Skip to content

Commit 6851256

Browse files
hc-github-team-secure-boundaryhc-github-team-secure-boundary
authored
Merge pull request #5022 from hashicorp/backport/moduli-e2e-worker-tags/ghastly-viable-lamprey
This pull request was automerged via backport-assistant
2 parents 7acc730 + 1ef4a4a commit 6851256

File tree

2 files changed

+228
-0
lines changed

2 files changed

+228
-0
lines changed

‎testing/internal/e2e/boundary/worker.go

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"context"
88
"encoding/json"
99
"fmt"
10+
"slices"
1011
"testing"
1112

1213
"github.com/hashicorp/boundary/api/workers"
@@ -44,3 +45,35 @@ func GetWorkerWithFilterCli(t testing.TB, ctx context.Context, filter string) (*
4445

4546
return items[0], nil
4647
}
48+
49+
func GetWorkersByTagCli(t testing.TB, ctx context.Context, tagKey, tagValue string) ([]*workers.Worker, error) {
50+
output := e2e.RunCommand(ctx, "boundary",
51+
e2e.WithArgs(
52+
"workers", "list",
53+
"-format", "json",
54+
),
55+
)
56+
if output.Err != nil {
57+
return nil, fmt.Errorf("%w: %s", output.Err, string(output.Stderr))
58+
}
59+
60+
var workersListResult workers.WorkerListResult
61+
err := json.Unmarshal(output.Stdout, &workersListResult)
62+
if err != nil {
63+
return nil, fmt.Errorf("failed to unmarshal workers list result: %w", err)
64+
}
65+
66+
items := workersListResult.GetItems()
67+
if len(items) == 0 {
68+
return nil, fmt.Errorf("no workers found using tag key: %s", tagKey)
69+
}
70+
71+
var workersWithTagKey []*workers.Worker
72+
for _, worker := range items {
73+
if slices.Contains(worker.CanonicalTags[tagKey], tagValue) {
74+
workersWithTagKey = append(workersWithTagKey, worker)
75+
}
76+
}
77+
78+
return workersWithTagKey, nil
79+
}

‎testing/internal/e2e/tests/base_with_worker/target_tcp_worker_connect_ssh_test.go

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"strings"
1111
"testing"
1212

