Skip to content

Commit c9b7ab4

Browse files
hc-github-team-secure-vault-corebrewgator
hc-github-team-secure-vault-core
and
brewgator
authored
backport of commit 403720c (#30720)
Co-authored-by: Luis (LT) Carbonell <[email protected]>
1 parent ce382f3 commit c9b7ab4

12 files changed

+150
-17
lines changed

‎enos/enos-modules.hcl

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,6 @@ module "vault_verify_removed_node_shim" {
306306
vault_install_dir = var.vault_install_dir
307307
}
308308

309-
310309
module "vault_verify_secrets_engines_create" {
311310
source = "./modules/verify_secrets_engines/modules/create"
312311

‎enos/enos-qualities.hcl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -602,6 +602,11 @@ quality "vault_secrets_kv_write" {
602602
description = "Vault kv secrets engine data is writable"
603603
}
604604

605+
606+
quality "vault_secrets_ldap_write_config" {
607+
description = "The Vault LDAP secrets engine is configured with the correct settings"
608+
}
609+
605610
quality "vault_service_restart" {
606611
description = "Vault restarts with existing configuration"
607612
}

‎enos/enos-scenario-agent.hcl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ scenario "agent" {
66
The agent scenario verifies Vault when running in Agent mode. The build can be a local branch,
77
any CRT built Vault artifact saved to the local machine, or any CRT built Vault artifact in the
88
stable channel in Artifactory.
9-
9+
1010
The scenario creates a new Vault Cluster using the candidate build and then runs the same Vault
1111
build in Agent mode and verifies behavior against the Vault cluster. The scenario also performs
1212
standard baseline verification that is not specific to the Agent mode deployment.
@@ -22,10 +22,10 @@ scenario "agent" {
2222
- vault_build_date*
2323
- vault_product_version
2424
- vault_revision*
25-
25+
2626
* If you don't already know what build date and revision you should be using, see
2727
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
28-
28+
2929
Variables required for some scenario variants:
3030
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3131
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -502,6 +502,7 @@ scenario "agent" {
502502
quality.vault_mount_auth,
503503
quality.vault_mount_kv,
504504
quality.vault_secrets_kv_write,
505+
quality.vault_secrets_ldap_write_config,
505506
]
506507

507508
variables {

‎enos/enos-scenario-autopilot.hcl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ scenario "autopilot" {
2424
- vault_build_date*
2525
- vault_product_version
2626
- vault_revision*
27-
27+
2828
* If you don't already know what build date and revision you should be using, see
2929
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
30-
30+
3131
Variables required for some scenario variants:
3232
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3333
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -370,6 +370,7 @@ scenario "autopilot" {
370370
quality.vault_mount_auth,
371371
quality.vault_mount_kv,
372372
quality.vault_secrets_kv_write,
373+
quality.vault_secrets_ldap_write_config,
373374
]
374375

375376
variables {

‎enos/enos-scenario-dr-replication.hcl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ scenario "dr_replication" {
2727
- vault_build_date*
2828
- vault_product_version
2929
- vault_revision*
30-
30+
3131
* If you don't already know what build date and revision you should be using, see
3232
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
33-
33+
3434
Variables required for some scenario variants:
3535
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3636
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -702,6 +702,7 @@ scenario "dr_replication" {
702702
quality.vault_mount_auth,
703703
quality.vault_mount_kv,
704704
quality.vault_secrets_kv_write,
705+
quality.vault_secrets_ldap_write_config,
705706
]
706707

707708
variables {

‎enos/enos-scenario-pr-replication.hcl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ scenario "pr_replication" {
2727
- vault_build_date*
2828
- vault_product_version
2929
- vault_revision*
30-
30+
3131
* If you don't already know what build date and revision you should be using, see
3232
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
33-
33+
3434
Variables required for some scenario variants:
3535
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3636
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -724,6 +724,7 @@ scenario "pr_replication" {
724724
quality.vault_mount_auth,
725725
quality.vault_mount_kv,
726726
quality.vault_secrets_kv_write,
727+
quality.vault_secrets_ldap_write_config,
727728
]
728729

