Skip to content

Commit 0187338

Browse files
charlesn-hccharlesn-hc
authored
[Enos] VAULT-30196: SSH Secrets Engine (#29534)
1 parent 3d46115 commit 0187338

24 files changed

+1149
-23
lines changed

‎enos/enos-descriptions.hcl‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ globals {
181181
EOF
182182

183183
verify_secrets_engines_read = <<-EOF
184-
Verify that data that we've created previously is still valid, consistent, and duarable.
184+
Verify that data that we've created previously is still valid, consistent, and durable.
185185
This includes:
186186
- v1/auth/userpass/*
187187
- v1/identity/*
@@ -191,6 +191,12 @@ globals {
191191
- v1/ldap/*
192192
EOF
193193

194+
verify_secrets_engines_delete = <<-EOF
195+
Verify that data that we've created previously can be deleted with no errors.
196+
This includes:
197+
- v1/ssh/*
198+
EOF
199+
194200
verify_ui = <<-EOF
195201
The Vault UI assets are embedded in the Vault binary and available when running.
196202
EOF

‎enos/enos-dev-scenario-pr-replication.hcl‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -679,6 +679,8 @@ scenario "dev_pr_replication" {
679679
}
680680

681681
variables {
682+
ports = global.ports
683+
ipv4_cidr = step.create_vpc.ipv4_cidr
682684
hosts = step.create_primary_cluster_targets.hosts
683685
leader_host = step.get_primary_cluster_ips.leader_host
684686
vault_addr = step.create_primary_cluster.api_addr_localhost

‎enos/enos-modules.hcl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,12 @@ module "vault_verify_secrets_engines_read" {
334334
vault_install_dir = var.vault_install_dir
335335
}
336336

337+
module "vault_verify_secrets_engines_delete" {
338+
source = "./modules/verify_secrets_engines/modules/delete"
339+
340+
vault_install_dir = var.vault_install_dir
341+
}
342+
337343
module "vault_verify_default_lcq" {
338344
source = "./modules/vault_verify_default_lcq"
339345

‎enos/enos-qualities.hcl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,10 @@ quality "vault_api_sys_auth_userpass_user_write" {
147147
description = "The v1/sys/auth/userpass/users/<user> Vault API associates a superuser policy with a user"
148148
}
149149

150+
quality "vault_api_ssh_role_delete" {
151+
description = "The v1/ssh/role Vault API deletes an SSH role associated with a key and clients"
152+
}
153+
150154
quality "vault_api_sys_config_read" {
151155
description = <<-EOF
152156
The v1/sys/config/sanitized Vault API returns sanitized configuration which matches our given

‎enos/enos-scenario-agent.hcl‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -549,7 +549,8 @@ scenario "agent" {
549549
ip_version = matrix.ip_version
550550
integration_host_state = step.set_up_external_integration_target.state
551551
leader_host = step.get_vault_cluster_ips.leader_host
552-
ports = global.integration_host_ports
552+
ports = global.ports
553+
ipv4_cidr = step.create_vpc.ipv4_cidr
553554
vault_addr = step.create_vault_cluster.api_addr_localhost
554555
vault_edition = matrix.edition
555556
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
@@ -660,6 +661,32 @@ scenario "agent" {
660661
}
661662
}
662663

664+
step "verify_secrets_engines_delete" {
665+
description = global.description.verify_secrets_engines_delete
666+
module = module.vault_verify_secrets_engines_delete
667+
depends_on = [
668+
step.verify_secrets_engines_create,
669+
step.verify_secrets_engines_read
670+
]
671+
672+
providers = {
673+
enos = local.enos_provider[matrix.distro]
674+
}
675+
676+
verifies = [
677+
quality.vault_api_ssh_role_delete
678+
]
679+
680+
variables {
681+
create_state = step.verify_secrets_engines_create.state
682+
hosts = step.get_vault_cluster_ips.follower_hosts
683+
leader_host = step.get_vault_cluster_ips.leader_host
684+
vault_addr = step.create_vault_cluster.api_addr_localhost
685+
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
686+
vault_root_token = step.create_vault_cluster.root_token
687+
}
688+
}
689+
663690
step "verify_ui" {
664691
description = global.description.verify_ui
665692
module = module.vault_verify_ui

‎enos/enos-scenario-autopilot.hcl‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,8 @@ scenario "autopilot" {
417417
ip_version = matrix.ip_version
418418
integration_host_state = step.set_up_external_integration_target.state
419419
leader_host = step.get_vault_cluster_ips.leader_host
420-
ports = global.integration_host_ports
420+
ports = global.ports
421+
ipv4_cidr = step.create_vpc.ipv4_cidr
421422
vault_addr = step.create_vault_cluster.api_addr_localhost
422423
vault_edition = matrix.edition
423424
vault_install_dir = local.vault_install_dir
@@ -674,6 +675,32 @@ scenario "autopilot" {
674675
}
675676
}
676677

