diff --git a/internal/cmd/commands.go b/internal/cmd/commands.go index 27a0d473c..3b3066e4d 100644 --- a/internal/cmd/commands.go +++ b/internal/cmd/commands.go @@ -364,6 +364,18 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) { Func: "create", }, nil }, + "credential-libraries create vault-generic": func() (cli.Command, error) { + return &credentiallibrariescmd.VaultGenericCommand{ + Command: base.NewCommand(ui), + Func: "create", + }, nil + }, + "credential-libraries create vault-ssh-certificate": func() (cli.Command, error) { + return &credentiallibrariescmd.VaultSshCertificateCommand{ + Command: base.NewCommand(ui), + Func: "create", + }, nil + }, "credential-libraries update": func() (cli.Command, error) { return &credentiallibrariescmd.Command{ Command: base.NewCommand(ui), @@ -371,7 +383,19 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) { }, nil }, "credential-libraries update vault": func() (cli.Command, error) { - return &credentiallibrariescmd.VaultCommand{ + return &credentiallibrariescmd.VaultGenericCommand{ + Command: base.NewCommand(ui), + Func: "update", + }, nil + }, + "credential-libraries update vault-generic": func() (cli.Command, error) { + return &credentiallibrariescmd.VaultGenericCommand{ + Command: base.NewCommand(ui), + Func: "update", + }, nil + }, + "credential-libraries update vault-ssh-certificate": func() (cli.Command, error) { + return &credentiallibrariescmd.VaultSshCertificateCommand{ Command: base.NewCommand(ui), Func: "update", }, nil diff --git a/internal/cmd/commands/credentiallibrariescmd/funcs.go b/internal/cmd/commands/credentiallibrariescmd/funcs.go index e6a3efa1b..b131536b9 100644 --- a/internal/cmd/commands/credentiallibrariescmd/funcs.go +++ b/internal/cmd/commands/credentiallibrariescmd/funcs.go @@ -140,6 +140,16 @@ func printItemTable(item *credentiallibraries.CredentialLibrary, resp *api.Respo nonAttributeMap["Type"] = item.Type } + var keySubstMap map[string]string + switch item.Type { + case "vault": + fallthrough + case "vault-generic": + keySubstMap = genericKeySubstMap + case "vault-ssh-certificate": + keySubstMap = sshCertKeySubstMap + } + maxLength := base.MaxAttributesLength(nonAttributeMap, item.Attributes, keySubstMap) ret := []string{ @@ -189,8 +199,19 @@ func printItemTable(item *credentiallibraries.CredentialLibrary, resp *api.Respo return base.WrapForHelpText(ret) } -var keySubstMap = map[string]string{ +var genericKeySubstMap = map[string]string{ "path": "Path", "http_method": "HTTP Method", "http_request_body": "HTTP Request Body", } + +var sshCertKeySubstMap = map[string]string{ + "path": "Path", + "username": "Username", + "key_type": "Key Type", + "key_bits": "Key Bits", + "ttl": "TTL", + "key_id": "Key ID", + "critical_options": "Critical Options", + "extensions": "Extensions", +} diff --git a/internal/cmd/commands/credentiallibrariescmd/vault-generic_credentiallibraries.gen.go b/internal/cmd/commands/credentiallibrariescmd/vault-generic_credentiallibraries.gen.go new file mode 100644 index 000000000..0aaa8b27d --- /dev/null +++ b/internal/cmd/commands/credentiallibrariescmd/vault-generic_credentiallibraries.gen.go @@ -0,0 +1,275 @@ +// Code generated by "make cli"; DO NOT EDIT. +package credentiallibrariescmd + +import ( + "errors" + "fmt" + + "github.com/hashicorp/boundary/api" + "github.com/hashicorp/boundary/api/credentiallibraries" + "github.com/hashicorp/boundary/internal/cmd/base" + "github.com/hashicorp/boundary/internal/cmd/common" + "github.com/hashicorp/go-secure-stdlib/strutil" + "github.com/mitchellh/cli" + "github.com/posener/complete" +) + +func initVaultGenericFlags() { + flagsOnce.Do(func() { + extraFlags := extraVaultGenericActionsFlagsMapFunc() + for k, v := range extraFlags { + flagsVaultGenericMap[k] = append(flagsVaultGenericMap[k], v...) + } + }) +} + +var ( + _ cli.Command = (*VaultGenericCommand)(nil) + _ cli.CommandAutocomplete = (*VaultGenericCommand)(nil) +) + +type VaultGenericCommand struct { + *base.Command + + Func string + + plural string + + extraVaultGenericCmdVars +} + +func (c *VaultGenericCommand) AutocompleteArgs() complete.Predictor { + initVaultGenericFlags() + return complete.PredictAnything +} + +func (c *VaultGenericCommand) AutocompleteFlags() complete.Flags { + initVaultGenericFlags() + return c.Flags().Completions() +} + +func (c *VaultGenericCommand) Synopsis() string { + if extra := extraVaultGenericSynopsisFunc(c); extra != "" { + return extra + } + + synopsisStr := "credential library" + + synopsisStr = fmt.Sprintf("%s %s", "vault-generic-type", synopsisStr) + + return common.SynopsisFunc(c.Func, synopsisStr) +} + +func (c *VaultGenericCommand) Help() string { + initVaultGenericFlags() + + var helpStr string + helpMap := common.HelpMap("credential library") + + switch c.Func { + + default: + + helpStr = c.extraVaultGenericHelpFunc(helpMap) + + } + + // Keep linter from complaining if we don't actually generate code using it + _ = helpMap + return helpStr +} + +var