luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Backport of Passes configured role name to Vault for AWS auth in Connect CA into release/1.16.x (#18099) 

* backport of commit 4034bb2b3eba81ea13bf6d3a62d27094d96ffc24

* backport of commit 9c4c3c50f07d4072bb981c16cf993118fd7f6f1d

* backport of commit 7282078993aa51915afa801bdabded0f78397cb5

---------

Co-authored-by: Tom Davies <thomas.23.davies@bt.com>
This commit is contained in:
hc-github-team-consul-core 2023-07-12 10:43:36 -05:00 committed by GitHub
parent 605bc24755
commit 021f4e472a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.changelog/17885.txt Normal file
View File

@ -0,0 +1,2 @@
```release-note:bug
ca: Fixed a bug where the Vault provider was not passing the configured role param for AWS auth

7
agent/connect/ca/provider_vault_auth_aws.go
View File

@ -72,6 +72,13 @@ func (g *AWSLoginDataGenerator) GenerateLoginData(authMethod *structs.VaultAuthM
if err != nil {
return nil, fmt.Errorf("aws auth failed to generate login data: %w", err)
}
// If a Vault role name is specified, we need to manually add this
role, ok := authMethod.Params["role"]
if ok {
loginData["role"] = role
}
return loginData, nil
}

17
agent/connect/ca/provider_vault_auth_test.go
View File

@ -278,15 +278,22 @@ func TestVaultCAProvider_AWSCredentialsConfig(t *testing.T) {
func TestVaultCAProvider_AWSLoginDataGenerator(t *testing.T) {
cases := map[string]struct {
expErr error
expErr error
authMethod structs.VaultAuthMethod
}{
"valid login data": {},
"valid login data": {
authMethod: structs.VaultAuthMethod{},
},
"with role": {
expErr: nil,
authMethod: structs.VaultAuthMethod{Type: "aws", MountPath: "", Params: map[string]interface{}{"role": "test-role"}},
},
}
for name, c := range cases {
t.Run(name, func(t *testing.T) {
ldg := &AWSLoginDataGenerator{credentials: credentials.AnonymousCredentials}
loginData, err := ldg.GenerateLoginData(&structs.VaultAuthMethod{})
loginData, err := ldg.GenerateLoginData(&c.authMethod)
if c.expErr != nil {
require.Error(t, err)
require.Contains(t, err.Error(), c.expErr.Error())
@ -307,6 +314,10 @@ func TestVaultCAProvider_AWSLoginDataGenerator(t *testing.T) {
require.True(t, exists, "missing expected key: %s", key)
require.NotEmpty(t, val, "expected non-empty value for key: %s", key)
}
if c.authMethod.Params["role"] != nil {
require.Equal(t, c.authMethod.Params["role"], loginData["role"])
}
})
}
}