CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create IPv6 and dual stack enos tests (#5212)

Browse Source 
Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
This commit is contained in:
daniDanielle MiuDamian Debkowski
 authored and GitHub committed 2025-01-21 07:37:04 -08:00
1 parent 34d13a0aae
commit dd9c7b9d60
59 files changed
+1773 -301
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

enos/modules/aws_boundary/alb.tf
+18 -4
View File
@@ -1,11 +1,22 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
locals {
stack = {
"4" = "ipv4",
"dual" = "dualstack",
"6" = "dualstack-without-public-ipv4",
}
}
resource "aws_alb" "boundary_alb" {
name = "boundary-alb-${random_string.cluster_id.result}"
depends_on = [aws_instance.controller]
security_groups = [aws_security_group.boundary_alb_sg.id]
subnets = data.aws_subnets.infra.ids
ip_address_type = lookup(local.stack, var.ip_version, local.stack["4"])
tags = merge(local.common_tags,
{
Name = "boundary-alb-${random_string.cluster_id.result}"
@@ -14,10 +25,11 @@ resource "aws_alb" "boundary_alb" {
}
resource "aws_alb_target_group" "boundary_tg" {
name = "boundary-tg-${random_string.cluster_id.result}"
port = var.listener_api_port
protocol = "HTTP"
vpc_id = var.vpc_id
name = "boundary-tg-${random_string.cluster_id.result}"
port = var.listener_api_port
protocol = "HTTP"
vpc_id = var.vpc_id
ip_address_type = var.ip_version == "6" ? "ipv6" : "ipv4"
health_check {
path = var.healthcheck_path
@@ -26,6 +38,7 @@ resource "aws_alb_target_group" "boundary_tg" {
timeout = 2
healthy_threshold = 2
}
tags = merge(local.common_tags,
{
Name = "boundary-tg-${random_string.cluster_id.result}"
@@ -45,6 +58,7 @@ resource "aws_alb_listener" "boundary" {
load_balancer_arn = aws_alb.boundary_alb.arn
port = var.alb_listener_api_port
protocol = "HTTP"
default_action {
target_group_arn = aws_alb_target_group.boundary_tg.arn
type = "forward"
enos/modules/aws_boundary/boundary-instances.tf
+28 -19
View File
@@ -15,6 +15,7 @@ resource "aws_instance" "controller" {
key_name = var.ssh_aws_keypair
iam_instance_profile = aws_iam_instance_profile.boundary_profile.name
monitoring = var.controller_monitoring
ipv6_address_count = local.network_stack[var.ip_version].ipv6_address_count
root_block_device {
iops = var.controller_ebs_iops
@@ -41,6 +42,7 @@ resource "aws_instance" "worker" {
key_name = var.ssh_aws_keypair
iam_instance_profile = aws_iam_instance_profile.boundary_profile.name
monitoring = var.worker_monitoring
ipv6_address_count = local.network_stack[var.ip_version].ipv6_address_count
root_block_device {
iops = var.worker_ebs_iops
@@ -69,7 +71,7 @@ resource "enos_bundle_install" "controller" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
@@ -86,7 +88,7 @@ resource "enos_remote_exec" "update_path_controller" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
@@ -101,26 +103,29 @@ resource "enos_file" "controller_config" {
destination = "/etc/boundary/boundary.hcl"
content = templatefile("${path.module}/${var.controller_config_file_path}", {
id = each.value
dbuser = var.db_user,
dbpass = var.db_pass,
dbuser = var.db_user
dbpass = var.db_pass
dbhost = var.db_host == null ? aws_db_instance.boundary[0].address : var.db_host
dbport = var.db_port
dbname = local.db_name,
dbname = local.db_name
db_max_open_connections = var.db_max_open_connections
kms_key_id = data.aws_kms_key.kms_key.id,
local_ipv4 = aws_instance.controller[tonumber(each.value)].private_ip
kms_key_id = data.aws_kms_key.kms_key.id
listener_address = var.ip_version == "4" ? "0.0.0.0" : "[::]"
api_port = var.listener_api_port
ops_port = var.listener_ops_port
cluster_address = var.ip_version == "4" ? aws_instance.controller[tonumber(each.value)].private_ip : format("[%s]", aws_instance.controller[tonumber(each.value)].ipv6_addresses[0])
cluster_port = var.listener_cluster_port
region = var.aws_region
max_page_size = var.max_page_size
audit_log_dir = local.audit_log_directory
vault_address = local.network_stack[var.ip_version].vault_address
vault_transit_token = var.vault_transit_token
})
for_each = toset([for idx in range(var.controller_count) : tostring(idx)])
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
@@ -135,7 +140,7 @@ resource "enos_boundary_init" "controller" {
transport = {
ssh = {
host = try(aws_instance.controller[0].public_ip, null)
host = try(var.ip_version == "6" ? aws_instance.controller[0].ipv6_addresses[0] : aws_instance.controller[0].public_ip, null)
}
}
@@ -152,7 +157,7 @@ resource "enos_boundary_start" "controller_start" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
@@ -177,10 +182,11 @@ resource "enos_remote_exec" "create_controller_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.controller[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.controller[tonumber(each.value)].ipv6_addresses[0] : aws_instance.controller[tonumber(each.value)].public_ip
