),
@@ -371,7 +383,19 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) {
 			}, nil
 		},
 		"credential-libraries update vault": func() (cli.Command, error) {
-			return &credentiallibrariescmd.VaultCommand{
+			return &credentiallibrariescmd.VaultGenericCommand{
+				Command: base.NewCommand(ui),
+				Func:    "update",
+			}, nil
+		},
+		"credential-libraries update vault-generic": func() (cli.Command, error) {
+			return &credentiallibrariescmd.VaultGenericCommand{
+				Command: base.NewCommand(ui),
+				Func:    "update",
+			}, nil
+		},
+		"credential-libraries update vault-ssh-certificate": func() (cli.Command, error) {
+			return &credentiallibrariescmd.VaultSshCertificateCommand{
 				Command: base.NewCommand(ui),
 				Func:    "update",
 			}, nil

internal/cmd/commands/credentiallibrariescmd/funcs.go

@@ -140,6 +140,16 @@ func printItemTable(item *credentiallibraries.CredentialLibrary, resp *api.Respo
 		nonAttributeMap["Type"] = item.Type
 	}
 
+	var keySubstMap map[string]string
+	switch item.Type {
+	case "vault":
+		fallthrough
+	case "vault-generic":
+		keySubstMap = genericKeySubstMap
+	case "vault-ssh-certificate":
+		keySubstMap = sshCertKeySubstMap
+	}
+
 	maxLength := base.MaxAttributesLength(nonAttributeMap, item.Attributes, keySubstMap)
 
 	ret := []string{
@@ -189,8 +199,19 @@ func printItemTable(item *credentiallibraries.CredentialLibrary, resp *api.Respo
 	return base.WrapForHelpText(ret)
 }
 
-var keySubstMap = map[string]string{
+var genericKeySubstMap = map[string]string{
 	"path":              "Path",
 	"http_method":       "HTTP Method",
 	"http_request_body": "HTTP Request Body",
 }
+
+var sshCertKeySubstMap = map[string]string{
+	"path":             "Path",
+	"username":         "Username",
+	"key_type":         "Key Type",
+	"key_bits":         "Key Bits",
+	"ttl":              "TTL",
+	"key_id":           "Key ID",
+	"critical_options": "Critical Options",
+	"extensions":       "Extensions",
+}

internal/cmd/commands/credentiallibrariescmd/vault-generic_credentiallibraries.gen.go

