Jeff Mitchell
163ce184b8
This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.
86 lines
2.3 KiB
Go
86 lines
2.3 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package worker
|
|
|
|
import (
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/google/go-cmp/cmp"
|
|
opsservices "github.com/hashicorp/boundary/internal/gen/ops/services"
|
|
pbhealth "github.com/hashicorp/boundary/internal/gen/worker/health"
|
|
"github.com/hashicorp/boundary/internal/server"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/protobuf/testing/protocmp"
|
|
"google.golang.org/protobuf/types/known/wrapperspb"
|
|
)
|
|
|
|
func TestGetHealth(t *testing.T) {
|
|
w := NewTestWorker(t, &TestWorkerOpts{
|
|
InitialUpstreams: []string{"0.0.0.0"},
|
|
})
|
|
defer w.Shutdown()
|
|
handler, err := w.Worker().GetHealthHandler()
|
|
require.NoError(t, err)
|
|
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
queryParams string
|
|
expectedResponse *opsservices.GetHealthResponse
|
|
expCode int
|
|
}{
|
|
{
|
|
name: "healthy reply",
|
|
method: http.MethodGet,
|
|
expCode: http.StatusOK,
|
|
expectedResponse: &opsservices.GetHealthResponse{},
|
|
},
|
|
{
|
|
name: "healthy reply with worker info",
|
|
method: http.MethodGet,
|
|
queryParams: "worker_info=1",
|
|
expCode: http.StatusOK,
|
|
expectedResponse: &opsservices.GetHealthResponse{
|
|
WorkerProcessInfo: &pbhealth.HealthInfo{
|
|
State: server.ActiveOperationalState.String(),
|
|
ActiveSessionCount: wrapperspb.UInt32(0),
|
|
},
|
|
},
|
|
},
|
|
{
|
|
name: "Post request",
|
|
method: http.MethodPost,
|
|
queryParams: "worker_info=1",
|
|
expCode: http.StatusNotImplemented,
|
|
expectedResponse: &opsservices.GetHealthResponse{},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
path := "/health"
|
|
if tt.queryParams != "" {
|
|
path = fmt.Sprintf("%s?%s", path, tt.queryParams)
|
|
}
|
|
req, err := http.NewRequest(tt.method, path, nil)
|
|
require.NoError(t, err)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
assert.Equal(t, tt.expCode, rr.Result().StatusCode)
|
|
b, err := io.ReadAll(rr.Result().Body)
|
|
require.NoError(t, err)
|
|
resp := &opsservices.GetHealthResponse{}
|
|
require.NoError(t, healthCheckMarshaler.Unmarshal(b, resp))
|
|
|
|
assert.Empty(t, cmp.Diff(tt.expectedResponse, resp, protocmp.Transform()))
|
|
})
|
|
}
|
|
}
|