Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OpenBao to acceptance test GitHub workflow #206

Merged
merged 1 commit into from
Aug 2, 2024
Merged

Add OpenBao to acceptance test GitHub workflow #206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 39 additions & 6 deletions .github/workflows/acceptance-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,19 @@ on:
name: Vault Acceptance Tests

jobs:
acceptance-tests:
acceptance-tests-matrix:
name: ${{ matrix.cli }}
runs-on: ubuntu-latest
continue-on-error: false
environment: development
strategy:
fail-fast: true
matrix:
cli: [vault, bao]
outputs:
artifactory_version: ${{ steps.run_artifactory_container.outputs.version }}
openbao_version: ${{ steps.get_bao_cli_version.outputs.version }}
vault_version: ${{ steps.get_vault_cli_version.outputs.version }}
steps:
- name: Checkout
uses: actions/checkout@v4
Expand All @@ -33,6 +40,26 @@ jobs:
install-only: true
- name: Install Vault binary
uses: eLco/setup-vault@v1
if: ${{ matrix.cli == 'vault' }}
- name: Get Vault CLI version
id: get_vault_cli_version
if: ${{ matrix.cli == 'vault' }}
run: |
VAULT_VERSION=$(vault version | cut -d ' ' -f 2)
echo $VAULT_VERSION
echo "version=$VAULT_VERSION" >> "$GITHUB_OUTPUT"
- name: Install OpenBoa binary
if: ${{ matrix.cli == 'bao' }}
run: |
curl -o ${{ runner.temp }}/bao_2.0.0_linux_amd64.deb https://github.com/openbao/openbao/releases/download/v2.0.0/bao_2.0.0_linux_amd64.deb
sudo dpkg -i ${{ runner.temp }}/bao_2.0.0_linux_amd64.deb
- name: Get OpenBao CLI version
id: get_bao_cli_version
if: ${{ matrix.cli == 'bao' }}
run: |
BAO_VERSION=$(bao version | cut -d ' ' -f 2)
echo $BAO_VERSION
echo "version=$BAO_VERSION" >> "$GITHUB_OUTPUT"
- name: Run Vault Dev server
run: |
docker run --cap-add=IPC_LOCK -e 'VAULT_LOCAL_CONFIG={"storage": {"file": {"path": "/vault/file"}}}' -d --name=dev-vault -p 8200:8200 hashicorp/vault server
Expand Down Expand Up @@ -88,8 +115,12 @@ jobs:
--header "cookie: ACCESSTOKEN=${ACCESSTOKEN}; REFRESHTOKEN=${REFRESHTOKEN}")
echo "::add-mask::$JFROG_ACCESS_TOKEN"
echo "JFROG_ACCESS_TOKEN=$JFROG_ACCESS_TOKEN" >> "$GITHUB_ENV"
- name: Execute acceptance tests
run: make acceptance
- name: Execute all tests
run: make alltests
- name: Setup plugin with Vault server
run: |
make build
VAULT_CLI=${{ matrix.cli }} make setup
- name: Clean up Docker container
if: always() && ${{ steps.run_artifactory_container.outcome == 'success' }}
run: docker stop artifactory
Expand All @@ -116,7 +147,7 @@ jobs:

update-changelog:
runs-on: ubuntu-latest
needs: acceptance-tests
needs: acceptance-tests-matrix
if: github.event_name == 'pull_request' && needs.acceptance-tests.result == 'success'
permissions:
contents: write
Expand All @@ -127,10 +158,12 @@ jobs:
ref: ${{ github.event.pull_request.head.ref }}
- name: Update CHANGELOG and push commit
env:
ARTIFACTORY_VERSION: ${{ needs.acceptance-tests.outputs.artifactory_version }}
ARTIFACTORY_VERSION: ${{ needs.acceptance-tests-matrix.outputs.artifactory_version }}
OPENBAO_VERSION: ${{ needs.acceptance-tests-matrix.outputs.openbao_version }}
VAULT_VERSION: ${{ needs.acceptance-tests-matrix.outputs.vault_version }}
run: |
echo "Adding Artifactory version to CHANGELOG.md"
sed -i -E "0,/(##\s.+\..+\..+\s\(.+\)).*/ s/(##\s.+\..+\..+\s\(.+\)).*/\1. Tested on Artifactory $ARTIFACTORY_VERSION/" CHANGELOG.md
sed -i -E "0,/(##\s.+\..+\..+\s\(.+\)).*/ s/(##\s.+\..+\..+\s\(.+\)).*/\1. Tested on Artifactory $ARTIFACTORY_VERSION with Vault $VAULT_VERSION and OpenBao $OPENBAO_VERSION/" CHANGELOG.md
head -10 CHANGELOG.md
git add CHANGELOG.md
export REGEX="Changes to be committed*"
Expand Down
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,6 @@
/vendor

.DS_Store
bin/
dist/
/coverage.*
40 changes: 21 additions & 19 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ PLUGIN_FILE := artifactory-secrets-plugin
PLUGIN_NAME ?= artifactory
PLUGIN_VAULT_PATH ?= artifactory

VAULT_CLI?=vault

ARTIFACTORY_ENV := ./vault/artifactory.env
ARTIFACTORY_SCOPE ?= applied-permissions/groups:readers
export JFROG_URL ?= http://localhost:8082
Expand All @@ -34,23 +36,23 @@ release:
goreleaser release --clean --snapshot --parallelism 2

start:
vault server -dev -dev-root-token-id=root -dev-plugin-dir=$(PLUGIN_DIR) -log-level=DEBUG
${VAULT_CLI} server -dev -dev-root-token-id=root -dev-plugin-dir=$(PLUGIN_DIR) -log-level=DEBUG

disable:
vault secrets disable $(PLUGIN_VAULT_PATH)
${VAULT_CLI} secrets disable $(PLUGIN_VAULT_PATH)

enable:
vault secrets enable -path=$(PLUGIN_VAULT_PATH) -plugin-version=$(NEXT_VERSION) $(PLUGIN_NAME)
${VAULT_CLI} secrets enable -path=$(PLUGIN_VAULT_PATH) -plugin-version=$(NEXT_VERSION) $(PLUGIN_NAME)

register:
vault plugin register -sha256=$$(sha256sum $(PLUGIN_DIR)/$(PLUGIN_FILE) | cut -d " " -f 1) -command=$(PLUGIN_FILE) -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
vault plugin info -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
${VAULT_CLI} plugin register -sha256=$$(sha256sum $(PLUGIN_DIR)/$(PLUGIN_FILE) | cut -d " " -f 1) -command=$(PLUGIN_FILE) -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
${VAULT_CLI} plugin info -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)

deregister:
vault plugin deregister -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
${VAULT_CLI} plugin deregister -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)

upgrade: build register
vault plugin reload -plugin=$(PLUGIN_NAME)
${VAULT_CLI} plugin reload -plugin=$(PLUGIN_NAME)

test:
go test -v -count=1 ./...
Expand All @@ -74,21 +76,21 @@ fmt:
setup: disable register enable

admin:
vault write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
vault read $(PLUGIN_VAULT_PATH)/config/admin
vault write -f $(PLUGIN_VAULT_PATH)/config/rotate
vault read $(PLUGIN_VAULT_PATH)/config/admin
${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/config/admin
${VAULT_CLI} write -f $(PLUGIN_VAULT_PATH)/config/rotate
${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/config/admin

usertoken:
vault write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
vault write $(PLUGIN_VAULT_PATH)/config/user_token default_description="Vault Test"
vault read $(PLUGIN_VAULT_PATH)/config/user_token
vault read $(PLUGIN_VAULT_PATH)/user_token/test refreshable=true include_reference_token=true use_expiring_tokens=true
${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/config/user_token default_description="Vault Test"
${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/config/user_token
${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/user_token/test refreshable=true include_reference_token=true use_expiring_tokens=true

testrole:
vault write $(PLUGIN_VAULT_PATH)/roles/test scope="$(ARTIFACTORY_SCOPE)" max_ttl=3h default_ttl=2h
vault read $(PLUGIN_VAULT_PATH)/roles/test
vault read $(PLUGIN_VAULT_PATH)/token/test
${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/roles/test scope="$(ARTIFACTORY_SCOPE)" max_ttl=3h default_ttl=2h
${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/roles/test
${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/token/test

artifactory: $(ARTIFACTORY_ENV)

Expand All @@ -99,4 +101,4 @@ stop_artifactory:
source $(ARTIFACTORY_ENV) && docker stop $$ARTIFACTORY_CONTAINER_ID
rm -f $(ARTIFACTORY_ENV)

.PHONY: build clean fmt start disable enable register deregister upgrade test acceptance setup admin testrole artifactory stop_artifactory
.PHONY: build clean fmt start disable enable register deregister upgrade test acceptance setup admin testrole artifactory stop_artifactory
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -717,6 +717,12 @@ brew tap hashicorp/tap
brew install hashicorp/tap/vault
```

#### Test with OpenBao binary

* You can follow the [Installing OpenBao](https://openbao.org/docs/install/) instructions.
* Export env var `VAULT_CLI=<your path to bao binary>`, e.g. `export VAULT_CLI=/usr/local/bin/bao`
* Run makefile as usual `make setup` or `VAULT_CLI=/usr/local/bin/bao make setup`

#### Start Vault dev server

```sh
Expand Down
Loading