From dc912e2a8630c4cce208ce5ebd8c93ee512a9cc6 Mon Sep 17 00:00:00 2001 From: Michael Li Date: Tue, 26 Sep 2023 10:33:53 -0400 Subject: [PATCH] test: Update tests to account for deprecated features in 0.14.0 (#3776) * chore: Fix comment typo * test(e2e): Update to use new credential library type * test(e2e): Update to use new field name * test(bats): Remove tests that use deprecated subcommand * chore: Update to 0.14.0 * test(credentiallibraries): Update to use new credential library type * doc: Add deprecation notices for 0.14.0 * fixup! doc: Add deprecation notices for 0.14.0 --- CHANGELOG.md | 37 +++++++----- .../credentiallibrary_service_test.go | 38 +------------ .../credentiallibrary_test.go | 8 +-- internal/tests/api/targets/target_test.go | 4 +- .../cli/boundary/credential_libraries.bats | 57 ------------------- testing/internal/e2e/boundary/boundary.go | 2 +- .../base_with_vault/credential_store_test.go | 8 +-- .../target_tcp_vault_connect_test.go | 2 +- .../target_tcp_worker_connect_ssh_test.go | 2 +- .../e2e/tests/database/migration_test.go | 4 +- version/VERSION | 2 +- version/feature_manager.go | 2 +- version/version_base.go | 2 +- 13 files changed, 42 insertions(+), 126 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e8a2fa825..092f10a36 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,15 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. ## Next +### Deprecations/Changes +* Per the note in Boundary 0.12.0, the `vault` credential library subtype has now been + removed in favor of `vault-generic`. For example, instead of `boundary + credential-libraries create vault`, you must use `boundary + credential-libraries create vault-generic`. +* Per the note in Boundary 0.12.0, errors returned from the cli when using the + `-format=json` option will now only use the `status_code` field. The `status` + field has been removed. + ### New and Improved * cli: Add support for specifying a command that will be executed on the remote host when @@ -14,11 +23,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. maximum_page_size and dereference_aliases ([PR](https://github.com/hashicorp/boundary/pull/3679)). * feat: add worker upstream connection status to ops health check - ([PR](https://github.com/hashicorp/boundary/pull/3650)). + ([PR](https://github.com/hashicorp/boundary/pull/3650)). * feat: allow HCP cluster id to be sourced from file or env variable ([PR](https://github.com/hashicorp/boundary/pull/3709)). -* feat: add support for telemetry events via flag or Boundary configuration (requires observation events to be enabled). -Deny filter now filters coordination worker status from observation events by default. (This behaviour is overridden by any user specified allow or deny filters) +* feat: add support for telemetry events via flag or Boundary configuration (requires observation events to be enabled). +Deny filter now filters coordination worker status from observation events by default. (This behaviour is overridden by any user specified allow or deny filters) ([PR](https://github.com/hashicorp/boundary/pull/3753)). ### Bug Fixes @@ -52,14 +61,14 @@ Deny filter now filters coordination worker status from observation events by de ### Bug Fixes -* PKI worker authentication: A worker authentication record can be stored more than once, if it matches the +* PKI worker authentication: A worker authentication record can be stored more than once, if it matches the existing record for that worker auth key ID. Fixes an edge case where a worker attempted authorization and the controller successfully stored the worker auth record but went down before returning authorization details to the worker. ([PR](https://github.com/hashicorp/boundary/pull/3389)) * LDAP managed groups: adding/setting/removing a principal to a role now works properly when it's an LDAP managed group. ([PR](https://github.com/hashicorp/boundary/pull/3361) and - [PR](https://github.com/hashicorp/boundary/pull/3363)) + [PR](https://github.com/hashicorp/boundary/pull/3363)) ## 0.13.0 (2023/06/13) @@ -134,12 +143,12 @@ Deny filter now filters coordination worker status from observation events by de incorrectly being generated for auth token resources, which do not support versioning. This is technically a breaking change, but