test(e2e): add GCP dynamic host catalog e2e tests (#5294)

* test(e2e): add GCP infra resources and tests for enos testing

- add 1 new `gcp_target` module that creates a GCP VM instance with labels for filtering
- add GCP dynamic host catalog e2e tests

enos/enos-modules.hcl

@@ -178,3 +178,15 @@ module "docker_ldap" {
 module "docker_minio" {
   source = "./modules/docker_minio"
 }
+
+module "gcp_iam_setup" {
+  source         = "./modules/gcp_iam_setup"
+  gcp_project_id = var.gcp_project_id
+}
+
+module "gcp_target" {
+  source       = "./modules/gcp_target"
+  target_count = var.target_count
+  environment  = var.environment
+  enos_user    = var.enos_user
+}

enos/enos-scenario-e2e-docker-base-with-gcp.hcl

@@ -0,0 +1,143 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# For this scenario to work, add the following line to /etc/hosts
+# 127.0.0.1 localhost boundary
+
+scenario "e2e_docker_base_with_gcp" {
+  terraform_cli = terraform_cli.default
+  terraform     = terraform.default
+  providers = [
+    provider.enos.default,
+    provider.google.default
+  ]
+
+  matrix {
+    builder = ["local", "crt"]
+  }
+
+  locals {
+    local_boundary_dir         = var.local_boundary_dir != null ? abspath(var.local_boundary_dir) : null
+    local_boundary_src_dir     = var.local_boundary_src_dir != null ? abspath(var.local_boundary_src_dir) : null
+    boundary_docker_image_file = abspath(var.boundary_docker_image_file)
+    license_path               = abspath(var.boundary_license_path != null ? var.boundary_license_path : joinpath(path.root, "./support/boundary.hclic"))
+    gcp_private_key            = var.gcp_private_key_path != null ? file(var.gcp_private_key_path) : var.gcp_private_key
+
+    network_cluster = "e2e_gcp"
+
+    build_path = {
+      "local" = "/tmp",
+      "crt"   = var.crt_bundle_path == null ? null : abspath(var.crt_bundle_path)
+    }
+    tags = merge({
+      "Project Name" : var.project_name
+      "Project" : "Enos",
+      "Environment" : "ci"
+    }, var.tags)
+  }
+
+  step "build_boundary_docker_image" {
+    module = matrix.builder == "crt" ? module.build_boundary_docker_crt : module.build_boundary_docker_local
+
+    variables {
+      path           = matrix.builder == "crt" ? local.boundary_docker_image_file : ""
+      cli_build_path = local.build_path[matrix.builder]
+      edition        = var.boundary_edition
+    }
+  }
+
+  step "create_docker_network" {
+    module = module.docker_network
+    variables {
+      network_name = local.network_cluster
+    }
+  }
+
+  step "create_boundary_database" {
+    depends_on = [
+      step.create_docker_network
+    ]
+    variables {
+      image_name   = "${var.docker_mirror}/library/postgres:latest"
+      network_name = [local.network_cluster]
+    }
+    module = module.docker_postgres
+  }
+
+  step "read_license" {
+    skip_step = var.boundary_edition == "oss"
+    module    = module.read_license
+
+    variables {
+      file_name = local.license_path
+    }
+  }
+
+  step "create_boundary" {
+    module = module.docker_boundary
+    depends_on = [
+      step.create_docker_network,
+      step.create_boundary_database,
+      step.build_boundary_docker_image
+    ]
+    variables {
+      image_name       = matrix.builder == "crt" ? var.boundary_docker_image_name : step.build_boundary_docker_image.image_name
+      network_name     = [local.network_cluster]
+      database_network = local.network_cluster
+      postgres_address = step.create_boundary_database.address
+      boundary_license = var.boundary_edition != "oss" ? step.read_license.license : ""
+    }
+  }
+
+  step "create_test_id" {
+    module = module.random_stringifier
+    variables {
+      length = 5
+    }
+  }
+
+  step "create_gcp_target" {
+    module = module.gcp_target
+
+    variables {
+      enos_user     = var.enos_user
+      instance_type = var.gcp_target_instance_type
+      gcp_zone      = var.gcp_zone
+      target_count  = 1
+    }
+  }
+
+  step "run_e2e_test" {
+    module = module.test_e2e_docker
+    depends_on = [
+      step.create_boundary,
+      step.create_gcp_target
+    ]
+    variables {
+      test_package           = "github.com/hashicorp/boundary/testing/internal/e2e/tests/gcp"
+      docker_mirror          = var.docker_mirror
+      network_name           = step.create_docker_network.network_name
+      go_version             = var.go_version
+      debug_no_run           = var.e2e_debug_no_run
+      alb_boundary_api_addr  = step.create_boundary.address
+      auth_method_id         = step.create_boundary.auth_method_id
+      auth_login_name        = step.create_boundary.login_name
+      auth_password          = step.create_boundary.password
+      local_boundary_dir     = step.build_boundary_docker_image.cli_zip_path
+      local_boundary_src_dir = local.local_boundary_src_dir
+      gcp_host_set_filter1   = step.create_gcp_target.filter_label1
+      gcp_host_set_filter2   = step.create_gcp_target.filter_label2
+      gcp_private_key_id     = var.gcp_private_key_id
+      gcp_private_key        = local.gcp_private_key
+      gcp_zone               = var.gcp_zone
+      gcp_project_id         = var.gcp_project_id
+      gcp_client_email       = var.gcp_client_email
+      gcp_target_ssh_key     = step.create_gcp_target.target_ssh_key
+      gcp_host_set_ips       = step.create_gcp_target.target_ips
+      target_address         = step.create_gcp_target.target_public_ips[0]
+      target_port            = "22"
+      target_user            = "ubuntu"
+      max_page_size          = step.create_boundary.max_page_size
+    }
+  }
+}