13+
"github.com/hashicorp/boundary/api/workers"
1314
"github.com/hashicorp/boundary/internal/target"
1415
"github.com/hashicorp/boundary/testing/internal/e2e"
1516
"github.com/hashicorp/boundary/testing/internal/e2e/boundary"
@@ -202,4 +203,198 @@ func TestCliTcpTargetWorkerConnectTarget(t *testing.T) {
202203
),
203204
)
204205
require.Error(t, output.Err, "Unexpectedly created a target with an ingress worker filter")
206+
207+
// Add an API tag and use that tag in the worker filter
208+
t.Log("Adding API tag to worker...")
209+
workerList, err := boundary.GetWorkersByTagCli(t, ctx, "type", "egress")
210+
require.NoError(t, err)
211+
output = e2e.RunCommand(ctx, "boundary",
212+
e2e.WithArgs(
213+
"workers", "add-worker-tags",
214+
"-id", workerList[0].Id,
215+
"-tag", "k=v",
216+
),
217+
)
218+
require.NoError(t, output.Err, string(output.Stderr))
219+
t.Cleanup(func() {
220+
_ = e2e.RunCommand(ctx, "boundary",
221+
e2e.WithArgs(
222+
"workers", "remove-worker-tags",
223+
"-id", workerList[0].Id,
224+
"-tag", "k=v",
225+
),
226+
)
227+
})
228+
// Update target to use new tag
229+
output = e2e.RunCommand(ctx, "boundary",
230+
e2e.WithArgs(
231+
"targets", "update", "tcp",
232+
"-id", targetId,
233+
"-egress-worker-filter", `"v" in "/tags/k"`,
234+
),
235+
)
236+
require.NoError(t, output.Err, string(output.Stderr))
237+
output = e2e.RunCommand(ctx, "boundary",
238+
e2e.WithArgs(
239+
"connect", "ssh",
240+
"-target-id", targetId,
241+
"-remote-command", "hostname -i",
242+
"--",
243+
"-o", "UserKnownHostsFile=/dev/null",
244+
"-o", "StrictHostKeyChecking=no",
245+
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
246+
),
247+
)
248+
require.NoError(t, output.Err, string(output.Stderr))
249+
require.Equal(t, c.TargetAddress, strings.TrimSpace(string(output.Stdout)))
250+
t.Log("Successfully connected to target with new filter")
251+
252+
// Update worker to have a different tag. This should result in a failed connection
253+
output = e2e.RunCommand(ctx, "boundary",
254+
e2e.WithArgs(
255+
"workers", "set-worker-tags",
256+
"-id", workerList[0].Id,
257+
"-tag", "a=v",
258+
),
259+
)
260+
require.NoError(t, output.Err, string(output.Stderr))
261+
t.Cleanup(func() {
262+
_ = e2e.RunCommand(ctx, "boundary",
263+
e2e.WithArgs(
264+
"workers", "remove-worker-tags",
265+
"-id", workerList[0].Id,
266+
"-tag", "a=v",
267+
),
268+
)
269+
})
270+
271+
output = e2e.RunCommand(ctx, "boundary",
272+
e2e.WithArgs(
273+
"connect", "ssh",
274+
"-target-id", targetId,
275+
"-remote-command", "hostname -i",
276+
"--",
277+
"-o", "UserKnownHostsFile=/dev/null",
278+
"-o", "StrictHostKeyChecking=no",
279+
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
280+
),
281+
)
282+
require.Error(t, output.Err)
283+
require.Equal(t, 1, output.ExitCode)
284+
t.Log("Successfully failed to connect to target with wrong filter")
285+
286+
// Update target to use new tag
287+
t.Log("Changing API tag on worker...")
288+
output = e2e.RunCommand(ctx, "boundary",
289+
e2e.WithArgs(
290+
"targets", "update", "tcp",
291+
"-id", targetId,
292+
"-egress-worker-filter", `"v" in "/tags/a"`,
293+
),
294+
)
295+
require.NoError(t, output.Err, string(output.Stderr))
296+
output = e2e.RunCommand(ctx, "boundary",
297+
e2e.WithArgs(
298+
"connect", "ssh",
299+
"-target-id", targetId,
300+
"-remote-command", "hostname -i",
301+
"--",
302+
"-o", "UserKnownHostsFile=/dev/null",
303+
"-o", "StrictHostKeyChecking=no",
304+
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
305+
),
306+
)
307+
require.NoError(t, output.Err, string(output.Stderr))
308+
require.Equal(t, c.TargetAddress, strings.TrimSpace(string(output.Stdout)))
309+
t.Log("Successfully connected to target with new filter")
310+
311+
// Remove API tags
312+
output = e2e.RunCommand(ctx, "boundary",
313+
e2e.WithArgs(
314+
"workers", "remove-worker-tags",
315+
"-id", workerList[0].Id,
316+
"-tag", "a=v",
317+
),
318+
)
319+
require.NoError(t, output.Err, string(output.Stderr))
320+
output = e2e.RunCommand(ctx, "boundary",
321+
e2e.WithArgs(
322+
"workers", "read",
323+
"-id", workerList[0].Id,
324+
"-format", "json",
325+
),
326+
)
327+
require.NoError(t, output.Err, string(output.Stderr))
328+
var workerReadResult workers.WorkerReadResult
329+
err = json.Unmarshal(output.Stdout, &workerReadResult)
330+
require.NoError(t, err)
331+
require.NotContains(t, workerReadResult.Item.CanonicalTags["k"], "v")
332+
require.NotContains(t, workerReadResult.Item.CanonicalTags["a"], "v")
333+
334+
// Add an API tag that's the same as a config tag
335+
t.Log("Adding API tag that's the same as a config tag...")
336+
require.NoError(t, err)
337+
output = e2e.RunCommand(ctx, "boundary",
338+
e2e.WithArgs(
339+
"workers", "add-worker-tags",
340+
"-id", workerList[0].Id,
341+
"-tag", fmt.Sprintf("%s=%s", "type", c.WorkerTagEgress),
342+
),
343+
)
344+
require.NoError(t, output.Err, string(output.Stderr))
345+
t.Cleanup(func() {
346+
_ = e2e.RunCommand(ctx, "boundary",
347+
e2e.WithArgs(
348+
"workers", "remove-worker-tags",
349+
"-id", workerList[0].Id,
350+
"-tag", fmt.Sprintf("%s=%s", "type", c.WorkerTagEgress),
351+
),
352+
)
353+
})
354+
output = e2e.RunCommand(ctx, "boundary",
355+
e2e.WithArgs(
356+
"targets", "update", "tcp",
357+
"-id", targetId,
358+
"-egress-worker-filter", fmt.Sprintf(`"%s" in "/tags/type"`, c.WorkerTagEgress),
359+
),
360+
)
361+
require.NoError(t, output.Err, string(output.Stderr))
362+
output = e2e.RunCommand(ctx, "boundary",
363+
e2e.WithArgs(
364+
"connect", "ssh",
365+
"-target-id", targetId,
366+
"-remote-command", "hostname -i",
367+
"--",
368+
"-o", "UserKnownHostsFile=/dev/null",
369+
"-o", "StrictHostKeyChecking=no",
370+
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
371+
),
372+
)
373+
require.NoError(t, output.Err, string(output.Stderr))
374+
require.Equal(t, c.TargetAddress, strings.TrimSpace(string(output.Stdout)))
375+
t.Log("Successfully connected to target")
376+
377+
// Remove API tag
378+
output = e2e.RunCommand(ctx, "boundary",
379+
e2e.WithArgs(
380+
"workers", "remove-worker-tags",
381+
"-id", workerList[0].Id,
382+
"-tag", fmt.Sprintf("%s=%s", "type", c.WorkerTagEgress),
383+
),
384+
)
385+
require.NoError(t, output.Err, string(output.Stderr))
386+
output = e2e.RunCommand(ctx, "boundary",
387+
e2e.WithArgs(
388+
"connect", "ssh",
389+
"-target-id", targetId,
390+
"-remote-command", "hostname -i",
391+
"--",
392+
"-o", "UserKnownHostsFile=/dev/null",
393+
"-o", "StrictHostKeyChecking=no",
394+
"-o", "IdentitiesOnly=yes", // forces the use of the provided key
395+
),
396+
)
397+
require.NoError(t, output.Err, string(output.Stderr))
398+
require.Equal(t, c.TargetAddress, strings.TrimSpace(string(output.Stdout)))
399+
t.Log("Successfully connected to target")
205400
}

0 commit comments

Comments
 (0)