Merge pull request #206 from jfrog/add-openbao-compatibility

Add OpenBao to acceptance test GitHub workflow
jfrog · Aug 2, 2024 · a661bfb · a661bfb
2 parents 5a58c91 + 9ca7599
commit a661bfb
Show file tree

Hide file tree

Showing 4 changed files with 67 additions and 25 deletions.
diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
@@ -10,12 +10,19 @@ on:
 name: Vault Acceptance Tests
 
 jobs:
-  acceptance-tests:
+  acceptance-tests-matrix:
+    name: ${{ matrix.cli }}
     runs-on: ubuntu-latest
     continue-on-error: false
     environment: development
+    strategy:
+      fail-fast: true
+      matrix:
+        cli: [vault, bao]
     outputs:
       artifactory_version: ${{ steps.run_artifactory_container.outputs.version }}
+      openbao_version: ${{ steps.get_bao_cli_version.outputs.version }}
+      vault_version: ${{ steps.get_vault_cli_version.outputs.version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -33,6 +40,26 @@ jobs:
           install-only: true
       - name: Install Vault binary
         uses: eLco/setup-vault@v1
+        if: ${{ matrix.cli == 'vault' }}
+      - name: Get Vault CLI version
+        id: get_vault_cli_version
+        if: ${{ matrix.cli == 'vault' }}
+        run: |
+          VAULT_VERSION=$(vault version | cut -d ' ' -f 2)
+          echo $VAULT_VERSION
+          echo "version=$VAULT_VERSION" >> "$GITHUB_OUTPUT"
+     - name: Install OpenBoa binary
+        if: ${{ matrix.cli == 'bao' }}
+        run: |
+          curl -o ${{ runner.temp }}/bao_2.0.0_linux_amd64.deb https://github.com/openbao/openbao/releases/download/v2.0.0/bao_2.0.0_linux_amd64.deb
+          sudo dpkg -i ${{ runner.temp }}/bao_2.0.0_linux_amd64.deb
+     - name: Get OpenBao CLI version
+        id: get_bao_cli_version
+        if: ${{ matrix.cli == 'bao' }}
+        run: |
+          BAO_VERSION=$(bao version | cut -d ' ' -f 2)
+          echo $BAO_VERSION
+          echo "version=$BAO_VERSION" >> "$GITHUB_OUTPUT"
       - name: Run Vault Dev server
         run: |
           docker run --cap-add=IPC_LOCK -e 'VAULT_LOCAL_CONFIG={"storage": {"file": {"path": "/vault/file"}}}' -d --name=dev-vault -p 8200:8200 hashicorp/vault server
@@ -88,8 +115,12 @@ jobs:
             --header "cookie: ACCESSTOKEN=${ACCESSTOKEN}; REFRESHTOKEN=${REFRESHTOKEN}")
           echo "::add-mask::$JFROG_ACCESS_TOKEN"
           echo "JFROG_ACCESS_TOKEN=$JFROG_ACCESS_TOKEN" >> "$GITHUB_ENV"
-      - name: Execute acceptance tests
-        run: make acceptance
+      - name: Execute all tests
+        run: make alltests
+      - name: Setup plugin with Vault server
+        run: |
+          make build
+          VAULT_CLI=${{ matrix.cli }} make setup
       - name: Clean up Docker container
         if: always() && ${{ steps.run_artifactory_container.outcome == 'success' }}
         run: docker stop artifactory
@@ -116,7 +147,7 @@ jobs:
 
   update-changelog:
     runs-on: ubuntu-latest
-    needs: acceptance-tests
+    needs: acceptance-tests-matrix
     if: github.event_name == 'pull_request' && needs.acceptance-tests.result == 'success'
     permissions:
       contents: write
@@ -127,10 +158,12 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
       - name: Update CHANGELOG and push commit
         env:
-          ARTIFACTORY_VERSION: ${{ needs.acceptance-tests.outputs.artifactory_version }}
+          ARTIFACTORY_VERSION: ${{ needs.acceptance-tests-matrix.outputs.artifactory_version }}
+          OPENBAO_VERSION: ${{ needs.acceptance-tests-matrix.outputs.openbao_version }}
+          VAULT_VERSION: ${{ needs.acceptance-tests-matrix.outputs.vault_version }}
         run: |
           echo "Adding Artifactory version to CHANGELOG.md"
-          sed -i -E "0,/(##\s.+\..+\..+\s\(.+\)).*/ s/(##\s.+\..+\..+\s\(.+\)).*/\1. Tested on Artifactory $ARTIFACTORY_VERSION/" CHANGELOG.md
+          sed -i -E "0,/(##\s.+\..+\..+\s\(.+\)).*/ s/(##\s.+\..+\..+\s\(.+\)).*/\1. Tested on Artifactory $ARTIFACTORY_VERSION with Vault $VAULT_VERSION and OpenBao $OPENBAO_VERSION/" CHANGELOG.md
           head -10 CHANGELOG.md
           git add CHANGELOG.md
           export REGEX="Changes to be committed*"

diff --git a/.gitignore b/.gitignore
@@ -3,5 +3,6 @@
 /vendor
 
 .DS_Store
+bin/
 dist/
 /coverage.*
diff --git a/Makefile b/Makefile
@@ -15,6 +15,8 @@ PLUGIN_FILE := artifactory-secrets-plugin
 PLUGIN_NAME ?= artifactory
 PLUGIN_VAULT_PATH ?= artifactory
 
