-
-
Notifications
You must be signed in to change notification settings - Fork 67
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
1ae578b
commit ca63b26
Showing
6 changed files
with
514 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| # Gnomock Vault | ||
|
|
||
| Gnomock vault is a [Gnomock](https://github.com/orlangure/gnomock) preset | ||
| for running tests against a real vault container, without mocks. | ||
|
|
||
| The test below starts a vault server with: | ||
|
|
||
| * with a policy `policy1` configured | ||
| * with `root-token` set as root token | ||
| * with an additional token written in a temporary file that has only the `default` policy | ||
| * with an additional `kubernetes` secrets engine mounted on `k8s_cluster1` | ||
|
|
||
| ```go | ||
| package vault_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/hashicorp/vault/api" | ||
| "github.com/orlangure/gnomock" | ||
| "github.com/orlangure/gnomock/preset/vault" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestVault(t *testing.T) { | ||
| const policy = ` | ||
| path "sys/mounts" { | ||
| capabilities = ["list", "read"] | ||
| } | ||
| path "secret/*" { | ||
| capabilities = ["list", "create"] | ||
| } | ||
| path "secret/data/*" { | ||
| capabilities = ["create", "read"] | ||
| } | ||
| path "secret/metadata/*" { | ||
| capabilities = ["list"] | ||
| } | ||
| ` | ||
|
|
||
| tmpFile, err := os.CreateTemp("", "token") | ||
| require.NoError(t, err) | ||
|
|
||
| defer func() { | ||
| _ = os.Remove(tmpFile.Name()) | ||
| }() | ||
|
|
||
| p := vault.Preset( | ||
| vault.WithVersion("latest"), | ||
| vault.WithAuthToken("root-token"), | ||
| vault.WithTokenCreate(vault.TokenCreate{ | ||
| FilePath: tmpFile.Name(), | ||
| Policies: []string{"default"}, | ||
| }), | ||
| vault.WithAuth([]vault.Auth{ | ||
| { | ||
| Path: "k8s_cluster1", | ||
| Type: "kubernetes", | ||
| }, | ||
| }), | ||
| vault.WithPolicies([]vault.Policy{ | ||
| { | ||
| Name: "policy1", | ||
| Data: policy, | ||
| }, | ||
| }), | ||
| ) | ||
|
|
||
| container, err := gnomock.Start(p) | ||
| require.NoError(t, err) | ||
|
|
||
| defer func() { require.NoError(t, gnomock.Stop(container)) }() | ||
|
|
||
| vaultConfig := api.DefaultConfig() | ||
| vaultConfig.Address = fmt.Sprintf("http://%s", container.DefaultAddress()) | ||
|
|
||
| cli, err := api.NewClient(vaultConfig) | ||
| require.NoError(t, err) | ||
| cli.SetToken("root-token") | ||
|
|
||
| _, err = cli.Sys().Health() | ||
| require.NoError(t, err) | ||
| } | ||
| ``` | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| package vault | ||
|
|
||
| // Option is an optional configuration of this Gnomock preset. Use available | ||
| // Options to configure the container. | ||
| type Option func(*P) | ||
|
|
||
| // WithVersion sets image version. | ||
| func WithVersion(version string) Option { | ||
| return func(o *P) { | ||
| o.Version = version | ||
| } | ||
| } | ||
|
|
||
| // WithAuthToken sets authentication (root) token to be used to connect to this | ||
| // container. | ||
| func WithAuthToken(token string) Option { | ||
| return func(p *P) { | ||
| p.AuthToken = token | ||
| } | ||
| } | ||
|
|
||
| // WithAuth enables new vault authorizations endpoints. | ||
| func WithAuth(auth []Auth) Option { | ||
| return func(p *P) { | ||
| p.Auth = auth | ||
| } | ||
| } | ||
|
|
||
| // WithPolicies configures vault with the provided policies. | ||
| func WithPolicies(policies []Policy) Option { | ||
| return func(p *P) { | ||
| p.Policies = policies | ||
| } | ||
| } | ||
|
|
||
| // WithAdditionalToken creates an additional access token with the provided policies and stores it | ||
| // in the provied file path. | ||
| func WithAdditionalToken(tc TokenCreate) Option { | ||
| return func(p *P) { | ||
| p.TokenCreate = &tc | ||
| } | ||
| } |
Oops, something went wrong.