enos/enos-variables.hcl

@@ -200,3 +200,56 @@ variable "hcp_boundary_cluster_id" {
   // If using HCP int, ensure that the cluster id starts with "int-"
   // Example: "int-19283a-123123-..."
 }
+
+variable "gcp_target_instance_type" {
+  description = "Instance type for test target nodes"
+  type        = string
+  default     = "e2-micro"
+}
+
+variable "gcp_region" {
+  description = "GCP region where the resources will be created"
+  type        = string
+  default     = "us-central1"
+}
+
+variable "gcp_zone" {
+  description = "GCP zone where the resources will be created"
+  type        = string
+  default     = "us-central1-a"
+}
+
+variable "gcp_project_id" {
+  description = "GCP project where the resources will be created"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "gcp_private_key_path" {
+  description = "Path to the GCP private key"
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "gcp_private_key" {
+  description = "GCP private key"
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "gcp_private_key_id" {
+  description = "GCP private key ID"
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "gcp_client_email" {
+  description = "GCP client email"
+  type        = string
+  sensitive   = true
+  default     = null
+}

enos/enos.hcl

@@ -17,6 +17,11 @@ terraform "default" {
       source  = "hashicorp/aws"
       version = "5.72.1"
     }
+
+    google = {
+      source  = "hashicorp/google"
+      version = "5.22.0"
+    }
   }
 }
 
@@ -32,3 +37,8 @@ provider "enos" "default" {
     }
   }
 }
+
+provider "google" "default" {
+  region  = var.gcp_region
+  project = var.gcp_project_id
+}

enos/enos.vars.hcl

@@ -60,6 +60,23 @@
 // Number of target instances to create. Applies to AWS scenarios only.
 // target_count = 1
 
+// The GCP project ID to use for the tests. Only needed if running GCP scenarios.
+// gcp_project_id = "my-gcp-project-id"
+
+// The GCP private_key_path. This is used to authenticate with GCP. Only needed
+// if running GCP scenarios. This should not be used in combination with gcp_private_key.
+// gcp_private_key_path = ""
+
+// The GCP private_key. This is used to authenticate with GCP. Only needed
+// if running GCP scenarios. This should not be used in combination with gcp_private_key_path.
+// gcp_private_key = ""
+
+// The GCP private_key_id. Only needed if running GCP scenarios. 
+// gcp_private_key_id = ""
+
+// The GCP client_email used to authenticate with GCP
+// gcp_client_email = "my-gcp-client-email"
+
 // The directory that contains the copy of the boundary cli that the e2e tests
 // will use in CI. Only needed if e2e_debug_no_run = false.
 // local_boundary_dir = "/Users/<user>/.go/bin"

