Skip to content

Commit 4b7fd40

Browse files
hc-github-team-secure-vault-corehc-github-team-secure-vault-core
committed
Merge remote-tracking branch 'remotes/from/ce/main'
2 parents 63e969b + 5a54a1b commit 4b7fd40

File tree

10 files changed

+502
-11
lines changed

10 files changed

+502
-11
lines changed

‎enos/enos-modules.hcl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,7 @@ module "vault_verify_secrets_engines_read" {
361361
module "vault_verify_secrets_engines_delete" {
362362
source = "./modules/verify_secrets_engines/modules/delete"
363363

364+
ldap_enabled = var.verify_ldap_secrets_engine
364365
vault_install_dir = var.vault_install_dir
365366
}
366367

‎enos/modules/verify_secrets_engines/modules/create/ldap/ldap.tf‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,3 +118,163 @@ resource "enos_remote_exec" "ldap_setup" {
118118
}
119119
}
120120
}
121+
122+
# Configure LDAP secrets engine (separate from auth backend)
123+
resource "enos_remote_exec" "ldap_secrets_config" {
124+
depends_on = [
125+
enos_remote_exec.secrets_enable_ldap_secret,
126+
enos_remote_exec.ldap_setup,
127+
]
128+
129+
environment = {
130+
MOUNT = local.ldap_output.ldap_mount
131+
LDAP_SERVER = local.ldap_output.host.private_ip
132+
LDAP_PORT = local.ldap_output.port
133+
LDAP_USERNAME = local.ldap_output.username
134+
LDAP_ADMIN_PW = local.ldap_output.pw
135+
VAULT_ADDR = var.vault_addr
136+
VAULT_INSTALL_DIR = var.vault_install_dir
137+
VAULT_TOKEN = var.vault_root_token
138+
}
139+
140+
scripts = [abspath("${path.module}/../../../scripts/ldap-secrets-config.sh")]
141+
142+
transport = {
143+
ssh = {
144+
host = var.leader_host.public_ip
145+
}
146+
}
147+
}
148+
149+
# Create a new Library set of service accounts
150+
# Test Case: Service Account Library - Create a new Library set of service accounts
151+
resource "enos_remote_exec" "ldap_library_set_create" {
152+
depends_on = [
153+
enos_remote_exec.ldap_secrets_config,
154+
]
155+
156+
environment = {
157+
REQPATH = "${local.ldap_output.ldap_mount}/library/test-set"
158+
PAYLOAD = jsonencode({
159+
service_account_names = "fizz"
160+
ttl = "10h"
161+
max_ttl = "20h"
162+
disable_check_in_enforcement = false
163+
})
164+
VAULT_ADDR = var.vault_addr
165+
VAULT_INSTALL_DIR = var.vault_install_dir
166+
VAULT_TOKEN = var.vault_root_token
167+
}
168+
169+
scripts = [abspath("${path.module}/../../../scripts/write.sh")]
170+
171+
transport = {
172+
ssh = {
173+
host = var.leader_host.public_ip
174+
}
175+
}
176+
}
177+
178+
# Update Library configuration
179+
# Test Case: Modify library settings and accounts - Update library configuration and associated service accounts
180+
resource "enos_remote_exec" "ldap_library_set_update" {
181+
depends_on = [
182+
enos_remote_exec.ldap_library_set_create,
183+
]
184+
185+
environment = {
186+
REQPATH = "${local.ldap_output.ldap_mount}/library/test-set"
187+
PAYLOAD = jsonencode({
188+
service_account_names = "fizz,buzz"
189+
ttl = "12h"
190+
max_ttl = "15h"
191+
disable_check_in_enforcement = true
192+
})
193+
VAULT_ADDR = var.vault_addr
194+
VAULT_INSTALL_DIR = var.vault_install_dir
195+
VAULT_TOKEN = var.vault_root_token
196+
}
197+
198+
scripts = [abspath("${path.module}/../../../scripts/write.sh")]
199+
200+
transport = {
201+
ssh = {
202+
host = var.leader_host.public_ip
203+
}
204+
}
205+
}
206+
207+
# Check-out Service Account
208+
# Test Case: Check-out Service Account - Borrow service accounts for temporary use
209+
resource "enos_remote_exec" "ldap_library_checkout_default_ttl" {
210+
depends_on = [
211+
enos_remote_exec.ldap_library_set_update,
212+
]
213+
214+
environment = {
215+
REQPATH = "${local.ldap_output.ldap_mount}/library/test-set/check-out"
216+
VAULT_ADDR = var.vault_addr
217+
VAULT_INSTALL_DIR = var.vault_install_dir
218+
VAULT_TOKEN = var.vault_root_token
219+
}
220+
221+
scripts = [abspath("${path.module}/../../../scripts/write.sh")]
222+
223+
transport = {
224+
ssh = {
225+
host = var.leader_host.public_ip
226+
}
227+
}
228+
}
229+
230+
# Check-out with Custom TTL
231+
# Test Case: Check-out with Custom TTL - Borrow with specific lease duration
232+
resource "enos_remote_exec" "ldap_library_checkout_custom_ttl" {
233+
depends_on = [
234+
enos_remote_exec.ldap_library_checkout_default_ttl,
235+
]
236+
237+
environment = {
238+
REQPATH = "${local.ldap_output.ldap_mount}/library/test-set/check-out"
239+
PAYLOAD = jsonencode({
240+
ttl = "2h"
241+
})
242+
VAULT_ADDR = var.vault_addr
243+
VAULT_INSTALL_DIR = var.vault_install_dir
244+
VAULT_TOKEN = var.vault_root_token
245+
}
246+
247+
scripts = [abspath("${path.module}/../../../scripts/write.sh")]
248+
249+
transport = {
250+
ssh = {
251+
host = var.leader_host.public_ip
252+
}
253+
}
254+
}
255+
256+
# Self Check-in (Explicit)
257+
# Test Case: Self Check-in (Explicit) - Return your checked-out account
258+
resource "enos_remote_exec" "ldap_library_self_checkin" {
259+
depends_on = [
260+
enos_remote_exec.ldap_library_checkout_custom_ttl,
261+
]
262+
263+
environment = {
264+
REQPATH = "${local.ldap_output.ldap_mount}/library/test-set/check-in"
265+
PAYLOAD = jsonencode({
266+
service_account_names = "fizz,buzz"
267+
})
268+
VAULT_ADDR = var.vault_addr
269+
VAULT_INSTALL_DIR = var.vault_install_dir
270+
VAULT_TOKEN = var.vault_root_token
271+
}
272+
273+
scripts = [abspath("${path.module}/../../../scripts/write.sh")]
274+
275+
transport = {
276+
ssh = {
277+
host = var.leader_host.public_ip
278+
}
279+
}
280+
}

