ce: chore(e2e): Add support for downstream workers (#6478)

(cherry picked from commit 77a682058ee8c7f0c27f017c61fb444d4dee40dd)

enos/modules/aws_boundary/boundary-instances.tf

@@ -242,6 +242,7 @@ resource "enos_file" "worker_config" {
     kms_key_id              = data.aws_kms_key.kms_key.id,
     controller_ips          = var.ip_version == "4" ? jsonencode(aws_instance.controller.*.private_ip) : jsonencode(formatlist("[%s]:9201", flatten(aws_instance.controller.*.ipv6_addresses)))
     listener_address        = var.ip_version == "4" ? "0.0.0.0" : "[::]"
+    listener_proxy_port     = var.listener_proxy_port
     public_address          = var.ip_version == "6" ? format("[%s]", aws_instance.worker[tonumber(each.value)].ipv6_addresses[0]) : aws_instance.worker[tonumber(each.value)].public_ip
     region                  = var.aws_region
     type                    = jsonencode(var.worker_type_tags)

enos/modules/aws_boundary/outputs.tf

@@ -16,6 +16,11 @@ output "worker_ips" {
   value       = var.ip_version == "6" ? flatten(aws_instance.worker.*.ipv6_addresses) : aws_instance.worker.*.public_ip
 }
 
+output "worker_ips_private" {
+  description = "Private IPs of boundary workers"
+  value       = var.ip_version == "6" || var.ip_version == "dual" ? flatten(aws_instance.worker.*.ipv6_addresses) : aws_instance.worker.*.private_ip
+}
+
 output "alb_hostname" {
   description = "Public hostname of Controller ALB"
   value       = aws_alb.boundary_alb.dns_name
@@ -256,4 +261,14 @@ output "worker_ipv6_cidr" {
 output "alb_cert" {
   description = "Public cert for the alb"
   value       = try(tls_self_signed_cert.certificate[0].cert_pem, null)
-}
+}
+
+output "controller_upstream_ips" {
+  description = "List of ips that workers can use to reach controllers"
+  value       = var.ip_version == "4" ? [for ip in aws_instance.controller.*.private_ip : "${ip}:${var.listener_cluster_port}"] : [for ip in flatten(aws_instance.controller.*.ipv6_addresses) : "[${ip}]:${var.listener_cluster_port}"]
+}
+
+output "worker_upstream_ips" {
+  description = "List of ips that workers can use to reach upstream workers"
+  value       = var.ip_version == "4" ? [for ip in aws_instance.worker.*.private_ip : "${ip}:${var.listener_proxy_port}"] : [for ip in flatten(aws_instance.worker.*.ipv6_addresses) : "[${ip}]:${var.listener_proxy_port}"]
+}

enos/modules/aws_boundary/templates/worker.hcl

@@ -4,7 +4,7 @@
 listener "tcp" {
   purpose     = "proxy"
   tls_disable = true
-  address     = "${listener_address}"
+  address     = "${listener_address}:${listener_proxy_port}"
 }
 
 worker {
@@ -30,6 +30,12 @@ kms "awskms" {
   kms_key_id = "${kms_key_id}"
 }
 
+kms "awskms" {
+  purpose    = "downstream-worker-auth"
+  region     = "${region}"
+  kms_key_id = "${kms_key_id}"
+}
+
 events {
   audit_enabled        = true
   observations_enabled = true

enos/modules/aws_boundary/templates/worker_bsr.hcl

@@ -4,7 +4,7 @@
 listener "tcp" {
   purpose     = "proxy"
   tls_disable = true
-  address     = "${listener_address}"
+  address     = "${listener_address}:${listener_proxy_port}"
 }
 
 worker {
@@ -32,6 +32,12 @@ kms "awskms" {
   kms_key_id = "${kms_key_id}"
 }
 
+kms "awskms" {
+  purpose    = "downstream-worker-auth"
+  region     = "${region}"
+  kms_key_id = "${kms_key_id}"
+}
+
 events {
   audit_enabled        = true
   observations_enabled = true

enos/modules/aws_boundary/templates/worker_bsr_vault_kms.hcl

@@ -4,7 +4,7 @@
 listener "tcp" {
   purpose     = "proxy"
   tls_disable = true
-  address     = "${listener_address}:9202"
+  address     = "${listener_address}:${listener_proxy_port}"
 }
 
 worker {
@@ -36,6 +36,16 @@ kms "transit" {
   tls_skip_verify    = "true"
 }
 
+kms "transit" {
+  purpose            = "downstream-worker-auth"
+  address            = "http://${vault_address}:8200"
+  token              = "${vault_transit_token}"
+  disable_renewal    = "false"
+  key_name           = "boundary-worker-auth"
+  mount_path         = "transit/"
+  tls_skip_verify    = "true"
+}
+
 events {
   audit_enabled        = true
   observations_enabled = true

enos/modules/aws_boundary/templates/worker_hcp_bsr.hcl

@@ -4,7 +4,7 @@
 listener "tcp" {
   purpose     = "proxy"
   tls_disable = true
-  address     = "${listener_address}"
+  address     = "${listener_address}:${listener_proxy_port}"
 }
 
 hcp_boundary_cluster_id = "${hcp_boundary_cluster_id}"
@@ -21,6 +21,12 @@ worker {
   recording_storage_path = "${recording_storage_path}"
 }
 
+kms "awskms" {
+  purpose    = "downstream-worker-auth"
+  region     = "${region}"
+  kms_key_id = "${kms_key_id}"
+}
+
 events {
   audit_enabled        = true
   observations_enabled = true

enos/modules/aws_boundary/templates/worker_vault_kms.hcl

@@ -4,7 +4,7 @@
 listener "tcp" {
   purpose     = "proxy"
   tls_disable = true
-  address     = "${listener_address}"
+  address     = "${listener_address}:${listener_proxy_port}"
 }
 
 worker {
@@ -34,6 +34,16 @@ kms "transit" {
   tls_skip_verify    = "true"
 }
 
+kms "transit" {
+  purpose            = "downstream-worker-auth"
+  address            = "http://${vault_address}:8200"
+  token              = "${vault_transit_token}"
+  disable_renewal    = "false"
+  key_name           = "boundary-worker-auth"
+  mount_path         = "transit/"
+  tls_skip_verify    = "true"
+}
+
 events {
   audit_enabled        = true
   observations_enabled = true

enos/modules/aws_boundary/variables.tf

@@ -31,7 +31,7 @@ variable "worker_instance_type" {
 variable "worker_type_tags" {
   description = "Tag to set on worker for use in worker filters"
   type        = list(string)
-  default     = ["collocated", "prod", "webservers", "linux"]
+  default     = ["collocated", "ingress", "prod", "webservers", "linux"]
 }
 
 variable "worker_ebs_iops" {
@@ -406,4 +406,4 @@ variable "protocol" {
   description = "http protocol (http/https)"
   type        = string
   default     = "http"
-}
+}