mirror of
https://github.com/hashicorp/vault-action.git
synced 2026-04-16 16:55:45 +00:00
Merge branch 'main' into wildcard-selector
This commit is contained in:
keattang
GitHub
commit
e716b61e11
23 changed files with 1437 additions and 863 deletions
134
integrationTests/basic/approle_auth.test.js
Normal file
134
integrationTests/basic/approle_auth.test.js
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
|
||||
describe('authenticate with approle', () => {
|
||||
let roleId;
|
||||
let secretId;
|
||||
beforeAll(async () => {
|
||||
try {
|
||||
// Verify Connection
|
||||
await got(`${vaultUrl}/v1/secret/config`, {
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/secret/data/approle-test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
data: {
|
||||
secret: 'SUPERSECRET_WITH_APPROLE',
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Enable approle
|
||||
try {
|
||||
await got(`${vaultUrl}/v1/sys/auth/approle`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
json: {
|
||||
type: 'approle'
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response.statusCode === 400 && response.body.includes("path is already in use")) {
|
||||
// Approle might already be enabled from previous test runs
|
||||
} else {
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
// Create policies
|
||||
await got(`${vaultUrl}/v1/sys/policies/acl/test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
json: {
|
||||
"name":"test",
|
||||
"policy":"path \"auth/approle/*\" {\n capabilities = [\"read\", \"list\"]\n}\npath \"auth/approle/role/my-role/role-id\"\n{\n capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\npath \"auth/approle/role/my-role/secret-id\"\n{\n capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\n\npath \"secret/data/*\" {\n capabilities = [\"list\"]\n}\npath \"secret/metadata/*\" {\n capabilities = [\"list\"]\n}\n\npath \"secret/data/approle-test\" {\n capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/approle-test\" {\n capabilities = [\"read\", \"list\"]\n}\n"
|
||||
},
|
||||
});
|
||||
|
||||
// Create approle
|
||||
await got(`${vaultUrl}/v1/auth/approle/role/my-role`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
json: {
|
||||
policies: 'test'
|
||||
},
|
||||
});
|
||||
|
||||
// Get role-id
|
||||
const roldIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/role-id`, {
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
responseType: 'json',
|
||||
});
|
||||
roleId = roldIdResponse.body.data.role_id;
|
||||
|
||||
// Get secret-id
|
||||
const secretIdResponse = await got(`${vaultUrl}/v1/auth/approle/role/my-role/secret-id`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
responseType: 'json',
|
||||
});
|
||||
secretId = secretIdResponse.body.data.secret_id;
|
||||
} catch(err) {
|
||||
console.warn('Create approle', err.response.body);
|
||||
throw err;
|
||||
}
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('method', expect.anything())
|
||||
.mockReturnValueOnce('approle');
|
||||
when(core.getInput)
|
||||
.calledWith('roleId', expect.anything())
|
||||
.mockReturnValueOnce(roleId);
|
||||
when(core.getInput)
|
||||
.calledWith('secretId', expect.anything())
|
||||
.mockReturnValueOnce(secretId);
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
.mockReturnValueOnce(`${vaultUrl}`);
|
||||
});
|
||||
|
||||
function mockInput(secrets) {
|
||||
when(core.getInput)
|
||||
.calledWith('secrets', expect.anything())
|
||||
.mockReturnValueOnce(secrets);
|
||||
}
|
||||
|
||||
it('authenticate with approle', async() => {
|
||||
mockInput('secret/data/approle-test secret');
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_WITH_APPROLE');
|
||||
})
|
||||
});
|
||||
116
integrationTests/basic/userpass_auth.test.js
Normal file
116
integrationTests/basic/userpass_auth.test.js
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
jest.mock('@actions/core');
|
||||
jest.mock('@actions/core/lib/command');
|
||||
const core = require('@actions/core');
|
||||
|
||||
const got = require('got');
|
||||
const { when } = require('jest-when');
|
||||
|
||||
const { exportSecrets } = require('../../src/action');
|
||||
|
||||
const vaultUrl = `http://${process.env.VAULT_HOST || 'localhost'}:${process.env.VAULT_PORT || '8200'}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
|
||||
describe('authenticate with userpass', () => {
|
||||
const username = `testUsername`;
|
||||
const password = `testPassword`;
|
||||
beforeAll(async () => {
|
||||
try {
|
||||
// Verify Connection
|
||||
await got(`${vaultUrl}/v1/secret/config`, {
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
});
|
||||
|
||||
await got(`${vaultUrl}/v1/secret/data/userpass-test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
data: {
|
||||
secret: 'SUPERSECRET_WITH_USERPASS',
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
// Enable userpass
|
||||
try {
