CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create IPv6 and dual stack enos tests (#5212)

Browse Source 
Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
This commit is contained in:
daniDanielle MiuDamian Debkowski
 authored and GitHub committed 2025-01-21 07:37:04 -08:00
1 parent 34d13a0aae
commit dd9c7b9d60
59 files changed
+1773 -301
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

enos/modules/aws_boundary/alb.tf
+18 -4
View File
@@ -1,11 +1,22 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
locals {
stack = {
"4" = "ipv4",
"dual" = "dualstack",
"6" = "dualstack-without-public-ipv4",
}
}
resource "aws_alb" "boundary_alb" {
name = "boundary-alb-${random_string.cluster_id.result}"
depends_on = [aws_instance.controller]
security_groups = [aws_security_group.boundary_alb_sg.id]
subnets = data.aws_subnets.infra.ids
ip_address_type = lookup(local.stack, var.ip_version, local.stack["4"])
tags = merge(local.common_tags,
{
Name = "boundary-alb-${random_string.cluster_id.result}"
@@ -14,10 +25,11 @@ resource "aws_alb" "boundary_alb" {
}
resource "aws_alb_target_group" "boundary_tg" {
name = "boundary-tg-${random_string.cluster_id.result}"
port = var.listener_api_port
protocol = "HTTP"
vpc_id = var.vpc_id
name = "boundary-tg-${random_string.cluster_id.result}"
port = var.listener_api_port
protocol = "HTTP"
vpc_id = var.vpc_id
ip_address_type = var.ip_version == "6" ? "ipv6" : "ipv4"
health_check {
path = var.healthcheck_path
@@ -26,6 +38,7 @@ resource "aws_alb_target_group" "boundary_tg" {
timeout = 2
healthy_threshold = 2
}
tags = merge(local.common_tags,
{
Name = "boundary-tg-${random_string.cluster_id.result}"
@@ -45,6 +58,7 @@ resource "aws_alb_listener" "boundary" {
load_balancer_arn = aws_alb.boundary_alb.arn
port = var.alb_listener_api_port
protocol = "HTTP"
default_action {
target_group_arn = aws_alb_target_group.boundary_tg.arn
type = "forward"
enos/modules/aws_boundary/boundary-instances.tf
+28 -19
View File
@@ -15,6 +15,7 @@ resource "aws_instance" "controller" {
key_name = var.ssh_aws_keypair
iam_instance_profile = aws_iam_instance_profile.boundary_profile.name
monitoring = var.controller_monitoring
ipv6_address_count = local.network_stack[var.ip_version].ipv6_address_count
root_block_device {
iops = var.controller_ebs_iops
@@ -41,6 +42,7 @@ resource "aws_instance" "worker" {
key_name = var.ssh_aws_keypair
iam_instance_profile = aws_iam_instance_profile.boundary_profile.name
monitoring = var.worker_monitoring
ipv6_address_count = local.network_stack[var.ip_version].ipv6_address_count
root_block_device {
iops = var.worker_ebs_iops
@@ -69,7 +71,7 @@ resource "enos_bundle_install" "controller" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
@@ -86,7 +88,7 @@ resource "enos_remote_exec" "update_path_controller" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
@@ -101,26 +103,29 @@ resource "enos_file" "controller_config" {
destination = "/etc/boundary/boundary.hcl"
content = templatefile("${path.module}/${var.controller_config_file_path}", {
id = each.value
dbuser = var.db_user,
dbpass = var.db_pass,
dbuser = var.db_user
dbpass = var.db_pass
dbhost = var.db_host == null ? aws_db_instance.boundary[0].address : var.db_host
dbport = var.db_port
dbname = local.db_name,
dbname = local.db_name
db_max_open_connections = var.db_max_open_connections
kms_key_id = data.aws_kms_key.kms_key.id,
local_ipv4 = aws_instance.controller[tonumber(each.value)].private_ip
kms_key_id = data.aws_kms_key.kms_key.id
listener_address = var.ip_version == "4" ? "0.0.0.0" : "[::]"
api_port = var.listener_api_port
ops_port = var.listener_ops_port
cluster_address = var.ip_version == "4" ? aws_instance.controller[tonumber(each.value)].private_ip : format("[%s]", aws_instance.controller[tonumber(each.value)].ipv6_addresses[0])
cluster_port = var.listener_cluster_port
region = var.aws_region
max_page_size = var.max_page_size
audit_log_dir = local.audit_log_directory
vault_address = local.network_stack[var.ip_version].vault_address
vault_transit_token = var.vault_transit_token
})
for_each = toset([for idx in range(var.controller_count) : tostring(idx)])
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
@@ -135,7 +140,7 @@ resource "enos_boundary_init" "controller" {
transport = {
ssh = {
host = try(aws_instance.controller[0].public_ip, null)
host = try(var.ip_version == "6" ? aws_instance.controller[0].ipv6_addresses[0] : aws_instance.controller[0].public_ip, null)
}
}
@@ -152,7 +157,7 @@ resource "enos_boundary_start" "controller_start" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
@@ -177,10 +182,11 @@ resource "enos_remote_exec" "create_controller_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
resource "enos_bundle_install" "worker" {
depends_on = [aws_instance.worker]
for_each = toset([for idx in range(var.worker_count) : tostring(idx)])
@@ -193,7 +199,7 @@ resource "enos_bundle_install" "worker" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -210,7 +216,7 @@ resource "enos_remote_exec" "update_path_worker" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -221,19 +227,22 @@ resource "enos_file" "worker_config" {
content = templatefile("${path.module}/${var.worker_config_file_path}", {
id = each.value
kms_key_id = data.aws_kms_key.kms_key.id,
controller_ips = jsonencode(aws_instance.controller.*.private_ip),
public_addr = aws_instance.worker[tonumber(each.value)].public_ip
controller_ips = var.ip_version == "4" ? jsonencode(aws_instance.controller.*.private_ip) : jsonencode(formatlist("[%s]:9201", flatten(aws_instance.controller.*.ipv6_addresses)))
listener_address = var.ip_version == "4" ? "0.0.0.0" : "[::]"
public_address = var.ip_version == "6" ? format("[%s]", aws_instance.worker[tonumber(each.value)].ipv6_addresses[0]) : aws_instance.worker[tonumber(each.value)].public_ip
region = var.aws_region
type = jsonencode(var.worker_type_tags)
recording_storage_path = var.recording_storage_path
audit_log_dir = local.audit_log_directory
hcp_boundary_cluster_id = var.hcp_boundary_cluster_id
vault_address = local.network_stack[var.ip_version].vault_address
vault_transit_token = var.vault_transit_token
})
for_each = toset([for idx in range(var.worker_count) : tostring(idx)])
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -250,7 +259,7 @@ resource "enos_boundary_start" "worker_start" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -270,7 +279,7 @@ resource "enos_remote_exec" "create_worker_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -282,7 +291,7 @@ resource "enos_remote_exec" "get_worker_token" {
inline = ["timeout 10s bash -c 'set -eo pipefail; until journalctl -u boundary.service | cat | grep \"Worker Auth Registration Request: .*\" | rev | cut -d \" \" -f 1 | rev | xargs; do sleep 2; done'"]
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
enos/modules/aws_boundary/main.tf
+43
View File
@@ -25,6 +25,49 @@ locals {
Pet = random_pet.default.id
},
)
network_stack = {