729730
variables {

‎enos/enos-scenario-proxy.hcl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ scenario "proxy" {
2222
- vault_build_date*
2323
- vault_product_version
2424
- vault_revision*
25-
25+
2626
* If you don't already know what build date and revision you should be using, see
2727
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
2828
@@ -479,6 +479,7 @@ scenario "proxy" {
479479
quality.vault_mount_auth,
480480
quality.vault_mount_kv,
481481
quality.vault_secrets_kv_write,
482+
quality.vault_secrets_ldap_write_config,
482483
]
483484

484485
variables {

‎enos/enos-scenario-seal-ha.hcl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,10 @@ scenario "seal_ha" {
2525
- vault_build_date*
2626
- vault_product_version
2727
- vault_revision*
28-
28+
2929
* If you don't already know what build date and revision you should be using, see
3030
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
31-
31+
3232
Variables required for some scenario variants:
3333
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3434
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -461,6 +461,7 @@ scenario "seal_ha" {
461461
quality.vault_mount_auth,
462462
quality.vault_mount_kv,
463463
quality.vault_secrets_kv_write,
464+
quality.vault_secrets_ldap_write_config,
464465
]
465466

466467
variables {

‎enos/enos-scenario-smoke.hcl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ scenario "smoke" {
2121
- vault_build_date*
2222
- vault_product_version
2323
- vault_revision*
24-
24+
2525
* If you don't already know what build date and revision you should be using, see
2626
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
27-
27+
2828
Variables required for some scenario variants:
2929
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3030
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -582,6 +582,7 @@ scenario "smoke" {
582582
quality.vault_mount_auth,
583583
quality.vault_mount_kv,
584584
quality.vault_secrets_kv_write,
585+
quality.vault_secrets_ldap_write_config,
585586
]
586587

587588
variables {

‎enos/enos-scenario-upgrade.hcl

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ scenario "upgrade" {
2222
- vault_build_date*
2323
- vault_product_version
2424
- vault_revision*
25-
25+
2626
* If you don't already know what build date and revision you should be using, see
2727
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
28-
28+
2929
Variables required for some scenario variants:
3030
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3131
- artifactory_token (if using `artifact_source:artifactory` in your filter)
@@ -420,6 +420,7 @@ scenario "upgrade" {
420420
quality.vault_mount_auth,
421421
quality.vault_mount_kv,
422422
quality.vault_secrets_kv_write,
423+
quality.vault_secrets_ldap_write_config,
423424
]
424425

425426
variables {

‎enos/modules/verify_secrets_engines/modules/create/auth.tf

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ locals {
88
user_password = "passtestuser1" # auth/userpass/login/passtestuser1
99
user_policy_name = "reguser" # sys/policy/reguser
1010