}
}
}
resource "enos_bundle_install" "worker" {
depends_on = [aws_instance.worker]
for_each = toset([for idx in range(var.worker_count) : tostring(idx)])
@@ -193,7 +199,7 @@ resource "enos_bundle_install" "worker" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -210,7 +216,7 @@ resource "enos_remote_exec" "update_path_worker" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -221,19 +227,22 @@ resource "enos_file" "worker_config" {
content = templatefile("${path.module}/${var.worker_config_file_path}", {
id = each.value
kms_key_id = data.aws_kms_key.kms_key.id,
controller_ips = jsonencode(aws_instance.controller.*.private_ip),
public_addr = aws_instance.worker[tonumber(each.value)].public_ip
controller_ips = var.ip_version == "4" ? jsonencode(aws_instance.controller.*.private_ip) : jsonencode(formatlist("[%s]:9201", flatten(aws_instance.controller.*.ipv6_addresses)))
listener_address = var.ip_version == "4" ? "0.0.0.0" : "[::]"
public_address = var.ip_version == "6" ? format("[%s]", aws_instance.worker[tonumber(each.value)].ipv6_addresses[0]) : aws_instance.worker[tonumber(each.value)].public_ip
region = var.aws_region
type = jsonencode(var.worker_type_tags)
recording_storage_path = var.recording_storage_path
audit_log_dir = local.audit_log_directory
hcp_boundary_cluster_id = var.hcp_boundary_cluster_id
vault_address = local.network_stack[var.ip_version].vault_address
vault_transit_token = var.vault_transit_token
})
for_each = toset([for idx in range(var.worker_count) : tostring(idx)])
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -250,7 +259,7 @@ resource "enos_boundary_start" "worker_start" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -270,7 +279,7 @@ resource "enos_remote_exec" "create_worker_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
@@ -282,7 +291,7 @@ resource "enos_remote_exec" "get_worker_token" {
inline = ["timeout 10s bash -c 'set -eo pipefail; until journalctl -u boundary.service | cat | grep \"Worker Auth Registration Request: .*\" | rev | cut -d \" \" -f 1 | rev | xargs; do sleep 2; done'"]
transport = {
ssh = {
host = aws_instance.worker[tonumber(each.value)].public_ip
host = var.ip_version == "6" ? aws_instance.worker[tonumber(each.value)].ipv6_addresses[0] : aws_instance.worker[tonumber(each.value)].public_ip
}
}
}
enos/modules/aws_boundary/main.tf
+43
View File
@@ -25,6 +25,49 @@ locals {
Pet = random_pet.default.id
},
)
network_stack = {
"4" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
formatlist("%s/32", var.alb_sg_additional_ips),
])
ingress_ipv6_cidr_blocks = [],
egress_cidr_blocks = ["0.0.0.0/0"],
egress_ipv6_cidr_blocks = [],
ipv6_address_count = 0,
vault_address = var.vault_address,
},
"6" = {
ingress_cidr_blocks = [],
ingress_ipv6_cidr_blocks = flatten([
try([for ip in coalesce(data.enos_environment.localhost.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)], []),
[data.aws_vpc.infra.ipv6_cidr_block],
[for ip in var.alb_sg_additional_ipv6_ips : cidrsubnet("${ip}/64", 0, 0)],
])
egress_cidr_blocks = [],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
vault_address = format("[%s]", var.vault_address)
},
"dual" = {
ingress_cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
formatlist("%s/32", var.alb_sg_additional_ips),
])
ingress_ipv6_cidr_blocks = flatten([
try([for ip in coalesce(data.enos_environment.localhost.public_ipv6_addresses, []) : cidrsubnet("${ip}/64", 0, 0)], []),
[data.aws_vpc.infra.ipv6_cidr_block],
[for ip in var.alb_sg_additional_ipv6_ips : cidrsubnet("${ip}/64", 0, 0)],
]),
egress_cidr_blocks = ["0.0.0.0/0"],
egress_ipv6_cidr_blocks = ["::/0"],
ipv6_address_count = 1,
vault_address = try(format("[%s]", var.vault_address), "")
}
}
}
resource "random_string" "cluster_id" {
enos/modules/aws_boundary/outputs.tf
+13 -3
View File
@@ -3,12 +3,12 @@
output "controller_ips" {
description = "Public IPs of boundary controllers"
value = aws_instance.controller.*.public_ip
value = var.ip_version == "6" ? flatten(aws_instance.controller.*.ipv6_addresses) : aws_instance.controller.*.public_ip
}
output "worker_ips" {
description = "Public IPs of boundary workers"
value = aws_instance.worker.*.public_ip
value = var.ip_version == "6" ? flatten(aws_instance.worker.*.ipv6_addresses) : aws_instance.worker.*.public_ip
}
output "alb_hostname" {
@@ -208,7 +208,7 @@ output "cluster_tag" {
}
output "public_controller_addresses" {
value = aws_instance.controller[*].public_ip
value = var.ip_version == "4" ? aws_instance.controller[*].public_ip : aws_instance.controller[*].ipv6_addresses[0]
}
output "controller_aux_sg_id" {
@@ -232,3 +232,13 @@ output "worker_tokens" {
for token in enos_remote_exec.get_worker_token : trimspace(token.stdout)
], null)
}
output "worker_cidr" {
description = "List of ipv4 subnets of all workers"
value = formatlist("%s/32", aws_instance.worker.*.public_ip)