@@ -0,0 +1,275 @@
+// Code generated by "make cli"; DO NOT EDIT.
+package credentiallibrariescmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/common"
+	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/mitchellh/cli"
+	"github.com/posener/complete"
+)
+
+func initVaultGenericFlags() {
+	flagsOnce.Do(func() {
+		extraFlags := extraVaultGenericActionsFlagsMapFunc()
+		for k, v := range extraFlags {
+			flagsVaultGenericMap[k] = append(flagsVaultGenericMap[k], v...)
+		}
+	})
+}
+
+var (
+	_ cli.Command             = (*VaultGenericCommand)(nil)
+	_ cli.CommandAutocomplete = (*VaultGenericCommand)(nil)
+)
+
+type VaultGenericCommand struct {
+	*base.Command
+
+	Func string
+
+	plural string
+
+	extraVaultGenericCmdVars
+}
+
+func (c *VaultGenericCommand) AutocompleteArgs() complete.Predictor {
+	initVaultGenericFlags()
+	return complete.PredictAnything
+}
+
+func (c *VaultGenericCommand) AutocompleteFlags() complete.Flags {
+	initVaultGenericFlags()
+	return c.Flags().Completions()
+}
+
+func (c *VaultGenericCommand) Synopsis() string {
+	if extra := extraVaultGenericSynopsisFunc(c); extra != "" {
+		return extra
+	}
+
+	synopsisStr := "credential library"
+
+	synopsisStr = fmt.Sprintf("%s %s", "vault-generic-type", synopsisStr)
+
+	return common.SynopsisFunc(c.Func, synopsisStr)
+}
+
+func (c *VaultGenericCommand) Help() string {
+	initVaultGenericFlags()
+
+	var helpStr string
+	helpMap := common.HelpMap("credential library")
+
+	switch c.Func {
+
+	default:
+
+		helpStr = c.extraVaultGenericHelpFunc(helpMap)
+
+	}
+
+	// Keep linter from complaining if we don't actually generate code using it
+	_ = helpMap
+	return helpStr
+}
+
+var flagsVaultGenericMap = map[string][]string{
+
+	"create": {"credential-store-id", "name", "description"},
+
+	"update": {"id", "name", "description", "version"},
+}
+
+func (c *VaultGenericCommand) Flags() *base.FlagSets {
+	if len(flagsVaultGenericMap[c.Func]) == 0 {
+		return c.FlagSet(base.FlagSetNone)
+	}
+
+	set := c.FlagSet(base.FlagSetHTTP | base.FlagSetClient | base.FlagSetOutputFormat)
+	f := set.NewFlagSet("Command Options")
+	common.PopulateCommonFlags(c.Command, f, "vault-generic-type credential library", flagsVaultGenericMap, c.Func)
+
+	extraVaultGenericFlagsFunc(c, set, f)
+
+	return set
+}
+
+func (c *VaultGenericCommand) Run(args []string) int {
+	initVaultGenericFlags()
+
+	switch c.Func {
+	case "":
+		return cli.RunResultHelp
+
+	}
+
+	c.plural = "vault-generic-type credential library"
+	switch c.Func {
+	case "list":
+		c.plural = "vault-generic-type credential librarys"
+	}
+
+	f := c.Flags()
+
+	if err := f.Parse(args); err != nil {
+		c.PrintCliError(err)
+		return base.CommandUserError
+	}
+
+	if strutil.StrListContains(flagsVaultGenericMap[c.Func], "id") && c.FlagId == "" {
+		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
+		return base.CommandUserError
+	}
+
+	var opts []credentiallibraries.Option
+
+	if strutil.StrListContains(flagsVaultGenericMap[c.Func], "credential-store-id") {
+		switch c.Func {
+
+		case "create":
+			if c.FlagCredentialStoreId == "" {
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				return base.CommandUserError
+			}
+
+		}
+	}
+
+	client, err := c.Client()
+	if c.WrapperCleanupFunc != nil {
+		defer func() {
+			if err := c.WrapperCleanupFunc(); err != nil {
+				c.PrintCliError(fmt.Errorf("Error cleaning kms wrapper: %w", err))
+			}
+		}()
+	}
+	if err != nil {
+		c.PrintCliError(fmt.Errorf("Error creating API client: %w", err))
+		return base.CommandCliError
+	}
+	credentiallibrariesClient := credentiallibraries.NewClient(client)
+
+	switch c.FlagName {
+	case "":
+	case "null":
+		opts = append(opts, credentiallibraries.DefaultName())
+	default:
+		opts = append(opts, credentiallibraries.WithName(c.FlagName))
+	}
+
+	switch c.FlagDescription {
+	case "":
+	case "null":
+		opts = append(opts, credentiallibraries.DefaultDescription())
+	default:
+		opts = append(opts, credentiallibraries.WithDescription(c.FlagDescription))
+	}
+
+	if c.FlagFilter != "" {
+		opts = append(opts, credentiallibraries.WithFilter(c.FlagFilter))
+	}
+
+	var version uint32
+
+	switch c.Func {
+
+	case "update":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	}
+
+	if ok := extraVaultGenericFlagsHandlingFunc(c, f, &opts); !ok {
+		return base.CommandUserError
+	}
+
+	var resp *api.Response
+	var item *credentiallibraries.CredentialLibrary
+
+	var createResult *credentiallibraries.CredentialLibraryCreateResult
+
+	var updateResult *credentiallibraries.CredentialLibraryUpdateResult
+
+	switch c.Func {
+
+	case "create":
+		createResult, err = credentiallibrariesClient.Create(c.Context, "vault-generic", c.FlagCredentialStoreId, opts...)
+		if exitCode := c.checkFuncError(err); exitCode > 0 {
+			return exitCode
+		}
+		resp = createResult.GetResponse()
+		item = createResult.GetItem()
+
+	case "update":
+		updateResult, err = credentiallibrariesClient.Update(c.Context, c.FlagId, version, opts...)
+		if exitCode := c.checkFuncError(err); exitCode > 0 {
+			return exitCode
+		}
+		resp = updateResult.GetResponse()
+		item = updateResult.GetItem()
+
+	}
+
+	resp, item, err = executeExtraVaultGenericActions(c, resp, item, err, credentiallibrariesClient, version, opts)
+	if exitCode := c.checkFuncError(err); exitCode > 0 {
+		return exitCode
+	}
+
+	output, err := printCustomVaultGenericActionOutput(c)
+	if err != nil {
+		c.PrintCliError(err)
+		return base.CommandUserError
+	}
+	if output {
+		return base.CommandSuccess
+	}
+
+	switch c.Func {
+
+	}
+
+	switch base.Format(c.UI) {
+	case "table":
+		c.UI.Output(printItemTable(item, resp))
+
+	case "json":
+		if ok := c.PrintJsonItem(resp); !ok {
+			return base.CommandCliError
+		}
+	}
+
+	return base.CommandSuccess
+}
+
+func (c *VaultGenericCommand) checkFuncError(err error) int {
+	if err == nil {
+		return 0
+	}
+	if apiErr := api.AsServerError(err); apiErr != nil {
+		c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
+		return base.CommandApiError
+	}
+	c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
+	return base.CommandCliError
+}
+
+var (
+	extraVaultGenericActionsFlagsMapFunc = func() map[string][]string { return nil }
+	extraVaultGenericSynopsisFunc        = func(*VaultGenericCommand) string { return "" }
+	extraVaultGenericFlagsFunc           = func(*VaultGenericCommand, *base.FlagSets, *base.FlagSet) {}
+	extraVaultGenericFlagsHandlingFunc   = func(*VaultGenericCommand, *base.FlagSets, *[]credentiallibraries.Option) bool { return true }
+	executeExtraVaultGenericActions      = func(_ *VaultGenericCommand, inResp *api.Response, inItem *credentiallibraries.CredentialLibrary, inErr error, _ *credentiallibraries.Client, _ uint32, _ []credentiallibraries.Option) (*api.Response, *credentiallibraries.CredentialLibrary, error) {
+		return inResp, inItem, inErr
+	}
+	printCustomVaultGenericActionOutput = func(*VaultGenericCommand) (bool, error) { return false, nil }
+)