it was a no-op option anyways that there was no reason to be using. It has now been removed. -* Plugins: With the introduction of the storage plugin service, the Azure and AWS Host plugin - repositories have been renamed to drop the `host` element of the repository name: +* Plugins: With the introduction of the storage plugin service, the Azure and AWS Host plugin + repositories have been renamed to drop the `host` element of the repository name: - https://github.com/hashicorp/boundary-plugin-host-aws -> https://github.com/hashicorp/boundary-plugin-aws - https://github.com/hashicorp/boundary-plugin-host-azure -> https://github.com/hashicorp/boundary-plugin-azure - + Similarly the `plugins/host` package has been renamed to `plugins/boundary` ([PR1](https://github.com/hashicorp/boundary/pull/3262), [PR2](https://github.com/hashicorp/boundary-plugin-aws/pull/24), @@ -253,14 +262,14 @@ open-source release of 0.12.3; the same fixes will be in 0.13.0 OSS. * metrics: Adds accepted connections and closed connections counters to keep track downstream connections for worker and controller servers. ([PR](https://github.com/hashicorp/boundary/pull/2668)) -* Egress and Ingress worker filters: The target `worker_filter` field has been deprecated and +* Egress and Ingress worker filters: The target `worker_filter` field has been deprecated and replaced with egress and ingress worker filters. Egress worker filters determine which workers are - used to access targets. Ingress worker filters (HCP Boundary only) determine which workers are + used to access targets. Ingress worker filters (HCP Boundary only) determine which workers are used to connect with a client to initiate a session. ([PR](https://github.com/hashicorp/boundary/pull/2654)) -* Multi-Hop Sessions (HCP Boundary only): Multi-hop PKI workers can communicate with each other to serve - 2 primary purposes: authentication and session proxying. This results in the ability to chain - multiple workers together to access services hidden under layers of network security. Multi-hop - workers can also establish a TCP session through multiple workers, with the ability to reverse +* Multi-Hop Sessions (HCP Boundary only): Multi-hop PKI workers can communicate with each other to serve + 2 primary purposes: authentication and session proxying. This results in the ability to chain + multiple workers together to access services hidden under layers of network security. Multi-hop + workers can also establish a TCP session through multiple workers, with the ability to reverse proxy and establish a connection. * Vault SSH certificate credential library: A new credential library that uses the vault ssh secret engine to generate ssh private key and certificates. The diff --git a/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go b/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go index b335303b4..81b69cd19 100644 --- a/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go +++ b/internal/daemon/controller/handlers/credentiallibraries/credentiallibrary_service_test.go @@ -781,7 +781,7 @@ func TestCreate(t *testing.T) { name: "Create a valid vault CredentialLibrary with the 'vault' subtype", req: &pbs.CreateCredentialLibraryRequest{Item: &pb.CredentialLibrary{ CredentialStoreId: store.GetPublicId(), - Type: vault.Subtype.String(), + Type: vault.GenericLibrarySubtype.String(), Attrs: &pb.CredentialLibrary_VaultCredentialLibraryAttributes{ VaultCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{ Path: wrapperspb.String("something"), @@ -809,42 +809,6 @@ func TestCreate(t *testing.T) { }, }, }, - { - name: "Create a valid vault CredentialLibrary with no type set subtype", - req: &pbs.CreateCredentialLibraryRequest{ - Item: &pb.CredentialLibrary{ - CredentialStoreId: store.GetPublicId(), - Type: "", - Attrs: &pb.CredentialLibrary_Attributes{ - Attributes: &structpb.Struct{ - Fields: map[string]*structpb.Value{ - "path": structpb.NewStringValue("something"), - }, - }, - }, - }, - }, - idPrefix: globals.VaultCredentialLibraryPrefix + "_", - res: &pbs.CreateCredentialLibraryResponse{ - Uri: fmt.Sprintf("credential-libraries/%s_", globals.VaultCredentialLibraryPrefix), - Item: &pb.CredentialLibrary{ - Id: store.GetPublicId(), - CredentialStoreId: store.GetPublicId(), - CreatedTime: store.GetCreateTime().GetTimestamp(), - UpdatedTime: store.GetUpdateTime().GetTimestamp(), - Scope: &scopepb.ScopeInfo{Id: prj.GetPublicId(), Type: prj.GetType(), ParentScopeId: prj.GetParentId()}, - Version: 1, - Type: vault.GenericLibrarySubtype.String(), - Attrs: &pb.CredentialLibrary_VaultGenericCredentialLibraryAttributes{ - VaultGenericCredentialLibraryAttributes: &pb.VaultCredentialLibraryAttributes{ - Path: wrapperspb.String("something"), - HttpMethod: wrapperspb.String("GET"), - }, - }, - AuthorizedActions: testAuthorizedActions, - }, - }, - }, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { diff --git a/internal/tests/api/credentiallibraries/credentiallibrary_test.go b/internal/tests/api/credentiallibraries/credentiallibrary_test.go index edbb93698..32498b8da 100644 --- a/internal/tests/api/credentiallibraries/credentiallibrary_test.go +++ b/internal/tests/api/credentiallibraries/credentiallibrary_test.go @@ -48,7 +48,7 @@ func TestList(t *testing.T) { expected = append(expected, &credentiallibraries.CredentialLibrary{Name: fmt.Sprint(i), Attributes: map[string]any{"vault_path": "something"}}) } - cl, err := lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName(expected[0].Name), credentiallibraries.WithVaultCredentialLibraryPath("something")) + cl, err := lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName(expected[0].Name), credentiallibraries.WithVaultCredentialLibraryPath("something")) require.NoError(err) expected[0] = cl.Item @@ -57,7 +57,7 @@ func TestList(t *testing.T) { assert.ElementsMatch(comparableSetSlice(expected[:1]), comparableSetSlice(ul.Items)) for i := 1; i < 10; i++ { - cl, err = lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName(expected[i].Name), credentiallibraries.WithVaultCredentialLibraryPath("something")) + cl, err = lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName(expected[i].Name), credentiallibraries.WithVaultCredentialLibraryPath("something")) require.NoError(err) expected[i] = cl.Item } @@ -119,7 +119,7 @@ func TestCrud(t *testing.T) { lClient := credentiallibraries.NewClient(client) - r, err := lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName("foo"), + r, err := lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName("foo"), credentiallibraries.WithVaultCredentialLibraryPath("something")) require.Nil(err) checkResource(t, "create", r.Item, err, "foo", 1) @@ -162,7 +162,7 @@ func TestErrors(t *testing.T) { lClient := credentiallibraries.NewClient(client) - l, err := lClient.Create(tc.Context(), cs.Item.Type, cs.Item.Id, credentiallibraries.WithName("foo"), + l, err := lClient.Create(tc.Context(), "vault-generic", cs.Item.Id, credentiallibraries.WithName("foo"), credentiallibraries.WithVaultCredentialLibraryPath("something")) require.NoError(err) assert.NotNil(l) diff --git a/internal/tests/api/targets/target_test.go b/internal/tests/api/targets/target_test.go index 443166522..508b01a8b 100644 --- a/internal/tests/api/targets/target_test.go +++ b/internal/tests/api/targets/target_test.go @@ -91,11 +91,11 @@ func TestCredentialSourcesASD(t *testing.T) { require.NotNil(csVault) lClient := credentiallibraries.NewClient(client) - lib1, err := lClient.Create(tc.Context(), csVault.Item.Type, csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1")) + lib1, err := lClient.Create(tc.Context(), "vault-generic", csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something1")) require.NoError(err) require.NotNil(lib1) - lib2, err := lClient.Create(tc.Context(), csVault.Item.Type, csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2")) + lib2, err := lClient.Create(tc.Context(), "vault-generic", csVault.Item.Id, credentiallibraries.WithVaultCredentialLibraryPath("something2")) require.NoError(err) require.NotNil(lib2) diff --git a/internal/tests/cli/boundary/credential_libraries.bats b/internal/tests/cli/boundary/credential_libraries.bats index 0a51e296f..794288e76 100644 --- a/internal/tests/cli/boundary/credential_libraries.bats +++ b/internal/tests/cli/boundary/credential_libraries.bats @@ -93,63 +93,6 @@ export NEW_VAULT_LIB="test_vault" [ "$status" -eq 0 ] } -@test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault library in credential store $NEW_STORE deprecated subcommand" { - skip_if_no_vault - - local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID) - run create_vault_library \ - -name $NEW_VAULT_LIB -credential-store-id $csid \ - -vault-path /kv/secret \ - -vault-http-method GET - echo "$output" - [ "$status" -eq 0 ] - - local clid=$(credential_library_id $NEW_VAULT_LIB $csid) - run read_credential_library $clid - echo "$output" - [ "$status" -eq 0 ] - got=$(echo "$output") - - run field_eq "$got" ".item.attributes.path" '"/kv/secret"' - [ "$status" -eq 0 ] - run field_eq "$got" ".item.attributes.http_method" '"GET"' - [ "$status" -eq 0 ] -} - -@test "boundary/credential-libraries: can not create already created $NEW_VAULT_LIB vault libary deprecated subcommand" { - skip_if_no_vault - - local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID) - run create_vault_library \ - -name $NEW_VAULT_LIB -credential-store-id $csid \ - -vault-path /kv/secret \ - -vault-http-method GET - echo "$output" - [ "$status" -eq 1 ] -} - -@test "boundary/credential-libraries: can read $NEW_VAULT_LIB vault library depcrecated subcommand" { - skip_if_no_vault - - local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID) - local clid=$(credential_library_id $NEW_VAULT_LIB $csid) - run read_credential_library $clid - echo "$output" - [ "$status" -eq 0 ] -} - -@test "boundary/credential-libraries: can delete $NEW_VAULT_LIB vault library depcrecated subcommand" { - skip_if_no_vault - - local csid=$(credential_store_id $NEW_STORE $DEFAULT_P_ID) - local clid=$(credential_library_id $NEW_VAULT_LIB $csid) - run delete_credential_library $clid - echo "$output" - [ "$status" -eq 0 ] - run has_status_code "$output" "204" - [ "$status" -eq 0 ] -} - @test "boundary/credential-libraries: can create $NEW_VAULT_LIB vault-ssh-certificate library in credential store $NEW_STORE" { skip_if_no_vault diff --git a/testing/internal/e2e/boundary/boundary.go b/testing/internal/e2e/boundary/boundary.go index 6ad7f4f18..c22d69971 100644 --- a/testing/internal/e2e/boundary/boundary.go +++ b/testing/internal/e2e/boundary/boundary.go @@ -34,5 +34,5 @@ type DbInitInfo struct { // CliError parses the Stderr from running a boundary command type CliError struct { - Status int `json:"status"` + Status int `json:"status_code"` } diff --git a/testing/internal/e2e/tests/base_with_vault/credential_store_test.go b/testing/internal/e2e/tests/base_with_vault/credential_store_test.go index 15a90a1db..8ddbbeaf6 100644 --- a/testing/internal/e2e/tests/base_with_vault/credential_store_test.go +++ b/testing/internal/e2e/tests/base_with_vault/credential_store_test.go @@ -102,7 +102,7 @@ func TestCliVaultCredentialStore(t *testing.T) { // Create a credential library for the private key output = e2e.RunCommand(ctx, "boundary", e2e.WithArgs( - "credential-libraries", "create", "vault", + "credential-libraries", "create", "vault-generic", "-credential-store-id", newCredentialStoreId, "-vault-path", c.VaultSecretPath+"/data/"+privateKeySecretName, "-name", "e2e Automated Test Vault Credential Library - Private Key", @@ -120,7 +120,7 @@ func TestCliVaultCredentialStore(t *testing.T) { // Create a credential library for the password output = e2e.RunCommand(ctx, "boundary", e2e.WithArgs( - "credential-libraries", "create", "vault", + "credential-libraries", "create", "vault-generic", "-credential-store-id", newCredentialStoreId, "-vault-path", c.VaultSecretPath+"/data/"+passwordSecretName, "-name", "e2e Automated Test Vault Credential Library - Password", @@ -259,7 +259,7 @@ func TestApiVaultCredentialStore(t *testing.T) { // Create a credential library for the private key clClient := credentiallibraries.NewClient(client) - newCredentialLibraryResult, err := clClient.Create(ctx, "vault", newCredentialStoreId, + newCredentialLibraryResult, err := clClient.Create(ctx, "vault-generic", newCredentialStoreId, credentiallibraries.WithVaultCredentialLibraryPath(c.VaultSecretPath+"/data/"+privateKeySecretName), credentiallibraries.WithCredentialType("ssh_private_key"), ) @@ -268,7 +268,7 @@ func TestApiVaultCredentialStore(t *testing.T) { t.Logf("Created Credential Library: %s", newPrivateKeyCredentialLibraryId) // Create a credential library for the password - newCredentialLibraryResult, err = clClient.Create(ctx, "vault", newCredentialStoreId, + newCredentialLibraryResult, err = clClient.Create(ctx, "vault-generic", newCredentialStoreId, credentiallibraries.WithVaultCredentialLibraryPath(c.VaultSecretPath+"/data/"+passwordSecretName), credentiallibraries.WithCredentialType("username_password"), ) diff --git a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_connect_test.go b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_connect_test.go index 852eed0e3..ca3349236 100644 --- a/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_connect_test.go +++ b/testing/internal/e2e/tests/base_with_vault/target_tcp_vault_connect_test.go @@ -103,7 +103,7 @@ func TestCliTcpTargetVaultConnectTarget(t *testing.T) { // Create a credential library output = e2e.RunCommand(ctx, "boundary", e2e.WithArgs( - "credential-libraries", "create", "vault", + "credential-libraries", "create", "vault-generic", "-credential-store-id", newCredentialStoreId, "-vault-path", fmt.Sprintf("%s/data/%s", c.VaultSecretPath, privateKeySecretName), "-name", "e2e Automated Test Vault Credential Library", diff --git a/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go b/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go index 0819690c0..23274d7a9 100644 --- a/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go +++ b/testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go @@ -100,7 +100,7 @@ func TestCliTcpTargetWorkerConnectTarget(t *testing.T) { // Create a credential library output = e2e.RunCommand(ctx, "boundary", e2e.WithArgs( - "credential-libraries", "create", "vault", + "credential-libraries", "create", "vault-generic", "-credential-store-id", newCredentialStoreId, "-vault-path", fmt.Sprintf("%s/data/%s", c.VaultSecretPath, privateKeySecretName), "-name", "e2e Automated Test Vault Credential Library", diff --git a/testing/internal/e2e/tests/database/migration_test.go b/testing/internal/e2e/tests/database/migration_test.go index ade44d4d6..91486dc7e 100644 --- a/testing/internal/e2e/tests/database/migration_test.go +++ b/testing/internal/e2e/tests/database/migration_test.go @@ -270,7 +270,7 @@ func populateBoundaryDatabase(t testing.TB, ctx context.Context, c *config, te T // Create a credential library for the private key in vault output = e2e.RunCommand(ctx, "boundary", e2e.WithArgs( - "credential-libraries", "create", "vault", + "credential-libraries", "create", "vault-generic", "-credential-store-id", newVaultCredentialStoreId, "-vault-path", c.VaultSecretPath+"/data/"+privateKeySecretName, "-name", "e2e Automated Test Vault Credential Library", @@ -288,7 +288,7 @@ func populateBoundaryDatabase(t testing.TB, ctx context.Context, c *config, te T // Create a credential library for the password in vault output = e2e.RunCommand(ctx, "boundary", e2e.WithArgs( - "credential-libraries", "create", "vault", + "credential-libraries", "create", "vault-generic", "-credential-store-id", newVaultCredentialStoreId, "-vault-path", c.VaultSecretPath+"/data/"+passwordSecretName, "-name", "e2e Automated Test Vault Credential Library - Password", diff --git a/version/VERSION b/version/VERSION index 9beb74d49..a803cc227 100644 --- a/version/VERSION +++ b/version/VERSION @@ -1 +1 @@ -0.13.2 +0.14.0 diff --git a/version/feature_manager.go b/version/feature_manager.go index 7d278b17b..41b0fe630 100644 --- a/version/feature_manager.go +++ b/version/feature_manager.go @@ -60,7 +60,7 @@ func init() { // UseTargetIdForHostId supports old CLI clients that are unaware of host-sourceless targets, // this feature populates the target's public id into the AuthorizeSessionResponse - // and the SessionAuthroizationData so the CLI can properly build the ssh command + // and the SessionAuthorizationData so the CLI can properly build the ssh command // when calling "boundary connect ssh..." featureMap[UseTargetIdForHostId] = MetadataConstraint{ Constraints: mustNewConstraints("< 0.14.0"), diff --git a/version/version_base.go b/version/version_base.go index fa11dcca6..96fae904d 100644 --- a/version/version_base.go +++ b/version/version_base.go @@ -13,7 +13,7 @@ var ( // Version is the base version // Default values - set when building locally (at build time) - Version = "0.13.2" + Version = "0.14.0" // VersionPrerelease is also set at compile time, similarly to Version. VersionPrerelease string