feat(cli): Add vault ssh certificate credential library

internal/tests/cli/Makefile

@@ -1,5 +1,36 @@
 all: test
 
+REGISTRY_NAME ?= docker.io/hashicorp
+TEST_VAULT_IMAGE_NAME=vault
+TEST_VAULT_IMAGE ?= $(REGISTRY_NAME)/$(TEST_VAULT_IMAGE_NAME):1.12.2
+TEST_VAULT_PORT ?= 8200
+TEST_VAULT_CONTAINER_NAME ?= boundary-cli-tests-vault
+
+VAULT_ADDR ?= "http://127.0.0.1:$(TEST_VAULT_PORT)"
+VAULT_TOKEN ?= boundarytok
+
+.PHONY: test-vault-up
+test-vault-up:
+	@echo "Using image: $(TEST_VAULT_IMAGE)"
+	@echo " vault addr: $(VAULT_ADDR)"
+	@echo "vault token: $(VAULT_TOKEN)"
+	@docker run \
+		-d \
+		--name $(TEST_VAULT_CONTAINER_NAME) \
+		-e VAULT_DEV_ROOT_TOKEN_ID=$(VAULT_TOKEN) \
+		-p $(TEST_VAULT_PORT):8200 \
+		--cap-add IPC_LOCK \
+		$(TEST_VAULT_IMAGE)
+	@echo "Container name: $(TEST_VAULT_CONTAINER_NAME)"
+	@echo "Test vault available at: $(VAULT_ADDR)"
+	@echo "For vault logs run:"
+	@echo "    docker logs $(TEST_VAULT_CONTAINER_NAME)"
+
+.PHONY: test-vault-down
+test-vault-down:
+	docker stop $(TEST_VAULT_CONTAINER_NAME) || true
+	docker rm -v $(TEST_VAULT_CONTAINER_NAME) || true
+
 .PHONY: test
 test:
 	./test.sh

internal/tests/cli/boundary/_credential_libraries.bash

@@ -0,0 +1,36 @@
+load _authorized_actions
+
+function create_vault_ssh_certificate_library() {
+  boundary credential-libraries \
+    create vault-ssh-certificate $@
+}
+
+function create_vault_generic_library() {
+  boundary credential-libraries \
+    create vault-generic $@
+}
+
+function create_vault_library() {
+  boundary credential-libraries \
+    create vault $@
+}
+
+function read_credential_library() {
+  boundary credential-libraries read -id $1 -format json
+}
+
+function delete_credential_library() {
+  boundary credential-libraries delete -id $1
+}
+
+function list_credential_libraries() {
+  local csid=$1
+  boundary credential-libraries list -credential-store-id $1 -format json
+}
+
+function credential_library_id() {
+  local name=$1
+  local csid=$2
+
+  strip $(list_credential_libraries $csid | jq -c ".items[] | select(.name | contains(\"$name\")) | .[\"id\"]")
+}

internal/tests/cli/boundary/_credential_stores.bash

@@ -10,6 +10,10 @@ function create_static_credential_store() {
     -scope-id $sid
 }
 
+function create_vault_credential_store() {
+  boundary credential-stores create vault $@
+}
+
 function read_credential_store() {
   boundary credential-stores read -id $1 -format json
 }

internal/tests/cli/boundary/_vault.bash

@@ -0,0 +1,47 @@
+
+function vault_write_boundary_policy() {
+  (
+  cat <<EOF
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/renew-self" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}
+
+path "sys/leases/renew" {
+  capabilities = ["update"]
+}
+
+path "sys/leases/revoke" {
+  capabilities = ["update"]
+}
+
+path "sys/capabilities-self" {
+  capabilities = ["update"]
+}
+EOF
+  ) | vault policy write boundary-controller -
+}
+
+function create_vault_token() {
+  vault token create \
+    -format=json \
+    -no-default-policy=true \
+    -policy="boundary-controller" \
+    -orphan=true \
+    -period=2m \
+    -renewable=true | \
+    jq -r '.auth.client_token'
+}
+
+function skip_if_no_vault() {
+  if [[ -z $VAULT_ADDR ]] || [[ -z $VAULT_TOKEN ]]; then
+    skip "vault environment variables \$VAULT_ADDR and \$VAULT_TOKEN not set"
+  fi
+}

internal/tests/cli/boundary/credential_libraries.bats

@@ -0,0 +1,181 @@
+#!/usr/bin/env bats
+
+load _auth
+load _helpers
+load _vault
+load _credential_stores
+load _credential_libraries
+
+export NEW_STORE='test_vault'
+export NEW_VAULT_LIB="test_vault"
+
+@test "boundary/login: can login as default user" {
+  run login $DEFAULT_LOGIN
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: setup vault-generic credential store $NEW_STORE in default project" {
+  skip_if_no_vault
+
+  vault_write_boundary_policy
+  local vault_token=$(create_vault_token)
+  run create_vault_credential_store \
+    -name $NEW_STORE -scope-id $DEFAULT_P_ID \
+    -vault-address $VAULT_ADDR \
+    -vault-token $vault_token
+
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-generic library in credential store $NEW_STORE" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_generic_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault-generic libary" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_generic_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault-generic library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault-generic library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault library in credential store $NEW_STORE deprecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault libary deprecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /kv/secret \
+    -vault-http-method GET
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault library depcrecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault library depcrecated subcommand" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-ssh-certificate library in credential store $NEW_STORE" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_ssh_certificate_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /ssh/sign/foo \
+    -username foo
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault-ssh-certificate libary" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run create_vault_ssh_certificate_library \
+    -name $NEW_VAULT_LIB -credential-store-id $csid \
+    -vault-path /ssh/sign/foo \
+    -username foo
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault-ssh-certificate library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run read_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault-ssh-certificate library" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  local clid=$(credential_library_id $NEW_VAULT_LIB $csid)
+  run delete_credential_library $clid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+
+# Note, deleting the cred store will revoke the vault token
+@test "boundary/credential-stores: cleanup can delete $NEW_STORE vault store" {
+  skip_if_no_vault
+
+  local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID)
+  run delete_credential_store $csid
+  echo "$output"
+  [ "$status" -eq 0 ]
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+}
+