‎enos/modules/verify_secrets_engines/modules/delete/ldap.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright IBM Corp. 2016, 2025
2+
// SPDX-License-Identifier: BUSL-1.1
3+
4+
// Delete LDAP library set
5+
// Test Case: Delete Library Set - Delete a library & all associated service accounts
6+
resource "enos_remote_exec" "ldap_library_set_delete" {
7+
count = var.ldap_enabled ? 1 : 0
8+
9+
environment = {
10+
REQPATH = "${try(var.create_state.ldap, null) != null ? var.create_state.ldap.ldap_mount : "ldap"}/library/test-set"
11+
VAULT_ADDR = var.vault_addr
12+
VAULT_TOKEN = var.vault_root_token
13+
VAULT_INSTALL_DIR = var.vault_install_dir
14+
}
15+
16+
scripts = [abspath("${path.module}/../../scripts/delete.sh")]
17+
18+
transport = {
19+
ssh = {
20+
host = var.leader_host.public_ip
21+
}
22+
}
23+
}
24+
25+

‎enos/modules/verify_secrets_engines/modules/delete/main.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,9 @@ variable "verify_ssh_secrets" {
5353
description = "Flag to verify SSH secrets"
5454
default = true
5555
}
56+
57+
variable "ldap_enabled" {
58+
type = bool
59+
description = "Whether or not we'll verify the LDAP secrets engine"
60+
default = false
61+
}

‎enos/modules/verify_secrets_engines/modules/read/ldap/ldap.tf‎

Lines changed: 121 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,12 @@ variable "enable_auth_verification" {
7474
default = true
7575
}
7676

77+
variable "enable_rollback_verification" {
78+
type = bool
79+
description = "Enable LDAP secrets engine rollback verification"
80+
default = true
81+
}
82+
7783
resource "enos_remote_exec" "ldap_verify_auth" {
7884
count = var.enable_auth_verification ? 1 : 0
7985
environment = {
@@ -147,12 +153,6 @@ resource "enos_remote_exec" "ldap_verify_rotation" {
147153
}
148154
}
149155

150-
variable "enable_rollback_verification" {
151-
type = bool
152-
description = "Enable LDAP secrets engine rollback verification"
153-
default = true
154-
}
155-
156156
# Configure and verify LDAP secrets engine rollback behavior
157157
resource "enos_remote_exec" "ldap_verify_rollback" {
158158
count = var.enable_rollback_verification ? 1 : 0
@@ -185,4 +185,119 @@ resource "enos_remote_exec" "ldap_verify_rollback" {
185185
}
186186
}
187187

