Skip to content

Commit f020140

Browse files
kporter101kporter101
authored
VAULT-31185 & 31186/use identity token auth for Artifactory in Vault CE & Ent (#31255)
* removed artifactory_username * updated artifactory token * ran enos fmt * ran terraform fmt * debugging/ testing - pinned enos version, added null username * byyyyy
1 parent a47862e commit f020140

19 files changed

+149
-201
lines changed

‎.github/workflows/test-run-enos-scenario-matrix.yml

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,7 @@ jobs:
131131
caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
132132
token: ${{ steps.vault-auth.outputs.token }}
133133
secrets: |
134-
kv/data/github/${{ github.repository }}/artifactory token | ARTIFACTORY_TOKEN;
135-
kv/data/github/${{ github.repository }}/artifactory username | ARTIFACTORY_USER;
134+
kv/data/github/${{ github.repository }}/artifactory bearer-token | ARTIFACTORY_BEARER_TOKEN;
136135
kv/data/github/${{ github.repository }}/aws access-key-id | AWS_ACCESS_KEY_ID_CI;
137136
kv/data/github/${{ github.repository }}/aws secret-access-key | AWS_SECRET_ACCESS_KEY_CI;
138137
kv/data/github/${{ github.repository }}/aws role-arn | AWS_ROLE_ARN_CI;
@@ -146,8 +145,7 @@ jobs:
146145
run: |
147146
if [[ "${{ needs.metadata.outputs.is-enterprise }}" != 'true' ]]; then
148147
{
149-
echo "artifactory-user=${{ secrets.ARTIFACTORY_USER }}"
150-
echo "artifactory-token=${{ secrets.ARTIFACTORY_TOKEN }}"
148+
echo "artifactory-token=${{ secrets.ARTIFACTORY_BEARER_TOKEN }}"
151149
echo "aws-access-key-id=${{ secrets.AWS_ACCESS_KEY_ID_CI }}"
152150
echo "aws-secret-access-key=${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}"
153151
echo "aws-role-arn=${{ secrets.AWS_ROLE_ARN_CI }}"
@@ -162,8 +160,7 @@ jobs:
162160
} | tee -a "$GITHUB_OUTPUT"
163161
else
164162
{
165-
echo "artifactory-user=${{ steps.vault-secrets.outputs.ARTIFACTORY_USER }}"
166-
echo "artifactory-token=${{ steps.vault-secrets.outputs.ARTIFACTORY_TOKEN }}"
163+
echo "artifactory-token=${{ steps.vault-secrets.outputs.ARTIFACTORY_BEARER_TOKEN }}"
167164
echo "aws-access-key-id=${{ steps.vault-secrets.outputs.AWS_ACCESS_KEY_ID_CI }}"
168165
echo "aws-secret-access-key=${{ steps.vault-secrets.outputs.AWS_SECRET_ACCESS_KEY_CI }}"
169166
echo "aws-role-arn=${{ steps.vault-secrets.outputs.AWS_ROLE_ARN_CI }}"
@@ -183,7 +180,6 @@ jobs:
183180
{
184181
echo "GITHUB_TOKEN=${{ steps.secrets.outputs.github-token }}"
185182
echo "ENOS_DEBUG_DATA_ROOT_DIR=/tmp/enos-debug-data"
186-
echo "ENOS_VAR_artifactory_username=${{ steps.secrets.outputs.artifactory-user }}"
187183
echo "ENOS_VAR_artifactory_token=${{ steps.secrets.outputs.artifactory-token }}"
188184
echo "ENOS_VAR_aws_region=${{ matrix.attributes.aws_region }}"
189185
echo "ENOS_VAR_aws_ssh_keypair_name=${{ inputs.ssh-key-name }}"

‎enos/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,6 @@ unzipped Vault binary at the `vault_local_binary_path`.
184184

185185
## `artifact_source:artifactory`
186186
This variant is for running the Enos scenario to test an artifact from Artifactory. It requires following Enos variables to be set:
187-
* `artifactory_username`
188187
* `artifactory_token`
189188
* `aws_ssh_keypair_name`
190189
* `aws_ssh_private_key_path`