11+
auth_ldap_path = "ldap" # auth/ldap
12+
1113
// Response data
1214
user_login_data = jsondecode(enos_remote_exec.auth_login_testuser.stdout)
1315
sys_auth_data = jsondecode(enos_remote_exec.read_sys_auth.stdout).data
@@ -143,3 +145,86 @@ resource "enos_remote_exec" "auth_login_testuser" {
143145
}
144146
}
145147
}
148+
149+
# Enable ldap auth
150+
resource "enos_remote_exec" "auth_enable_ldap" {
151+
environment = {
152+
AUTH_METHOD = "ldap"
153+
AUTH_PATH = local.auth_ldap_path
154+
VAULT_ADDR = var.vault_addr
155+
VAULT_TOKEN = var.vault_root_token
156+
VAULT_INSTALL_DIR = var.vault_install_dir
157+
}
158+
159+
scripts = [abspath("${path.module}/../../scripts/auth-enable.sh")]
160+
161+
transport = {
162+
ssh = {
163+
host = var.leader_host.public_ip
164+
}
165+
}
166+
}
167+
168+
# Write the initial ldap config
169+
# This is a one time write to the leader node.
170+
resource "enos_remote_exec" "auth_write_ldap_config" {
171+
depends_on = [
172+
enos_remote_exec.auth_enable_ldap
173+
]
174+
175+
environment = {
176+
AUTH_PATH = local.auth_ldap_path
177+
GROUPATTR = "memberOf"
178+
GROUPDN = "CN=Users,DC=corp,DC=example,DC=net"
179+
INSECURE_TLS = "true"
180+
POLICIES = local.auth_ldap_path
181+
UPNDOMAIN = "corp.example.net"
182+
URL = "ldaps://ldap.example.com"
183+
USERATTR = "sAMAccountName"
184+
USERDN = "CN=Users,DC=corp,DC=example,DC=net"
185+
VAULT_ADDR = var.vault_addr
186+
VAULT_INSTALL_DIR = var.vault_install_dir
187+
VAULT_TOKEN = var.vault_root_token
188+
}
189+
190+
scripts = [abspath("${path.module}/../../scripts/auth-ldap-write.sh")]
191+
192+
transport = {
193+
ssh = {
194+
host = var.leader_host.public_ip
195+
}
196+
}
197+
}
198+
199+
# Update the ldap config on all nodes
200+
# This ensures that a write to the non-leader nodes will not panic.
201+
resource "enos_remote_exec" "auth_update_ldap_config" {
202+
depends_on = [
203+
enos_remote_exec.auth_enable_ldap
204+
]
205+
206+
for_each = var.hosts
207+
208+
environment = {
209+
AUTH_PATH = local.auth_ldap_path
210+
GROUPATTR = "memberOf"
211+
GROUPDN = "CN=Users,DC=corp,DC=example,DC=net"
212+
INSECURE_TLS = "true"
213+
POLICIES = local.auth_ldap_path
214+
UPNDOMAIN = "corp.example.net"
215+
URL = "ldaps://ldap2.example.com"
216+
USERATTR = "sAMAccountName"
217+
USERDN = "CN=Users,DC=corp,DC=example,DC=net"
218+
VAULT_ADDR = var.vault_addr
219+
VAULT_INSTALL_DIR = var.vault_install_dir
220+
VAULT_TOKEN = var.vault_root_token
221+
}
222+
223+
scripts = [abspath("${path.module}/../../scripts/auth-ldap-write.sh")]
224+
225+
transport = {
226+
ssh = {
227+
host = each.value.public_ip
228+
}
229+
}
230+
}

‎enos/modules/verify_secrets_engines/scripts/auth-ldap-write.sh

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/usr/bin/env bash
2+
# Copyright (c) HashiCorp, Inc.
3+
# SPDX-License-Identifier: BUSL-1.1
4+
5+
set -e
6+
7+
fail() {
8+
echo "$1" 1>&2
9+
exit 1
10+
}
11+
12+
[[ -z "$AUTH_PATH" ]] && fail "AUTH_PATH env variable has not been set"
13+
[[ -z "$GROUPATTR" ]] && fail "GROUPATTR env variable has not been set"
14+
[[ -z "$GROUPDN" ]] && fail "GROUPDN env variable has not been set"
15+
[[ -z "$INSECURE_TLS" ]] && fail "INSECURE_TLS env variable has not been set"
16+
[[ -z "$UPNDOMAIN" ]] && fail "UPNDOMAIN env variable has not been set"
17+
[[ -z "$URL" ]] && fail "URL env variable has not been set"
18+
[[ -z "$USERATTR" ]] && fail "USERATTR env variable has not been set"
19+
[[ -z "$USERDN" ]] && fail "USERDN env variable has not been set"
20+
21+
[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
22+
[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
23+
[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
24+
25+
binpath=${VAULT_INSTALL_DIR}/vault
26+
test -x "$binpath" || fail "unable to locate vault binary at $binpath"
27+
28+
export VAULT_FORMAT=json
29+
"$binpath" write "auth/$AUTH_PATH/config" \
30+
url="$URL" \
31+
userdn="$USERDN" \
32+
userattr="$USERATTR" \
33+
groupdn="$GROUPDN" \
34+
groupattr="$GROUPATTR" \
35+
upndomain="$UPNDOMAIN" \
36+
insecure_tls="$INSECURE_TLS"

0 commit comments

Comments
 (0)