Skip to content

Backport of Passes configured role name to Vault for AWS auth in Connect CA into release/1.15.x #18098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hc-github-team-consul-core merged 3 commits into from
Jul 12, 2023
Merged

Backport of Passes configured role name to Vault for AWS auth in Connect CA into release/1.15.x #18098

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c2f9509
backport of commit 4034bb2b3eba81ea13bf6d3a62d27094d96ffc24
t-davies Jun 26, 2023
e7a76c9
backport of commit 9c4c3c50f07d4072bb981c16cf993118fd7f6f1d
t-davies Jul 11, 2023
ce8b68a
backport of commit 7282078993aa51915afa801bdabded0f78397cb5
t-davies Jul 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .changelog/17885.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
```release-note:bug
ca: Fixed a bug where the Vault provider was not passing the configured role param for AWS auth
7 changes: 7 additions & 0 deletions agent/connect/ca/provider_vault_auth_aws.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,13 @@ func (g *AWSLoginDataGenerator) GenerateLoginData(authMethod *structs.VaultAuthM
if err != nil {
return nil, fmt.Errorf("aws auth failed to generate login data: %w", err)
}

// If a Vault role name is specified, we need to manually add this
role, ok := authMethod.Params["role"]
if ok {
loginData["role"] = role
}

return loginData, nil
}

Expand Down
17 changes: 14 additions & 3 deletions agent/connect/ca/provider_vault_auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,15 +269,22 @@ func TestVaultCAProvider_AWSCredentialsConfig(t *testing.T) {

func TestVaultCAProvider_AWSLoginDataGenerator(t *testing.T) {
cases := map[string]struct {
expErr error
expErr error
authMethod structs.VaultAuthMethod
}{
"valid login data": {},
"valid login data": {
authMethod: structs.VaultAuthMethod{},
},
"with role": {
expErr: nil,
authMethod: structs.VaultAuthMethod{Type: "aws", MountPath: "", Params: map[string]interface{}{"role": "test-role"}},
},
}

for name, c := range cases {
t.Run(name, func(t *testing.T) {
ldg := &AWSLoginDataGenerator{credentials: credentials.AnonymousCredentials}
loginData, err := ldg.GenerateLoginData(&structs.VaultAuthMethod{})
loginData, err := ldg.GenerateLoginData(&c.authMethod)
if c.expErr != nil {
require.Error(t, err)
require.Contains(t, err.Error(), c.expErr.Error())
Expand All @@ -298,6 +305,10 @@ func TestVaultCAProvider_AWSLoginDataGenerator(t *testing.T) {
require.True(t, exists, "missing expected key: %s", key)
require.NotEmpty(t, val, "expected non-empty value for key: %s", key)
}

if c.authMethod.Params["role"] != nil {
require.Equal(t, c.authMethod.Params["role"], loginData["role"])
}
})
}
}