internal/cmd/commands/credentiallibrariescmd/vault-generic_funcs.go

@@ -0,0 +1,174 @@
+package credentiallibrariescmd
+
+import (
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
+)
+
+func init() {
+	extraVaultGenericFlagsFunc = extraVaultGenericFlagsFuncImpl
+	extraVaultGenericActionsFlagsMapFunc = extraVaultGenericActionsFlagsMapFuncImpl
+	extraVaultGenericFlagsHandlingFunc = extraVaultGenericFlagHandlingFuncImpl
+}
+
+const (
+	pathFlagName              = "vault-path"
+	httpMethodFlagName        = "vault-http-method"
+	httpRequestBodyFlagName   = "vault-http-request-body"
+	credentialTypeFlagName    = "credential-type"
+	credentialMappingFlagName = "credential-mapping-override"
+)
+
+type extraVaultGenericCmdVars struct {
+	flagPath              string
+	flagHttpMethod        string
+	flagHttpRequestBody   string
+	flagCredentialType    string
+	flagCredentialMapping []base.CombinedSliceFlagValue
+}
+
+func extraVaultGenericActionsFlagsMapFuncImpl() map[string][]string {
+	flags := map[string][]string{
+		"create": {
+			pathFlagName,
+			httpMethodFlagName,
+			httpRequestBodyFlagName,
+			credentialTypeFlagName,
+			credentialMappingFlagName,
+		},
+		"update": {
+			pathFlagName,
+			httpMethodFlagName,
+			httpRequestBodyFlagName,
+			credentialMappingFlagName,
+		},
+	}
+	return flags
+}
+
+func extraVaultGenericFlagsFuncImpl(c *VaultGenericCommand, set *base.FlagSets, _ *base.FlagSet) {
+	f := set.NewFlagSet("Vault Credential Library Options")
+
+	for _, name := range flagsVaultGenericMap[c.Func] {
+		switch name {
+		case pathFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   pathFlagName,
+				Target: &c.flagPath,
+				Usage:  "The path in vault to request credentials from.",
+			})
+		case httpMethodFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   httpMethodFlagName,
+				Target: &c.flagHttpMethod,
+				Usage:  "The http method the library should use when communicating with vault.",
+			})
+		case httpRequestBodyFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   httpRequestBodyFlagName,
+				Target: &c.flagHttpRequestBody,
+				Usage:  "The http request body the library uses to communicate with vault. This can be the value itself, refer to a file on disk (file://) from which the value will be read, or an env var (env://) from which the value will be read.",
+			})
+		case credentialTypeFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   credentialTypeFlagName,
+				Target: &c.flagCredentialType,
+				Usage:  "The type of credential this library will issue, defaults to Unspecified.",
+			})
+		case credentialMappingFlagName:
+			f.CombinationSliceVar(&base.CombinationSliceVar{
+				Name:    credentialMappingFlagName,
+				Target:  &c.flagCredentialMapping,
+				KvSplit: true,
+				Usage:   "The credential mapping override.",
+			})
+		}
+	}
+}
+
+func extraVaultGenericFlagHandlingFuncImpl(c *VaultGenericCommand, _ *base.FlagSets, opts *[]credentiallibraries.Option) bool {
+	switch c.flagPath {
+	case "":
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryPath(c.flagPath))
+	}
+	switch c.flagHttpMethod {
+	case "":
+	case "null":
+		*opts = append(*opts, credentiallibraries.DefaultVaultCredentialLibraryHttpMethod())
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryHttpMethod(c.flagHttpMethod))
+	}
+	switch c.flagHttpRequestBody {
+	case "":
+	case "null":
+		*opts = append(*opts, credentiallibraries.DefaultVaultCredentialLibraryHttpRequestBody())
+	default:
+		rb, _ := parseutil.ParsePath(c.flagHttpRequestBody)
+		*opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryHttpRequestBody(rb))
+	}
+	switch c.flagCredentialType {
+	case "":
+	case "null":
+		*opts = append(*opts, credentiallibraries.DefaultCredentialType())
+	default:
+		*opts = append(*opts, credentiallibraries.WithCredentialType(c.flagCredentialType))
+	}
+	switch len(c.flagCredentialMapping) {
+	case 0:
+	case 1:
+		if len(c.flagCredentialMapping[0].Keys) == 1 && c.flagCredentialMapping[0].Keys[0] == "null" && c.flagCredentialMapping[0].Value == nil {
+			*opts = append(*opts, credentiallibraries.DefaultCredentialMappingOverrides())
+			break
+		}
+		fallthrough
+	default:
+		mappings := make(map[string]any, len(c.flagCredentialMapping))
+		for _, mapping := range c.flagCredentialMapping {
+			switch {
+			case len(mapping.Keys) != 1 || mapping.Keys[0] == "" || mapping.Value == nil || mapping.Value.GetValue() == "":
+				// mapping override does not support key segments (e.g. 'x.y=z')
+				c.UI.Error("Credential mapping override must be in the format 'key=value', 'key=null' to clear field or 'null' to clear all.")
+				return false
+			case mapping.Value.GetValue() == "null":
+				// user provided 'key=null' indicating the field specific override should
+				// be cleared, set map value to nil
+				mappings[mapping.Keys[0]] = nil
+			default:
+				mappings[mapping.Keys[0]] = mapping.Value.GetValue()
+			}
+		}
+		*opts = append(*opts, credentiallibraries.WithCredentialMappingOverrides(mappings))
+	}
+
+	return true
+}
+
+func (c *VaultGenericCommand) extraVaultGenericHelpFunc(_ map[string]func() string) string {
+	var helpStr string
+	switch c.Func {
+	case "create":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary credential-libraries create vault -credential-store-id [options] [args]",
+			"",
+			"  Create a vault-generic-type credential library. Example:",
+			"",
+			`    $ boundary credential-libraries create vault-generic -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
+			"",
+			"",
+		})
+
+	case "update":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary credential-libraries update vault [options] [args]",
+			"",
+			"  Update a vault-generic-type credential library given its ID. Example:",
+			"",
+			`    $ boundary credential-libraries update vault-generic -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			"",
+			"",
+		})
+	}
+	return helpStr + c.Flags().Help()
+}

internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_credentiallibraries.gen.go