‎enos/enos-dev-scenario-pr-replication.hcl

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -113,12 +113,10 @@ scenario "dev_pr_replication" {
113113
artifactory_repo:
114114
The artifactory host to search. It's very unlikely that you'll want to change this. The
115115
default value is where CRT will publish packages.
116-
artifactory_username:
117-
The artifactory username associated with your token. You'll need this if you wish to use
118-
deb or rpm artifacts! You can request access via Okta.
119116
artifactory_token:
120-
The artifactory token associated with your username. You'll need this if you wish to use
121-
deb or rpm artifacts! You can create a token by logging into Artifactory via Okta.
117+
The artifactory identity token to use for authentication. You'll need this if you wish
118+
to use deb or rpm artifacts! You can get a token by joining the 'artifactory-users' Doormat
119+
group and using 'doormat artifactory create-token'.
122120
dev_build_local_ui:
123121
If you are not testing any changes in the UI, set to false. This will save time by not
124122
building the entire UI. If you need to test the UI, set to true.
@@ -149,11 +147,10 @@ scenario "dev_pr_replication" {
149147
// Required when using a RPM or Deb package
150148
// Some of these variables don't have default values so we'll only set them if they are
151149
// required.
152-
artifactory_host = local.use_artifactory ? var.artifactory_host : null
153-
artifactory_repo = local.use_artifactory ? var.artifactory_repo : null
154-
artifactory_username = local.use_artifactory ? var.artifactory_username : null
155-
artifactory_token = local.use_artifactory ? var.artifactory_token : null
156-
distro = matrix.distro
150+
artifactory_host = local.use_artifactory ? var.artifactory_host : null
151+
artifactory_repo = local.use_artifactory ? var.artifactory_repo : null
152+
artifactory_token = local.use_artifactory ? var.artifactory_token : null
153+
distro = matrix.distro
157154
}
158155
}
159156

‎enos/enos-dev-scenario-single-cluster.hcl

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -107,12 +107,10 @@ scenario "dev_single_cluster" {
107107
artifactory_repo:
108108
The artifactory host to search. It's very unlikely that you'll want to change this. The
109109
default value is where CRT will publish packages.
110-
artifactory_username:
111-
The artifactory username associated with your token. You'll need this if you wish to use
112-
deb or rpm artifacts! You can request access via Okta.
113110
artifactory_token:
114-
The artifactory token associated with your username. You'll need this if you wish to use
115-
deb or rpm artifacts! You can create a token by logging into Artifactory via Okta.
111+
The artifactory identity token to use for authentication. You'll need this if you wish
112+
to use deb or rpm artifacts! You can get a token by joining the 'artifactory-users' Doormat
113+
group and using 'doormat artifactory create-token'.
116114
dev_build_local_ui:
117115
If you are not testing any changes in the UI, set to false. This will save time by not
118116
building the entire UI. If you need to test the UI, set to true.
@@ -143,12 +141,11 @@ scenario "dev_single_cluster" {
143141
// Required when using a RPM or Deb package
144142
// Some of these variables don't have default values so we'll only set them if they are
145143
// required.
146-
artifactory_host = local.use_artifactory ? var.artifactory_host : null
147-
artifactory_repo = local.use_artifactory ? var.artifactory_repo : null
148-
artifactory_username = local.use_artifactory ? var.artifactory_username : null
149-
artifactory_token = local.use_artifactory ? var.artifactory_token : null
150-
distro = matrix.distro
151-
distro_version = global.distro_version[matrix.distro]
144+
artifactory_host = local.use_artifactory ? var.artifactory_host : null
145+
artifactory_repo = local.use_artifactory ? var.artifactory_repo : null
146+
artifactory_token = local.use_artifactory ? var.artifactory_token : null
147+
distro = matrix.distro
148+
distro_version = global.distro_version[matrix.distro]
152149
}
153150
}
154151

‎enos/enos-scenario-agent.hcl

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ scenario "agent" {
2727
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
2828
2929
Variables required for some scenario variants:
30-
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3130
- artifactory_token (if using `artifact_source:artifactory` in your filter)
3231
- aws_region (if different from the default value in enos-variables.hcl)
3332
- consul_license_path (if using an ENT edition of Consul)
@@ -102,20 +101,19 @@ scenario "agent" {
102101
module = "build_${matrix.artifact_source}"
103102

104103
variables {
105-
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
106-
artifact_path = local.artifact_path
107-
goarch = matrix.arch
108-
goos = "linux"
109-
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
110-
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
111-
artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
112-
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
113-
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
114-
product_version = var.vault_product_version
115-
artifact_type = matrix.artifact_type
116-
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
117-
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
118-
revision = var.vault_revision
104+
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
105+
artifact_path = local.artifact_path
106+
goarch = matrix.arch
107+
goos = "linux"
108+
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
109+
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
110+
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
111+
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
112+
product_version = var.vault_product_version
113+
artifact_type = matrix.artifact_type
114+
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
115+
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
116+
revision = var.vault_revision
119117
}
120118
}
121119

