CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create IPv6 and dual stack enos tests (#5212)

Browse Source 
Co-authored-by: Danielle Miu <29378233+DanielleMiu@users.noreply.github.com>
Co-authored-by: Damian Debkowski <damian.debkowski@hashicorp.com>
This commit is contained in:
daniDanielle MiuDamian Debkowski
 authored and GitHub committed 2025-01-21 07:37:04 -08:00
1 parent 34d13a0aae
commit dd9c7b9d60
59 files changed
+1773 -301
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

enos/modules/aws_worker/main.tf
+37 -22
View File
@@ -56,10 +56,13 @@ resource "random_integer" "az" {
# Create a subnet so that the worker doesn't share one with a controller
resource "aws_subnet" "default" {
vpc_id = var.vpc_id
cidr_block = "10.13.9.0/24"
map_public_ip_on_launch = true
availability_zone = local.selected_az
vpc_id = var.vpc_id
cidr_block = "10.13.9.0/24"
ipv6_cidr_block = var.ip_version != "4" ? cidrsubnet(var.vpc_cidr_ipv6, 8, 0) : null
map_public_ip_on_launch = true
assign_ipv6_address_on_creation = var.ip_version != "4"
availability_zone = local.selected_az
tags = merge(
local.common_tags,
{
@@ -79,22 +82,28 @@ resource "aws_security_group" "default" {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = flatten([formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses)])
cidr_blocks = var.ip_version == "6" ? [] : flatten([
# allow ingress from ipv4 to allow for test setup from ci
formatlist("%s/32", data.enos_environment.current.public_ipv4_addresses)
])
ipv6_cidr_blocks = var.ip_version == "4" ? [] : (data.enos_environment.current.public_ipv6_addresses != null ? [for ip in data.enos_environment.current.public_ipv6_addresses : cidrsubnet("${ip}/64", 0, 0)] : [])
}
ingress {
description = "Communication from Boundary controller to worker"
from_port = 9202
to_port = 9202
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
description = "Communication from Boundary controller to worker"
from_port = 9202
to_port = 9202
protocol = "tcp"
cidr_blocks = var.ip_version == "6" ? [] : ["0.0.0.0/0"]
ipv6_cidr_blocks = var.ip_version == "4" ? [] : ["::/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = var.ip_version == "6" ? [] : ["0.0.0.0/0"]
ipv6_cidr_blocks = var.ip_version == "4" ? [] : ["::/0"]
}
tags = merge(
@@ -110,7 +119,8 @@ resource "aws_security_group" "default" {
resource "aws_vpc_security_group_ingress_rule" "worker_to_controller" {
description = "This rule allows traffic from a worker to controllers over WAN"
security_group_id = var.controller_sg_id
cidr_ipv4 = "${aws_instance.worker.public_ip}/32"
cidr_ipv4 = var.ip_version == "4" ? "${aws_instance.worker.public_ip}/32" : null
cidr_ipv6 = var.ip_version == "4" ? null : cidrsubnet("${aws_instance.worker.ipv6_addresses[0]}/64", 0, 0)
from_port = 9201
to_port = 9201
ip_protocol = "tcp"
@@ -134,6 +144,8 @@ resource "aws_instance" "worker" {
iam_instance_profile = aws_iam_instance_profile.boundary_profile.name
monitoring = var.worker_monitoring
ipv6_address_count = var.ip_version == "4" ? 0 : 1
root_block_device {
iops = var.ebs_iops
volume_size = var.ebs_size
@@ -160,7 +172,7 @@ resource "enos_bundle_install" "worker" {
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -176,7 +188,7 @@ resource "enos_remote_exec" "update_path_worker" {
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -193,17 +205,20 @@ resource "enos_file" "worker_config" {
content = templatefile("${path.module}/${var.config_file_path}", {
id = random_pet.worker.id
kms_key_id = data.aws_kms_key.kms_key.id
public_addr = aws_instance.worker.public_ip
controller_ips = var.ip_version == "4" ? jsonencode(var.controller_addresses) : jsonencode(formatlist("[%s]:9201", var.controller_addresses))
listener_address = var.ip_version == "4" ? "0.0.0.0" : "[::]"
public_address = var.ip_version == "6" ? format("[%s]", aws_instance.worker.ipv6_addresses[0]) : aws_instance.worker.public_ip
type = jsonencode(var.worker_type_tags)
region = data.aws_availability_zone.worker_az.region
controller_addresses = jsonencode(var.controller_addresses)
recording_storage_path = var.recording_storage_path
audit_log_dir = local.audit_log_directory
vault_address = var.ip_version == "4" ? var.vault_address : try(format("[%s]", var.vault_address), "")
vault_transit_token = var.vault_transit_token
})
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -219,7 +234,7 @@ resource "enos_boundary_start" "worker_start" {