@@ -0,0 +1,275 @@
+// Code generated by "make cli"; DO NOT EDIT.
+package credentiallibrariescmd
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/boundary/api"
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/common"
+	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/mitchellh/cli"
+	"github.com/posener/complete"
+)
+
+func initVaultSshCertificateFlags() {
+	flagsOnce.Do(func() {
+		extraFlags := extraVaultSshCertificateActionsFlagsMapFunc()
+		for k, v := range extraFlags {
+			flagsVaultSshCertificateMap[k] = append(flagsVaultSshCertificateMap[k], v...)
+		}
+	})
+}
+
+var (
+	_ cli.Command             = (*VaultSshCertificateCommand)(nil)
+	_ cli.CommandAutocomplete = (*VaultSshCertificateCommand)(nil)
+)
+
+type VaultSshCertificateCommand struct {
+	*base.Command
+
+	Func string
+
+	plural string
+
+	extraVaultSshCertificateCmdVars
+}
+
+func (c *VaultSshCertificateCommand) AutocompleteArgs() complete.Predictor {
+	initVaultSshCertificateFlags()
+	return complete.PredictAnything
+}
+
+func (c *VaultSshCertificateCommand) AutocompleteFlags() complete.Flags {
+	initVaultSshCertificateFlags()
+	return c.Flags().Completions()
+}
+
+func (c *VaultSshCertificateCommand) Synopsis() string {
+	if extra := extraVaultSshCertificateSynopsisFunc(c); extra != "" {
+		return extra
+	}
+
+	synopsisStr := "credential library"
+
+	synopsisStr = fmt.Sprintf("%s %s", "vault-ssh-certificate-type", synopsisStr)
+
+	return common.SynopsisFunc(c.Func, synopsisStr)
+}
+
+func (c *VaultSshCertificateCommand) Help() string {
+	initVaultSshCertificateFlags()
+
+	var helpStr string
+	helpMap := common.HelpMap("credential library")
+
+	switch c.Func {
+
+	default:
+
+		helpStr = c.extraVaultSshCertificateHelpFunc(helpMap)
+
+	}
+
+	// Keep linter from complaining if we don't actually generate code using it
+	_ = helpMap
+	return helpStr
+}
+
+var flagsVaultSshCertificateMap = map[string][]string{
+
+	"create": {"credential-store-id", "name", "description"},
+
+	"update": {"id", "name", "description", "version"},
+}
+
+func (c *VaultSshCertificateCommand) Flags() *base.FlagSets {
+	if len(flagsVaultSshCertificateMap[c.Func]) == 0 {
+		return c.FlagSet(base.FlagSetNone)
+	}
+
+	set := c.FlagSet(base.FlagSetHTTP | base.FlagSetClient | base.FlagSetOutputFormat)
+	f := set.NewFlagSet("Command Options")
+	common.PopulateCommonFlags(c.Command, f, "vault-ssh-certificate-type credential library", flagsVaultSshCertificateMap, c.Func)
+
+	extraVaultSshCertificateFlagsFunc(c, set, f)
+
+	return set
+}
+
+func (c *VaultSshCertificateCommand) Run(args []string) int {
+	initVaultSshCertificateFlags()
+
+	switch c.Func {
+	case "":
+		return cli.RunResultHelp
+
+	}
+
+	c.plural = "vault-ssh-certificate-type credential library"
+	switch c.Func {
+	case "list":
+		c.plural = "vault-ssh-certificate-type credential librarys"
+	}
+
+	f := c.Flags()
+
+	if err := f.Parse(args); err != nil {
+		c.PrintCliError(err)
+		return base.CommandUserError
+	}
+
+	if strutil.StrListContains(flagsVaultSshCertificateMap[c.Func], "id") && c.FlagId == "" {
+		c.PrintCliError(errors.New("ID is required but not passed in via -id"))
+		return base.CommandUserError
+	}
+
+	var opts []credentiallibraries.Option
+
+	if strutil.StrListContains(flagsVaultSshCertificateMap[c.Func], "credential-store-id") {
+		switch c.Func {
+
+		case "create":
+			if c.FlagCredentialStoreId == "" {
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				return base.CommandUserError
+			}
+
+		}
+	}
+
+	client, err := c.Client()
+	if c.WrapperCleanupFunc != nil {
+		defer func() {
+			if err := c.WrapperCleanupFunc(); err != nil {
+				c.PrintCliError(fmt.Errorf("Error cleaning kms wrapper: %w", err))
+			}
+		}()
+	}
+	if err != nil {
+		c.PrintCliError(fmt.Errorf("Error creating API client: %w", err))
+		return base.CommandCliError
+	}
+	credentiallibrariesClient := credentiallibraries.NewClient(client)
+
+	switch c.FlagName {
+	case "":
+	case "null":
+		opts = append(opts, credentiallibraries.DefaultName())
+	default:
+		opts = append(opts, credentiallibraries.WithName(c.FlagName))
+	}
+
+	switch c.FlagDescription {
+	case "":
+	case "null":
+		opts = append(opts, credentiallibraries.DefaultDescription())
+	default:
+		opts = append(opts, credentiallibraries.WithDescription(c.FlagDescription))
+	}
+
+	if c.FlagFilter != "" {
+		opts = append(opts, credentiallibraries.WithFilter(c.FlagFilter))
+	}
+
+	var version uint32
+
+	switch c.Func {
+
+	case "update":
+		switch c.FlagVersion {
+		case 0:
+			opts = append(opts, credentiallibraries.WithAutomaticVersioning(true))
+		default:
+			version = uint32(c.FlagVersion)
+		}
+
+	}
+
+	if ok := extraVaultSshCertificateFlagsHandlingFunc(c, f, &opts); !ok {
+		return base.CommandUserError
+	}
+
+	var resp *api.Response
+	var item *credentiallibraries.CredentialLibrary
+
+	var createResult *credentiallibraries.CredentialLibraryCreateResult
+
+	var updateResult *credentiallibraries.CredentialLibraryUpdateResult
+
+	switch c.Func {
+
+	case "create":
+		createResult, err = credentiallibrariesClient.Create(c.Context, "vault-ssh-certificate", c.FlagCredentialStoreId, opts...)
+		if exitCode := c.checkFuncError(err); exitCode > 0 {
+			return exitCode
+		}
+		resp = createResult.GetResponse()
+		item = createResult.GetItem()
+
+	case "update":
+		updateResult, err = credentiallibrariesClient.Update(c.Context, c.FlagId, version, opts...)
+		if exitCode := c.checkFuncError(err); exitCode > 0 {
+			return exitCode
+		}
+		resp = updateResult.GetResponse()
+		item = updateResult.GetItem()
+
+	}
+
+	resp, item, err = executeExtraVaultSshCertificateActions(c, resp, item, err, credentiallibrariesClient, version, opts)
+	if exitCode := c.checkFuncError(err); exitCode > 0 {
+		return exitCode
+	}
+
+	output, err := printCustomVaultSshCertificateActionOutput(c)
+	if err != nil {
+		c.PrintCliError(err)
+		return base.CommandUserError
+	}
+	if output {
+		return base.CommandSuccess
+	}
+
+	switch c.Func {
+
+	}
+
+	switch base.Format(c.UI) {
+	case "table":
+		c.UI.Output(printItemTable(item, resp))
+
+	case "json":
+		if ok := c.PrintJsonItem(resp); !ok {
+			return base.CommandCliError
+		}
+	}
+
+	return base.CommandSuccess
+}
+
+func (c *VaultSshCertificateCommand) checkFuncError(err error) int {
+	if err == nil {
+		return 0
+	}
+	if apiErr := api.AsServerError(err); apiErr != nil {
+		c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural))
+		return base.CommandApiError
+	}
+	c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error()))
+	return base.CommandCliError
+}
+
+var (
+	extraVaultSshCertificateActionsFlagsMapFunc = func() map[string][]string { return nil }
+	extraVaultSshCertificateSynopsisFunc        = func(*VaultSshCertificateCommand) string { return "" }
+	extraVaultSshCertificateFlagsFunc           = func(*VaultSshCertificateCommand, *base.FlagSets, *base.FlagSet) {}
+	extraVaultSshCertificateFlagsHandlingFunc   = func(*VaultSshCertificateCommand, *base.FlagSets, *[]credentiallibraries.Option) bool { return true }
+	executeExtraVaultSshCertificateActions      = func(_ *VaultSshCertificateCommand, inResp *api.Response, inItem *credentiallibraries.CredentialLibrary, inErr error, _ *credentiallibraries.Client, _ uint32, _ []credentiallibraries.Option) (*api.Response, *credentiallibraries.CredentialLibrary, error) {
+		return inResp, inItem, inErr
+	}
+	printCustomVaultSshCertificateActionOutput = func(*VaultSshCertificateCommand) (bool, error) { return false, nil }
+)

internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_funcs.go

@@ -0,0 +1,264 @@
+package credentiallibrariescmd
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/hashicorp/boundary/api/credentiallibraries"
+	"github.com/hashicorp/boundary/internal/cmd/base"
+	"github.com/hashicorp/boundary/internal/cmd/common"
+)
+
+func init() {
+	extraVaultSshCertificateFlagsFunc = extraVaultSshCertificateFlagsFuncImpl
+	extraVaultSshCertificateActionsFlagsMapFunc = extraVaultSshCertificateActionsFlagsMapFuncImpl
+	extraVaultSshCertificateFlagsHandlingFunc = extraVaultSshCertificateFlagHandlingFuncImpl
+}
+
+const (
+	usernameName                 = "username"
+	keyTypeName                  = "key-type"
+	keyBitsName                  = "key-bits"
+	ttlName                      = "ttl"
+	keyIdName                    = "key-id"
+	criticalOptionsName          = "critical-options"
+	piecewiseCriticalOptionsName = "critical-option"
+	extensionsName               = "extensions"
+	piecewiseExtensionName       = "extension"
+)
+
+type extraVaultSshCertificateCmdVars struct {
+	flagPath            string
+	flagUsername        string
+	flagKeyType         string
+	flagKeyBits         string
+	flagTtl             string
+	flagKeyId           string
+	flagCriticalOptions string
+	flagCriticalOpts    []base.CombinedSliceFlagValue
+	flagExtensions      string
+	flagExtens          []base.CombinedSliceFlagValue
+}
+
+func extraVaultSshCertificateActionsFlagsMapFuncImpl() map[string][]string {
+	flags := map[string][]string{
+		"create": {
+			pathFlagName,
+			usernameName,
+			keyTypeName,
+			keyBitsName,
+			ttlName,
+			keyIdName,
+			criticalOptionsName,
+			piecewiseCriticalOptionsName,
+			extensionsName,
+			piecewiseExtensionName,
+		},
+		"update": {
+			pathFlagName,
+			usernameName,
+			keyTypeName,
+			keyBitsName,
+			ttlName,
+			keyIdName,
+			criticalOptionsName,
+			piecewiseCriticalOptionsName,
+			extensionsName,
+			piecewiseExtensionName,
+		},
+	}
+	return flags
+}
+
+func extraVaultSshCertificateFlagsFuncImpl(c *VaultSshCertificateCommand, set *base.FlagSets, _ *base.FlagSet) {
+	f := set.NewFlagSet("Vault SSH Certificate Credential Library Options")
+
+	for _, name := range flagsVaultSshCertificateMap[c.Func] {
+		switch name {
+		case pathFlagName:
+			f.StringVar(&base.StringVar{
+				Name:   pathFlagName,
+				Target: &c.flagPath,
+				Usage:  "The path in vault to request credentials from.",
+			})
+		case usernameName:
+			f.StringVar(&base.StringVar{
+				Name:   usernameName,
+				Target: &c.flagUsername,
+				Usage:  "The username to use with the ssh certificate.",
+			})
+		case keyTypeName:
+			f.StringVar(&base.StringVar{
+				Name:   keyTypeName,
+				Target: &c.flagKeyType,
+				Usage:  "The key type for the generated ssh private key. One of: ed25519, ecdsa, rsa.",
+			})
+		case keyBitsName:
+			f.StringVar(&base.StringVar{
+				Name:   keyBitsName,
+				Target: &c.flagKeyBits,
+				Usage:  "The number of bits when generating the ssh private key. Depends on key_type. If ed25519 this should not be set, or set to 0, if ecdsa one of 256, 384, 521, if rsa one of 2048, 3072, 4096.",
+			})
+		case ttlName:
+			f.StringVar(&base.StringVar{
+				Name:   ttlName,
+				Target: &c.flagTtl,
+				Usage:  "The time-to-live for the generated certificate.",
+			})
+		case keyIdName:
+			f.StringVar(&base.StringVar{
+				Name:   keyIdName,
+				Target: &c.flagKeyId,
+				Usage:  "The key id that the created certificate should have.",
+			})
+		}
+	}
+	criticalOptsInput := common.CombinedSliceFlagValuePopulationInput{
+		FlagSet:                          f,
+		FlagNames:                        flagsVaultSshCertificateMap[c.Func],
+		FullPopulationFlag:               &c.flagCriticalOptions,
+		FullPopulationInputName:          criticalOptionsName,
+		PiecewisePopulationFlag:          &c.flagCriticalOpts,
+		PiecewisePopulationInputBaseName: piecewiseCriticalOptionsName,
+		PiecewiseNoProtoCompat:           true,
+	}
+	common.PopulateCombinedSliceFlagValue(criticalOptsInput)
+
+	extensionsInput := common.CombinedSliceFlagValuePopulationInput{
+		FlagSet:                          f,