flagsVaultGenericMap = map[string][]string{ + + "create": {"credential-store-id", "name", "description"}, + + "update": {"id", "name", "description", "version"}, +} + +func (c *VaultGenericCommand) Flags() *base.FlagSets { + if len(flagsVaultGenericMap[c.Func]) == 0 { + return c.FlagSet(base.FlagSetNone) + } + + set := c.FlagSet(base.FlagSetHTTP | base.FlagSetClient | base.FlagSetOutputFormat) + f := set.NewFlagSet("Command Options") + common.PopulateCommonFlags(c.Command, f, "vault-generic-type credential library", flagsVaultGenericMap, c.Func) + + extraVaultGenericFlagsFunc(c, set, f) + + return set +} + +func (c *VaultGenericCommand) Run(args []string) int { + initVaultGenericFlags() + + switch c.Func { + case "": + return cli.RunResultHelp + + } + + c.plural = "vault-generic-type credential library" + switch c.Func { + case "list": + c.plural = "vault-generic-type credential librarys" + } + + f := c.Flags() + + if err := f.Parse(args); err != nil { + c.PrintCliError(err) + return base.CommandUserError + } + + if strutil.StrListContains(flagsVaultGenericMap[c.Func], "id") && c.FlagId == "" { + c.PrintCliError(errors.New("ID is required but not passed in via -id")) + return base.CommandUserError + } + + var opts []credentiallibraries.Option + + if strutil.StrListContains(flagsVaultGenericMap[c.Func], "credential-store-id") { + switch c.Func { + + case "create": + if c.FlagCredentialStoreId == "" { + c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID")) + return base.CommandUserError + } + + } + } + + client, err := c.Client() + if c.WrapperCleanupFunc != nil { + defer func() { + if err := c.WrapperCleanupFunc(); err != nil { + c.PrintCliError(fmt.Errorf("Error cleaning kms wrapper: %w", err)) + } + }() + } + if err != nil { + c.PrintCliError(fmt.Errorf("Error creating API client: %w", err)) + return base.CommandCliError + } + credentiallibrariesClient := credentiallibraries.NewClient(client) + + switch c.FlagName { + case "": + case "null": + opts = append(opts, credentiallibraries.DefaultName()) + default: + opts = append(opts, credentiallibraries.WithName(c.FlagName)) + } + + switch c.FlagDescription { + case "": + case "null": + opts = append(opts, credentiallibraries.DefaultDescription()) + default: + opts = append(opts, credentiallibraries.WithDescription(c.FlagDescription)) + } + + if c.FlagFilter != "" { + opts = append(opts, credentiallibraries.WithFilter(c.FlagFilter)) + } + + var version uint32 + + switch c.Func { + + case "update": + switch c.FlagVersion { + case 0: + opts = append(opts, credentiallibraries.WithAutomaticVersioning(true)) + default: + version = uint32(c.FlagVersion) + } + + } + + if ok := extraVaultGenericFlagsHandlingFunc(c, f, &opts); !ok { + return base.CommandUserError + } + + var resp *api.Response + var item *credentiallibraries.CredentialLibrary + + var createResult *credentiallibraries.CredentialLibraryCreateResult + + var updateResult *credentiallibraries.CredentialLibraryUpdateResult + + switch c.Func { + + case "create": + createResult, err = credentiallibrariesClient.Create(c.Context, "vault-generic", c.FlagCredentialStoreId, opts...) + if exitCode := c.checkFuncError(err); exitCode > 0 { + return exitCode + } + resp = createResult.GetResponse() + item = createResult.GetItem() + + case "update": + updateResult, err = credentiallibrariesClient.Update(c.Context, c.FlagId, version, opts...) + if exitCode := c.checkFuncError(err); exitCode > 0 { + return exitCode + } + resp = updateResult.GetResponse() + item = updateResult.GetItem() + + } + + resp, item, err = executeExtraVaultGenericActions(c, resp, item, err, credentiallibrariesClient, version, opts) + if exitCode := c.checkFuncError(err); exitCode > 0 { + return exitCode + } + + output, err := printCustomVaultGenericActionOutput(c) + if err != nil { + c.PrintCliError(err) + return base.CommandUserError + } + if output { + return base.CommandSuccess + } + + switch c.Func { + + } + + switch base.Format(c.UI) { + case "table": + c.UI.Output(printItemTable(item, resp)) + + case "json": + if ok := c.PrintJsonItem(resp); !ok { + return base.CommandCliError + } + } + + return base.CommandSuccess +} + +func (c *VaultGenericCommand) checkFuncError(err error) int { + if err == nil { + return 0 + } + if apiErr := api.AsServerError(err); apiErr != nil { + c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural)) + return base.CommandApiError + } + c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error())) + return base.CommandCliError +} + +var ( + extraVaultGenericActionsFlagsMapFunc = func() map[string][]string { return nil } + extraVaultGenericSynopsisFunc = func(*VaultGenericCommand) string { return "" } + extraVaultGenericFlagsFunc = func(*VaultGenericCommand, *base.FlagSets, *base.FlagSet) {} + extraVaultGenericFlagsHandlingFunc = func(*VaultGenericCommand, *base.FlagSets, *[]credentiallibraries.Option) bool { return true } + executeExtraVaultGenericActions = func(_ *VaultGenericCommand, inResp *api.Response, inItem *credentiallibraries.CredentialLibrary, inErr error, _ *credentiallibraries.Client, _ uint32, _ []credentiallibraries.Option) (*api.Response, *credentiallibraries.CredentialLibrary, error) { + return inResp, inItem, inErr + } + printCustomVaultGenericActionOutput = func(*VaultGenericCommand) (bool, error) { return false, nil } +) diff --git a/internal/cmd/commands/credentiallibrariescmd/vault-generic_funcs.go b/internal/cmd/commands/credentiallibrariescmd/vault-generic_funcs.go new file mode 100644 index 000000000..b2192b02b --- /dev/null +++ b/internal/cmd/commands/credentiallibrariescmd/vault-generic_funcs.go @@ -0,0 +1,174 @@ +package credentiallibrariescmd + +import ( + "github.com/hashicorp/boundary/api/credentiallibraries" + "github.com/hashicorp/boundary/internal/cmd/base" + "github.com/hashicorp/go-secure-stdlib/parseutil" +) + +func init() { + extraVaultGenericFlagsFunc = extraVaultGenericFlagsFuncImpl + extraVaultGenericActionsFlagsMapFunc = extraVaultGenericActionsFlagsMapFuncImpl + extraVaultGenericFlagsHandlingFunc = extraVaultGenericFlagHandlingFuncImpl +} + +const ( + pathFlagName = "vault-path" + httpMethodFlagName = "vault-http-method" + httpRequestBodyFlagName = "vault-http-request-body" + credentialTypeFlagName = "credential-type" + credentialMappingFlagName = "credential-mapping-override" +) + +type extraVaultGenericCmdVars struct { + flagPath string + flagHttpMethod string + flagHttpRequestBody string + flagCredentialType string + flagCredentialMapping []base.CombinedSliceFlagValue +} + +func extraVaultGenericActionsFlagsMapFuncImpl() map[string][]string { + flags := map[string][]string{ + "create": { + pathFlagName, + httpMethodFlagName, + httpRequestBodyFlagName, + credentialTypeFlagName, + credentialMappingFlagName, + }, + "update": { + pathFlagName, + httpMethodFlagName, + httpRequestBodyFlagName, + credentialMappingFlagName, + }, + } + return flags +} + +func extraVaultGenericFlagsFuncImpl(c *VaultGenericCommand, set *base.FlagSets, _ *base.FlagSet) { + f := set.NewFlagSet("Vault Credential Library Options") + + for _, name := range flagsVaultGenericMap[c.Func] { + switch name { + case pathFlagName: + f.StringVar(&base.StringVar{ + Name: pathFlagName, + Target: &c.flagPath, + Usage: "The path in vault to request credentials from.", + }) + case httpMethodFlagName: + f.StringVar(&base.StringVar{ + Name: httpMethodFlagName, + Target: &c.flagHttpMethod, + Usage: "The http method the library should use when communicating with vault.", + }) + case httpRequestBodyFlagName: + f.StringVar(&base.StringVar{ + Name: httpRequestBodyFlagName, + Target: &c.flagHttpRequestBody, + Usage: "The http request body the library uses to communicate with vault. This can be the value itself, refer to a file on disk (file://) from which the value will be read, or an env var (env://) from which the value will be read.", + }) + case credentialTypeFlagName: + f.StringVar(&base.StringVar{ + Name: credentialTypeFlagName, + Target: &c.flagCredentialType, + Usage: "The type of credential this library will issue, defaults to Unspecified.", + }) + case credentialMappingFlagName: + f.CombinationSliceVar(&base.CombinationSliceVar{ + Name: credentialMappingFlagName, + Target: &c.flagCredentialMapping, + KvSplit: true, + Usage: "The credential mapping override.", + }) + } + } +} + +func extraVaultGenericFlagHandlingFuncImpl(c *VaultGenericCommand, _ *base.FlagSets, opts *[]credentiallibraries.Option) bool { + switch c.flagPath { + case "": + default: + *opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryPath(c.flagPath)) + } + switch c.flagHttpMethod { + case "": + case "null": + *opts = append(*opts, credentiallibraries.DefaultVaultCredentialLibraryHttpMethod()) + default: + *opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryHttpMethod(c.flagHttpMethod)) + } + switch c.flagHttpRequestBody { + case "": + case "null": + *opts = append(*opts, credentiallibraries.DefaultVaultCredentialLibraryHttpRequestBody()) + default: + rb, _ := parseutil.ParsePath(c.flagHttpRequestBody) + *opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryHttpRequestBody(rb)) + } + switch c.flagCredentialType { + case "": + case "null": + *opts = append(*opts, credentiallibraries.DefaultCredentialType()) + default: + *opts = append(*opts, credentiallibraries.WithCredentialType(c.flagCredentialType)) + } + switch len(c.flagCredentialMapping) { + case 0: + case 1: + if len(c.flagCredentialMapping[0].Keys) == 1 && c.flagCredentialMapping[0].Keys[0] == "null" && c.flagCredentialMapping[0].Value == nil { + *opts = append(*opts, credentiallibraries.DefaultCredentialMappingOverrides()) + break + } + fallthrough + default: + mappings := make(map[string]any, len(c.flagCredentialMapping)) + for _, mapping := range c.flagCredentialMapping { + switch { + case len(mapping.Keys) != 1 || mapping.Keys[0] == "" || mapping.Value == nil || mapping.Value.GetValue() == "": + // mapping override does not support key segments (e.g. 