"4" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
formatlist("%s/32", var.alb_sg_additional_ips),
])
ingress_ipv6_cidr_blocks = [],
egress_cidr_blocks = ["0.0.0.0/0"],
egress_ipv6_cidr_blocks = [],
ipv6_address_count = 0,
vault_address = var.vault_address,
},
"6" = {
ingress_cidr_blocks = [],
ingress_ipv6_cidr_blocks = flatten([
try([for ip in coalesce(data.enos_environment.localhost.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)], []),
[data.aws_vpc.infra.ipv6_cidr_block],
[for ip in var.alb_sg_additional_ipv6_ips : cidrsubnet("${ip}/64", 0, 0)],
])
egress_cidr_blocks = [],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
vault_address = format("[%s]", var.vault_address)
},
"dual" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
formatlist("%s/32", var.alb_sg_additional_ips),
])
ingress_ipv6_cidr_blocks = flatten([
try([for ip in coalesce(data.enos_environment.localhost.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)], []),
[data.aws_vpc.infra.ipv6_cidr_block],
[for ip in var.alb_sg_additional_ipv6_ips : cidrsubnet("${ip}/64", 0, 0)],
]),
egress_cidr_blocks = ["0.0.0.0/0"],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
vault_address = try(format("[%s]", var.vault_address), "")
}
}
}
resource "random_string" "cluster_id" {
enos/modules/aws_boundary/outputs.tf
+13 -3
View File
@@ -3,12 +3,12 @@
output "controller_ips" {
description = "Public IPs of boundary controllers"
value = aws_instance.controller.*.public_ip
value = var.ip_version == "6" ? flatten(aws_instance.controller.*.ipv6_addresses) : aws_instance.controller.*.public_ip
}
output "worker_ips" {
description = "Public IPs of boundary workers"
value = aws_instance.worker.*.public_ip
value = var.ip_version == "6" ? flatten(aws_instance.worker.*.ipv6_addresses) : aws_instance.worker.*.public_ip
}
output "alb_hostname" {
@@ -208,7 +208,7 @@ output "cluster_tag" {
}
output "public_controller_addresses" {
value = aws_instance.controller[*].public_ip
value = var.ip_version == "4" ? aws_instance.controller[*].public_ip : aws_instance.controller[*].ipv6_addresses[0]
}
output "controller_aux_sg_id" {
@@ -232,3 +232,13 @@ output "worker_tokens" {
for token in enos_remote_exec.get_worker_token : trimspace(token.stdout)
], null)
}
output "worker_cidr" {
description = "List of ipv4 subnets of all workers"
value = formatlist("%s/32", aws_instance.worker.*.public_ip)
}
output "worker_ipv6_cidr" {
description = "List of ipv6 subnets of all workers"
value = distinct([for ip in flatten(aws_instance.worker.*.ipv6_addresses) : cidrsubnet("${ip}/64", 0, 0)])
}
enos/modules/aws_boundary/rds.tf
+3 -1
View File
@@ -17,9 +17,11 @@ resource "aws_db_instance" "boundary" {
instance_class = var.db_class
monitoring_interval = var.db_monitoring_interval
monitoring_role_arn = var.db_monitoring_role_arn
publicly_accessible = true
publicly_accessible = false
db_name = local.db_name
network_type = var.ip_version == "4" ? "IPV4" : "DUAL"
// username and password must not be provided when restoring from a snapshot
username = local.is_restored_db ? null : var.db_user
password = local.is_restored_db ? null : var.db_pass
enos/modules/aws_boundary/security-groups.tf
+37 -35
View File
@@ -22,24 +22,22 @@ resource "aws_security_group" "boundary_sg" {
# SSH
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses)])
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
dynamic "ingress" {
for_each = local.listener_ports
content {
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
])
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
description = ingress.key
from_port = ingress.value
to_port = ingress.value
ipv6_cidr_blocks = []
prefix_list_ids = []
protocol = "tcp"
self = null
@@ -48,10 +46,11 @@ resource "aws_security_group" "boundary_sg" {
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(
@@ -86,27 +85,29 @@ resource "aws_security_group" "boundary_alb_sg" {
content {
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
try(format("%s/32", aws_instance.controller.0.public_ip), []),
formatlist("%s/32", var.alb_sg_additional_ips)
])
description = ingress.key
from_port = ingress.value
to_port = ingress.value
ipv6_cidr_blocks = []
prefix_list_ids = []
protocol = "tcp"
self = null
security_groups = []
local.network_stack[var.ip_version].ingress_cidr_blocks]
)
ipv6_cidr_blocks = flatten([
try(cidrsubnet("${aws_instance.controller.0.ipv6_addresses[0]}/64", 0, 0), []),
local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks]
)
description = ingress.key
from_port = ingress.value
to_port = ingress.value
prefix_list_ids = []
protocol = "tcp"
self = null
security_groups = []
}
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(
@@ -124,11 +125,11 @@ resource "aws_security_group" "boundary_db_sg" {
vpc_id = var.vpc_id
ingress {
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses), join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block)])
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
description = "database"
from_port = 5432
to_port = 5432
ipv6_cidr_blocks = []
prefix_list_ids = []
protocol = "tcp"
self = null
@@ -136,10 +137,11 @@ resource "aws_security_group" "boundary_db_sg" {
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(local.common_tags,
enos/modules/aws_boundary/templates/controller.hcl
+3 -3
View File
@@ -18,7 +18,7 @@ controller {
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${local_ipv4}:${api_port}"
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
@@ -31,7 +31,7 @@ listener "tcp" {
# API listener configuration block
listener "tcp" {
address = "${local_ipv4}:${ops_port}"
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
@@ -39,7 +39,7 @@ listener "tcp" {
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${local_ipv4}:${cluster_port}"
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
enos/modules/aws_boundary/templates/controller_bsr.hcl
+3 -3
View File
@@ -18,7 +18,7 @@ controller {
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${local_ipv4}:${api_port}"
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
@@ -31,7 +31,7 @@ listener "tcp" {
# API listener configuration block
listener "tcp" {
address = "${local_ipv4}:${ops_port}"
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
@@ -39,7 +39,7 @@ listener "tcp" {
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${local_ipv4}:${cluster_port}"
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
enos/modules/aws_boundary/templates/controller_bsr_vault_kms.hcl
+126
View File
@@ -0,0 +1,126 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
disable_mlock = true
controller {
name = "boundary-controller-${id}"
description = "Enos Boundary controller ${id}"
max_page_size = ${max_page_size}
database {
url = "postgresql://${dbuser}:${dbpass}@${dbhost}:${dbport}/${dbname}"
max_open_connections = ${db_max_open_connections}
}
}
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
# Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s)