enos/modules/gcp_target/main.tf

@@ -0,0 +1,160 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "target_count" {}
+variable "enos_user" {}
+variable "additional_labels" {
+  default = {}
+}
+variable "instance_type" {
+  description = "The type of instance to create."
+  type        = string
+  default     = "e2-micro"
+}
+variable "environment" {
+  description = "Name of the environment."
+  type        = string
+  default     = "enos-environment"
+}
+variable "private_cidr_block" {
+  type    = list(string)
+  default = ["10.0.0.0/8"]
+}
+variable "gcp_zone" {
+  description = "The zone to deploy the resources."
+  type        = string
+  default     = "us-central1-a"
+}
+
+data "enos_environment" "current" {}
+
+resource "random_string" "test_string" {
+  length  = 5
+  lower   = true
+  upper   = false
+  numeric = false
+  special = false
+}
+
+resource "google_compute_network" "boundary_compute_network" {
+  name = "boundary-enos-network-${random_string.test_string.result}"
+}
+
+resource "random_id" "filter_label1" {
+  prefix      = "enos_boundary"
+  byte_length = 4
+}
+
+resource "random_id" "filter_label2" {
+  prefix      = "enos_boundary"
+  byte_length = 4
+}
+
+resource "tls_private_key" "ssh" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "google_compute_address" "boundary_external_ip" {
+  count        = var.target_count
+  name         = "boundary-external-ip-${random_string.test_string.result}-${count.index}"
+  address_type = "EXTERNAL"
+}
+
+resource "google_compute_firewall" "boundary_private_ssh" {
+  name          = "boundary-private-ssh-${random_string.test_string.result}"
+  network       = google_compute_network.boundary_compute_network.name
+  source_ranges = var.private_cidr_block
+  target_tags   = ["boundary-target-${random_string.test_string.result}"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["22"]
+  }
+}
+
+resource "google_compute_firewall" "boundary_enos_ssh" {
+  name          = "boundary-enos-ssh-${random_string.test_string.result}"
+  network       = google_compute_network.boundary_compute_network.name
+  source_ranges = flatten([formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses)])
+  target_tags   = ["boundary-target-${random_string.test_string.result}"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["22"]
+  }
+}
+
+resource "google_compute_instance" "boundary_target" {
+  count        = var.target_count
+  name         = "boundary-target-${random_string.test_string.result}-${count.index}"
+  machine_type = var.instance_type
+  zone         = var.gcp_zone
+
+  boot_disk {
+    initialize_params {
+      image = "ubuntu-os-cloud/ubuntu-2204-lts"
+    }
+  }
+
+  network_interface {
+    network = google_compute_network.boundary_compute_network.id
+
+    access_config {
+      nat_ip = google_compute_address.boundary_external_ip[count.index].address
+    }
+  }
+
+  tags = ["boundary-target-${random_string.test_string.result}"]
+
+  metadata = {
+    ssh-keys = "ubuntu:${tls_private_key.ssh.public_key_openssh}"
+  }
+
+  labels = merge(var.additional_labels, {
+    "name" : "boundary-target-${random_string.test_string.result}-${count.index}",
+    "type" : "target",
+    "project" : "enos",
+    "project_name" : "qti-enos-boundary",
+    "environment" : var.environment,
+    "enos_user" : var.enos_user,
+    "filter_label_1" : random_id.filter_label1.hex
+    "filter_label_2" : random_id.filter_label2.hex
+  })
+}
+
+output "target_private_ips" {
+  value = [for instance in google_compute_instance.boundary_target : instance.network_interface[0].network_ip]
+}
+
+output "target_public_ips" {
+  value = [for instance in google_compute_instance.boundary_target : instance.network_interface[0].access_config[0].nat_ip]
+}
+
+output "target_ips" {
+  value = flatten([
+    [for instance in google_compute_instance.boundary_target : instance.network_interface[0].network_ip],
+    [for instance in google_compute_instance.boundary_target : instance.network_interface[0].access_config[0].nat_ip]
+  ])
+}
+
+output "target_ssh_key" {
+  value     = tls_private_key.ssh.private_key_pem
+  sensitive = true
+}
+
+output "filter_label1" {
+  value = "labels.filter_label_1=${random_id.filter_label1.hex}"
+}
+
+output "filter_label2" {
+  value = "labels.filter_label_2=${random_id.filter_label2.hex}"
+}