'x.y=z') + c.UI.Error("Credential mapping override must be in the format 'key=value', 'key=null' to clear field or 'null' to clear all.") + return false + case mapping.Value.GetValue() == "null": + // user provided 'key=null' indicating the field specific override should + // be cleared, set map value to nil + mappings[mapping.Keys[0]] = nil + default: + mappings[mapping.Keys[0]] = mapping.Value.GetValue() + } + } + *opts = append(*opts, credentiallibraries.WithCredentialMappingOverrides(mappings)) + } + + return true +} + +func (c *VaultGenericCommand) extraVaultGenericHelpFunc(_ map[string]func() string) string { + var helpStr string + switch c.Func { + case "create": + helpStr = base.WrapForHelpText([]string{ + "Usage: boundary credential-libraries create vault -credential-store-id [options] [args]", + "", + " Create a vault-generic-type credential library. Example:", + "", + ` $ boundary credential-libraries create vault-generic -credential-store-id csvlt_1234567890 -vault-path "/some/path"`, + "", + "", + }) + + case "update": + helpStr = base.WrapForHelpText([]string{ + "Usage: boundary credential-libraries update vault [options] [args]", + "", + " Update a vault-generic-type credential library given its ID. Example:", + "", + ` $ boundary credential-libraries update vault-generic -id clvlt_1234567890 -name devops -description "For DevOps usage"`, + "", + "", + }) + } + return helpStr + c.Flags().Help() +} diff --git a/internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_credentiallibraries.gen.go b/internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_credentiallibraries.gen.go new file mode 100644 index 000000000..bdc891939 --- /dev/null +++ b/internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_credentiallibraries.gen.go @@ -0,0 +1,275 @@ +// Code generated by "make cli"; DO NOT EDIT. +package credentiallibrariescmd + +import ( + "errors" + "fmt" + + "github.com/hashicorp/boundary/api" + "github.com/hashicorp/boundary/api/credentiallibraries" + "github.com/hashicorp/boundary/internal/cmd/base" + "github.com/hashicorp/boundary/internal/cmd/common" + "github.com/hashicorp/go-secure-stdlib/strutil" + "github.com/mitchellh/cli" + "github.com/posener/complete" +) + +func initVaultSshCertificateFlags() { + flagsOnce.Do(func() { + extraFlags := extraVaultSshCertificateActionsFlagsMapFunc() + for k, v := range extraFlags { + flagsVaultSshCertificateMap[k] = append(flagsVaultSshCertificateMap[k], v...) + } + }) +} + +var ( + _ cli.Command = (*VaultSshCertificateCommand)(nil) + _ cli.CommandAutocomplete = (*VaultSshCertificateCommand)(nil) +) + +type VaultSshCertificateCommand struct { + *base.Command + + Func string + + plural string + + extraVaultSshCertificateCmdVars +} + +func (c *VaultSshCertificateCommand) AutocompleteArgs() complete.Predictor { + initVaultSshCertificateFlags() + return complete.PredictAnything +} + +func (c *VaultSshCertificateCommand) AutocompleteFlags() complete.Flags { + initVaultSshCertificateFlags() + return c.Flags().Completions() +} + +func (c *VaultSshCertificateCommand) Synopsis() string { + if extra := extraVaultSshCertificateSynopsisFunc(c); extra != "" { + return extra + } + + synopsisStr := "credential library" + + synopsisStr = fmt.Sprintf("%s %s", "vault-ssh-certificate-type", synopsisStr) + + return common.SynopsisFunc(c.Func, synopsisStr) +} + +func (c *VaultSshCertificateCommand) Help() string { + initVaultSshCertificateFlags() + + var helpStr string + helpMap := common.HelpMap("credential library") + + switch c.Func { + + default: + + helpStr = c.extraVaultSshCertificateHelpFunc(helpMap) + + } + + // Keep linter from complaining if we don't actually generate code using it + _ = helpMap + return helpStr +} + +var flagsVaultSshCertificateMap = map[string][]string{ + + "create": {"credential-store-id", "name", "description"}, + + "update": {"id", "name", "description", "version"}, +} + +func (c *VaultSshCertificateCommand) Flags() *base.FlagSets { + if len(flagsVaultSshCertificateMap[c.Func]) == 0 { + return c.FlagSet(base.FlagSetNone) + } + + set := c.FlagSet(base.FlagSetHTTP | base.FlagSetClient | base.FlagSetOutputFormat) + f := set.NewFlagSet("Command Options") + common.PopulateCommonFlags(c.Command, f, "vault-ssh-certificate-type credential library", flagsVaultSshCertificateMap, c.Func) + + extraVaultSshCertificateFlagsFunc(c, set, f) + + return set +} + +func (c *VaultSshCertificateCommand) Run(args []string) int { + initVaultSshCertificateFlags() + + switch c.Func { + case "": + return cli.RunResultHelp + + } + + c.plural = "vault-ssh-certificate-type credential library" + switch c.Func { + case "list": + c.plural = "vault-ssh-certificate-type credential librarys" + } + + f := c.Flags() + + if err := f.Parse(args); err != nil { + c.PrintCliError(err) + return base.CommandUserError + } + + if strutil.StrListContains(flagsVaultSshCertificateMap[c.Func], "id") && c.FlagId == "" { + c.PrintCliError(errors.New("ID is required but not passed in via -id")) + return base.CommandUserError + } + + var opts []credentiallibraries.Option + + if strutil.StrListContains(flagsVaultSshCertificateMap[c.Func], "credential-store-id") { + switch c.Func { + + case "create": + if c.FlagCredentialStoreId == "" { + c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID")) + return base.CommandUserError + } + + } + } + + client, err := c.Client() + if c.WrapperCleanupFunc != nil { + defer func() { + if err := c.WrapperCleanupFunc(); err != nil { + c.PrintCliError(fmt.Errorf("Error cleaning kms wrapper: %w", err)) + } + }() + } + if err != nil { + c.PrintCliError(fmt.Errorf("Error creating API client: %w", err)) + return base.CommandCliError + } + credentiallibrariesClient := credentiallibraries.NewClient(client) + + switch c.FlagName { + case "": + case "null": + opts = append(opts, credentiallibraries.DefaultName()) + default: + opts = append(opts, credentiallibraries.WithName(c.FlagName)) + } + + switch c.FlagDescription { + case "": + case "null": + opts = append(opts, credentiallibraries.DefaultDescription()) + default: + opts = append(opts, credentiallibraries.WithDescription(c.FlagDescription)) + } + + if c.FlagFilter != "" { + opts = append(opts, credentiallibraries.WithFilter(c.FlagFilter)) + } + + var version uint32 + + switch c.Func { + + case "update": + switch c.FlagVersion { + case 0: + opts = append(opts, credentiallibraries.WithAutomaticVersioning(true)) + default: + version = uint32(c.FlagVersion) + } + + } + + if ok := extraVaultSshCertificateFlagsHandlingFunc(c, f, &opts); !ok { + return base.CommandUserError + } + + var resp *api.Response + var item *credentiallibraries.CredentialLibrary + + var createResult *credentiallibraries.CredentialLibraryCreateResult + + var updateResult *credentiallibraries.CredentialLibraryUpdateResult + + switch c.Func { + + case "create": + createResult, err = credentiallibrariesClient.Create(c.Context, "vault-ssh-certificate", c.FlagCredentialStoreId, opts...) + if exitCode := c.checkFuncError(err); exitCode > 0 { + return exitCode + } + resp = createResult.GetResponse() + item = createResult.GetItem() + + case "update": + updateResult, err = credentiallibrariesClient.Update(c.Context, c.FlagId, version, opts...) + if exitCode := c.checkFuncError(err); exitCode > 0 { + return exitCode + } + resp = updateResult.GetResponse() + item = updateResult.GetItem() + + } + + resp, item, err = executeExtraVaultSshCertificateActions(c, resp, item, err, credentiallibrariesClient, version, opts) + if exitCode := c.checkFuncError(err); exitCode > 0 { + return exitCode + } + + output, err := printCustomVaultSshCertificateActionOutput(c) + if err != nil { + c.PrintCliError(err) + return base.CommandUserError + } + if output { + return base.CommandSuccess + } + + switch c.Func { + + } + + switch base.Format(c.UI) { + case "table": + c.UI.Output(printItemTable(item, resp)) + + case "json": + if ok := c.PrintJsonItem(resp); !ok { + return base.CommandCliError + } + } + + return base.CommandSuccess +} + +func (c *VaultSshCertificateCommand) checkFuncError(err error) int { + if err == nil { + return 0 + } + if apiErr := api.AsServerError(err); apiErr != nil { + c.PrintApiError(apiErr, fmt.Sprintf("Error from controller when performing %s on %s", c.Func, c.plural)) + return base.CommandApiError + } + c.PrintCliError(fmt.Errorf("Error trying to %s %s: %s", c.Func, c.plural, err.Error())) + return base.CommandCliError +} + +var ( + extraVaultSshCertificateActionsFlagsMapFunc = func() map[string][]string { return nil } + extraVaultSshCertificateSynopsisFunc = func(*VaultSshCertificateCommand) string { return "" } + extraVaultSshCertificateFlagsFunc = func(*VaultSshCertificateCommand, *base.FlagSets, *base.FlagSet) {} + extraVaultSshCertificateFlagsHandlingFunc = func(*VaultSshCertificateCommand, *base.FlagSets, *[]credentiallibraries.Option) bool { return true } + executeExtraVaultSshCertificateActions = func(_ *VaultSshCertificateCommand, inResp *api.Response, inItem *credentiallibraries.CredentialLibrary, inErr error, _ *credentiallibraries.Client, _ uint32, _ []credentiallibraries.Option) (*api.Response, *credentiallibraries.CredentialLibrary, error) { + return inResp, inItem, inErr + } + printCustomVaultSshCertificateActionOutput = func(*VaultSshCertificateCommand) (bool, error) { return false, nil } +) diff --git a/internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_funcs.go b/internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_funcs.go new file mode 100644 index 000000000..23d588cab --- /dev/null +++ b/internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_funcs.go @@ -0,0 +1,264 @@ +package credentiallibrariescmd + +import ( + "fmt" + "strconv" + + "github.com/hashicorp/boundary/api/credentiallibraries" + "github.com/hashicorp/boundary/internal/cmd/base" + "github.com/hashicorp/boundary/internal/cmd/common" +) + +func init() { + extraVaultSshCertificateFlagsFunc = extraVaultSshCertificateFlagsFuncImpl + extraVaultSshCertificateActionsFlagsMapFunc = extraVaultSshCertificateActionsFlagsMapFuncImpl + extraVaultSshCertificateFlagsHandlingFunc = extraVaultSshCertificateFlagHandlingFuncImpl +} + +const ( + usernameName = "username" + keyTypeName = "key-type" + keyBitsName = "key-bits" + ttlName = "ttl" + keyIdName = "key-id" + criticalOptionsName = "critical-options" + piecewiseCriticalOptionsName = "critical-option" + extensionsName = "extensions" + piecewiseExtensionName = "extension" +) + +type extraVaultSshCertificateCmdVars struct { + flagPath string + flagUsername string + flagKeyType string + flagKeyBits string + flagTtl string + flagKeyId string + flagCriticalOptions string + flagCriticalOpts []base.CombinedSliceFlagValue + flagExtensions string + flagExtens []base.CombinedSliceFlagValue +} + +func extraVaultSshCertificateActionsFlagsMapFuncImpl() map[string][]string { + flags := map[string][]string{ + "create": { + pathFlagName, + usernameName, + keyTypeName, + keyBitsName, + ttlName, + keyIdName, + criticalOptionsName, + piecewiseCriticalOptionsName, + extensionsName, + piecewiseExtensionName, + }, + "update": { + pathFlagName, + usernameName, + keyTypeName, + keyBitsName, + ttlName, + keyIdName, + criticalOptionsName, + piecewiseCriticalOptionsName, + extensionsName, + piecewiseExtensionName, + }, + } + return flags +} + +func extraVaultSshCertificateFlagsFuncImpl(c *VaultSshCertificateCommand, set *base.FlagSets, _ *base.FlagSet) { + f := set.NewFlagSet("Vault SSH Certificate Credential Library Options") + + for _, name := range flagsVaultSshCertificateMap[c.Func] { + switch name { + case pathFlagName: + f.StringVar(&base.StringVar{ + Name: pathFlagName, + Target: &c.flagPath, + Usage: "The path in vault to request credentials from.", + }) + case usernameName: + f.StringVar(&base.StringVar{ + Name: usernameName, + Target: &c.flagUsername, + Usage: "The username to use with the ssh certificate.", + }) + case keyTypeName: + f.StringVar(&base.StringVar{ + Name: keyTypeName, + Target: &c.flagKeyType, + Usage: "The key type for the generated ssh private key. One of: ed25519, ecdsa, rsa.", + }) + case keyBitsName: + f.StringVar(&base.StringVar{ + Name: keyBitsName, + Target: &c.flagKeyBits, + Usage: "The number of bits when generating the ssh private key. Depends on key_type. If ed25519 this should not be set, or set to 0, if ecdsa one of 256, 384, 521, if rsa one of 2048, 3072, 4096.", + }) + case ttlName: + f.StringVar(&base.StringVar{ + Name: ttlName, + Target: &c.flagTtl, + Usage: "The time-to-live for the generated certificate.", + }) + case keyIdName: + f.StringVar(&base.StringVar{ + Name: keyIdName, + Target: &c.flagKeyId, + Usage: "The key id that the created certificate should have.", + }) + } + } + criticalOptsInput := common.CombinedSliceFlagValuePopulationInput{ + FlagSet: f, + FlagNames: flagsVaultSshCertificateMap[c.Func], + FullPopulationFlag: &c.flagCriticalOptions, + FullPopulationInputName: criticalOptionsName, + PiecewisePopulationFlag: &c.flagCriticalOpts, + PiecewisePopulationInputBaseName: piecewiseCriticalOptionsName, + PiecewiseNoProtoCompat: true, + } + common.PopulateCombinedSliceFlagValue(criticalOptsInput) + + extensionsInput := common.CombinedSliceFlagValuePopulationInput{ + FlagSet: f, + FlagNames: flagsVaultSshCertificateMap[c.Func], + FullPopulationFlag: &c.flagExtensions, + FullPopulationInputName: extensionsName, + PiecewisePopulationFlag: &c.flagExtens, + PiecewisePopulationInputBaseName: piecewiseExtensionName, + PiecewiseNoProtoCompat: true, + } + common.PopulateCombinedSliceFlagValue(extensionsInput) +} + +func extraVaultSshCertificateFlagHandlingFuncImpl(c *VaultSshCertificateCommand, _ *base.FlagSets, opts *[]credentiallibraries.Option) bool { + switch c.flagPath { + case "": + default: + *opts = append(*opts, credentiallibraries.WithVaultCredentialLibraryPath(c.flagPath)) + } + switch c.flagUsername { + case "": + default: + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryUsername(c.flagUsername)) + } + switch c.flagKeyType { + case "": + case "null": + *opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryKeyType()) + default: + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyType(c.flagKeyType)) + } + switch c.flagKeyBits { + case "": + case "0", "null": + *opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryKeyBits()) + default: + var final uint32 + keyBits, err := strconv.ParseUint(c.flagKeyBits, 10, 32) + if err != nil { + c.UI.Error(fmt.Sprintf("Error parsing %q: %s", c.flagKeyBits, err)) + return false + } + final = uint32(keyBits) + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyBits(final)) + } + switch c.flagTtl { + case "": + case "null": + *opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryTtl()) + default: + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryTtl(c.flagTtl)) + } + switch c.flagKeyId { + case "": + case "null": + *opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryKeyId()) + default: + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryKeyId(c.flagKeyId)) + } + + if err := common.HandleAttributeFlags( + c.Command, + piecewiseCriticalOptionsName, + c.flagCriticalOptions, + c.flagCriticalOpts, + func() { + *opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryCriticalOptions()) + }, + func(in map[string]any) { + inn := make(map[string]string, len(in)) + for k, v := range in { + switch vv := v.