test(e2e): Add an enos module for docker-based workers (#3603)

* test(e2e): Add an enos module for a worker in docker

* fixup! test(e2e): Add an enos module for a worker in docker

enos/modules/docker_worker/main.tf

@@ -0,0 +1,120 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "3.0.1"
+    }
+
+    tls = {
+      source  = "hashicorp/tls"
+      version = "4.0.4"
+    }
+
+    enos = {
+      source = "app.terraform.io/hashicorp-qti/enos"
+    }
+  }
+}
+
+variable "image_name" {
+  description = "Name of Docker Image"
+  type        = string
+}
+variable "network_name" {
+  description = "Name of Docker Networks to join"
+  type        = list(string)
+}
+variable "container_name" {
+  description = "Name of Docker Container"
+  type        = string
+  default     = "worker"
+}
+variable "boundary_license" {
+  description = "License string"
+  type        = string
+}
+variable "initial_upstream" {
+  description = "Address to upstream instance that it communicates to"
+  type        = string
+}
+variable "port" {
+  description = "Port to use"
+  type        = number
+  default     = 9402
+}
+variable "tags" {
+  description = "Tags to set on worker for use in worker filters"
+  type        = list(string)
+  default     = ["e2e"]
+}
+variable "config_file" {
+  description = "Path to config file"
+  type        = string
+  default     = "worker-config.hcl"
+}
+
+resource "docker_image" "boundary" {
+  name         = var.image_name
+  keep_locally = true
+}
+
+locals {
+  recording_storage_path = "/recordings"
+}
+
+resource "docker_container" "worker" {
+  image   = docker_image.boundary.image_id
+  name    = var.container_name
+  command = ["boundary", "server", "-config", "/boundary/worker-config.hcl"]
+  env = [
+    "BOUNDARY_LICENSE=${var.boundary_license}",
+    "HOSTNAME=boundary",
+    "SKIP_CHOWN=true",
+  ]
+  ports {
+    internal = var.port
+    external = var.port
+  }
+  capabilities {
+    add = ["IPC_LOCK"]
+  }
+  mounts {
+    type   = "tmpfs"
+    target = local.recording_storage_path
+  }
+  mounts {
+    type   = "tmpfs"
+    target = "/boundary/logs"
+  }
+  upload {
+    content = templatefile("${abspath(path.module)}/${var.config_file}", {
+      worker_name            = var.container_name
+      initial_upstream       = var.initial_upstream
+      type_tags              = jsonencode(var.tags)
+      recording_storage_path = local.recording_storage_path
+      port                   = var.port
+    })
+    file = "/boundary/worker-config.hcl"
+  }
+  healthcheck {
+    test     = ["CMD", "grep", "-i", "worker has successfully authenticated", "/boundary/logs/events.log"]
+    interval = "3s"
+    timeout  = "5s"
+    retries  = 5
+  }
+  wait     = true
+  must_run = true
+  dynamic "networks_advanced" {
+    for_each = var.network_name
+    content {
+      name = networks_advanced.value
+    }
+  }
+}
+
+output "upstream_address" {
+  value = "${var.container_name}:${var.port}"
+}

enos/modules/docker_worker/worker-config-bsr-downstream.hcl

@@ -0,0 +1,66 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_mlock = true
+
+telemetry {
+  prometheus_retention_time = "24h"
+  disable_hostname          = true
+}
+
+listener "tcp" {
+  address     = "0.0.0.0:${port}"
+  purpose     = "proxy"
+  tls_disable = true
+}
+
+worker {
+  name = "${worker_name}"
+  initial_upstreams = ["${initial_upstream}"]
+
+  tags {
+    type = ${type_tags},
+  }
+
+  recording_storage_path = "${recording_storage_path}"
+}
+
+# This key_id needs to match the corresponding upstream worker's
+# "downstream-worker-auth" kms
+kms "aead" {
+  purpose   = "worker-auth"
+  aead_type = "aes-gcm"
+  key       = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
+  key_id    = "downstream_worker-auth"
+}
+
+events {
+  audit_enabled       = true
+  sysevents_enabled   = true
+  observations_enable = true
+
+  sink "stderr" {
+    name        = "all-events"
+    description = "All events sent to stderr"
+    event_types = ["*"]
+    format      = "cloudevents-json"
+  }
+
+  sink {
+    name = "Log File"
+    event_types = ["*"]
+    format = "cloudevents-json"
+
+    file {
+      path = "/boundary/logs"
+      file_name = "events.log"
+    }
+
+    audit_config {
+      audit_filter_overrides {
+        secret    = "redact"
+        sensitive = "redact"
+      }
+    }
+  }
+}