+		FlagNames:                        flagsVaultSshCertificateMap[c.Func],
+		FullPopulationFlag:               &c.flagExtensions,
+		FullPopulationInputName:          extensionsName,
+		PiecewisePopulationFlag:          &c.flagExtens,
+		PiecewisePopulationInputBaseName: piecewiseExtensionName,
+		PiecewiseNoProtoCompat:           true,
+	}
+	common.PopulateCombinedSliceFlagValue(extensionsInput)
+}
+
+func extraVaultSshCertificateFlagHandlingFuncImpl(c *VaultSshCertificateCommand, _ *base.FlagSets, opts *[]credentiallibraries.Option) bool {
+	switch c.flagPath {
+	case "":
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryPath(c.flagPath))
+	}
+	switch c.flagUsername {
+	case "":
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryUsername(c.flagUsername))
+	}
+	switch c.flagKeyType {
+	case "":
+	case "null":
+		*opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryKeyType())
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyType(c.flagKeyType))
+	}
+	switch c.flagKeyBits {
+	case "":
+	case "0", "null":
+		*opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryKeyBits())
+	default:
+		var final uint32
+		keyBits, err := strconv.ParseUint(c.flagKeyBits, 10, 32)
+		if err != nil {
+			c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagKeyBits, err))
+			return false
+		}
+		final = uint32(keyBits)
+		*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyBits(final))
+	}
+	switch c.flagTtl {
+	case "":
+	case "null":
+		*opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryTtl())
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryTtl(c.flagTtl))
+	}
+	switch c.flagKeyId {
+	case "":
+	case "null":
+		*opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryKeyId())
+	default:
+		*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyId(c.flagKeyId))
+	}
+
+	if err := common.HandleAttributeFlags(
+		c.Command,
+		piecewiseCriticalOptionsName,
+		c.flagCriticalOptions,
+		c.flagCriticalOpts,
+		func() {
+			*opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryCriticalOptions())
+		},
+		func(in map[string]any) {
+			inn := make(map[string]string, len(in))
+			for k, v := range in {
+				switch vv := v.(type) {
+				case nil:
+					inn[k] = ""
+				case string:
+					inn[k] = vv
+				default:
+					continue
+				}
+			}
+			*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryCriticalOptions(inn))
+		}); err != nil {
+		return false
+	}
+	if err := common.HandleAttributeFlags(
+		c.Command,
+		piecewiseExtensionName,
+		c.flagExtensions,
+		c.flagExtens,
+		func() {
+			*opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryExtensions())
+		},
+		func(in map[string]any) {
+			inn := make(map[string]string, len(in))
+			for k, v := range in {
+				switch vv := v.(type) {
+				case nil:
+					inn[k] = ""
+				case string:
+					inn[k] = vv
+				default:
+					continue
+				}
+			}
+			*opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(inn))
+		}); err != nil {
+		return false
+	}
+
+	return true
+}
+
+func (c *VaultSshCertificateCommand) extraVaultSshCertificateHelpFunc(_ map[string]func() string) string {
+	var helpStr string
+	switch c.Func {
+	case "create":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary credential-libraries create vault-ssh-certificate -credential-store-id [options] [args]",
+			"",
+			"  Create a vault-ssh-certificate-type credential library. Example:",
+			"",
+			`    $ boundary credential-libraries create vault-ssh-certificate -credential-store-id  csvlt_1234567890 -vault-path "/ssh/sign/role" -username user`,
+			"",
+			"",
+		})
+
+	case "update":
+		helpStr = base.WrapForHelpText([]string{
+			"Usage: boundary credential-libraries update vault-ssh-certificate [options] [args]",
+			"",
+			"  Update a vault-ssh-certificate-type credential library given its ID. Example:",
+			"",
+			`    $ boundary credential-libraries update vault-ssh-certificate -id clvsclt_1234567890 -name devops -description "For DevOps usage"`,
+			"",
+			"",
+		})
+	}
+	return helpStr + c.Flags().Help()
+}

internal/cmd/commands/credentiallibrariescmd/vault_funcs.go

@@ -12,39 +12,10 @@ func init() {
 	extraVaultFlagsHandlingFunc = extraVaultFlagHandlingFuncImpl
 }
 