‎enos/enos-scenario-autopilot.hcl

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ scenario "autopilot" {
2929
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
3030
3131
Variables required for some scenario variants:
32-
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3332
- artifactory_token (if using `artifact_source:artifactory` in your filter)
3433
- aws_region (if different from the default value defined in enos-variables.hcl)
3534
- consul_license_path (if using an ENT edition of Consul)
@@ -112,20 +111,19 @@ scenario "autopilot" {
112111
module = "build_${matrix.artifact_source}"
113112

114113
variables {
115-
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
116-
artifact_path = local.artifact_path
117-
goarch = matrix.arch
118-
goos = "linux"
119-
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
120-
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
121-
artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
122-
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
123-
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
124-
product_version = var.vault_product_version
125-
artifact_type = matrix.artifact_type
126-
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
127-
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
128-
revision = var.vault_revision
114+
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
115+
artifact_path = local.artifact_path
116+
goarch = matrix.arch
117+
goos = "linux"
118+
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
119+
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
120+
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
121+
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
122+
product_version = var.vault_product_version
123+
artifact_type = matrix.artifact_type
124+
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
125+
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
126+
revision = var.vault_revision
129127
}
130128
}
131129

‎enos/enos-scenario-benchmark.hcl

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -128,20 +128,19 @@ scenario "benchmark" {
128128
module = "build_${matrix.artifact_source}"
129129

130130
variables {
131-
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
132-
artifact_path = local.artifact_path
133-
goarch = matrix.arch
134-
goos = "linux"
135-
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
136-
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
137-
artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
138-
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
139-
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
140-
product_version = var.vault_product_version
141-
artifact_type = matrix.artifact_type
142-
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
143-
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
144-
revision = var.vault_revision
131+
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
132+
artifact_path = local.artifact_path
133+
goarch = matrix.arch
134+
goos = "linux"
135+
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
136+
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
137+
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
138+
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
139+
product_version = var.vault_product_version
140+
artifact_type = matrix.artifact_type
141+
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
142+
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
143+
revision = var.vault_revision
145144
}
146145
}
147146

‎enos/enos-scenario-dr-replication.hcl

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ scenario "dr_replication" {
3232
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
3333
3434
Variables required for some scenario variants:
35-
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3635
- artifactory_token (if using `artifact_source:artifactory` in your filter)
3736
- aws_region (if different from the default value in enos-variables.hcl)
3837
- consul_license_path (if using an ENT edition of Consul)
@@ -125,20 +124,19 @@ scenario "dr_replication" {
125124
module = "build_${matrix.artifact_source}"
126125

127126
variables {
128-
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
129-
artifact_path = local.artifact_path
130-
goarch = matrix.arch
131-
goos = "linux"
132-
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
133-
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
134-
artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
135-
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
136-
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
137-
product_version = var.vault_product_version
138-
artifact_type = matrix.artifact_type
139-
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
140-
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
141-
revision = var.vault_revision
127+
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
128+
artifact_path = local.artifact_path
129+
goarch = matrix.arch
130+
goos = "linux"
131+
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
132+
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
133+
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
134+
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
135+
product_version = var.vault_product_version
136+
artifact_type = matrix.artifact_type
137+
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
138+
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
139+
revision = var.vault_revision
142140
}
143141
}
144142

‎enos/enos-scenario-pr-replication.hcl

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ scenario "pr_replication" {
3232
https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
3333
3434
Variables required for some scenario variants:
35-
- artifactory_username (if using `artifact_source:artifactory` in your filter)
3635
- artifactory_token (if using `artifact_source:artifactory` in your filter)
3736
- aws_region (if different from the default value in enos-variables.hcl)
3837
- consul_license_path (if using an ENT edition of Consul)
@@ -125,20 +124,19 @@ scenario "pr_replication" {
125124
module = "build_${matrix.artifact_source}"
126125

127126
variables {
128-
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
129-
artifact_path = local.artifact_path
130-
goarch = matrix.arch
131-
goos = "linux"
132-
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
133-
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
134-
artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
135-
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
136-
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
137-
product_version = var.vault_product_version
138-
artifact_type = matrix.artifact_type
139-
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
140-
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
141-
revision = var.vault_revision
127+
build_tags = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
128+
artifact_path = local.artifact_path
129+
goarch = matrix.arch
130+
goos = "linux"
131+
artifactory_host = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
132+
artifactory_repo = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
133+
artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
134+
arch = matrix.artifact_source == "artifactory" ? matrix.arch : null
135+
product_version = var.vault_product_version
136+
artifact_type = matrix.artifact_type
137+
distro = matrix.artifact_source == "artifactory" ? matrix.distro : null
138+
edition = matrix.artifact_source == "artifactory" ? matrix.edition : null
139+
revision = var.vault_revision
142140
}
143141
}
144142

0 commit comments

Comments
 (0)