mirror of https://github.com/hashicorp/boundary
test(e2e): Add an enos module for docker-based workers (#3603)
* test(e2e): Add an enos module for a worker in docker * fixup! test(e2e): Add an enos module for a worker in dockerpull/3612/head
Michael Li
3 years ago
committed by
GitHub
parent
06a37f605a
commit
9687535ab0
@ -0,0 +1,60 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
disable_mlock = true
|
||||
|
||||
controller {
|
||||
name = "docker-controller"
|
||||
|
||||
database {
|
||||
url = "env://BOUNDARY_POSTGRES_URL"
|
||||
}
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "boundary:9200"
|
||||
purpose = "api"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "boundary:9201"
|
||||
purpose = "cluster"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "boundary:9203"
|
||||
purpose = "ops"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
kms "aead" {
|
||||
purpose = "root"
|
||||
aead_type = "aes-gcm"
|
||||
key = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung="
|
||||
key_id = "global_root"
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding downstream worker's
|
||||
# "worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "OLFhJNbEb3umRjdhY15QKNEmNXokY1Iq"
|
||||
key_id = "global_worker-auth"
|
||||
}
|
||||
|
||||
kms "aead" {
|
||||
purpose = "recovery"
|
||||
aead_type = "aes-gcm"
|
||||
key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
|
||||
key_id = "global_recovery"
|
||||
}
|
||||
|
||||
kms "aead" {
|
||||
purpose = "bsr"
|
||||
aead_type = "aes-gcm"
|
||||
key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
|
||||
key_id = "bsr_key"
|
||||
}
|
||||
@ -0,0 +1,120 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
terraform {
|
||||
required_providers {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
version = "3.0.1"
|
||||
}
|
||||
|
||||
tls = {
|
||||
source = "hashicorp/tls"
|
||||
version = "4.0.4"
|
||||
}
|
||||
|
||||
enos = {
|
||||
source = "app.terraform.io/hashicorp-qti/enos"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
variable "image_name" {
|
||||
description = "Name of Docker Image"
|
||||
type = string
|
||||
}
|
||||
variable "network_name" {
|
||||
description = "Name of Docker Networks to join"
|
||||
type = list(string)
|
||||
}
|
||||
variable "container_name" {
|
||||
description = "Name of Docker Container"
|
||||
type = string
|
||||
default = "worker"
|
||||
}
|
||||
variable "boundary_license" {
|
||||
description = "License string"
|
||||
type = string
|
||||
}
|
||||
variable "initial_upstream" {
|
||||
description = "Address to upstream instance that it communicates to"
|
||||
type = string
|
||||
}
|
||||
variable "port" {
|
||||
description = "Port to use"
|
||||
type = number
|
||||
default = 9402
|
||||
}
|
||||
variable "tags" {
|
||||
description = "Tags to set on worker for use in worker filters"
|
||||
type = list(string)
|
||||
default = ["e2e"]
|
||||
}
|
||||
variable "config_file" {
|
||||
description = "Path to config file"
|
||||
type = string
|
||||
default = "worker-config.hcl"
|
||||
}
|
||||
|
||||
resource "docker_image" "boundary" {
|
||||
name = var.image_name
|
||||
keep_locally = true
|
||||
}
|
||||
|
||||
locals {
|
||||
recording_storage_path = "/recordings"
|
||||
}
|
||||
|
||||
resource "docker_container" "worker" {
|
||||
image = docker_image.boundary.image_id
|
||||
name = var.container_name
|
||||
command = ["boundary", "server", "-config", "/boundary/worker-config.hcl"]
|
||||
env = [
|
||||
"BOUNDARY_LICENSE=${var.boundary_license}",
|
||||
"HOSTNAME=boundary",
|
||||
"SKIP_CHOWN=true",
|
||||
]
|
||||
ports {
|
||||
internal = var.port
|
||||
external = var.port
|
||||
}
|
||||
capabilities {
|
||||
add = ["IPC_LOCK"]
|
||||
}
|
||||
mounts {
|
||||
type = "tmpfs"
|
||||
target = local.recording_storage_path
|
||||
}
|
||||
mounts {
|
||||
type = "tmpfs"
|
||||
target = "/boundary/logs"
|
||||
}
|
||||
upload {
|
||||
content = templatefile("${abspath(path.module)}/${var.config_file}", {
|
||||
worker_name = var.container_name
|
||||
initial_upstream = var.initial_upstream
|
||||
type_tags = jsonencode(var.tags)
|
||||
recording_storage_path = local.recording_storage_path
|
||||
port = var.port
|
||||
})
|
||||
file = "/boundary/worker-config.hcl"
|
||||
}
|
||||
healthcheck {
|
||||
test = ["CMD", "grep", "-i", "worker has successfully authenticated", "/boundary/logs/events.log"]
|
||||
interval = "3s"
|
||||
timeout = "5s"
|
||||
retries = 5
|
||||
}
|
||||
wait = true
|
||||
must_run = true
|
||||
dynamic "networks_advanced" {
|
||||
for_each = var.network_name
|
||||
content {
|
||||
name = networks_advanced.value
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output "upstream_address" {
|
||||
value = "${var.container_name}:${var.port}"
|
||||
}
|
||||
@ -0,0 +1,66 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
disable_mlock = true
|
||||
|
||||
telemetry {
|
||||
prometheus_retention_time = "24h"
|
||||
disable_hostname = true
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:${port}"
|
||||
purpose = "proxy"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
worker {
|
||||
name = "${worker_name}"
|
||||
initial_upstreams = ["${initial_upstream}"]
|
||||
|
||||
tags {
|
||||
type = ${type_tags},
|
||||
}
|
||||
|
||||
recording_storage_path = "${recording_storage_path}"
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding upstream worker's