(type) { + case nil: + inn[k] = "" + case string: + inn[k] = vv + default: + continue + } + } + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryCriticalOptions(inn)) + }); err != nil { + return false + } + if err := common.HandleAttributeFlags( + c.Command, + piecewiseExtensionName, + c.flagExtensions, + c.flagExtens, + func() { + *opts = append(*opts, credentiallibraries.DefaultVaultSSHCertificateCredentialLibraryExtensions()) + }, + func(in map[string]any) { + inn := make(map[string]string, len(in)) + for k, v := range in { + switch vv := v.(type) { + case nil: + inn[k] = "" + case string: + inn[k] = vv + default: + continue + } + } + *opts = append(*opts, credentiallibraries.WithVaultSSHCertificateCredentialLibraryExtensions(inn)) + }); err != nil { + return false + } + + return true +} + +func (c *VaultSshCertificateCommand) extraVaultSshCertificateHelpFunc(_ map[string]func() string) string { + var helpStr string + switch c.Func { + case "create": + helpStr = base.WrapForHelpText([]string{ + "Usage: boundary credential-libraries create vault-ssh-certificate -credential-store-id [options] [args]", + "", + " Create a vault-ssh-certificate-type credential library. Example:", + "", + ` $ boundary credential-libraries create vault-ssh-certificate -credential-store-id csvlt_1234567890 -vault-path "/ssh/sign/role" -username user`, + "", + "", + }) + + case "update": + helpStr = base.WrapForHelpText([]string{ + "Usage: boundary credential-libraries update vault-ssh-certificate [options] [args]", + "", + " Update a vault-ssh-certificate-type credential library given its ID. Example:", + "", + ` $ boundary credential-libraries update vault-ssh-certificate -id clvsclt_1234567890 -name devops -description "For DevOps usage"`, + "", + "", + }) + } + return helpStr + c.Flags().Help() +} diff --git a/internal/cmd/commands/credentiallibrariescmd/vault_funcs.go b/internal/cmd/commands/credentiallibrariescmd/vault_funcs.go index d066a2cde..867e0e85c 100644 --- a/internal/cmd/commands/credentiallibrariescmd/vault_funcs.go +++ b/internal/cmd/commands/credentiallibrariescmd/vault_funcs.go @@ -12,39 +12,10 @@ func init() { extraVaultFlagsHandlingFunc = extraVaultFlagHandlingFuncImpl } -const ( - pathFlagName = "vault-path" - httpMethodFlagName = "vault-http-method" - httpRequestBodyFlagName = "vault-http-request-body" - credentialTypeFlagName = "credential-type" - credentialMappingFlagName = "credential-mapping-override" -) - -type extraVaultCmdVars struct { - flagPath string - flagHttpMethod string - flagHttpRequestBody string - flagCredentialType string - flagCredentialMapping []base.CombinedSliceFlagValue -} +type extraVaultCmdVars extraVaultGenericCmdVars func extraVaultActionsFlagsMapFuncImpl() map[string][]string { - flags := map[string][]string{ - "create": { - pathFlagName, - httpMethodFlagName, - httpRequestBodyFlagName, - credentialTypeFlagName, - credentialMappingFlagName, - }, - "update": { - pathFlagName, - httpMethodFlagName, - httpRequestBodyFlagName, - credentialMappingFlagName, - }, - } - return flags + return extraVaultGenericActionsFlagsMapFuncImpl() } func extraVaultFlagsFuncImpl(c *VaultCommand, set *base.FlagSets, _ *base.FlagSet) { @@ -150,6 +121,7 @@ func (c *VaultCommand) extraVaultHelpFunc(_ map[string]func() string) string { switch c.Func { case "create": helpStr = base.WrapForHelpText([]string{ + "Deprecated: use 'boundary credential-libraries create vault-generic' instead.", "Usage: boundary credential-libraries create vault -credential-store-id [options] [args]", "", " Create a vault-type credential library. Example:", @@ -161,6 +133,7 @@ func (c *VaultCommand) extraVaultHelpFunc(_ map[string]func() string) string { case "update": helpStr = base.WrapForHelpText([]string{ + "Deprecated: use 'boundary credential-libraries update vault-generic' instead.", "Usage: boundary credential-libraries update vault [options] [args]", "", " Update a vault-type credential library given its ID. Example:", diff --git a/internal/cmd/common/flags.go b/internal/cmd/common/flags.go index f907545ed..07d6ead52 100644 --- a/internal/cmd/common/flags.go +++ b/internal/cmd/common/flags.go @@ -139,6 +139,11 @@ type CombinedSliceFlagValuePopulationInput struct { // combination method, e.g. "attr" will be used to build "string-attr"; also // used for generating help texts PiecewisePopulationInputBaseName string + + // If ProtoCompat is true, the key will be validated against proto3 syntax + // requirements for identifiers. If the string is split via KeyDelimiter, each + // segment will be evaluated