}
output "worker_ipv6_cidr" {
description = "List of ipv6 subnets of all workers"
value = distinct([for ip in flatten(aws_instance.worker.*.ipv6_addresses) : cidrsubnet("${ip}/64", 0, 0)])
}
enos/modules/aws_boundary/rds.tf
+3 -1
View File
@@ -17,9 +17,11 @@ resource "aws_db_instance" "boundary" {
instance_class = var.db_class
monitoring_interval = var.db_monitoring_interval
monitoring_role_arn = var.db_monitoring_role_arn
publicly_accessible = true
publicly_accessible = false
db_name = local.db_name
network_type = var.ip_version == "4" ? "IPV4" : "DUAL"
// username and password must not be provided when restoring from a snapshot
username = local.is_restored_db ? null : var.db_user
password = local.is_restored_db ? null : var.db_pass
enos/modules/aws_boundary/security-groups.tf
+37 -35
View File
@@ -22,24 +22,22 @@ resource "aws_security_group" "boundary_sg" {
# SSH
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses)])
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
}
dynamic "ingress" {
for_each = local.listener_ports
content {
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
])
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
description = ingress.key
from_port = ingress.value
to_port = ingress.value
ipv6_cidr_blocks = []
prefix_list_ids = []
protocol = "tcp"
self = null
@@ -48,10 +46,11 @@ resource "aws_security_group" "boundary_sg" {
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(
@@ -86,27 +85,29 @@ resource "aws_security_group" "boundary_alb_sg" {
content {
cidr_blocks = flatten([
formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block),
try(format("%s/32", aws_instance.controller.0.public_ip), []),
formatlist("%s/32", var.alb_sg_additional_ips)
])
description = ingress.key
from_port = ingress.value
to_port = ingress.value
ipv6_cidr_blocks = []
prefix_list_ids = []
protocol = "tcp"
self = null
security_groups = []
local.network_stack[var.ip_version].ingress_cidr_blocks]
)
ipv6_cidr_blocks = flatten([
try(cidrsubnet("${aws_instance.controller.0.ipv6_addresses[0]}/64", 0, 0), []),
local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks]
)
description = ingress.key
from_port = ingress.value
to_port = ingress.value
prefix_list_ids = []
protocol = "tcp"
self = null
security_groups = []
}
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(
@@ -124,11 +125,11 @@ resource "aws_security_group" "boundary_db_sg" {
vpc_id = var.vpc_id
ingress {
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses), join(",", data.aws_vpc.infra.cidr_block_associations.*.cidr_block)])
cidr_blocks = local.network_stack[var.ip_version].ingress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].ingress_ipv6_cidr_blocks
description = "database"
from_port = 5432
to_port = 5432
ipv6_cidr_blocks = []
prefix_list_ids = []
protocol = "tcp"
self = null
@@ -136,10 +137,11 @@ resource "aws_security_group" "boundary_db_sg" {
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.network_stack[var.ip_version].egress_cidr_blocks
ipv6_cidr_blocks = local.network_stack[var.ip_version].egress_ipv6_cidr_blocks
}
tags = merge(local.common_tags,
enos/modules/aws_boundary/templates/controller.hcl
+3 -3
View File
@@ -18,7 +18,7 @@ controller {
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${local_ipv4}:${api_port}"
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
@@ -31,7 +31,7 @@ listener "tcp" {
# API listener configuration block
listener "tcp" {
address = "${local_ipv4}:${ops_port}"
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
@@ -39,7 +39,7 @@ listener "tcp" {
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${local_ipv4}:${cluster_port}"
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
enos/modules/aws_boundary/templates/controller_bsr.hcl
+3 -3
View File
@@ -18,7 +18,7 @@ controller {
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${local_ipv4}:${api_port}"
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
@@ -31,7 +31,7 @@ listener "tcp" {
# API listener configuration block
listener "tcp" {
address = "${local_ipv4}:${ops_port}"
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
@@ -39,7 +39,7 @@ listener "tcp" {
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${local_ipv4}:${cluster_port}"
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
enos/modules/aws_boundary/templates/controller_bsr_vault_kms.hcl
+126
View File
@@ -0,0 +1,126 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
disable_mlock = true
controller {
name = "boundary-controller-${id}"
description = "Enos Boundary controller ${id}"
max_page_size = ${max_page_size}
database {
url = "postgresql://${dbuser}:${dbpass}@${dbhost}:${dbport}/${dbname}"
max_open_connections = ${db_max_open_connections}
}
}
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
# Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s)