# to appropriate values.
#cors_enabled = true
#cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"]
}
# API listener configuration block
listener "tcp" {
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "root"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-root"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "recovery"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-recovery"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "bsr"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-bsr"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/templates/controller_vault_kms.hcl
+115
View File
@@ -0,0 +1,115 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
disable_mlock = true
controller {
name = "boundary-controller-${id}"
description = "Enos Boundary controller ${id}"
max_page_size = ${max_page_size}
database {
url = "postgresql://${dbuser}:${dbpass}@${dbhost}:${dbport}/${dbname}"
max_open_connections = ${db_max_open_connections}
}
}
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
# Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s)
# to appropriate values.
#cors_enabled = true
#cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"]
}
# API listener configuration block
listener "tcp" {
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "root"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-root"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "recovery"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-recovery"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/templates/worker.hcl
+3 -3
View File
@@ -2,9 +2,9 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}"
}
worker {
@@ -15,7 +15,7 @@ worker {
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
type = ${type}
enos/modules/aws_boundary/templates/worker_bsr.hcl
+3 -3
View File
@@ -2,9 +2,9 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}"
}
worker {
@@ -15,7 +15,7 @@ worker {
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
type = ${type}
enos/modules/aws_boundary/templates/worker_bsr_vault_kms.hcl
+78
View File
@@ -0,0 +1,78 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "${listener_address}:9202"
}
worker {
# Name attr must be unique across workers
name = "demo-worker-${id}"
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_address}"
tags {
type = ${type}
region = ["${region}"]
}
recording_storage_path = "${recording_storage_path}"
}
# must be same key as used on controller config
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/templates/worker_hcp_bsr.hcl
+3 -3
View File
@@ -2,15 +2,15 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}"
}
hcp_boundary_cluster_id = "${hcp_boundary_cluster_id}"
worker {
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
type = ${type}
enos/modules/aws_boundary/templates/worker_vault_kms.hcl
+76
View File
@@ -0,0 +1,76 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "${listener_address}"
}
worker {
# Name attr must be unique across workers
name = "demo-worker-${id}"
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_address}"
tags {
type = ${type}
region = ["${region}"]
}
}
# must be same key as used on controller config
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/variables.tf
+29
View File
@@ -334,6 +334,12 @@ variable "alb_sg_additional_ips" {
default = []
}
variable "alb_sg_additional_ipv6_ips" {
description = "Additional ipv6 IPs to be allowed (ingress) on an ALB Security Group"
type = list(string)
default = []
}
variable "boundary_license" {
description = "Boundary license (not needed for OSS, required for enterprise)"
type = string
@@ -378,3 +384,26 @@ variable "hcp_boundary_cluster_id" {
// If using HCP int, ensure that the cluster id starts with "int-"
// Example: "int-19283a-123123-..."
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
variable "vault_address" {
description = "network address to a vault instance"
type = string
default = "localhost"
}
variable "vault_transit_token" {
description = "vault token used for kms transit in the boundary config"
type = string
default = ""
}
enos/modules/aws_target/main.tf
+70 -20
View File
@@ -26,36 +26,84 @@ variable "ingress_cidr" {
default = ["10.0.0.0/8"]
}
variable "ingress_ipv6_cidr" {
type = list(string)
default = []
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
data "enos_environment" "current" {}
data "aws_caller_identity" "current" {}
locals {
network_stack = {
"4" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses),
var.ingress_cidr,
])
ingress_ipv6_cidr_blocks = [],
egress_cidr_blocks = ["0.0.0.0/0"],
egress_ipv6_cidr_blocks = [],
ipv6_address_count = 0,
},
"6" = {
ingress_cidr_blocks = [],
ingress_ipv6_cidr_blocks = flatten([
[for ip in coalesce(data.enos_environment.current.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)],
var.ingress_ipv6_cidr,
])
egress_cidr_blocks = [],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
},
"dual" = {
ingress_cidr_blocks = flatten([
# allow ingress from ipv4 to allow for test setup from ci
formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses),
var.ingress_cidr,
])
ingress_ipv6_cidr_blocks = flatten([
[for ip in coalesce(data.enos_environment.current.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)],
var.ingress_ipv6_cidr,
])
egress_cidr_blocks = [],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
}
}
}
resource "aws_security_group" "boundary_target" {
name_prefix = "boundary-target-sg"
description = "SSH and boundary Traffic"
vpc_id = var.vpc_id
# SSH
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = var.ingress_cidr
}
ingress {
description = "SSH to the instance"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses)])
description = "SSH to the instance"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = {
@@ -71,6 +119,8 @@ resource "aws_instance" "target" {
subnet_id = var.subnet_ids[count.index % length(var.subnet_ids)]
key_name = var.aws_ssh_keypair_name
ipv6_address_count = local.network_stack[var.ip_version].ipv6_address_count
