Skip to content

Commit

Permalink
Support server TLS with vault for the client snapshot agent deployment (
Browse files Browse the repository at this point in the history 
#891)
  • Loading branch information
@ishustava
ishustava authored Dec 6, 2021
1 parent f611a38 commit 2dca3f0
Show file tree
Hide file tree
Showing 3 changed files with 131 additions and 1 deletion.
11 changes: 11 additions & 0 deletions charts/consul/templates/client-snapshot-agent-deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,17 @@ spec:
component: client-snapshot-agent
annotations:
"consul.hashicorp.com/connect-inject": "false"
{{- if (and .Values.global.secretsBackend.vault.enabled .Values.global.tls.enabled) }}
"vault.hashicorp.com/agent-init-first": "true"
"vault.hashicorp.com/agent-inject": "true"
"vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.consulCARole }}
"vault.hashicorp.com/agent-inject-secret-serverca": {{ .Values.global.tls.caCert.secretName }}
"vault.hashicorp.com/agent-inject-template-serverca": {{ template "consul.serverTLSCATemplate" . }}
{{- if and .Values.global.secretsBackend.vault.ca.secretName .Values.global.secretsBackend.vault.ca.secretKey }}
"vault.hashicorp.com/agent-extra-secret": "{{ .Values.global.secretsBackend.vault.ca.secretName }}"
"vault.hashicorp.com/ca-cert": "/vault/custom/{{ .Values.global.secretsBackend.vault.ca.secretKey }}"
{{- end }}
{{- end }}
spec:
{{- if .Values.client.tolerations }}
tolerations:
Expand Down
120 changes: 120 additions & 0 deletions charts/consul/test/unit/client-snapshot-agent-deployment.bats
View file
Original file line number Diff line number Diff line change
Expand Up @@ -458,3 +458,123 @@ exec /bin/consul snapshot agent \'
yq -r -c '.spec.template.spec.containers[0].env[] | select(.name == "CONSUL_LICENSE_PATH")' | tee /dev/stderr)
[ "${actual}" = "" ]
}

#--------------------------------------------------------------------
# Vault

@test "client/SnapshotAgentDeployment: configures server CA to come from vault when vault is enabled" {
cd `chart_dir`
local object=$(helm template \
-s templates/client-snapshot-agent-deployment.yaml \
--set 'client.snapshotAgent.enabled=true' \
--set 'global.tls.enabled=true' \
--set 'global.tls.enableAutoEncrypt=true' \
--set 'global.tls.caCert.secretName=foo' \
--set 'global.secretsBackend.vault.enabled=true' \
--set 'global.secretsBackend.vault.consulClientRole=test' \
--set 'global.secretsBackend.vault.consulServerRole=foo' \
--set 'global.secretsBackend.vault.consulCARole=carole' \
. | tee /dev/stderr |
yq -r '.spec.template' | tee /dev/stderr)

# Check annotations
local actual
actual=$(echo $object | jq -r '.metadata.annotations["vault.hashicorp.com/agent-init-first"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
local actual
actual=$(echo $object | jq -r '.metadata.annotations["vault.hashicorp.com/agent-inject"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
local actual
actual=$(echo $object | jq -r '.metadata.annotations["vault.hashicorp.com/role"]' | tee /dev/stderr)
[ "${actual}" = "carole" ]
local actual
actual=$(echo $object | jq -r '.metadata.annotations["vault.hashicorp.com/agent-inject-secret-serverca"]' | tee /dev/stderr)
[ "${actual}" = "foo" ]
local actual
actual=$(echo $object | jq -r '.metadata.annotations["vault.hashicorp.com/agent-inject-template-serverca"]' | tee /dev/stderr)
[ "${actual}" = $'{{- with secret \"foo\" -}}\n{{- .Data.certificate -}}\n{{- end -}}' ]
}

@test "client/SnapshotAgentDeployment: vault CA is not configured by default" {
cd `chart_dir`
local object=$(helm template \
-s templates/client-snapshot-agent-deployment.yaml \
--set 'client.snapshotAgent.enabled=true' \
--set 'global.tls.enabled=true' \
--set 'global.tls.enableAutoEncrypt=true' \
--set 'global.tls.caCert.secretName=foo' \
--set 'global.secretsBackend.vault.enabled=true' \
--set 'global.secretsBackend.vault.consulClientRole=foo' \
--set 'global.secretsBackend.vault.consulServerRole=test' \
. | tee /dev/stderr |
yq -r '.spec.template' | tee /dev/stderr)

local actual=$(echo $object | yq -r '.metadata.annotations | has("vault.hashicorp.com/agent-extra-secret")')
[ "${actual}" = "false" ]
local actual=$(echo $object | yq -r '.metadata.annotations | has("vault.hashicorp.com/ca-cert")')
[ "${actual}" = "false" ]
}