+VAULT_CLI?=vault
+
 ARTIFACTORY_ENV := ./vault/artifactory.env
 ARTIFACTORY_SCOPE ?= applied-permissions/groups:readers
 export JFROG_URL ?= http://localhost:8082
@@ -34,23 +36,23 @@ release:
 	goreleaser release --clean --snapshot --parallelism 2
 
 start:
-	vault server -dev -dev-root-token-id=root -dev-plugin-dir=$(PLUGIN_DIR) -log-level=DEBUG
+	${VAULT_CLI} server -dev -dev-root-token-id=root -dev-plugin-dir=$(PLUGIN_DIR) -log-level=DEBUG
 
 disable:
-	vault secrets disable $(PLUGIN_VAULT_PATH)
+	${VAULT_CLI} secrets disable $(PLUGIN_VAULT_PATH)
 
 enable:
-	vault secrets enable -path=$(PLUGIN_VAULT_PATH) -plugin-version=$(NEXT_VERSION) $(PLUGIN_NAME)
+	${VAULT_CLI} secrets enable -path=$(PLUGIN_VAULT_PATH) -plugin-version=$(NEXT_VERSION) $(PLUGIN_NAME)
 
 register:
-	vault plugin register -sha256=$$(sha256sum $(PLUGIN_DIR)/$(PLUGIN_FILE) | cut -d " " -f 1) -command=$(PLUGIN_FILE) -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
-	vault plugin info -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
+	${VAULT_CLI} plugin register -sha256=$$(sha256sum $(PLUGIN_DIR)/$(PLUGIN_FILE) | cut -d " " -f 1) -command=$(PLUGIN_FILE) -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
+	${VAULT_CLI} plugin info -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
 
 deregister:
-	vault plugin deregister -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
+	${VAULT_CLI} plugin deregister -version=$(NEXT_VERSION) secret $(PLUGIN_NAME)
 
 upgrade: build register
-	vault plugin reload -plugin=$(PLUGIN_NAME)
+	${VAULT_CLI} plugin reload -plugin=$(PLUGIN_NAME)
 
 test:
 	go test -v -count=1 ./...
@@ -74,21 +76,21 @@ fmt:
 setup: disable register enable
 
 admin:
-	vault write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
-	vault read $(PLUGIN_VAULT_PATH)/config/admin
-	vault write -f $(PLUGIN_VAULT_PATH)/config/rotate
-	vault read $(PLUGIN_VAULT_PATH)/config/admin
+	${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
+	${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/config/admin
+	${VAULT_CLI} write -f $(PLUGIN_VAULT_PATH)/config/rotate
+	${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/config/admin
 
 usertoken:
-	vault write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
-	vault write $(PLUGIN_VAULT_PATH)/config/user_token default_description="Vault Test"
-	vault read $(PLUGIN_VAULT_PATH)/config/user_token
-	vault read $(PLUGIN_VAULT_PATH)/user_token/test refreshable=true include_reference_token=true use_expiring_tokens=true
+	${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/config/admin url=$(JFROG_URL) access_token=$(JFROG_ACCESS_TOKEN)
+	${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/config/user_token default_description="Vault Test"
+	${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/config/user_token
+	${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/user_token/test refreshable=true include_reference_token=true use_expiring_tokens=true
 
 testrole:
-	vault write $(PLUGIN_VAULT_PATH)/roles/test scope="$(ARTIFACTORY_SCOPE)" max_ttl=3h default_ttl=2h
-	vault read $(PLUGIN_VAULT_PATH)/roles/test
-	vault read $(PLUGIN_VAULT_PATH)/token/test
+	${VAULT_CLI} write $(PLUGIN_VAULT_PATH)/roles/test scope="$(ARTIFACTORY_SCOPE)" max_ttl=3h default_ttl=2h
+	${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/roles/test
+	${VAULT_CLI} read $(PLUGIN_VAULT_PATH)/token/test
 
 artifactory: $(ARTIFACTORY_ENV)
 
@@ -99,4 +101,4 @@ stop_artifactory:
 	source $(ARTIFACTORY_ENV) && docker stop $$ARTIFACTORY_CONTAINER_ID
 	rm -f $(ARTIFACTORY_ENV)
 
-.PHONY: build clean fmt start disable enable register deregister upgrade test acceptance  setup admin testrole artifactory stop_artifactory
+.PHONY: build clean fmt start disable enable register deregister upgrade test acceptance setup admin testrole artifactory stop_artifactory
diff --git a/README.md b/README.md
@@ -717,6 +717,12 @@ brew tap hashicorp/tap
 brew install hashicorp/tap/vault
 ```
 
+#### Test with OpenBao binary
+
+*  You can follow the [Installing OpenBao](https://openbao.org/docs/install/) instructions.
+* Export env var `VAULT_CLI=<your path to bao binary>`, e.g. `export VAULT_CLI=/usr/local/bin/bao`
+* Run makefile as usual `make setup` or `VAULT_CLI=/usr/local/bin/bao make setup`
+
 #### Start Vault dev server
 
 ```sh