tags = merge(var.additional_tags, {
"Name" : "boundary-target-${count.index}-${split(":", data.aws_caller_identity.current.user_id)[1]}",
"Type" : "target",
@@ -90,15 +140,15 @@ resource "enos_remote_exec" "wait" {
transport = {
ssh = {
host = aws_instance.target[each.key].public_ip
host = var.ip_version == "6" ? aws_instance.target[each.key].ipv6_addresses[0] : aws_instance.target[each.key].public_ip
}
}
}
output "target_private_ips" {
value = aws_instance.target.*.private_ip
value = var.ip_version == "4" ? aws_instance.target.*.private_ip : formatlist("[%s]", flatten(aws_instance.target.*.ipv6_addresses))
}
output "target_public_ips" {
value = aws_instance.target.*.public_ip
value = var.ip_version == "4" ? aws_instance.target.*.public_ip : formatlist("[%s]", flatten(aws_instance.target.*.ipv6_addresses))
}
enos/modules/aws_vault/iam.tf
+6 -3
View File
@@ -36,17 +36,20 @@ data "aws_iam_policy_document" "vault_profile" {
}
resource "aws_iam_role" "vault_instance_role" {
count = var.deploy ? 1 : 0
name = "vault_instance_role-${random_string.cluster_id.result}"
assume_role_policy = data.aws_iam_policy_document.vault_instance_role.json
}
resource "aws_iam_instance_profile" "vault_profile" {
name = "vault_instance_profile-${random_string.cluster_id.result}"
role = aws_iam_role.vault_instance_role.name
count = var.deploy ? 1 : 0
name = "vault_instance_profile-${random_string.cluster_id.result}"
role = aws_iam_role.vault_instance_role[0].name
}
resource "aws_iam_role_policy" "vault_policy" {
count = var.deploy ? 1 : 0
name = "vault_policy-${random_string.cluster_id.result}"
role = aws_iam_role.vault_instance_role.id
role = aws_iam_role.vault_instance_role[0].id
policy = data.aws_iam_policy_document.vault_profile.json
}
enos/modules/aws_vault/locals.tf
+40 -3
View File
@@ -11,9 +11,9 @@ locals {
"awskms" = null
"shamir" = 3
}
followers = toset(slice(local.instances, 1, length(local.instances)))
instances = [for idx in range(var.instance_count) : tostring(idx)]
leader = toset(slice(local.instances, 0, 1))
followers = var.deploy ? toset(slice(local.instances, 1, length(local.instances))) : toset([])
instances = var.deploy ? [for idx in range(var.instance_count) : tostring(idx)] : []
leader = var.deploy ? toset(slice(local.instances, 0, 1)) : toset([])
name_suffix = "${var.project_name}-${var.environment}"
recovery_shares = {
"awskms" = 5
@@ -53,4 +53,41 @@ locals {
audit_device_file_path = "/var/log/vault/vault_audit.log"
vault_service_user = "vault"
enable_audit_device = var.enable_file_audit_device && var.vault_init
network_stack = {
"4" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
formatlist("%s/32", var.sg_additional_ips),
])
ingress_ipv6_cidr_blocks = [],
egress_cidr_blocks = ["0.0.0.0/0"],
egress_ipv6_cidr_blocks = [],
ipv6_address_count = 0,
},
"6" = {
ingress_cidr_blocks = [],
ingress_ipv6_cidr_blocks = flatten([
[for ip in coalesce(data.enos_environment.localhost.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)],
[data.aws_vpc.infra.ipv6_cidr_block],
[for ip in var.sg_additional_ipv6_ips : cidrsubnet("${ip}/64", 0, 0)],
])
egress_cidr_blocks = [],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
},
"dual" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
])
ingress_ipv6_cidr_blocks = flatten([
[for ip in coalesce(data.enos_environment.localhost.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)],
[data.aws_vpc.infra.ipv6_cidr_block],
[for ip in var.sg_additional_ipv6_ips : cidrsubnet("${ip}/64", 0, 0)],
])
egress_cidr_blocks = [],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
}
}
}
enos/modules/aws_vault/outputs.tf
+5 -1
View File
@@ -8,7 +8,7 @@ output "instance_ids" {
output "instance_public_ips" {
description = "Public IPs of Vault instances"
value = [for instance in aws_instance.vault_instance : instance.public_ip]
value = var.ip_version == "4" ? [for instance in aws_instance.vault_instance : instance.public_ip] : flatten([for instance in aws_instance.vault_instance : instance.ipv6_addresses])
}
output "instance_private_ips" {
@@ -40,6 +40,10 @@ output "vault_root_token" {
value = coalesce(var.vault_root_token, try(enos_vault_init.leader[0].root_token, null), "none")
}
output "vault_transit_token" {
value = try([for token in enos_remote_exec.vault_kms_policy : trimspace(token.stdout)][0], "")
}
output "vault_unseal_keys_b64" {
value = try(enos_vault_init.leader[0].unseal_keys_b64, [])
}
enos/modules/aws_vault/security-groups.tf
+26 -33
View File
@@ -2,52 +2,44 @@
# SPDX-License-Identifier: BUSL-1.1
resource "aws_security_group" "enos_vault_sg" {
count = var.deploy ? 1 : 0
name = "vault-sg-${random_string.cluster_id.result}"
description = "SSH and Vault Traffic"
vpc_id = var.vpc_id
# SSH
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
])
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
# Vault traffic
ingress {
from_port = 8200
to_port = 8201
protocol = "tcp"
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
formatlist("%s/32", var.sg_additional_ips),
])
from_port = 8200
to_port = 8201
protocol = "tcp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
# Consul Agent traffic
ingress {
from_port = 8301
to_port = 8301
protocol = "tcp"
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
])
from_port = 8301
to_port = 8301
protocol = "tcp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
ingress {
from_port = 8301
to_port = 8301
protocol = "udp"
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
])
from_port = 8301
to_port = 8301
protocol = "udp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
# Internal Traffic
@@ -59,10 +51,11 @@ resource "aws_security_group" "enos_vault_sg" {
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(
enos/modules/aws_vault/templates/create-kms-policy.sh
Executable
+71
View File
@@ -0,0 +1,71 @@
#!/bin/bash
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
function retry {
local retries=$1
shift
local count=0
until "$@"; do
exit=$?