@test "client/SnapshotAgentDeployment: vault CA is not configured when secretName is set but secretKey is not" {
cd `chart_dir`
local object=$(helm template \
-s templates/client-snapshot-agent-deployment.yaml \
--set 'client.snapshotAgent.enabled=true' \
--set 'global.tls.enabled=true' \
--set 'global.tls.enableAutoEncrypt=true' \
--set 'global.tls.caCert.secretName=foo' \
--set 'global.secretsBackend.vault.enabled=true' \
--set 'global.secretsBackend.vault.consulClientRole=foo' \
--set 'global.secretsBackend.vault.consulServerRole=test' \
--set 'global.secretsBackend.vault.ca.secretName=ca' \
. | tee /dev/stderr |
yq -r '.spec.template' | tee /dev/stderr)

local actual=$(echo $object | yq -r '.metadata.annotations | has("vault.hashicorp.com/agent-extra-secret")')
[ "${actual}" = "false" ]
local actual=$(echo $object | yq -r '.metadata.annotations | has("vault.hashicorp.com/ca-cert")')
[ "${actual}" = "false" ]
}

@test "client/SnapshotAgentDeployment: vault CA is not configured when secretKey is set but secretName is not" {
cd `chart_dir`
local object=$(helm template \
-s templates/client-snapshot-agent-deployment.yaml \
--set 'client.snapshotAgent.enabled=true' \
--set 'global.tls.enabled=true' \
--set 'global.tls.enableAutoEncrypt=true' \
--set 'global.tls.caCert.secretName=foo' \
--set 'global.secretsBackend.vault.enabled=true' \
--set 'global.secretsBackend.vault.consulClientRole=foo' \
--set 'global.secretsBackend.vault.consulServerRole=test' \
--set 'global.secretsBackend.vault.ca.secretKey=tls.crt' \
. | tee /dev/stderr |
yq -r '.spec.template' | tee /dev/stderr)

local actual=$(echo $object | yq -r '.metadata.annotations | has("vault.hashicorp.com/agent-extra-secret")')
[ "${actual}" = "false" ]
local actual=$(echo $object | yq -r '.metadata.annotations | has("vault.hashicorp.com/ca-cert")')
[ "${actual}" = "false" ]
}

@test "client/SnapshotAgentDeployment: vault CA is configured when both secretName and secretKey are set" {
cd `chart_dir`
local object=$(helm template \
-s templates/client-snapshot-agent-deployment.yaml \
--set 'client.snapshotAgent.enabled=true' \
--set 'global.tls.enabled=true' \
--set 'global.tls.enableAutoEncrypt=true' \
--set 'global.tls.caCert.secretName=foo' \
--set 'global.secretsBackend.vault.enabled=true' \
--set 'global.secretsBackend.vault.consulClientRole=foo' \
--set 'global.secretsBackend.vault.consulServerRole=test' \
--set 'global.secretsBackend.vault.ca.secretName=ca' \
--set 'global.secretsBackend.vault.ca.secretKey=tls.crt' \
. | tee /dev/stderr |
yq -r '.spec.template' | tee /dev/stderr)

local actual=$(echo $object | yq -r '.metadata.annotations."vault.hashicorp.com/agent-extra-secret"')
[ "${actual}" = "ca" ]
local actual=$(echo $object | yq -r '.metadata.annotations."vault.hashicorp.com/ca-cert"')
[ "${actual}" = "/vault/custom/tls.crt" ]
}
1 change: 0 additions & 1 deletion charts/consul/test/unit/sync-catalog-deployment.bats
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1097,4 +1097,3 @@ load _helpers
local actual=$(echo $object | yq -r '.metadata.annotations."vault.hashicorp.com/ca-cert"')
[ "${actual}" = "/vault/custom/tls.crt" ]
}

0 comments on commit 2dca3f0

Please sign in to comment.