678+
step "verify_secrets_engines_delete" {
679+
description = global.description.verify_secrets_engines_delete
680+
module = module.vault_verify_secrets_engines_delete
681+
depends_on = [
682+
step.verify_secrets_engines_create,
683+
step.verify_secrets_engines_read
684+
]
685+
686+
providers = {
687+
enos = local.enos_provider[matrix.distro]
688+
}
689+
690+
verifies = [
691+
quality.vault_api_ssh_role_delete
692+
]
693+
694+
variables {
695+
create_state = step.verify_secrets_engines_create.state
696+
hosts = step.get_vault_cluster_ips.follower_hosts
697+
leader_host = step.get_vault_cluster_ips.leader_host
698+
vault_addr = step.create_vault_cluster.api_addr_localhost
699+
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
700+
vault_root_token = step.create_vault_cluster.root_token
701+
}
702+
}
703+
677704
step "raft_remove_peers" {
678705
description = <<-EOF
679706
Remove the nodes that were running the prior version of Vault from the raft cluster

‎enos/enos-scenario-dr-replication.hcl‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -748,7 +748,8 @@ scenario "dr_replication" {
748748
ip_version = matrix.ip_version
749749
integration_host_state = step.set_up_external_integration_target.state
750750
leader_host = step.get_primary_cluster_ips.leader_host
751-
ports = global.integration_host_ports
751+
ports = global.ports
752+
ipv4_cidr = step.create_vpc.ipv4_cidr
752753
vault_addr = step.create_primary_cluster.api_addr_localhost
753754
vault_edition = matrix.edition
754755
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
@@ -1159,6 +1160,7 @@ scenario "dr_replication" {
11591160
vault_root_token = step.create_secondary_cluster.root_token
11601161
verify_pki_certs = false
11611162
verify_aws_engine_creds = false
1163+
verify_ssh_secrets = false
11621164
}
11631165
}
11641166

@@ -1300,6 +1302,39 @@ scenario "dr_replication" {
13001302
vault_root_token = step.create_secondary_cluster.root_token
13011303
verify_pki_certs = false
13021304
verify_aws_engine_creds = false
1305+
verify_ssh_secrets = false
1306+
}
1307+
}
1308+
1309+
# Verification is intentionally disabled for DR clusters because they do not handle client requests.
1310+
# However, we still include this step to future-proof the module, making it easier to enable delete
1311+
# verification later for other secrets engines or use cases where DR verification becomes relevant.
1312+
# For now, the script will short-circuit if verification is disabled. Potential future work will include
1313+
# verifying against the primary cluster.
1314+
step "verify_secrets_engines_delete" {
1315+
description = global.description.verify_secrets_engines_delete
1316+
module = module.vault_verify_secrets_engines_delete
1317+
depends_on = [
1318+
step.verify_secrets_engines_on_primary,
1319+
step.verify_failover_replicated_data
1320+
]
1321+
1322+
providers = {
1323+
enos = local.enos_provider[matrix.distro]
1324+
}
1325+
1326+
verifies = [
1327+
quality.vault_api_ssh_role_delete
1328+
]
1329+
1330+
variables {
1331+
create_state = step.verify_secrets_engines_on_primary.state
1332+
hosts = step.get_secondary_cluster_ips.follower_hosts
1333+
leader_host = step.get_secondary_cluster_ips.leader_host
1334+
vault_addr = step.create_secondary_cluster.api_addr_localhost
1335+
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
1336+
vault_root_token = step.create_secondary_cluster.root_token
1337+
verify_ssh_secrets = false
13031338
}
13041339
}
13051340