independently. + PiecewiseNoProtoCompat bool } func PopulateCombinedSliceFlagValue(input CombinedSliceFlagValuePopulationInput) { @@ -163,7 +168,7 @@ func PopulateCombinedSliceFlagValue(input CombinedSliceFlagValuePopulationInput) Target: input.PiecewisePopulationFlag, KvSplit: true, KeyDelimiter: &keyDelimiter, - ProtoCompatKey: true, + ProtoCompatKey: !input.PiecewiseNoProtoCompat, KeyOnlyAllowed: true, Usage: fmt.Sprintf( "A key=value pair to add to the request's %s map. "+ diff --git a/internal/cmd/gencli/input.go b/internal/cmd/gencli/input.go index 20b6b2b61..a7df2d470 100644 --- a/internal/cmd/gencli/input.go +++ b/internal/cmd/gencli/input.go @@ -237,9 +237,41 @@ var inputStructs = map[string][]*cmdInfo{ HasId: true, HasName: true, HasDescription: true, + NeedsSubtypeInCreate: true, Container: "CredentialStore", VersionedActions: []string{"update"}, + PrefixAttributeFieldErrorsWithSubactionPrefix: true, + }, + { + ResourceType: resource.CredentialLibrary.String(), + Pkg: "credentiallibraries", + StdActions: []string{"create", "update"}, + SubActionPrefix: "vault-generic", + HasExtraCommandVars: true, + SkipNormalHelp: true, + HasExtraHelpFunc: true, + HasId: true, + HasName: true, + HasDescription: true, NeedsSubtypeInCreate: true, + Container: "CredentialStore", + VersionedActions: []string{"update"}, + PrefixAttributeFieldErrorsWithSubactionPrefix: true, + }, + { + ResourceType: resource.CredentialLibrary.String(), + Pkg: "credentiallibraries", + StdActions: []string{"create", "update"}, + SubActionPrefix: "vault-ssh-certificate", + HasExtraCommandVars: true, + SkipNormalHelp: true, + HasExtraHelpFunc: true, + HasId: true, + HasName: true, + HasDescription: true, + NeedsSubtypeInCreate: true, + Container: "CredentialStore", + VersionedActions: []string{"update"}, PrefixAttributeFieldErrorsWithSubactionPrefix: true, }, }, diff --git a/internal/tests/cli/Makefile b/internal/tests/cli/Makefile index f153e4e37..b9531bd03 100644 --- a/internal/tests/cli/Makefile +++ b/internal/tests/cli/Makefile @@ -1,5 +1,36 @@ all: test +REGISTRY_NAME ?= docker.io/hashicorp +TEST_VAULT_IMAGE_NAME=vault +TEST_VAULT_IMAGE ?= $(REGISTRY_NAME)/$(TEST_VAULT_IMAGE_NAME):1.12.2 +TEST_VAULT_PORT ?= 8200 +TEST_VAULT_CONTAINER_NAME ?= boundary-cli-tests-vault + +VAULT_ADDR ?= "http://127.0.0.1:$(TEST_VAULT_PORT)" +VAULT_TOKEN ?= boundarytok + +.PHONY: test-vault-up +test-vault-up: + @echo "Using image: $(TEST_VAULT_IMAGE)" + @echo " vault addr: $(VAULT_ADDR)" + @echo "vault token: $(VAULT_TOKEN)" + @docker run \ + -d \ + --name $(TEST_VAULT_CONTAINER_NAME) \ + -e VAULT_DEV_ROOT_TOKEN_ID=$(VAULT_TOKEN) \ + -p $(TEST_VAULT_PORT):8200 \ + --cap-add IPC_LOCK \ + $(TEST_VAULT_IMAGE) + @echo "Container name: $(TEST_VAULT_CONTAINER_NAME)" + @echo "Test vault available at: $(VAULT_ADDR)" + @echo "For vault logs run:" + @echo " docker logs $(TEST_VAULT_CONTAINER_NAME)" + +.PHONY: test-vault-down +test-vault-down: + docker stop $(TEST_VAULT_CONTAINER_NAME) || true + docker rm -v $(TEST_VAULT_CONTAINER_NAME) || true + .PHONY: test test: ./test.sh diff --git a/internal/tests/cli/boundary/_credential_libraries.bash b/internal/tests/cli/boundary/_credential_libraries.bash new file mode 100644 index 000000000..606399e6b --- /dev/null +++ b/internal/tests/cli/boundary/_credential_libraries.bash @@ -0,0 +1,36 @@ +load _authorized_actions + +function create_vault_ssh_certificate_library() { + boundary credential-libraries \ + create vault-ssh-certificate $@ +} + +function create_vault_generic_library() { + boundary credential-libraries \ + create vault-generic $@ +} + +function create_vault_library() { + boundary credential-libraries \ + create vault $@ +} + +function read_credential_library() { + boundary credential-libraries read -id $1 -format json +} + +function delete_credential_library() { + boundary credential-libraries delete -id $1 +} + +function list_credential_libraries() { + local csid=$1 + boundary credential-libraries list -credential-store-id $1 -format json +} + +function credential_library_id() { + local name=$1 + local csid=$2 + + strip $(list_credential_libraries $csid | jq -c ".items[] | select(.name | contains(\"$name\")) | .[\"id\"]") +} diff --git a/internal/tests/cli/boundary/_credential_stores.bash b/internal/tests/cli/boundary/_credential_stores.bash index 54db7cc93..26a8fb907 100644 --- a/internal/tests/cli/boundary/_credential_stores.bash +++ b/internal/tests/cli/boundary/_credential_stores.bash @@ -10,6 +10,10 @@ function create_static_credential_store() { -scope-id $sid } +function create_vault_credential_store() { + boundary credential-stores create vault $@ +} + function read_credential_store() { boundary credential-stores read -id $1 -format json } diff --git a/internal/tests/cli/boundary/_vault.bash b/internal/tests/cli/boundary/_vault.bash new file mode 100644 index 000000000..4b7955ae2 --- /dev/null +++ b/internal/tests/cli/boundary/_vault.bash @@ -0,0 +1,47 @@ + +function vault_write_boundary_policy() { + ( + cat <