|
||||
# "downstream-worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
|
||||
key_id = "downstream_worker-auth"
|
||||
}
|
||||
|
||||
events {
|
||||
audit_enabled = true
|
||||
sysevents_enabled = true
|
||||
observations_enable = true
|
||||
|
||||
sink "stderr" {
|
||||
name = "all-events"
|
||||
description = "All events sent to stderr"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
}
|
||||
|
||||
sink {
|
||||
name = "Log File"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
|
||||
file {
|
||||
path = "/boundary/logs"
|
||||
file_name = "events.log"
|
||||
}
|
||||
|
||||
audit_config {
|
||||
audit_filter_overrides {
|
||||
secret = "redact"
|
||||
sensitive = "redact"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,75 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
disable_mlock = true
|
||||
|
||||
telemetry {
|
||||
prometheus_retention_time = "24h"
|
||||
disable_hostname = true
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:${port}"
|
||||
purpose = "proxy"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
worker {
|
||||
name = "${worker_name}"
|
||||
initial_upstreams = ["${initial_upstream}"]
|
||||
|
||||
tags {
|
||||
type = ${type_tags},
|
||||
}
|
||||
|
||||
recording_storage_path = "${recording_storage_path}"
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding upstream controller's
|
||||
# "worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "OLFhJNbEb3umRjdhY15QKNEmNXokY1Iq"
|
||||
key_id = "global_worker-auth"
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding downstream worker's
|
||||
# "worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "downstream-worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
|
||||
key_id = "downstream_worker-auth"
|
||||
}
|
||||
|
||||
events {
|
||||
audit_enabled = true
|
||||
sysevents_enabled = true
|
||||
observations_enable = true
|
||||
|
||||
sink "stderr" {
|
||||
name = "all-events"
|
||||
description = "All events sent to stderr"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
}
|
||||
|
||||
sink {
|
||||
name = "Log File"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
|
||||
file {
|
||||
path = "/boundary/logs"
|
||||
file_name = "events.log"
|
||||
}
|
||||
|
||||
audit_config {
|
||||
audit_filter_overrides {
|
||||
secret = "redact"
|
||||
sensitive = "redact"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,64 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
disable_mlock = true
|
||||
|
||||
telemetry {
|
||||
prometheus_retention_time = "24h"
|
||||
disable_hostname = true
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:${port}"
|
||||
purpose = "proxy"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
worker {
|
||||
name = "${worker_name}"
|
||||
initial_upstreams = ["${initial_upstream}"]
|
||||
|
||||
tags {
|
||||
type = ${type_tags},
|
||||
}
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding upstream worker's
|
||||
# "downstream-worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
|
||||
key_id = "downstream_worker-auth"
|
||||
}
|
||||
|
||||
events {
|
||||
audit_enabled = true
|
||||
sysevents_enabled = true
|
||||
observations_enable = true
|
||||
|
||||
sink "stderr" {
|
||||
name = "all-events"
|
||||
description = "All events sent to stderr"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
}
|
||||
|
||||
sink {
|
||||
name = "Log File"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
|
||||
file {
|
||||
path = "/boundary/logs"
|
||||
file_name = "events.log"
|
||||
}
|
||||
|
||||
audit_config {
|
||||
audit_filter_overrides {
|
||||
secret = "redact"
|
||||
sensitive = "redact"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,73 @@
|
||||
# Copyright (c) HashiCorp, Inc.
|
||||
# SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
disable_mlock = true
|
||||
|
||||
telemetry {
|
||||
prometheus_retention_time = "24h"
|
||||
disable_hostname = true
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:${port}"
|
||||
purpose = "proxy"
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
worker {
|
||||
name = "${worker_name}"
|
||||
initial_upstreams = ["${initial_upstream}"]
|
||||
|
||||
tags {
|
||||
type = ${type_tags},
|
||||
}
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding upstream controller's
|
||||
# "worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "OLFhJNbEb3umRjdhY15QKNEmNXokY1Iq"
|
||||
key_id = "global_worker-auth"
|
||||
}
|
||||
|
||||
# This key_id needs to match the corresponding downstream worker's
|
||||
# "worker-auth" kms
|
||||
kms "aead" {
|
||||
purpose = "downstream-worker-auth"
|
||||
aead_type = "aes-gcm"
|
||||
key = "X+IJMVT6OnsrIR6G/9OTcJSX+lM9FSPN"
|
||||
key_id = "downstream_worker-auth"
|
||||
}
|
||||
|
||||
events {
|
||||
audit_enabled = true
|
||||
sysevents_enabled = true
|
||||
observations_enable = true
|
||||
|
||||
sink "stderr" {
|
||||
name = "all-events"
|
||||
description = "All events sent to stderr"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
}
|
||||
|
||||
sink {
|
||||
name = "Log File"
|
||||
event_types = ["*"]
|
||||
format = "cloudevents-json"
|
||||
|
||||
file {
|
||||
path = "/boundary/logs"
|
||||
file_name = "events.log"
|
||||
}
|
||||
|
||||
audit_config {
|
||||
audit_filter_overrides {
|
||||
secret = "redact"
|
||||
sensitive = "redact"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in new issue