-const (
-	pathFlagName              = "vault-path"
-	httpMethodFlagName        = "vault-http-method"
-	httpRequestBodyFlagName   = "vault-http-request-body"
-	credentialTypeFlagName    = "credential-type"
-	credentialMappingFlagName = "credential-mapping-override"
-)
-
-type extraVaultCmdVars struct {
-	flagPath              string
-	flagHttpMethod        string
-	flagHttpRequestBody   string
-	flagCredentialType    string
-	flagCredentialMapping []base.CombinedSliceFlagValue
-}
+type extraVaultCmdVars extraVaultGenericCmdVars
 
 func extraVaultActionsFlagsMapFuncImpl() map[string][]string {
-	flags := map[string][]string{
-		"create": {
-			pathFlagName,
-			httpMethodFlagName,
-			httpRequestBodyFlagName,
-			credentialTypeFlagName,
-			credentialMappingFlagName,
-		},
-		"update": {
-			pathFlagName,
-			httpMethodFlagName,
-			httpRequestBodyFlagName,
-			credentialMappingFlagName,
-		},
-	}
-	return flags
+	return extraVaultGenericActionsFlagsMapFuncImpl()
 }
 
 func extraVaultFlagsFuncImpl(c *VaultCommand, set *base.FlagSets, _ *base.FlagSet) {
@@ -150,6 +121,7 @@ func (c *VaultCommand) extraVaultHelpFunc(_ map[string]func() string) string {
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
+			"Deprecated: use 'boundary credential-libraries create vault-generic' instead.",
 			"Usage: boundary credential-libraries create vault -credential-store-id [options] [args]",
 			"",
 			"  Create a vault-type credential library. Example:",
@@ -161,6 +133,7 @@ func (c *VaultCommand) extraVaultHelpFunc(_ map[string]func() string) string {
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
+			"Deprecated: use 'boundary credential-libraries update vault-generic' instead.",
 			"Usage: boundary credential-libraries update vault [options] [args]",
 			"",
 			"  Update a vault-type credential library given its ID. Example:",

internal/cmd/common/flags.go

@@ -139,6 +139,11 @@ type CombinedSliceFlagValuePopulationInput struct {
 	// combination method, e.g. "attr" will be used to build "string-attr"; also
 	// used for generating help texts
 	PiecewisePopulationInputBaseName string
+
+	// If ProtoCompat is true, the key will be validated against proto3 syntax
+	// requirements for identifiers. If the string is split via KeyDelimiter, each
+	// segment will be evaluated independently.
+	PiecewiseNoProtoCompat bool
 }
 
 func PopulateCombinedSliceFlagValue(input CombinedSliceFlagValuePopulationInput) {
@@ -163,7 +168,7 @@ func PopulateCombinedSliceFlagValue(input CombinedSliceFlagValuePopulationInput)
 				Target:         input.PiecewisePopulationFlag,
 				KvSplit:        true,
 				KeyDelimiter:   &keyDelimiter,
-				ProtoCompatKey: true,
+				ProtoCompatKey: !input.PiecewiseNoProtoCompat,
 				KeyOnlyAllowed: true,
 				Usage: fmt.Sprintf(
 					"A key=value pair to add to the request's %s map. "+

internal/cmd/gencli/input.go

@@ -237,9 +237,41 @@ var inputStructs = map[string][]*cmdInfo{
 			HasId:                true,
 			HasName:              true,
 			HasDescription:       true,
+			NeedsSubtypeInCreate: true,
 			Container:            "CredentialStore",
 			VersionedActions:     []string{"update"},
+			PrefixAttributeFieldErrorsWithSubactionPrefix: true,
+		},
+		{
+			ResourceType:         resource.CredentialLibrary.String(),
+			Pkg:                  "credentiallibraries",
+			StdActions:           []string{"create", "update"},
+			SubActionPrefix:      "vault-generic",
+			HasExtraCommandVars:  true,
+			SkipNormalHelp:       true,
+			HasExtraHelpFunc:     true,
+			HasId:                true,
+			HasName:              true,
+			HasDescription:       true,
 			NeedsSubtypeInCreate: true,
+			Container:            "CredentialStore",
+			VersionedActions:     []string{"update"},
+			PrefixAttributeFieldErrorsWithSubactionPrefix: true,
+		},
+		{
+			ResourceType:         resource.CredentialLibrary.String(),
+			Pkg:                  "credentiallibraries",
+			StdActions:           []string{"create", "update"},
+			SubActionPrefix:      "vault-ssh-certificate",
+			HasExtraCommandVars:  true,
+			SkipNormalHelp:       true,
+			HasExtraHelpFunc:     true,
+			HasId:                true,
+			HasName:              true,
+			HasDescription:       true,
+			NeedsSubtypeInCreate: true,
+			Container:            "CredentialStore",
+			VersionedActions:     []string{"update"},
 			PrefixAttributeFieldErrorsWithSubactionPrefix: true,
 		},
 	},

