From 4034bb2b3eba81ea13bf6d3a62d27094d96ffc24 Mon Sep 17 00:00:00 2001 From: Tom Davies Date: Mon, 26 Jun 2023 22:00:07 +0100 Subject: [PATCH 1/3] Passes configured role name to Vault CA AWS auth --- agent/connect/ca/provider_vault_auth_aws.go | 10 ++++++++++ agent/connect/ca/provider_vault_auth_test.go | 17 ++++++++++++++--- 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/agent/connect/ca/provider_vault_auth_aws.go b/agent/connect/ca/provider_vault_auth_aws.go index 59f1c98035af..03d4ec4b952d 100644 --- a/agent/connect/ca/provider_vault_auth_aws.go +++ b/agent/connect/ca/provider_vault_auth_aws.go @@ -72,6 +72,16 @@ func (g *AWSLoginDataGenerator) GenerateLoginData(authMethod *structs.VaultAuthM if err != nil { return nil, fmt.Errorf("aws auth failed to generate login data: %w", err) } + if loginData == nil { + return nil, fmt.Errorf("got nil response from GenerateLoginData") + } + + // If a Vault role name is specified, we need to manually add this + role, ok := authMethod.Params["role"] + if ok { + loginData["role"] = role + } + return loginData, nil } diff --git a/agent/connect/ca/provider_vault_auth_test.go b/agent/connect/ca/provider_vault_auth_test.go index c6979dbbe50a..74507acb39e7 100644 --- a/agent/connect/ca/provider_vault_auth_test.go +++ b/agent/connect/ca/provider_vault_auth_test.go @@ -278,15 +278,22 @@ func TestVaultCAProvider_AWSCredentialsConfig(t *testing.T) { func TestVaultCAProvider_AWSLoginDataGenerator(t *testing.T) { cases := map[string]struct { - expErr error + expErr error + authMethod structs.VaultAuthMethod }{ - "valid login data": {}, + "valid login data": { + authMethod: structs.VaultAuthMethod{}, + }, + "with role": { + expErr: nil, + authMethod: structs.VaultAuthMethod{Type: "aws", MountPath: "", Params: map[string]interface{}{"role": "test-role"}}, + }, } for name, c := range cases { t.Run(name, func(t *testing.T) { ldg := &AWSLoginDataGenerator{credentials: credentials.AnonymousCredentials} - loginData, err := ldg.GenerateLoginData(&structs.VaultAuthMethod{}) + loginData, err := ldg.GenerateLoginData(&c.authMethod) if c.expErr != nil { require.Error(t, err) require.Contains(t, err.Error(), c.expErr.Error()) @@ -307,6 +314,10 @@ func TestVaultCAProvider_AWSLoginDataGenerator(t *testing.T) { require.True(t, exists, "missing expected key: %s", key) require.NotEmpty(t, val, "expected non-empty value for key: %s", key) } + + if c.authMethod.Params["role"] != nil { + require.Equal(t, c.authMethod.Params["role"], loginData["role"]) + } }) } } From 9c4c3c50f07d4072bb981c16cf993118fd7f6f1d Mon Sep 17 00:00:00 2001 From: Tom Davies Date: Tue, 11 Jul 2023 15:56:18 +0100 Subject: [PATCH 2/3] Adds changelog entry for Vault CA AWS auth fix --- .changelog/17885.txt | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .changelog/17885.txt diff --git a/.changelog/17885.txt b/.changelog/17885.txt new file mode 100644 index 000000000000..2cd690488d92 --- /dev/null +++ b/.changelog/17885.txt @@ -0,0 +1,2 @@ +```release-note:bug +ca: Fixed a bug where the Vault provider was not passing the configured role param for AWS auth From 7282078993aa51915afa801bdabded0f78397cb5 Mon Sep 17 00:00:00 2001 From: Tom Davies Date: Tue, 11 Jul 2023 16:35:33 +0100 Subject: [PATCH 3/3] Removes unnecessary nil check for loginData --- agent/connect/ca/provider_vault_auth_aws.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/agent/connect/ca/provider_vault_auth_aws.go b/agent/connect/ca/provider_vault_auth_aws.go index 03d4ec4b952d..02abf39824cb 100644 --- a/agent/connect/ca/provider_vault_auth_aws.go +++ b/agent/connect/ca/provider_vault_auth_aws.go @@ -72,9 +72,6 @@ func (g *AWSLoginDataGenerator) GenerateLoginData(authMethod *structs.VaultAuthM if err != nil { return nil, fmt.Errorf("aws auth failed to generate login data: %w", err) } - if loginData == nil { - return nil, fmt.Errorf("got nil response from GenerateLoginData") - } // If a Vault role name is specified, we need to manually add this role, ok := authMethod.Params["role"]