mirror of https://github.com/hashicorp/boundary
ICU-14484: redis connect helper (#6001)
* add redis connect support * Setup redis in docker for e2e testing * Update docs and changelog * Commenting out e2e tests for now, will revisit in a separate taskpull/6078/head
Justin Nguyen
5 months ago
committed by
GitHub
parent
f8a5894e29
commit
4548028efe
@ -0,0 +1,82 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package connect
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"github.com/hashicorp/boundary/api/proxy"
|
||||
"github.com/hashicorp/boundary/internal/cmd/base"
|
||||
"github.com/posener/complete"
|
||||
)
|
||||
|
||||
const (
|
||||
redisSynopsis = "Authorize a session against a target and invoke a redis client to connect"
|
||||
)
|
||||
|
||||
func redisOptions(c *Command, set *base.FlagSets) {
|
||||
f := set.NewFlagSet("Redis Options")
|
||||
|
||||
f.StringVar(&base.StringVar{
|
||||
Name: "style",
|
||||
Target: &c.flagRedisStyle,
|
||||
EnvVar: "BOUNDARY_CONNECT_REDIS_STYLE",
|
||||
Completion: complete.PredictSet("redis-cli"),
|
||||
Default: "redis-cli",
|
||||
Usage: `Specifies how the CLI will attempt to invoke a Redis client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "redis-cli".`,
|
||||
})
|
||||
|
||||
f.StringVar(&base.StringVar{
|
||||
Name: "username",
|
||||
Target: &c.flagUsername,
|
||||
EnvVar: "BOUNDARY_CONNECT_USERNAME",
|
||||
Completion: complete.PredictNothing,
|
||||
Usage: `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
|
||||
})
|
||||
}
|
||||
|
||||
type redisFlags struct {
|
||||
flagRedisStyle string
|
||||
}
|
||||
|
||||
func (r *redisFlags) defaultExec() string {
|
||||
return strings.ToLower(r.flagRedisStyle)
|
||||
}
|
||||
|
||||
func (r *redisFlags) buildArgs(c *Command, port, ip, _ string, creds proxy.Credentials) (args, envs []string, retCreds proxy.Credentials, retErr error) {
|
||||
var username, password string
|
||||
|
||||
retCreds = creds
|
||||
if len(retCreds.UsernamePassword) > 0 {
|
||||
// Mark credential as consumed, such that it is not printed to the user
|
||||
retCreds.UsernamePassword[0].Consumed = true
|
||||
|
||||
// Grab the first available username/password credential brokered
|
||||
username = retCreds.UsernamePassword[0].Username
|
||||
password = retCreds.UsernamePassword[0].Password
|
||||
}
|
||||
|
||||
switch r.flagRedisStyle {
|
||||
case "redis-cli":
|
||||
args = append(args, "-h", ip)
|
||||
if port != "" {
|
||||
args = append(args, "-p", port)
|
||||
}
|
||||
|
||||
switch {
|
||||
case username != "":
|
||||
args = append(args, "--user", username)
|
||||
case c.flagUsername != "":
|
||||
args = append(args, "--user", c.flagUsername, "--askpass")
|
||||
}
|
||||
|
||||
// Password is read by redis-cli via environment variable. The password disappears after the command exits.
|
||||
if password != "" {
|
||||
envs = append(envs, fmt.Sprintf("REDISCLI_AUTH=%s", password))
|
||||
}
|
||||
}
|
||||
|
||||
return args, envs, retCreds, retErr
|
||||
}
|
||||
@ -0,0 +1,125 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package base_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestCliTcpTargetConnectRedis uses the boundary cli to connect to a target using `connect redis`
|
||||
func TestCliTcpTargetConnectRedis(t *testing.T) {
|
||||
t.Skip("Skipped (TODO: ICU-17634). Test fails due to issues between redis-cli and pty.")
|
||||
return //nolint
|
||||
|
||||
// e2e.MaybeSkipTest(t)
|
||||
|
||||
// pool, err := dockertest.NewPool("")
|
||||
// require.NoError(t, err)
|
||||
|
||||
// ctx := context.Background()
|
||||
|
||||
// network, err := pool.NetworksByName("e2e_cluster")
|
||||
// require.NoError(t, err, "Failed to get e2e_cluster network")
|
||||
|
||||
// c := infra.StartRedis(t, pool, &network[0], "redis", "latest")
|
||||
// require.NotNil(t, c, "Redis container should not be nil")
|
||||
// t.Cleanup(func() {
|
||||
// if err := pool.Purge(c.Resource); err != nil {
|
||||
// t.Logf("Failed to purge Redis container: %v", err)
|
||||
// }
|
||||
// })
|
||||
|
||||
// u, err := url.Parse(c.UriNetwork)
|
||||
// t.Log(u)
|
||||
// require.NoError(t, err, "Failed to parse Redis URL")
|
||||
|
||||
// user, hostname, port := u.User.Username(), u.Hostname(), u.Port()
|
||||
// pw, pwSet := u.User.Password()
|
||||
|
||||
// t.Logf("Redis info: user=%s, host=%s, port=%s, password-set:%t",
|
||||
// user, hostname, port, pwSet)
|
||||
|
||||
// // Wait for Redis to be ready
|
||||
// err = pool.Retry(func() error {
|
||||
// out, e := exec.CommandContext(ctx, "docker", "exec", hostname,
|
||||
// "redis-cli", "-h", hostname, "-p", port, "PING").CombinedOutput()
|
||||
// t.Logf("Redis PING output: %s", out)
|
||||