wait=$((2 ** count))
count=$((count + 1))
if [ "$count" -lt "$retries" ]; then
sleep "$wait"
else
return "$exit"
fi
done
return 0
}
export VAULT_ADDR=http://localhost:8200
export VAULT_TOKEN='${vault_root_token}'
cat > ./kms-transit.hcl << EOF
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
path "transit/encrypt/boundary-recovery" {
capabilities = ["create", "update"]
}
path "transit/decrypt/boundary-recovery" {
capabilities = ["create", "update"]
}
path "transit/encrypt/boundary-worker-auth" {
capabilities = ["create", "update"]
}
path "transit/decrypt/boundary-worker-auth" {
capabilities = ["create", "update"]
}
path "transit/encrypt/boundary-root" {
capabilities = ["create", "update"]
}
path "transit/decrypt/boundary-root" {
capabilities = ["create", "update"]
}
path "transit/encrypt/boundary-bsr" {
capabilities = ["create", "update"]
}
path "transit/decrypt/boundary-bsr" {
capabilities = ["create", "update"]
}
EOF
retry 5 ${vault_bin_path} secrets enable transit > /dev/null
retry 5 ${vault_bin_path} policy write boundary-kms-transit-policy ./kms-transit.hcl > /dev/null
rm ./kms-transit.hcl > /dev/null
retry 5 ${vault_bin_path} token create -policy=boundary-kms-transit-policy -field=token
enos/modules/aws_vault/variables.tf
+24 -1
View File
@@ -71,6 +71,12 @@ variable "environment" {
type = string
}
variable "deploy" {
description = "Flag to toggle whether or not all the resources defined in this module should be deployed."
type = bool
default = false
}
variable "instance_count" {
description = "Number of EC2 instances in each subnet"
type = number
@@ -101,7 +107,13 @@ variable "project_name" {
}
variable "sg_additional_ips" {
description = "A list of additional IPs to allow by Vault security groups (use with caution)"
description = "A list of additional IPv4 IPs to allow by Vault security groups (use with caution)"
type = list(string)
default = []
}
variable "sg_additional_ipv6_ips" {
description = "A list of additional IPv6 IPs to allow by Vault security groups (use with caution)"
type = list(string)
default = []
}
@@ -253,3 +265,14 @@ variable "enable_file_audit_device" {
type = bool
default = true
}
variable "ip_version" {
type = string
description = "Optional variable that configures the vault instance to run on a ipv4, ipv6, or dualstack network"
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "Valid values for ip_version are (4, 6, dual)."
}
}
enos/modules/aws_vault/vault-instances.tf
+43 -23
View File
@@ -5,10 +5,11 @@ resource "aws_instance" "vault_instance" {
for_each = local.vault_instances
ami = var.ami_id
instance_type = var.instance_type
vpc_security_group_ids = [aws_security_group.enos_vault_sg.id]
vpc_security_group_ids = [aws_security_group.enos_vault_sg[0].id]
subnet_id = tolist(data.aws_subnets.infra.ids)[each.key % length(data.aws_subnets.infra.ids)]
key_name = var.ssh_aws_keypair
iam_instance_profile = aws_iam_instance_profile.vault_profile.name
iam_instance_profile = aws_iam_instance_profile.vault_profile[0].name
ipv6_address_count = local.network_stack[var.ip_version].ipv6_address_count
tags = merge(
var.common_tags,
{
@@ -31,7 +32,7 @@ resource "enos_remote_exec" "install_dependencies" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.value].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.value].ipv6_addresses[0] : aws_instance.vault_instance[each.value].public_ip
}
}
}
@@ -47,7 +48,7 @@ resource "enos_bundle_install" "consul" {
transport = {
ssh = {
host = each.value.public_ip
host = var.ip_version == "6" ? each.value.ipv6_addresses[0] : each.value.public_ip
}
}
}
@@ -62,7 +63,7 @@ resource "enos_bundle_install" "vault" {
transport = {
ssh = {
host = each.value.public_ip
host = var.ip_version == "6" ? each.value.ipv6_addresses[0] : each.value.public_ip
}
}
}
@@ -88,7 +89,7 @@ resource "enos_consul_start" "consul" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.key].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.key].ipv6_addresses[0] : aws_instance.vault_instance[each.key].public_ip
}
}
}
@@ -104,13 +105,13 @@ resource "enos_vault_start" "leader" {
config_dir = var.vault_config_dir
manage_service = var.manage_service
config = {
api_addr = "http://${aws_instance.vault_instance[each.key].private_ip}:8200"
cluster_addr = "http://${aws_instance.vault_instance[each.key].private_ip}:8201"
api_addr = var.ip_version == "4" ? "http://${aws_instance.vault_instance[each.key].private_ip}:8200" : "http://[${aws_instance.vault_instance[each.key].ipv6_addresses[0]}]:8200"
cluster_addr = var.ip_version == "4" ? "http://${aws_instance.vault_instance[each.key].private_ip}:8201" : "http://[${aws_instance.vault_instance[each.key].ipv6_addresses[0]}]:8201"
cluster_name = local.vault_cluster_tag
listener = {
type = "tcp"
attributes = {
address = "0.0.0.0:8200"
address = var.ip_version == "4" ? "0.0.0.0:8200" : "[::]:8200"
tls_disable = "true"
}
}
@@ -130,7 +131,7 @@ resource "enos_vault_start" "leader" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.key].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.key].ipv6_addresses[0] : aws_instance.vault_instance[each.key].public_ip
}
}
}
@@ -145,14 +146,14 @@ resource "enos_vault_start" "followers" {
config_dir = var.vault_config_dir
manage_service = var.manage_service
config = {
api_addr = "http://${aws_instance.vault_instance[each.key].private_ip}:8200"
cluster_addr = "http://${aws_instance.vault_instance[each.key].private_ip}:8201"
api_addr = var.ip_version == "4" ? "http://${aws_instance.vault_instance[each.key].private_ip}:8200" : "http://[${aws_instance.vault_instance[each.key].ipv6_addresses[0]}]:8200"