|
||||
await got(`${vaultUrl}/v1/sys/auth/userpass`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
json: {
|
||||
type: 'userpass'
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
const {response} = error;
|
||||
if (response.statusCode === 400 && response.body.includes("path is already in use")) {
|
||||
// Userpass might already be enabled from previous test runs
|
||||
} else {
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
// Create policies
|
||||
await got(`${vaultUrl}/v1/sys/policies/acl/userpass-test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
json: {
|
||||
"name":"userpass-test",
|
||||
"policy":`path \"auth/userpass/*\" {\n capabilities = [\"read\", \"list\"]\n}\npath \"auth/userpass/users/${username}\"\n{\n capabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\n}\n\npath \"secret/data/*\" {\n capabilities = [\"list\"]\n}\npath \"secret/metadata/*\" {\n capabilities = [\"list\"]\n}\n\npath \"secret/data/userpass-test\" {\n capabilities = [\"read\", \"list\"]\n}\npath \"secret/metadata/userpass-test\" {\n capabilities = [\"read\", \"list\"]\n}\n`
|
||||
},
|
||||
});
|
||||
|
||||
// Create user
|
||||
await got(`${vaultUrl}/v1/auth/userpass/users/${username}`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken
|
||||
},
|
||||
json: {
|
||||
password: `${password}`,
|
||||
policies: 'userpass-test'
|
||||
},
|
||||
});
|
||||
} catch(err) {
|
||||
console.warn('Create user in userpass', err.response.body);
|
||||
throw err;
|
||||
}
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
jest.resetAllMocks();
|
||||
|
||||
when(core.getInput)
|
||||
.calledWith('method', expect.anything())
|
||||
.mockReturnValueOnce('userpass');
|
||||
when(core.getInput)
|
||||
.calledWith('username', expect.anything())
|
||||
.mockReturnValueOnce(username);
|
||||
when(core.getInput)
|
||||
.calledWith('password', expect.anything())
|
||||
.mockReturnValueOnce(password);
|
||||
when(core.getInput)
|
||||
.calledWith('url', expect.anything())
|
||||
.mockReturnValueOnce(`${vaultUrl}`);
|
||||
});
|
||||
|
||||
function mockInput(secrets) {
|
||||
when(core.getInput)
|
||||
.calledWith('secrets', expect.anything())
|
||||
.mockReturnValueOnce(secrets);
|
||||
}
|
||||
|
||||
it('authenticate with userpass', async() => {
|
||||
mockInput('secret/data/userpass-test secret');
|
||||
|
||||
await exportSecrets();
|
||||
|
||||
expect(core.exportVariable).toBeCalledWith('SECRET', 'SUPERSECRET_WITH_USERPASS');
|
||||
})
|
||||
});
|
||||
|
|
@ -9,5 +9,9 @@ describe('e2e', () => {
|
|||
expect(process.env.OTHERALTSECRET).toBe("OTHERCUSTOMSECRET");
|
||||
expect(process.env.FOO).toBe("bar");
|
||||
expect(process.env.NAMED_CUBBYSECRET).toBe("zap");
|
||||
expect(process.env.SUBSEQUENT_TEST_SECRET).toBe("SUBSEQUENT_TEST_SECRET");
|
||||
expect(process.env.JSONSTRING).toBe('{"x":1,"y":"qux"}');
|
||||
expect(process.env.JSONSTRINGMULTILINE).toBe('{"x": 1, "y": "q\\nux"}');
|
||||
expect(process.env.JSONDATA).toBe('{"x":1,"y":"qux"}');
|
||||
});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -1,7 +1,9 @@
|
|||
const got = require('got');
|
||||
|
||||
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
const vaultToken = `${process.env.VAULT_TOKEN}` === undefined ? `${process.env.VAULT_TOKEN}` : "testtoken";
|
||||
|
||||
const jsonStringMultiline = '{"x": 1, "y": "q\\nux"}';
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
|
|
@ -36,6 +38,44 @@ const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
|||
}
|
||||
});
|
||||
|
||||
await got(`http://${vaultUrl}/v1/secret/data/test-json-string`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
data: {
|
||||
// this is stored in Vault as a string
|
||||
jsonString: '{"x":1,"y":"qux"}',
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
await got(`http://${vaultUrl}/v1/secret/data/test-json-data`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
data: {
|
||||
// this is stored in Vault as a map
|
||||
jsonData: {"x":1,"y":"qux"},
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
await got(`http://${vaultUrl}/v1/secret/data/test-json-string-multiline`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
data: {
|
||||
jsonStringMultiline,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
await got(`http://${vaultUrl}/v1/sys/mounts/my-secret`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
|
|
@ -76,6 +116,18 @@ const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
|||
zip: 'zap',
|
||||
},
|
||||
});
|
||||
|
||||
await got(`http://${vaultUrl}/v1/secret/data/subsequent-test`, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
'X-Vault-Token': vaultToken,
|
||||
},
|
||||
json: {
|
||||
data: {
|
||||
secret: 'SUBSEQUENT_TEST_SECRET',
|
||||
},
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
console.log(error);
|
||||
process.exit(1);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue