Michael Li
8fe0d13caa
Adds the first set of vault tests. This test sets up vault as a credential store and creates a set of credentials for a target.
101 lines
2.8 KiB
Go
101 lines
2.8 KiB
Go
// Package vault provides methods for commonly used vault actions that are used in end-to-end tests.
|
|
package vault
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"path"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/boundary/testing/internal/e2e"
|
|
"github.com/kelseyhightower/envconfig"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
type config struct {
|
|
VaultAddr string `envconfig:"VAULT_ADDR"` // e.g. "http://127.0.0.1:8200"
|
|
VaultToken string `envconfig:"VAULT_TOKEN"`
|
|
}
|
|
|
|
func (c *config) validate() error {
|
|
if c.VaultAddr == "" {
|
|
return errors.New("VaultAddr is empty. Set environment variable: VAULT_ADDR")
|
|
}
|
|
if c.VaultToken == "" {
|
|
return errors.New("VaultToken is empty. Set environment variable: VAULT_TOKEN")
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func loadConfig() (*config, error) {
|
|
var c config
|
|
err := envconfig.Process("", &c)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &c, err
|
|
}
|
|
|
|
// Setup verifies if appropriate credentials are set and adds the boundary controller
|
|
// policy to vault. Returns the vault address.
|
|
func Setup(t testing.TB) (string, string) {
|
|
c, err := loadConfig()
|
|
require.NoError(t, err)
|
|
err = c.validate()
|
|
require.NoError(t, err)
|
|
|
|
_, filename, _, ok := runtime.Caller(0)
|
|
require.True(t, ok)
|
|
policyName := "boundary-controller"
|
|
output := e2e.RunCommand("vault", e2e.WithArgs("policy", "write", policyName,
|
|
path.Join(path.Dir(filename), "boundary-controller-policy.hcl")),
|
|
)
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
t.Cleanup(func() {
|
|
output := e2e.RunCommand("vault", e2e.WithArgs("policy", "delete", policyName))
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
})
|
|
|
|
return c.VaultAddr, policyName
|
|
}
|
|
|
|
// CreateKvPrivateKeyCredential creates a private key credential in vault and creates a vault policy
|
|
// to be able to read that credential. Returns the name of the policy.
|
|
func CreateKvPrivateKeyCredential(t testing.TB, secretName string, secretPath string, user string, keyPath string) string {
|
|
// Create policy file to read secret
|
|
kvPolicyFileName := "kv-policy-test.hcl"
|
|
kvPolicyFilePath := fmt.Sprintf("%s/%s", t.TempDir(), kvPolicyFileName)
|
|
|
|
f, err := os.Create(kvPolicyFilePath)
|
|
require.NoError(t, err)
|
|
_, err = f.WriteString(fmt.Sprintf("path \"%s/data/%s\" { capabilities = [\"read\"] }",
|
|
secretPath,
|
|
secretName,
|
|
))
|
|
require.NoError(t, err)
|
|
|
|
// Add policy to vault
|
|
policyName := "kv-read"
|
|
output := e2e.RunCommand("vault", e2e.WithArgs("policy", "write", policyName, kvPolicyFilePath))
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
t.Cleanup(func() {
|
|
output := e2e.RunCommand("vault", e2e.WithArgs("policy", "delete", policyName))
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
})
|
|
|
|
// Create secret
|
|
output = e2e.RunCommand("vault", e2e.WithArgs("kv", "put",
|
|
"-mount", secretPath,
|
|
secretName,
|
|
"username="+user,
|
|
"private_key=@"+keyPath,
|
|
))
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
return policyName
|
|
}
|