cluster_addr = var.ip_version == "4" ? "http://${aws_instance.vault_instance[each.key].private_ip}:8201" : "http://[${aws_instance.vault_instance[each.key].ipv6_addresses[0]}]:8201"
cluster_name = local.vault_cluster_tag
log_level = var.vault_log_level
listener = {
type = "tcp"
attributes = {
address = "0.0.0.0:8200"
address = var.ip_version == "4" ? "0.0.0.0:8200" : "[::]:8200"
tls_disable = "true"
}
}
@@ -171,7 +172,7 @@ resource "enos_vault_start" "followers" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.key].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.key].ipv6_addresses[0] : aws_instance.vault_instance[each.key].public_ip
}
}
}
@@ -194,7 +195,7 @@ resource "enos_vault_init" "leader" {
transport = {
ssh = {
host = aws_instance.vault_instance[0].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[0].ipv6_addresses[0] : aws_instance.vault_instance[0].public_ip
}
}
}
@@ -212,7 +213,7 @@ resource "enos_vault_unseal" "leader" {
transport = {
ssh = {
host = aws_instance.vault_instance[0].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[0].ipv6_addresses[0] : aws_instance.vault_instance[0].public_ip
}
}
}
@@ -237,7 +238,7 @@ resource "enos_remote_exec" "create_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.value].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.value].ipv6_addresses[0] : aws_instance.vault_instance[each.value].public_ip
}
}
}
@@ -254,7 +255,7 @@ resource "enos_remote_exec" "init_audit_device" {
environment = {
VAULT_TOKEN = enos_vault_init.leader[each.key].root_token
VAULT_ADDR = "http://127.0.0.1:8200"
VAULT_ADDR = var.ip_version == "4" ? "http://127.0.0.1:8200" : "http://[::1]:8200"
VAULT_BIN_PATH = local.vault_bin_path
LOG_FILE_PATH = local.audit_device_file_path
SERVICE_USER = local.vault_service_user
@@ -266,7 +267,7 @@ resource "enos_remote_exec" "init_audit_device" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.key].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.key].ipv6_addresses[0] : aws_instance.vault_instance[each.key].public_ip
}
}
}
@@ -289,7 +290,7 @@ resource "enos_vault_unseal" "followers" {
transport = {
ssh = {
host = aws_instance.vault_instance[0].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[0].ipv6_addresses[0] : aws_instance.vault_instance[0].public_ip
}
}
}
@@ -315,13 +316,13 @@ resource "enos_vault_unseal" "when_vault_unseal_when_no_init_is_set" {
transport = {
ssh = {
host = aws_instance.vault_instance[each.key].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[each.key].ipv6_addresses[0] : aws_instance.vault_instance[each.key].public_ip
}
}
}
resource "enos_remote_exec" "vault_write_license" {
count = var.vault_init ? 1 : 0
count = var.deploy && var.vault_init ? 1 : 0
depends_on = [
enos_vault_unseal.leader,
enos_vault_unseal.when_vault_unseal_when_no_init_is_set,
@@ -335,7 +336,26 @@ resource "enos_remote_exec" "vault_write_license" {
transport = {
ssh = {
host = aws_instance.vault_instance[0].public_ip
host = var.ip_version == "6" ? aws_instance.vault_instance[0].ipv6_addresses[0] : aws_instance.vault_instance[0].public_ip
}
}
}
resource "enos_remote_exec" "vault_kms_policy" {
count = var.deploy && var.vault_init ? 1 : 0
depends_on = [
enos_remote_exec.vault_write_license,
]
content = templatefile("${path.module}/templates/create-kms-policy.sh", {
vault_bin_path = local.vault_bin_path,
vault_root_token = coalesce(var.vault_root_token, try(enos_vault_init.leader[0].root_token, null), "none")
policy_path = "${path.module}/policies/kms-transit.hcl"
})
transport = {
ssh = {
host = var.ip_version == "6" ? aws_instance.vault_instance[0].ipv6_addresses[0] : aws_instance.vault_instance[0].public_ip
}
}
}
enos/modules/aws_vpc/main.tf
+1 -1
View File
@@ -210,7 +210,7 @@ output "vpc_id" {
output "vpc_cidr" {
description = "CIDR for whole VPC"
value = var.cidr
value = aws_vpc.vpc.cidr_block
}
output "vpc_subnets" {
enos/modules/aws_vpc_ipv6/main.tf
+319
View File
@@ -0,0 +1,319 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
terraform {
required_version = ">= 1.1.2"
required_providers {
enos = {
source = "registry.terraform.io/hashicorp-forge/enos"
version = ">= 0.3.25"
}
}
}
variable "name" {
type = string
default = "enos-vpc"
description = "The name of the VPC"
}
variable "availability_zones" {
description = "List of AWS availability zones to use (or * for all available)"
type = list(string)
default = ["*"]
}
variable "cidr" {
type = string
default = "10.13.0.0/16"
description = "CIDR block for the VPC"
}
variable "ipv6_cidr" {
type = string
default = "fd13:1:1::/48"
description = "IPv6 CIDR block for the VPC"
}
variable "environment" {
description = "Name of the environment."
type = string
default = "enos-environment"
}
variable "common_tags" {
description = "Tags to set for all resources"
type = map(string)
default = { "Project" : "enos" }
}
variable "create_kms_key" {
description = "Whether or not to create an key management service key"
type = bool
default = true
}
variable "ami_architectures" {
type = list(string)
description = "The AMI architectures to fetch AMI IDs for."
default = ["amd64", "arm64"]
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
data "enos_environment" "localhost" {}
check "ipv6_connection" {
assert {
condition = var.ip_version != "6" || data.enos_environment.localhost.public_ipv6_addresses != null
error_message = "no ipv6 connectivity detected, unable to set up ipv6-only tests"
}
}
locals {
// AWS AMIs standardized on the x86_64 label for 64bit x86 architectures, therefore amd64 should be rather x86_64.