# to appropriate values.
#cors_enabled = true
#cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"]
}
# API listener configuration block
listener "tcp" {
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "root"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-root"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "recovery"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-recovery"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "bsr"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-bsr"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/templates/controller_vault_kms.hcl
+115
View File
@@ -0,0 +1,115 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
disable_mlock = true
controller {
name = "boundary-controller-${id}"
description = "Enos Boundary controller ${id}"
max_page_size = ${max_page_size}
database {
url = "postgresql://${dbuser}:${dbpass}@${dbhost}:${dbport}/${dbname}"
max_open_connections = ${db_max_open_connections}
}
}
# API listener configuration block
listener "tcp" {
# Should be the address of the NIC that the controller server will be reached on
address = "${listener_address}:${api_port}"
# The purpose of this listener block
purpose = "api"
tls_disable = true
# Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s)
# to appropriate values.
#cors_enabled = true
#cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"]
}
# API listener configuration block
listener "tcp" {
address = "${listener_address}:${ops_port}"
purpose = "ops"
tls_disable = true
}
# Data-plane listener configuration block (used for worker coordination)
listener "tcp" {
# Should be the IP of the NIC that the worker will connect on
address = "${cluster_address}:${cluster_port}"
# The purpose of this listener
purpose = "cluster"
}
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "root"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-root"
mount_path = "transit/"
tls_skip_verify = "true"
}
kms "transit" {
purpose = "recovery"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-recovery"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/templates/worker.hcl
+3 -3
View File
@@ -2,9 +2,9 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}"
}
worker {
@@ -15,7 +15,7 @@ worker {
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
type = ${type}
enos/modules/aws_boundary/templates/worker_bsr.hcl
+3 -3
View File
@@ -2,9 +2,9 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}"
}
worker {
@@ -15,7 +15,7 @@ worker {
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
type = ${type}
enos/modules/aws_boundary/templates/worker_bsr_vault_kms.hcl
+78
View File
@@ -0,0 +1,78 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "${listener_address}:9202"
}
worker {
# Name attr must be unique across workers
name = "demo-worker-${id}"
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_address}"
tags {
type = ${type}
region = ["${region}"]
}
recording_storage_path = "${recording_storage_path}"
}
# must be same key as used on controller config
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/templates/worker_hcp_bsr.hcl
+3 -3
View File
@@ -2,15 +2,15 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}"
}
hcp_boundary_cluster_id = "${hcp_boundary_cluster_id}"
worker {
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
type = ${type}
enos/modules/aws_boundary/templates/worker_vault_kms.hcl
+76
View File
@@ -0,0 +1,76 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "${listener_address}"
}
worker {
# Name attr must be unique across workers
name = "demo-worker-${id}"
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_address}"
tags {
type = ${type}
region = ["${region}"]
}
}
# must be same key as used on controller config
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_boundary/variables.tf
+29
View File
@@ -334,6 +334,12 @@ variable "alb_sg_additional_ips" {
default = []
}
variable "alb_sg_additional_ipv6_ips" {
description = "Additional ipv6 IPs to be allowed (ingress) on an ALB Security Group"
type = list(string)
default = []
}
variable "boundary_license" {
description = "Boundary license (not needed for OSS, required for enterprise)"
type = string
@@ -378,3 +384,26 @@ variable "hcp_boundary_cluster_id" {
// If using HCP int, ensure that the cluster id starts with "int-"
// Example: "int-19283a-123123-..."
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
variable "vault_address" {
description = "network address to a vault instance"
type = string
default = "localhost"
}
variable "vault_transit_token" {
description = "vault token used for kms transit in the boundary config"
type = string
default = ""
}