‎enos/enos-scenario-pr-replication.hcl‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -770,7 +770,8 @@ scenario "pr_replication" {
770770
ip_version = matrix.ip_version
771771
integration_host_state = step.set_up_external_integration_target.state
772772
leader_host = step.get_primary_cluster_ips.leader_host
773-
ports = global.integration_host_ports
773+
ports = global.ports
774+
ipv4_cidr = step.create_vpc.ipv4_cidr
774775
vault_addr = step.create_primary_cluster.api_addr_localhost
775776
vault_edition = matrix.edition
776777
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
@@ -991,6 +992,34 @@ scenario "pr_replication" {
991992
vault_root_token = step.create_secondary_cluster.root_token
992993
verify_pki_certs = false
993994
verify_aws_engine_creds = false
995+
verify_ssh_secrets = false
996+
}
997+
}
998+
999+
step "verify_secrets_engines_delete" {
1000+
description = global.description.verify_secrets_engines_delete
1001+
module = module.vault_verify_secrets_engines_delete
1002+
depends_on = [
1003+
step.verify_secrets_engines_on_primary,
1004+
step.verify_replicated_data
1005+
]
1006+
1007+
providers = {
1008+
enos = local.enos_provider[matrix.distro]
1009+
}
1010+
1011+
verifies = [
1012+
quality.vault_api_ssh_role_delete
1013+
]
1014+
1015+
variables {
1016+
create_state = step.verify_secrets_engines_on_primary.state
1017+
hosts = step.get_secondary_cluster_ips.follower_hosts
1018+
leader_host = step.get_secondary_cluster_ips.leader_host
1019+
vault_addr = step.create_secondary_cluster.api_addr_localhost
1020+
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
1021+
vault_root_token = step.create_secondary_cluster.root_token
1022+
verify_ssh_secrets = false
9941023
}
9951024
}
9961025

‎enos/enos-scenario-proxy.hcl‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -525,7 +525,8 @@ scenario "proxy" {
525525
ip_version = matrix.ip_version
526526
integration_host_state = step.set_up_external_integration_target.state
527527
leader_host = step.get_vault_cluster_ips.leader_host
528-
ports = global.integration_host_ports
528+
ports = global.ports
529+
ipv4_cidr = step.create_vpc.ipv4_cidr
529530
vault_addr = step.create_vault_cluster.api_addr_localhost
530531
vault_edition = matrix.edition
531532
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
@@ -636,6 +637,32 @@ scenario "proxy" {
636637
}
637638
}
638639

640+
step "verify_secrets_engines_delete" {
641+
description = global.description.verify_secrets_engines_delete
642+
module = module.vault_verify_secrets_engines_delete
643+
depends_on = [
644+
step.verify_secrets_engines_create,
645+
step.verify_secrets_engines_read
646+
]
647+
648+
providers = {
649+
enos = local.enos_provider[matrix.distro]
650+
}
651+
652+
verifies = [
653+
quality.vault_api_ssh_role_delete
654+
]
655+
656+
variables {
657+
create_state = step.verify_secrets_engines_create.state
658+
hosts = step.get_vault_cluster_ips.follower_hosts
659+
leader_host = step.get_vault_cluster_ips.leader_host
660+
vault_addr = step.create_vault_cluster.api_addr_localhost
661+
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
662+
vault_root_token = step.create_vault_cluster.root_token
663+
}
664+
}
665+
639666
step "verify_ui" {
640667
description = global.description.verify_ui
641668
module = module.vault_verify_ui

‎enos/enos-scenario-seal-ha.hcl‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -505,7 +505,8 @@ scenario "seal_ha" {
505505
ip_version = matrix.ip_version
506506
integration_host_state = step.set_up_external_integration_target.state
507507
leader_host = step.get_vault_cluster_ips.leader_host
508-
ports = global.integration_host_ports
508+
ports = global.ports
509+
ipv4_cidr = step.create_vpc.ipv4_cidr
509510
vault_addr = step.create_vault_cluster.api_addr_localhost
510511
vault_edition = matrix.edition
511512
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
@@ -1091,6 +1092,32 @@ scenario "seal_ha" {
10911092
}
10921093
}
10931094

1095+
step "verify_secrets_engines_delete" {
1096+
description = global.description.verify_secrets_engines_delete
1097+
module = module.vault_verify_secrets_engines_delete
1098+
depends_on = [
1099+
step.verify_secrets_engines_create,
1100+
step.verify_secrets_engines_read_after_migration
1101+
]
1102+
1103+
providers = {
1104+
enos = local.enos_provider[matrix.distro]
1105+
}
1106+
1107+
verifies = [
1108+
quality.vault_api_ssh_role_delete
1109+
]
1110+
1111+
variables {
1112+
create_state = step.verify_secrets_engines_create.state
1113+
hosts = step.get_vault_cluster_ips.follower_hosts
1114+
leader_host = step.get_vault_cluster_ips.leader_host
1115+
vault_addr = step.create_vault_cluster.api_addr_localhost
1116+
vault_install_dir = global.vault_install_dir[matrix.artifact_type]
1117+
vault_root_token = step.create_vault_cluster.root_token
1118+
}
1119+
}
1120+
10941121
// Make sure we have our secondary seal type after migration
10951122
step "verify_seal_type_after_migration" {
10961123
// Don't run this on versions less than 1.16.0-beta1 until VAULT-21053 is fixed on prior branches.

0 commit comments

Comments
 (0)