enos/modules/test_e2e_docker/main.tf

@@ -222,6 +222,63 @@ variable "test_timeout" {
   type    = string
   default = "25m"
 }
+variable "gcp_private_key_id" {
+  description = "ID of the private key used to authenticate with GCP"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "gcp_private_key" {
+  description = "Private key used to authenticate with GCP"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "gcp_project_id" {
+  description = "GCP project where the resources will be created"
+  type        = string
+  default     = ""
+}
+
+variable "gcp_zone" {
+  description = "GCP zone where the resources will be created"
+  type        = string
+  default     = ""
+}
+
+variable "gcp_target_ssh_key" {
+  description = "SSH key used to authenticate with GCP target"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "gcp_client_email" {
+  description = "GCP client email associated with the private key"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "gcp_host_set_filter1" {
+  description = "value for the first filter in the host set"
+  type        = string
+  default     = ""
+}
+
+variable "gcp_host_set_filter2" {
+  description = "value for the second filter in the host set"
+  type        = string
+  default     = ""
+}
+
+variable "gcp_host_set_ips" {
+  description = "List of IP addresses"
+  type        = list(string)
+  default     = [""]
+}
 
 resource "enos_local_exec" "get_go_version" {
   count  = var.go_version == "" ? 1 : 0
@@ -284,6 +341,15 @@ resource "enos_local_exec" "run_e2e_test" {
     E2E_LDAP_USER_NAME            = var.ldap_user_name
     E2E_LDAP_USER_PASSWORD        = var.ldap_user_password
     E2E_LDAP_GROUP_NAME           = var.ldap_group_name
+    E2E_GCP_PRIVATE_KEY_ID        = var.gcp_private_key_id
+    E2E_GCP_PRIVATE_KEY           = var.gcp_private_key
+    E2E_GCP_PROJECT_ID            = var.gcp_project_id
+    E2E_GCP_CLIENT_EMAIL          = var.gcp_client_email
+    E2E_GCP_ZONE                  = var.gcp_zone
+    E2E_GCP_TARGET_SSH_KEY        = var.gcp_target_ssh_key
+    E2E_GCP_HOST_SET_FILTER1      = var.gcp_host_set_filter1
+    E2E_GCP_HOST_SET_FILTER2      = var.gcp_host_set_filter2
+    E2E_GCP_HOST_SET_IPS          = jsonencode(var.gcp_host_set_ips)
     E2E_MAX_PAGE_SIZE             = var.max_page_size
     E2E_CONTROLLER_CONTAINER_NAME = var.controller_container_name
     BOUNDARY_DIR                  = abspath(var.local_boundary_src_dir)

enos/modules/test_e2e_docker/test_runner.sh

@@ -45,6 +45,15 @@ docker run \
     -e "E2E_LDAP_USER_NAME=$E2E_LDAP_USER_NAME" \
     -e "E2E_LDAP_USER_PASSWORD=$E2E_LDAP_USER_PASSWORD" \
     -e "E2E_LDAP_GROUP_NAME=$E2E_LDAP_GROUP_NAME" \
+    -e "E2E_GCP_PRIVATE_KEY_ID=$E2E_GCP_PRIVATE_KEY_ID" \
+    -e "E2E_GCP_PRIVATE_KEY=$E2E_GCP_PRIVATE_KEY" \
+    -e "E2E_GCP_CLIENT_EMAIL=$E2E_GCP_CLIENT_EMAIL" \
+    -e "E2E_GCP_PROJECT_ID=$E2E_GCP_PROJECT_ID" \
+    -e "E2E_GCP_ZONE=$E2E_GCP_ZONE" \
+    -e "E2E_GCP_TARGET_SSH_KEY=$E2E_GCP_TARGET_SSH_KEY" \
+    -e "E2E_GCP_HOST_SET_FILTER1=$E2E_GCP_HOST_SET_FILTER1" \
+    -e "E2E_GCP_HOST_SET_FILTER2=$E2E_GCP_HOST_SET_FILTER2" \
+    -e "E2E_GCP_HOST_SET_IPS=$E2E_GCP_HOST_SET_IPS" \
     -e "E2E_MAX_PAGE_SIZE=$E2E_MAX_PAGE_SIZE" \
     -e "E2E_CONTROLLER_CONTAINER_NAME=$E2E_CONTROLLER_CONTAINER_NAME" \
     --mount type=bind,src=$BOUNDARY_DIR,dst=/src/boundary/ \