internal/tests/cli/Makefile

@@ -1,5 +1,36 @@
 all: test
 
+REGISTRY_NAME ?= docker.io/hashicorp
+TEST_VAULT_IMAGE_NAME=vault
+TEST_VAULT_IMAGE ?= $(REGISTRY_NAME)/$(TEST_VAULT_IMAGE_NAME):1.12.2
+TEST_VAULT_PORT ?= 8200
+TEST_VAULT_CONTAINER_NAME ?= boundary-cli-tests-vault
+
+VAULT_ADDR ?= "http://127.0.0.1:$(TEST_VAULT_PORT)"
+VAULT_TOKEN ?= boundarytok
+
+.PHONY: test-vault-up
+test-vault-up:
+	@echo "Using image: $(TEST_VAULT_IMAGE)"
+	@echo " vault addr: $(VAULT_ADDR)"
+	@echo "vault token: $(VAULT_TOKEN)"
+	@docker run \
+		-d \
+		--name $(TEST_VAULT_CONTAINER_NAME) \
+		-e VAULT_DEV_ROOT_TOKEN_ID=$(VAULT_TOKEN) \
+		-p $(TEST_VAULT_PORT):8200 \
+		--cap-add IPC_LOCK \
+		$(TEST_VAULT_IMAGE)
+	@echo "Container name: $(TEST_VAULT_CONTAINER_NAME)"
+	@echo "Test vault available at: $(VAULT_ADDR)"
+	@echo "For vault logs run:"
+	@echo "    docker logs $(TEST_VAULT_CONTAINER_NAME)"
+
+.PHONY: test-vault-down
+test-vault-down:
+	docker stop $(TEST_VAULT_CONTAINER_NAME) || true
+	docker rm -v $(TEST_VAULT_CONTAINER_NAME) || true
+
 .PHONY: test
 test:
 	./test.sh

internal/tests/cli/boundary/_credential_libraries.bash

@@ -0,0 +1,36 @@
+load _authorized_actions
+
+function create_vault_ssh_certificate_library() {
+  boundary credential-libraries \
+    create vault-ssh-certificate $@
+}
+
+function create_vault_generic_library() {
+  boundary credential-libraries \
+    create vault-generic $@
+}
+
+function create_vault_library() {
+  boundary credential-libraries \
+    create vault $@
+}
+
+function read_credential_library() {
+  boundary credential-libraries read -id $1 -format json
+}
+
+function delete_credential_library() {
+  boundary credential-libraries delete -id $1
+}
+
+function list_credential_libraries() {
+  local csid=$1
+  boundary credential-libraries list -credential-store-id $1 -format json
+}
+
+function credential_library_id() {
+  local name=$1
+  local csid=$2
+
+  strip $(list_credential_libraries $csid | jq -c ".items[] | select(.name | contains(\"$name\")) | .[\"id\"]")
+}

internal/tests/cli/boundary/_credential_stores.bash

@@ -10,6 +10,10 @@ function create_static_credential_store() {
     -scope-id $sid
 }
 
+function create_vault_credential_store() {
+  boundary credential-stores create vault $@
+}
+
 function read_credential_store() {
   boundary credential-stores read -id $1 -format json
 }

internal/tests/cli/boundary/_vault.bash

@@ -0,0 +1,47 @@
+
+function vault_write_boundary_policy() {
+  (
+  cat <<EOF
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/renew-self" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}
+
+path "sys/leases/renew" {
+  capabilities = ["update"]
+}
+
+path "sys/leases/revoke" {
+  capabilities = ["update"]
+}
+
+path "sys/capabilities-self" {
+  capabilities = ["update"]
+}
+EOF
+  ) | vault policy write boundary-controller -
+}
+
+function create_vault_token() {
+  vault token create \
+    -format=json \
+    -no-default-policy=true \
+    -policy="boundary-controller" \
+    -orphan=true \
+    -period=2m \
+    -renewable=true | \
+    jq -r '.auth.client_token'
+}
+
+function skip_if_no_vault() {
+  if [[ -z $VAULT_ADDR ]] || [[ -z $VAULT_TOKEN ]]; then
+    skip "vault environment variables \$VAULT_ADDR and \$VAULT_TOKEN not set"
+  fi
+}

internal/tests/cli/boundary/credential_libraries.bats

@@ -0,0 +1,181 @@
+#!/usr/bin/env bats
+
+load _auth
+load _helpers
+load _vault
+load _credential_stores
+load _credential_libraries
+
+export NEW_STORE='test_vault'
+export NEW_VAULT_LIB="test_vault"
+
+@test "boundary/login: can login as default user" {
+  run login $DEFAULT_LOGIN
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: setup vault-generic credential store $NEW_STORE in default project" {
+  skip_if_no_vault
+
+  vault_write_boundary_policy
+  local vault_token=$(create_vault_token)
+  run create_vault_credential_store \
+    -name $NEW_STORE -scope-id $DEFAULT_P_ID \
+    -vault-address $VAULT_ADDR \
+    -vault-token $vault_token
+
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-generic library in credential store $NEW_STORE" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_generic_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault-generic libary" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_generic_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault-generic library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault-generic library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault library in credential store $NEW_STORE deprecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault libary deprecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault library depcrecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault library depcrecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-ssh-certificate library in credential store $NEW_STORE" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_ssh_certificate_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /ssh/sign/foo \
+    -username foo
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault-ssh-certificate libary" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_ssh_certificate_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /ssh/sign/foo \
+    -username foo
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault-ssh-certificate library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault-ssh-certificate library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+# Note, deleting the cred store will revoke the vault token
+@test "boundary/credential-stores: cleanup can delete $NEW_STORE vault store" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run delete_credential_store $csid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+