188+
# Read Library configuration
189+
# Test Case: Read Library configuration - Read the library set details
190+
resource "enos_remote_exec" "ldap_library_set_read" {
191+
depends_on = [
192+
enos_remote_exec.ldap_verify_secrets,
193+
]
194+
195+
environment = {
196+
REQPATH = "${var.create_state.ldap.ldap_mount}/library/test-set"
197+
VAULT_ADDR = var.vault_addr
198+
VAULT_INSTALL_DIR = var.vault_install_dir
199+
VAULT_TOKEN = var.vault_root_token
200+
}
201+
202+
scripts = [abspath("${path.module}/../../../scripts/read.sh")]
203+
204+
transport = {
205+
ssh = {
206+
host = var.hosts[0].public_ip
207+
}
208+
}
209+
}
210+
211+
# List all library sets
212+
# Test Case #5: List all library sets - List all the service account library sets
213+
resource "enos_remote_exec" "ldap_library_list_all" {
214+
depends_on = [
215+
enos_remote_exec.ldap_verify_secrets,
216+
]
217+
218+
environment = {
219+
REQPATH = "${var.create_state.ldap.ldap_mount}/library"
220+
VAULT_ADDR = var.vault_addr
221+
VAULT_INSTALL_DIR = var.vault_install_dir
222+
VAULT_TOKEN = var.vault_root_token
223+
}
224+
225+
scripts = [abspath("${path.module}/../../../scripts/list.sh")]
226+
227+
transport = {
228+
ssh = {
229+
host = var.hosts[0].public_ip
230+
}
231+
}
232+
}
233+
234+
# List library set by name
235+
# Test Case #6: List library sets by account name - List account details for the given service account set
236+
resource "enos_remote_exec" "ldap_library_list_set" {
237+
depends_on = [
238+
enos_remote_exec.ldap_verify_secrets,
239+
]
240+
241+
environment = {
242+
REQPATH = "${var.create_state.ldap.ldap_mount}/library/test-set"
243+
VAULT_ADDR = var.vault_addr
244+
VAULT_INSTALL_DIR = var.vault_install_dir
245+
VAULT_TOKEN = var.vault_root_token
246+
}
247+
248+
scripts = [abspath("${path.module}/../../../scripts/list.sh")]
249+
250+
transport = {
251+
ssh = {
252+
host = var.hosts[0].public_ip
253+
}
254+
}
255+
}
256+
257+
# List library sets by account name
258+
# Test Case #7: List library sets by account name - List account details for the given service account
259+
resource "enos_remote_exec" "ldap_library_list_by_account" {
260+
depends_on = [
261+
enos_remote_exec.ldap_verify_secrets,
262+
]
263+
264+
environment = {
265+
# Using the service account name from test case #1 (uid=fizz)
266+
REQPATH = "${var.create_state.ldap.ldap_mount}/library/fizz"
267+
VAULT_ADDR = var.vault_addr
268+
VAULT_INSTALL_DIR = var.vault_install_dir
269+
VAULT_TOKEN = var.vault_root_token
270+
}
271+
272+
scripts = [abspath("${path.module}/../../../scripts/list.sh")]
273+
274+
transport = {
275+
ssh = {
276+
host = var.hosts[0].public_ip
277+
}
278+
}
279+
}
280+
281+
# Renew Check-out Lease
282+
# Test Case #10: Renew Check-out Lease - Renew the lease for a checked-out account
283+
resource "enos_remote_exec" "ldap_library_checkout_lease_renew" {
284+
depends_on = [
285+
enos_remote_exec.ldap_verify_secrets,
286+
]
188287

288+
environment = {
289+
# LEASE_ID will be provided via create_state.ldap from the create module after checkout
290+
LEASE_ID = try(var.create_state.ldap.data.checkout_custom.lease_id, "")
291+
VAULT_ADDR = var.vault_addr
292+
VAULT_INSTALL_DIR = var.vault_install_dir
293+
VAULT_TOKEN = var.vault_root_token
294+
}
295+
296+
scripts = [abspath("${path.module}/../../../scripts/ldap-lease-renew.sh")]
297+
298+
transport = {
299+
ssh = {
300+
host = var.hosts[0].public_ip
301+
}
302+
}
303+
}

‎enos/modules/verify_secrets_engines/scripts/delete.sh‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,25 @@ binpath="${VAULT_INSTALL_DIR}/vault"
1818
test -x "$binpath" || fail "unable to locate vault binary at $binpath"
1919

2020
export VAULT_FORMAT=json
21-
if output=$("$binpath" delete "$REQPATH" 2>&1); then
21+
22+
echo "Vault DELETE request to path: $REQPATH"
23+
24+
set +e
25+
output=$("$binpath" delete "$REQPATH" 2>&1)
26+
exit_code=$?
27+
set -e
28+
29+
# Always print output
30+
if [ "$exit_code" -eq 0 ]; then
2231
printf "%s\n" "$output"
2332
else
24-
fail "failed to delete path: $REQPATH out=$output"
33+
printf "%s\n" "$output" >&2
34+
# Handle expected errors gracefully (idempotent delete)
35+
# Exit code 2 typically means "not found" - acceptable for idempotent cleanup
36+
if [ "$exit_code" -eq 2 ]; then
37+
echo "Note: Path not found (exit code 2), treating as successful cleanup: $REQPATH" >&2
38+
exit 0
39+
fi
40+
# For other errors, fail the test
41+
fail "failed to delete path: $REQPATH exit_code=${exit_code}"
2542
fi

0 commit comments

Comments
 (0)