mirror of
https://github.com/kemko/nomad.git
synced 2026-01-04 17:35:43 +03:00
8bce0b0954
Nomad 1.10.0 is removing the legacy Vault token based workflow which means the legacy e2e compatibility tests will fail and not work. The Nomad e2e cluster was using the legacy Vault token based workflow for initial cluster build. This change migrates to using the workload identity flow which utilizes authentication methods, roles, and policies. The Nomad server network has been modified to allow traffic from the HCP Vault HVN which is a private network peered into our AWS account. This is required, so that Vault can pull JWKS information from the Nomad API without going over the public internet. The cluster build will now also configure a Vault KV v2 mount at a unique indentifier for the e2e cluster. This allows all Nomad workloads and tests to use this if required. The vaultsecrets suite has been updated to accommodate the new changes and extended to test the default workload ID flow for allocations which use Vault for secrets.
58 lines
1.3 KiB
Go
58 lines
1.3 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build !ent
|
|
|
|
package vaultcompat
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/go-version"
|
|
"github.com/shoenig/test/must"
|
|
)
|
|
|
|
// usable is used by the downloader to verify that we're getting the right
|
|
// versions of Vault CE
|
|
func usable(v, minimum *version.Version) bool {
|
|
switch {
|
|
case v.Metadata() != "":
|
|
return false
|
|
case v.LessThan(minimum):
|
|
return false
|
|
default:
|
|
return true
|
|
}
|
|
}
|
|
|
|
func testVaultJWT(t *testing.T, b build) {
|
|
vStop, vc := startVault(t, b)
|
|
defer vStop()
|
|
|
|
// Start Nomad without access to the Vault token.
|
|
vaultToken := vc.Token()
|
|
vc.SetToken("")
|
|
nStop, nc := startNomad(t, configureNomadVaultJWT(vc))
|
|
defer nStop()
|
|
|
|
// Restore token and configure Vault for JWT login.
|
|
vc.SetToken(vaultToken)
|
|
setupVaultJWT(t, vc, nc.Address()+"/.well-known/jwks.json")
|
|
|
|
// Write secrets for test job.
|
|
_, err := vc.KVv2("secret").Put(context.Background(), "default/cat_jwt", map[string]any{
|
|
"secret": "workload",
|
|
})
|
|
must.NoError(t, err)
|
|
|
|
_, err = vc.KVv2("secret").Put(context.Background(), "restricted", map[string]any{
|
|
"secret": "restricted",
|
|
})
|
|
must.NoError(t, err)
|
|
|
|
// Run test job.
|
|
runJob(t, nc, "input/cat_jwt.hcl", "default", validateJWTAllocs)
|
|
runJob(t, nc, "input/restricted_jwt.hcl", "default", validateJWTAllocs)
|
|
}
|