test(e2e): Add test for controller-led worker registration (#3882)

* test(e2e): Add test for controller led worker registration

* chore(e2e): Rename log files to ensure uniqueness

This updates the log files to be based on the scenario name instead of just the test package in case some scenarios run the same test package

enos/modules/docker_boundary/get_auth_token.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+set -eu -o pipefail
+
+boundary authenticate password \
+  -login-name $LOGIN_NAME \
+  -password env://BPASS \
+  -format json

enos/modules/docker_boundary/get_worker_token.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env sh
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+set -eu -o pipefail
+
+boundary workers create controller-led \
+  -token env://BOUNDARY_TOKEN \
+  -format json

enos/modules/docker_boundary/main.tf

@@ -54,6 +54,16 @@ variable "worker_tag" {
   type        = string
   default     = "collocated"
 }
+variable "get_auth_token" {
+  description = "Flag to retrieve a boundary auth token"
+  type        = bool
+  default     = false
+}
+variable "get_worker_token" {
+  description = "Flag to retrieve a boundary worker token"
+  type        = bool
+  default     = false
+}
 
 resource "docker_image" "boundary" {
   name         = var.image_name
@@ -150,6 +160,47 @@ resource "enos_local_exec" "check_health" {
   inline = ["timeout 10s bash -c 'until curl -i http://0.0.0.0:9203/health; do sleep 2; done'"]
 }
 
+resource "enos_local_exec" "get_auth_token" {
+  count      = var.get_auth_token ? 1 : 0
+  depends_on = [enos_local_exec.check_health]
+  environment = {
+    TEST_BOUNDARY_IMAGE           = var.image_name
+    BOUNDARY_ADDR                 = local.address
+    TEST_NETWORK_NAME             = var.network_name[0]
+    E2E_PASSWORD_ADMIN_LOGIN_NAME = local.login_name
+    E2E_PASSWORD_ADMIN_PASSWORD   = local.password
+    MODULE_DIR                    = abspath(path.module)
+    SCRIPT                        = "${abspath(path.module)}/get_auth_token.sh"
+  }
+  inline = ["bash ./${path.module}/script_runner.sh"]
+}
+
+locals {
+  auth_info  = var.get_auth_token ? jsondecode(enos_local_exec.get_auth_token[0].stdout) : null
+  auth_token = var.get_auth_token ? local.auth_info["item"]["attributes"]["token"] : ""
+}
+
+resource "enos_local_exec" "get_worker_token" {
+  count      = var.get_worker_token ? 1 : 0
+  depends_on = [enos_local_exec.check_health]
+  environment = {
+    TEST_BOUNDARY_IMAGE           = var.image_name,
+    BOUNDARY_ADDR                 = local.address
+    TEST_NETWORK_NAME             = var.network_name[0]
+    E2E_PASSWORD_ADMIN_LOGIN_NAME = local.login_name
+    E2E_PASSWORD_ADMIN_PASSWORD   = local.password
+    MODULE_DIR                    = abspath(path.module)
+    SCRIPT                        = "${abspath(path.module)}/get_worker_token.sh"
+    BOUNDARY_TOKEN                = local.auth_token
+  }
+  inline = ["bash ./${path.module}/script_runner.sh"]
+}
+
+locals {
+  worker_info  = var.get_worker_token ? jsondecode(enos_local_exec.get_worker_token[0].stdout) : null
+  worker_token = var.get_worker_token ? local.worker_info["item"]["controller_generated_activation_token"] : ""
+}
+
 output "address" {
   value = local.address
 }
@@ -173,3 +224,13 @@ output "password" {
 output "worker_tag" {
   value = var.worker_tag
 }
+
+output "auth_token" {
+  value     = local.auth_token
+  sensitive = true
+}
+
+output "worker_token" {
+  value     = local.worker_token
+  sensitive = true
+}

enos/modules/docker_boundary/script_runner.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# This script initializes a postgres database to work with Boundary by spinning up a temporary
+# Boundary docker container pointed to the specified database and invoking `boundary database init`.
+#
+# This script must only output the JSON that comes from `boundary database init` as the output is
+# consumed by other scripts.
+
+TEST_CONTAINER_NAME=boundary-script-runner
+SOURCE=$(realpath $(dirname ${BASH_SOURCE[0]})) # get directory of this script
+
+docker run \
+    --rm \
+    --name $TEST_CONTAINER_NAME \
+    -e "BOUNDARY_ADDR=$BOUNDARY_ADDR" \
+    -e "LOGIN_NAME=$E2E_PASSWORD_ADMIN_LOGIN_NAME" \
+    -e "BPASS=$E2E_PASSWORD_ADMIN_PASSWORD" \
+    -e "BOUNDARY_TOKEN=$BOUNDARY_TOKEN" \
+    -e "SKIP_CHOWN=true" \
+    --cap-add IPC_LOCK \
+    --network $TEST_NETWORK_NAME \
+    -v "$SCRIPT:/script.sh" \
+    $TEST_BOUNDARY_IMAGE \
+    /bin/sh -c /script.sh

enos/modules/docker_worker/main.tf

@@ -55,6 +55,11 @@ variable "config_file" {
   type        = string
   default     = "worker-config.hcl"
 }
+variable "token" {
+  description = "Controller generated activation token to initialize worker"
+  type        = string
+  default     = ""
+}
 
 resource "docker_image" "boundary" {
   name         = var.image_name
@@ -102,6 +107,7 @@ resource "docker_container" "worker" {
       recording_storage_path = local.recording_storage_path
       port                   = var.port
       port_ops               = local.port_ops
+      token                  = var.token
     })
     file = "/boundary/worker-config.hcl"
   }

enos/modules/docker_worker/worker-config-controller-led.hcl

@@ -0,0 +1,64 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_mlock = true
+
+telemetry {
+  prometheus_retention_time = "24h"
+  disable_hostname          = true
+}
+
+listener "tcp" {
+  address     = "0.0.0.0:${port}"
+  purpose     = "proxy"
+  tls_disable = true
+}
+
+listener "tcp" {
+  address = "0.0.0.0:${port_ops}"
+  purpose = "ops"
+  tls_disable = true
+}
+
+worker {
+  public_addr = "${worker_name}:${port}"
+  initial_upstreams = ["${initial_upstream}"]
+  controller_generated_activation_token = "${token}"
+
+  tags {
+    type = ${type_tags},
+  }
+
+  auth_storage_path = "/tmp/boundary/worker"
+}
+
+events {
+  audit_enabled       = true
+  sysevents_enabled   = true
+  observations_enable = true
+
+  sink "stderr" {
+    name        = "all-events"
+    description = "All events sent to stderr"
+    event_types = ["*"]
+    format      = "cloudevents-json"
+  }
+
+  sink {
+    name = "Log File"
+    event_types = ["*"]
+    format = "cloudevents-json"
+
+    file {
+      path = "/boundary/logs"
+      file_name = "events.log"
+    }
+
+    audit_config {
+      audit_filter_overrides {
+        secret    = "redact"
+        sensitive = "redact"
+      }
+    }
+  }
+}