architecture_filters = [for arch in var.ami_architectures : (arch == "amd64" ? "x86_64" : arch)]
tag_module = "aws_vpc"
common_tags = merge(
var.common_tags,
{
"Module" = local.tag_module
},
)
}
data "aws_availability_zones" "available" {
state = "available"
filter {
name = "zone-name"
values = var.availability_zones
}
}
data "aws_ami" "ubuntu" {
most_recent = true
count = length(local.architecture_filters)
# Currently latest LTS-1
filter {
name = "name"
values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-*-server-*"]
}
filter {
name = "virtualization-type"
values = ["hvm"]
}
filter {
name = "architecture"
values = [local.architecture_filters[count.index]]
}
owners = ["099720109477"] # Canonical
}
data "aws_ami" "rhel" {
most_recent = true
count = length(local.architecture_filters)
filter {
name = "name"
values = ["RHEL-8.8*HVM-20*"]
}
filter {
name = "virtualization-type"
values = ["hvm"]
}
filter {
name = "architecture"
values = [local.architecture_filters[count.index]]
}
owners = ["309956199498"] # Redhat
}
resource "random_string" "cluster_id" {
length = 8
lower = true
upper = false
numeric = false
special = false
}
resource "aws_kms_key" "key" {
count = var.create_kms_key ? 1 : 0
description = "enos-kms-key"
deletion_window_in_days = 7 // 7 is the shortest allowed window
}
resource "aws_kms_alias" "alias" {
count = var.create_kms_key ? 1 : 0
name = "alias/enos_key-${random_string.cluster_id.result}"
target_key_id = aws_kms_key.key[0].key_id
}
resource "aws_vpc" "vpc" {
cidr_block = var.cidr
enable_dns_hostnames = true
enable_dns_support = true
assign_generated_ipv6_cidr_block = true
tags = merge(
local.common_tags,
{
"Name" = var.name
},
)
}
resource "aws_subnet" "subnet" {
count = length(data.aws_availability_zones.available.names)
vpc_id = aws_vpc.vpc.id
cidr_block = cidrsubnet(var.cidr, 8, count.index)
availability_zone = data.aws_availability_zones.available.names[count.index]
map_public_ip_on_launch = true
ipv6_cidr_block = cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, 8, count.index + 16) # + 16 so we have some guaranteed unused subnets for other workers
assign_ipv6_address_on_creation = true
tags = merge(
local.common_tags,
{
"Name" = "${var.name}-subnet-${data.aws_availability_zones.available.names[count.index]}"
},
)
}
resource "aws_internet_gateway" "igw" {
vpc_id = aws_vpc.vpc.id
tags = merge(
local.common_tags,
{
"Name" = "${var.name}-igw"
},
)
}
resource "aws_route" "igw_ipv6" {
route_table_id = aws_vpc.vpc.default_route_table_id
destination_ipv6_cidr_block = "::/0"
gateway_id = aws_internet_gateway.igw.id
}
resource "aws_route" "igw_ipv4" {
count = var.ip_version == "6" ? 0 : 1
route_table_id = aws_vpc.vpc.default_route_table_id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw.id
}
resource "aws_security_group" "default" {
vpc_id = aws_vpc.vpc.id
ingress {
description = "allow_ingress_from_ipv6_only"
from_port = 0
to_port = 0
protocol = "tcp"
ipv6_cidr_blocks = ["::/0"]
}
ingress {
description = "allow_ingress_only_from_ipv4_enos_host"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([
# allow ingress from ipv4 to allow for test setup from ci
# TODO: remove this when github actions has ipv6 compatibility
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses)
])
}
egress {
description = "allow_egress_only_to_ipv4_enos_host"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([
# allow egress to ipv4 to allow for test setup from ci
# TODO: remove this when github actions has ipv6 compatibility
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses)
])
}
egress {
description = "allow_egress_from_ipv6_only"
from_port = 0
to_port = 0
protocol = "-1"
ipv6_cidr_blocks = ["::/0"]
}
tags = merge(
local.common_tags,
{
"Name" = "${var.name}-default"
},
)
}
output "vpc_id" {
description = "Created VPC ID"
value = aws_vpc.vpc.id
}
output "vpc_cidr" {
description = "CIDR for whole VPC"
value = aws_vpc.vpc.cidr_block
}
output "vpc_cidr_ipv6" {
description = "ipv6 CIDR for whole VPC"
value = aws_vpc.vpc.ipv6_cidr_block
}
output "vpc_subnets" {
description = "Generated subnet IDs and CIDRs"
value = { for s in aws_subnet.subnet : s.id => s.cidr_block }
}
output "kms_key_arn" {
description = "ARN of the generated KMS key"
value = try(aws_kms_key.key[0].arn, null)
}
output "kms_key_alias" {
description = "Alias of the generated KMS key"
value = try(aws_kms_alias.alias[0].name, null)
}
output "availability_zone_names" {
description = "All availability zones with resources"
value = data.aws_availability_zones.available.names
}
output "ami_ids" {
description = "The AWS AMI IDs for to use for ubuntu and rhel based instance for the amd64 and arm64 architectures."
value = {
ubuntu = { for idx, arch in var.ami_architectures : arch => data.aws_ami.ubuntu[idx].id }
rhel = { for idx, arch in var.ami_architectures : arch => data.aws_ami.rhel[idx].id }
}
}
output "vpc_tag_module" {
value = local.tag_module
}
enos/modules/aws_worker/main.tf
+37 -22
View File
@@ -56,10 +56,13 @@ resource "random_integer" "az" {
# Create a subnet so that the worker doesn't share one with a controller
resource "aws_subnet" "default" {
vpc_id = var.vpc_id
cidr_block = "10.13.9.0/24"
map_public_ip_on_launch = true
availability_zone = local.selected_az
vpc_id = var.vpc_id
cidr_block = "10.13.9.0/24"
ipv6_cidr_block = var.ip_version != "4" ? cidrsubnet(var.vpc_cidr_ipv6, 8, 0) : null
map_public_ip_on_launch = true
assign_ipv6_address_on_creation = var.ip_version != "4"
availability_zone = local.selected_az
tags = merge(
local.common_tags,
{
@@ -79,22 +82,28 @@ resource "aws_security_group" "default" {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses)])
cidr_blocks = var.ip_version == "6" ? [] : flatten([
# allow ingress from ipv4 to allow for test setup from ci
formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses)
])
ipv6_cidr_blocks = var.ip_version == "4" ? [] : (data.enos_environment.current.public_ipv6_addresses != null ? [for ip in data.enos_environment.current.public_ipv6_addresses : cidrsubnet("${ip}/64", 0, 0)] : [])
}
ingress {
description = "Communication from Boundary controller to worker"
from_port = 9202
to_port = 9202
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
description = "Communication from Boundary controller to worker"
from_port = 9202
to_port = 9202
protocol = "tcp"
cidr_blocks = var.ip_version == "6" ? [] : ["0.0.0.0/0"]
ipv6_cidr_blocks = var.ip_version == "4" ? [] : ["::/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = var.ip_version == "6" ? [] : ["0.0.0.0/0"]