recording_storage_path = var.recording_storage_path != "" ? var.recording_storage_path : null
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
@@ -238,7 +253,7 @@ resource "enos_remote_exec" "create_worker_audit_log_dir" {
transport = {
ssh = {
host = aws_instance.worker.public_ip
host = var.ip_version == "6" ? aws_instance.worker.ipv6_addresses[0] : aws_instance.worker.public_ip
}
}
}
enos/modules/aws_worker/outputs.tf
+11 -1
View File
@@ -3,7 +3,7 @@
output "worker_ip" {
description = "The public IP of the Boundary worker"
value = aws_instance.worker.public_ip
value = var.ip_version == "6" ? format("[%s]", aws_instance.worker.ipv6_addresses[0]) : aws_instance.worker.public_ip
}
output "worker_tags" {
@@ -25,3 +25,13 @@ output "role_arn" {
description = "The ARN of the IAM role used in this module"
value = aws_iam_role.boundary_instance_role.arn
}
output "worker_cidr" {
description = "The subnet of the isolated worker"
value = var.ip_version == "6" ? [] : [aws_subnet.default.cidr_block]
}
output "worker_ipv6_cidr" {
description = "The ipv6 subnet of the isolated worker"
value = var.ip_version == "4" ? [] : [aws_subnet.default.ipv6_cidr_block]
}
enos/modules/aws_worker/templates/worker.hcl
+4 -4
View File
@@ -2,9 +2,9 @@
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}:9202"
}
worker {
@@ -13,9 +13,9 @@ worker {
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_addresses}
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
region = ["${region}"]
enos/modules/aws_worker/templates/worker_bsr.hcl
+3 -3
View File
@@ -4,7 +4,7 @@
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "0.0.0.0"
address = "${listener_address}:9202"
}
worker {
@@ -13,9 +13,9 @@ worker {
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_addresses}
initial_upstreams = ${controller_ips}
public_addr = "${public_addr}"
public_addr = "${public_address}"
tags {
region = ["${region}"]
enos/modules/aws_worker/templates/worker_bsr_vault_kms.hcl
+78
View File
@@ -0,0 +1,78 @@
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
listener "tcp" {
purpose = "proxy"
tls_disable = true
address = "${listener_address}:9202"
}
worker {
# Name attr must be unique across workers
name = "demo-worker-${id}"
description = "Enos Boundary worker ${id}"
# Workers must be able to reach controllers on :9201
initial_upstreams = ${controller_ips}
public_addr = "${public_address}"
tags {
type = ${type}
region = ["${region}"]
}
recording_storage_path = "${recording_storage_path}"
}
# must be same key as used on controller config
kms "transit" {
purpose = "worker-auth"
address = "http://${vault_address}:8200"
token = "${vault_transit_token}"
disable_renewal = "false"
key_name = "boundary-worker-auth"
mount_path = "transit/"
tls_skip_verify = "true"
}
events {
audit_enabled = true
observations_enabled = true
sysevents_enabled = true
sink "stderr" {
name = "all-events"
description = "All events sent to stderr"
event_types = ["*"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
"\"/data/request_info/path\" contains \"/health\"",
]
}
sink {
name = "audit-sink"
description = "Audit sent to a file"
event_types = ["audit"]
format = "cloudevents-json"
deny_filters = [
"\"/data/request_info/method\" contains \"Status\"",
]
file {
path = "${audit_log_dir}"
file_name = "audit.log"
}
audit_config {
audit_filter_overrides {
secret = "encrypt"
sensitive = "hmac-sha256"
}
}
}
}
enos/modules/aws_worker/variables.tf
+37
View File
@@ -142,3 +142,40 @@ variable "bucket_arn" {
type = string
default = ""
}
variable "vpc_cidr" {
description = "cidr subnet of the vpc created for the enos scenario"
type = string
nullable = true
default = null
}
variable "vpc_cidr_ipv6" {
description = "ipv6 cidr subnet of the vpc created for the enos scenario"
type = string
nullable = true
default = null
}
variable "ip_version" {
description = "ip version used to setup boundary instance, should be 4, 6, or dual"
type = string
default = "4"
validation {
condition = contains(["4", "6", "dual"], var.ip_version)
error_message = "ip_version must be one of: [4, 6, dual]"
}
}
variable "vault_address" {
description = "network address to a vault instance"
type = string
default = "localhost"
}
variable "vault_transit_token" {
description = "vault token used for kms transit in the boundary config"
type = string
default = ""
}