You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
180 lines
5.1 KiB
Nix
180 lines
5.1 KiB
Nix
{
|
|
makeTest ? import <nixpkgs/nixos/tests/make-test-python.nix>,
|
|
pkgs ? (import <nixpkgs> {}),
|
|
vaultAgent ? ../modules/vault-agent.nix,
|
|
systemdVaultd ? ../modules/systemd-vaultd.nix,
|
|
}: let
|
|
makeTest' = args:
|
|
makeTest args {
|
|
inherit pkgs;
|
|
inherit (pkgs) system;
|
|
};
|
|
in {
|
|
vault-agent = makeTest' {
|
|
name = "vault-agent";
|
|
nodes.server = {
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
imports = [
|
|
vaultAgent
|
|
./dev-vault-server.nix
|
|
];
|
|
|
|
services.vault.agents.test.settings = {
|
|
vault = {
|
|
address = "http://localhost:8200";
|
|
};
|
|
template = {
|
|
contents = ''{{ with secret "secret/my-secret" }}{{ .Data.data.foo }}{{ end }}'';
|
|
destination = "/run/render.txt";
|
|
};
|
|
|
|
auto_auth = {
|
|
method = [
|
|
{
|
|
type = "approle";
|
|
config = {
|
|
role_id_file_path = "/tmp/roleID";
|
|
secret_id_file_path = "/tmp/secretID";
|
|
remove_secret_id_file_after_reading = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
testScript = ''
|
|
start_all()
|
|
machine.wait_for_unit("multi-user.target")
|
|
machine.wait_for_unit("vault.service")
|
|
machine.wait_for_open_port(8200)
|
|
machine.wait_for_unit("setup-vault-agent-approle.service")
|
|
|
|
# It should be able to write our template
|
|
out = machine.wait_until_succeeds("cat /run/render.txt")
|
|
print(out)
|
|
assert out == "bar"
|
|
'';
|
|
};
|
|
systemd-vaultd = makeTest' {
|
|
name = "systemd-vaultd";
|
|
nodes.server = {
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
imports = [
|
|
vaultAgent
|
|
systemdVaultd
|
|
./dev-vault-server.nix
|
|
];
|
|
|
|
systemd.services.service1 = {
|
|
wantedBy = ["multi-user.target"];
|
|
script = ''
|
|
cat $CREDENTIALS_DIRECTORY/foo > /tmp/service1
|
|
'';
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
vault = {
|
|
template = ''
|
|
{{ with secret "secret/my-secret" }}{{ .Data.data | toJSON }}{{ end }}
|
|
'';
|
|
secrets.foo = {};
|
|
};
|
|
};
|
|
|
|
systemd.services.service2 = {
|
|
wantedBy = ["multi-user.target"];
|
|
script = ''
|
|
cat $CREDENTIALS_DIRECTORY/secret > /tmp/service2
|
|
sleep infinity
|
|
'';
|
|
reload = ''
|
|
cat $CREDENTIALS_DIRECTORY/secret > /tmp/service2-reload
|
|
'';
|
|
serviceConfig.LoadCredential = ["secret:/run/systemd-vaultd/sock"];
|
|
vault = {
|
|
template = ''
|
|
{{ with secret "secret/blocking-secret" }}{{ scratch.MapSet "secrets" "secret" .Data.data.foo }}{{ end }}
|
|
{{ scratch.Get "secrets" | explodeMap | toJSON }}
|
|
'';
|
|
secrets.secret = {};
|
|
};
|
|
};
|
|
|
|
systemd.package = pkgs.systemd.overrideAttrs (old: {
|
|
patches =
|
|
old.patches
|
|
++ [
|
|
(pkgs.fetchpatch {
|
|
url = "https://github.com/Mic92/systemd/commit/93a2921a81cab3be9b7eacab6b0095c96a0ae9e2.patch";
|
|
sha256 = "sha256-7WlhMLE7sfD3Cxn6n6R1sUNzUOvas7XMyabi3bsq7jM=";
|
|
})
|
|
];
|
|
});
|
|
|
|
services.vault.agents.default.settings = {
|
|
vault = {
|
|
address = "http://localhost:8200";
|
|
};
|
|
auto_auth = {
|
|
method = [
|
|
{
|
|
type = "approle";
|
|
config = {
|
|
role_id_file_path = "/tmp/roleID";
|
|
secret_id_file_path = "/tmp/secretID";
|
|
remove_secret_id_file_after_reading = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
testScript = ''
|
|
start_all()
|
|
machine.wait_for_unit("vault.service")
|
|
machine.wait_for_open_port(8200)
|
|
machine.wait_for_unit("setup-vault-agent-approle.service")
|
|
machine.wait_for_unit("service1.service")
|
|
out = machine.succeed("cat /tmp/service1")
|
|
print(out)
|
|
assert out == "bar", f"{out} != bar"
|
|
|
|
out = machine.succeed("systemctl status service2")
|
|
print(out)
|
|
assert "(sd-mkdcreds)" in out, "service2 should be still blocked"
|
|
|
|
machine.succeed("vault kv put secret/blocking-secret foo=bar")
|
|
out = machine.wait_until_succeeds("cat /tmp/service2")
|
|
print(out)
|
|
assert out == "bar", f"{out} != bar"
|
|
|
|
machine.succeed("vault kv put secret/blocking-secret foo=reload")
|
|
machine.succeed("rm /run/systemd-vaultd/secrets/service2.service.json")
|
|
machine.succeed("systemctl restart vault-agent-default")
|
|
machine.wait_until_succeeds("cat /run/systemd-vaultd/secrets/service2.service.json >&2")
|
|
machine.succeed("systemctl reload service2")
|
|
out = machine.wait_until_succeeds("cat /tmp/service2-reload")
|
|
print(out)
|
|
assert out == "reload", f"{out} != reload"
|
|
'';
|
|
};
|
|
unittests = makeTest' {
|
|
name = "unittests";
|
|
nodes.server = {};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
server.succeed("machinectl shell .host ${pkgs.callPackage ./unittests.nix {}} >&2")
|
|
# machinectl does not passthru exit codes, so we have to check manually
|
|
server.succeed("[[ -f /tmp/success ]]")
|
|
'';
|
|
};
|
|
}
|