// return e
|
||||
// })
|
||||
// require.NoError(t, err, "Redis container failed to start")
|
||||
|
||||
// boundary.AuthenticateAdminCli(t, ctx)
|
||||
|
||||
// orgId, err := boundary.CreateOrgCli(t, ctx)
|
||||
// require.NoError(t, err)
|
||||
// t.Cleanup(func() {
|
||||
// ctx := context.Background()
|
||||
// boundary.AuthenticateAdminCli(t, ctx)
|
||||
// output := e2e.RunCommand(ctx, "boundary", e2e.WithArgs("scopes", "delete", "-id", orgId))
|
||||
// require.NoError(t, output.Err, string(output.Stderr))
|
||||
// })
|
||||
|
||||
// projectId, err := boundary.CreateProjectCli(t, ctx, orgId)
|
||||
// require.NoError(t, err)
|
||||
|
||||
// targetId, err := boundary.CreateTargetCli(
|
||||
// t,
|
||||
// ctx,
|
||||
// projectId,
|
||||
// port,
|
||||
// target.WithAddress(hostname),
|
||||
// )
|
||||
// require.NoError(t, err)
|
||||
|
||||
// storeId, err := boundary.CreateCredentialStoreStaticCli(t, ctx, projectId)
|
||||
// require.NoError(t, err)
|
||||
|
||||
// credentialId, err := boundary.CreateStaticCredentialPasswordCli(
|
||||
// t,
|
||||
// ctx,
|
||||
// storeId,
|
||||
// user,
|
||||
// pw,
|
||||
// )
|
||||
// require.NoError(t, err)
|
||||
|
||||
// err = boundary.AddBrokeredCredentialSourceToTargetCli(t, ctx, targetId, credentialId)
|
||||
// require.NoError(t, err)
|
||||
|
||||
// t.Logf("Attempting to connect to Redis target %s", targetId)
|
||||
|
||||
// cmd := exec.CommandContext(ctx,
|
||||
// "boundary",
|
||||
// "connect", "redis",
|
||||
// "-target-id", targetId,
|
||||
// )
|
||||
|
||||
// f, err := pty.Start(cmd)
|
||||
// require.NoError(t, err)
|
||||
// t.Cleanup(func() {
|
||||
// err := f.Close()
|
||||
// require.NoError(t, err)
|
||||
// })
|
||||
|
||||
// _, err = f.Write([]byte("SET e2etestkey e2etestvalue\r\n"))
|
||||
// require.NoError(t, err)
|
||||
// _, err = f.Write([]byte("GET e2etestkey\r\n"))
|
||||
// require.NoError(t, err)
|
||||
// _, err = f.Write([]byte("QUIT\r\n"))
|
||||
// require.NoError(t, err)
|
||||
// _, err = f.Write([]byte{4})
|
||||
// require.NoError(t, err)
|
||||
|
||||
//// io.Copy will hang because not all bytes seem to be written to pty (QUIT is not recognized).
|
||||
|
||||
// var buf bytes.Buffer
|
||||
// _, _ = io.Copy(&buf, f)
|
||||
// output := buf.String()
|
||||
// t.Logf("Redis session output: %s", output)
|
||||
|
||||
// require.Contains(t, output, "OK")
|
||||
// require.Contains(t, output, "\"e2etestvalue\"")
|
||||
|
||||
// t.Log("Successfully connected to Redis target")
|
||||
}
|
||||
@ -0,0 +1,61 @@
|
||||
---
|
||||
layout: docs
|
||||
page_title: connect redis - Command
|
||||
description: >-
|
||||
The "connect redis" command performs a target authorization or consumes an existing authorization token, and then launches a proxied redis (redis-cli) connection.
|
||||
---
|
||||
|
||||
# connect redis
|
||||
|
||||
Command: `boundary connect redis`
|
||||
The `connect redis` command authorizes a session against a target and invokes a Redis client for the connection.
|
||||
The command fills in the local address and port.
|
||||
|
||||
@include 'cmd-connect-env-vars.mdx'
|
||||
|
||||
|
||||
## Examples
|
||||
|
||||
The following example shows how to connect to a target with the ID `ttcp_eTcZMueUYv` using a Redis helper:
|
||||
|
||||
```shell-session
|
||||
$ boundary connect redis -target-id=ttcp_eTcZMueUYv \
|
||||
-username=superuser
|
||||
```
|
||||
|
||||
When prompted, you must enter the password for the user, "superuser":
|
||||
|
||||
<CodeBlockConfig hideClipboard>
|
||||
|
||||
|
||||
```plaintext
|
||||
Please input password:
|
||||
127.0.0.1:60835>
|
||||
```
|
||||
|
||||
</CodeBlockConfig>
|
||||
|
||||
## Usage
|
||||
|
||||
<CodeBlockConfig hideClipboard>
|
||||
|
||||
```shell-session
|
||||
$ boundary connect redis [options] [args]
|
||||
```
|
||||
|
||||
</CodeBlockConfig>
|
||||
|
||||
@include 'cmd-connect-command-options.mdx'
|
||||
|
||||
### Redis options:
|
||||
|
||||
- `-style` `(string: "")` - How the CLI attempts to invoke a Redis client.
|
||||
This value also sets a suitable default for `-exec`, if you did not specify a value.
|
||||
The default and currently-understood value is `redis-cli`.
|
||||
You can also specify how the CLI attempts to invoke a Redis client using the **BOUNDARY_CONNECT_REDIS_STYLE** environment variable.
|
||||
|
||||
- `-username` `(string: "")` - The username you want to pass through to the client.
|
||||
This value may be overridden by credentials sourced from a credential store.
|
||||
You can also specify a username using the **BOUNDARY_CONNECT_USERNAME** environment variable.
|
||||
|
||||
@include 'cmd-option-note.mdx'
|
||||
Loading…
Reference in new issue