ipv6_cidr_blocks = var.ip_version == "4" ? [] : ["::/0"]
}
tags = merge(
@@ -110,7 +119,8 @@ resource "aws_security_group" "default" {
resource "aws_vpc_security_group_ingress_rule" "worker_to_controller" {
description = "This rule allows traffic from a worker to controllers over WAN"
security_group_id = var.controller_sg_id
cidr_ipv4 = "${aws_instance.worker.public_ip}/32"
cidr_ipv4 = var.ip_version == "4" ? "${aws_instance.worker.public_ip}/32" : null
cidr_ipv6 = var.ip_version == "4" ? null : cidrsubnet("${aws_instance.worker.ipv6_addresses[0]}/64", 0, 0)
from_port = 9201
to_port = 9201
ip_protocol = "tcp"
@@ -134,6 +144,8 @@ resource "aws_instance" "worker" {
iam_instance_profile = aws_iam_instance_profile.boundary_profile.name
monitoring = var.worker_monitoring
ipv6_address_count = var.ip_version == "4" ? 0 : 1
root_block_device {
iops = var.ebs_iops
volume_size = var.ebs_size
@@ -160,7 +172,7 @@ resource "enos_bundle_install" "worker" {
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -176,7 +188,7 @@ resource "enos_remote_exec" "update_path_worker" {
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -193,17 +205,20 @@ resource "enos_file" "worker_config" {
content = templatefile("${path.module}/${var.config_file_path}", {
id = random_pet.worker.id
kms_key_id = data.aws_kms_key.kms_key.id
public_addr = aws_instance.worker.public_ip
controller_ips = var.ip_version == "4" ? jsonencode(var.controller_addresses) : jsonencode(formatlist("[%s]:9201", var.controller_addresses))
listener_address = var.ip_version == "4" ? "0.0.0.0" : "[::]"
public_address = var.ip_version == "6" ? format("[%s]", aws_instance.worker.ipv6_addresses[0]) : aws_instance.worker.public_ip
type = jsonencode(var.worker_type_tags)
region = data.aws_availability_zone.worker_az.region
controller_addresses = jsonencode(var.controller_addresses)
recording_storage_path = var.recording_storage_path
audit_log_dir = local.audit_log_directory
vault_address = var.ip_version == "4" ? var.vault_address : try(format("[%s]", var.vault_address), "")
vault_transit_token = var.vault_transit_token
})
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -219,7 +234,7 @@ resource "enos_boundary_start" "worker_start" {
recording_storage_path = var.recording_storage_path != "" ? var.recording_storage_path : null
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -238,7 +253,7 @@ resource "enos_remote_exec" "create_worker_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
enos/modules/aws_worker/outputs.tf
+11 -1
View File
@@ -3,7 +3,7 @@
output "worker_ip" {
description = "The public IP of the Boundary worker"
value = aws_instance.worker.public_ip
value = var.ip_version == "6" ? format("[%s]", aws_instance.worker.ipv6_addresses[0]) : aws_instance.worker.public_ip
}
output "worker_tags" {
@@ -25,3 +25,13 @@ output "role_arn" {
description = "The ARN of the IAM role used in this module"
value = aws_iam_role.boundary_instance_role.arn
}
output "worker_cidr" {
description = "The subnet of the isolated worker"
value = var.ip_version == "6" ? [] : [aws_subnet.default.cidr_block]
}
output "worker_ipv6_cidr" {
description = "The ipv6 subnet of the isolated worker"
value = var.ip_version == "4" ? [] : [aws_subnet.default.ipv6_cidr_block]
}
enos/modules/aws_worker/templates/worker.hcl
+4 -4
View File
@@ -2,9 +2,9 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}:9202"
}
worker {
@@ -13,9 +13,9 @@ worker {
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_addresses}
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
region = ["${region}"]
enos/modules/aws_worker/templates/worker_bsr.hcl
+3 -3
View File
@@ -4,7 +4,7 @@
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}:9202"
}
worker {
@@ -13,9 +13,9 @@ worker {
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_addresses}
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
region = ["${region}"]
enos/modules/aws_worker/templates/worker_bsr_vault_kms.hcl
+78
View File
@@ -0,0 +1,78 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "${listener_address}:9202"
}
worker {
# Name attr must be unique across workers
name = "demo-worker-${id}"
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_address}"
tags {
type = ${type}
region = ["${region}"]
}
recording_storage_path = "${recording_storage_path}"
}
# must be same key as used on controller config
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_worker/variables.tf
+37
View File
@@ -142,3 +142,40 @@ variable "bucket_arn" {
type = string
default = ""
}
variable "vpc_cidr" {
description = "cidr subnet of the vpc created for the enos scenario"
type = string
nullable = true
default = null
}
variable "vpc_cidr_ipv6" {
description = "ipv6 cidr subnet of the vpc created for the enos scenario"
type = string
nullable = true
default = null
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
variable "vault_address" {
description = "network address to a vault instance"
type = string
default = "localhost"
}
variable "vault_transit_token" {
description = "vault token used for kms transit in the boundary config"
type = string
default = ""
}
enos/modules/read_license/main.tf
+2 -2
View File
@@ -1,8 +1,8 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
variable "file_name" {}
variable "license_path" {}
output "license" {
value = file(var.file_name)
value = file(var.license_path)
}
enos/modules/test_e2e/main.tf
+19 -2
View File
@@ -140,7 +140,11 @@ variable "worker_tag_ingress" {
type = string
default = ""
}
variable "worker_tag_egress" {
variable "worker_tag_isolated" {
type = string
default = ""
}
variable "worker_tag_collocated" {
type = string
default = ""
}
@@ -157,6 +161,17 @@ variable "boundary_license" {
default = ""
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
locals {
aws_ssh_private_key_path = abspath(var.aws_ssh_private_key_path)
vault_addr = var.vault_addr != "" ? "http://${var.vault_addr}:${var.vault_port}" : ""
@@ -192,9 +207,11 @@ resource "enos_local_exec" "run_e2e_test" {
E2E_AWS_BUCKET_NAME = var.aws_bucket_name
E2E_AWS_ROLE_ARN = var.aws_role_arn
E2E_WORKER_TAG_INGRESS = var.worker_tag_ingress
E2E_WORKER_TAG_EGRESS = var.worker_tag_egress
E2E_WORKER_TAG_ISOLATED = var.worker_tag_isolated
E2E_WORKER_TAG_COLLOCATED = var.worker_tag_collocated
E2E_WORKER_ADDRESS = var.worker_address
E2E_MAX_PAGE_SIZE = var.max_page_size
E2E_IP_VERSION = var.ip_version
}
inline = var.debug_no_run ? [""] : [