enos/modules/docker_worker/worker-config-bsr.hcl

@@ -0,0 +1,75 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_mlock = true
+
+telemetry {
+  prometheus_retention_time = "24h"
+  disable_hostname          = true
+}
+
+listener "tcp" {
+  address     = "0.0.0.0:${port}"
+  purpose     = "proxy"
+  tls_disable = true
+}
+
+worker {
+  name = "${worker_name}"
+  initial_upstreams = ["${initial_upstream}"]
+
+  tags {
+    type = ${type_tags},
+  }
+
+  recording_storage_path = "${recording_storage_path}"
+}
+
+# This key_id needs to match the corresponding upstream controller's
+# "worker-auth" kms
+kms "aead" {
+  purpose   = "worker-auth"
+  aead_type = "aes-gcm"
+  key       = "OLFhJNbEb3umRjdhY15QKNEmNXokY1Iq"
+  key_id    = "global_worker-auth"
+}
+
+# This key_id needs to match the corresponding downstream worker's
+# "worker-auth" kms
+kms "aead" {
+  purpose   = "downstream-worker-auth"
+  aead_type = "aes-gcm"
+  key       = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
+  key_id    = "downstream_worker-auth"
+}
+
+events {
+  audit_enabled       = true
+  sysevents_enabled   = true
+  observations_enable = true
+
+  sink "stderr" {
+    name        = "all-events"
+    description = "All events sent to stderr"
+    event_types = ["*"]
+    format      = "cloudevents-json"
+  }
+
+  sink {
+    name = "Log File"
+    event_types = ["*"]
+    format = "cloudevents-json"
+
+    file {
+      path = "/boundary/logs"
+      file_name = "events.log"
+    }
+
+    audit_config {
+      audit_filter_overrides {
+        secret    = "redact"
+        sensitive = "redact"
+      }
+    }
+  }
+}

enos/modules/docker_worker/worker-config-downstream.hcl

@@ -0,0 +1,64 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_mlock = true
+
+telemetry {
+  prometheus_retention_time = "24h"
+  disable_hostname          = true
+}
+
+listener "tcp" {
+  address     = "0.0.0.0:${port}"
+  purpose     = "proxy"
+  tls_disable = true
+}
+
+worker {
+  name = "${worker_name}"
+  initial_upstreams = ["${initial_upstream}"]
+
+  tags {
+    type = ${type_tags},
+  }
+}
+
+# This key_id needs to match the corresponding upstream worker's
+# "downstream-worker-auth" kms
+kms "aead" {
+  purpose   = "worker-auth"
+  aead_type = "aes-gcm"
+  key       = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
+  key_id    = "downstream_worker-auth"
+}
+
+events {
+  audit_enabled       = true
+  sysevents_enabled   = true
+  observations_enable = true
+
+  sink "stderr" {
+    name        = "all-events"
+    description = "All events sent to stderr"
+    event_types = ["*"]
+    format      = "cloudevents-json"
+  }
+
+  sink {
+    name = "Log File"
+    event_types = ["*"]
+    format = "cloudevents-json"
+
+    file {
+      path = "/boundary/logs"
+      file_name = "events.log"
+    }
+
+    audit_config {
+      audit_filter_overrides {
+        secret    = "redact"
+        sensitive = "redact"
+      }
+    }
+  }
+}

enos/modules/docker_worker/worker-config.hcl

@@ -0,0 +1,73 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_mlock = true
+
+telemetry {
+  prometheus_retention_time = "24h"
+  disable_hostname          = true
+}
+
+listener "tcp" {
+  address     = "0.0.0.0:${port}"
+  purpose     = "proxy"
+  tls_disable = true
+}
+
+worker {
+  name = "${worker_name}"
+  initial_upstreams = ["${initial_upstream}"]
+
+  tags {
+    type = ${type_tags},
+  }
+}
+
+# This key_id needs to match the corresponding upstream controller's
+# "worker-auth" kms
+kms "aead" {
+  purpose   = "worker-auth"
+  aead_type = "aes-gcm"
+  key       = "OLFhJNbEb3umRjdhY15QKNEmNXokY1Iq"
+  key_id    = "global_worker-auth"
+}
+
+# This key_id needs to match the corresponding downstream worker's
+# "worker-auth" kms
+kms "aead" {
+  purpose   = "downstream-worker-auth"
+  aead_type = "aes-gcm"
+  key       = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
+  key_id    = "downstream_worker-auth"
+}
+
+events {
+  audit_enabled       = true
+  sysevents_enabled   = true
+  observations_enable = true
+
+  sink "stderr" {
+    name        = "all-events"
+    description = "All events sent to stderr"
+    event_types = ["*"]
+    format      = "cloudevents-json"
+  }
+
+  sink {
+    name = "Log File"
+    event_types = ["*"]
+    format = "cloudevents-json"
+
+    file {
+      path = "/boundary/logs"
+      file_name = "events.log"
+    }
+
+    audit_config {
+      audit_filter_overrides {
+        secret    = "redact"
+        sensitive = "redact"
+      }
+    }
+  }
+}