From c65ac19eb740ddd4425ece55b0862b60cf3ef814 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Mon, 21 Sep 2020 13:53:26 +0200 Subject: [PATCH] Polishing Fix property names to spring.couchbase instead of spring.data.couchbase. Fix VaultConfigCouchbaseTests to make it work with Couchbase instead of using Cassandra. Add CouchbaseSecretIntegrationTests to verify interaction through VaultConfigTemplate. Remove property overrides for username/password so that Vault PropertySources are used. Use unique role name to avoid clashes with other tests. Enable VaultConfigCouchbaseDatabaseTests for ConfigData API by importing vault://. Update reference documentation. Resolves gh-408. --- .gitignore | 1 + docs/src/main/asciidoc/new-features.adoc | 1 + docs/src/main/asciidoc/secret-backends.adoc | 10 +- spring-cloud-vault-config-databases/pom.xml | 14 +- ...tConfigDatabaseBootstrapConfiguration.java | 4 +- .../databases/VaultCouchbaseProperties.java | 4 +- .../main/resources/META-INF/spring.factories | 9 +- .../CouchbaseSecretIntegrationTests.java | 102 +++++++++++++ ...ultConfigCouchbaseDatabaseStaticTests.java | 139 ------------------ .../VaultConfigCouchbaseDatabaseTests.java | 15 +- .../databases/VaultConfigCouchbaseTests.java | 70 ++++----- src/test/bash/install_vault.sh | 2 +- src/test/bash/vault.conf | 2 + 13 files changed, 165 insertions(+), 208 deletions(-) create mode 100644 spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/CouchbaseSecretIntegrationTests.java delete mode 100644 spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseStaticTests.java diff --git a/.gitignore b/.gitignore index 3ee6e747..dcfbf8b9 100644 --- a/.gitignore +++ b/.gitignore @@ -25,4 +25,5 @@ pom.xml.releaseBackup release.properties .vscode/ .sdkmanrc +plugins/ diff --git a/docs/src/main/asciidoc/new-features.adoc b/docs/src/main/asciidoc/new-features.adoc index f572b09e..a52dc1d6 100644 --- a/docs/src/main/asciidoc/new-features.adoc +++ b/docs/src/main/asciidoc/new-features.adoc @@ -6,3 +6,4 @@ This section briefly covers items that are new and noteworthy in the latest rele === New in Spring Cloud Vault 3.0 * Migration of `PropertySource` initialization from Spring Cloud's Bootstrap Context to Spring Boot's <>. +* Support for the <> backend. diff --git a/docs/src/main/asciidoc/secret-backends.adoc b/docs/src/main/asciidoc/secret-backends.adoc index a74f5734..c5f67426 100644 --- a/docs/src/main/asciidoc/secret-backends.adoc +++ b/docs/src/main/asciidoc/secret-backends.adoc @@ -344,8 +344,8 @@ Spring Cloud Vault can obtain credentials for Couchbase. The integration can be enabled by setting `spring.cloud.vault.couchbase.enabled=true` (default `false`) and providing the role name with `spring.cloud.vault.couchbase.role=…`. -Username and password are available from `spring.data.couchbase.username` -and `spring.data.couchbase.password` properties so using Spring Boot will pick up the generated credentials without further configuration. +Username and password are available from `spring.couchbase.username` +and `spring.couchbase.password` properties so using Spring Boot will pick up the generated credentials without further configuration. You can configure the property names by setting `spring.cloud.vault.couchbase.username-property` and `spring.cloud.vault.couchbase.password-property`. @@ -358,8 +358,8 @@ spring.cloud.vault: enabled: true role: readonly backend: database - username-property: spring.data.couchbase.username - password-property: spring.data.couchbase.password + username-property: spring.couchbase.username + password-property: spring.couchbase.password ---- ==== @@ -369,7 +369,7 @@ spring.cloud.vault: * `username-property` sets the property name in which the Couchbase username is stored * `password-property` sets the property name in which the Couchbase password is stored -See also: https://www.vaultproject.io/docs/secrets/couchbase/index.html[Vault Documentation: Setting up Couchbase with Vault] +See also: https://github.com/hashicorp/vault-plugin-database-couchbase[Couchbase Database Plugin Documentation] [[vault.config.backends.elasticsearch]] === Elasticsearch diff --git a/spring-cloud-vault-config-databases/pom.xml b/spring-cloud-vault-config-databases/pom.xml index 4b700aeb..0043488d 100644 --- a/spring-cloud-vault-config-databases/pom.xml +++ b/spring-cloud-vault-config-databases/pom.xml @@ -48,6 +48,12 @@ test + + com.couchbase.client + java-client + test + + com.h2database h2 @@ -95,11 +101,13 @@ spring-boot-starter-jdbc test + - org.springframework.data - spring-data-couchbase - test + org.springframework.boot + spring-boot-starter-data-couchbase + test + diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java index ff23f6a4..d3263755 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java @@ -41,8 +41,8 @@ import org.springframework.vault.core.util.PropertyTransformer; */ @Configuration(proxyBeanMethods = false) @EnableConfigurationProperties({ VaultMySqlProperties.class, VaultPostgreSqlProperties.class, - VaultCassandraProperties.class, VaultMongoProperties.class, VaultElasticsearchProperties.class, - VaultDatabaseProperties.class, VaultCouchbaseProperties.class }) + VaultCassandraProperties.class, VaultCouchbaseProperties.class, VaultMongoProperties.class, + VaultElasticsearchProperties.class, VaultDatabaseProperties.class }) public class VaultConfigDatabaseBootstrapConfiguration { @Bean diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCouchbaseProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCouchbaseProperties.java index 790136d4..c88af91b 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCouchbaseProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCouchbaseProperties.java @@ -56,13 +56,13 @@ public class VaultCouchbaseProperties implements DatabaseSecretProperties { * Target property for the obtained username. */ @NotEmpty - private String usernameProperty = "spring.data.couchbase.username"; + private String usernameProperty = "spring.couchbase.username"; /** * Target property for the obtained password. */ @NotEmpty - private String passwordProperty = "spring.data.couchbase.password"; + private String passwordProperty = "spring.couchbase.password"; @Override public boolean isEnabled() { diff --git a/spring-cloud-vault-config-databases/src/main/resources/META-INF/spring.factories b/spring-cloud-vault-config-databases/src/main/resources/META-INF/spring.factories index 914a2ed4..59d5e158 100644 --- a/spring-cloud-vault-config-databases/src/main/resources/META-INF/spring.factories +++ b/spring-cloud-vault-config-databases/src/main/resources/META-INF/spring.factories @@ -6,9 +6,10 @@ org.springframework.cloud.vault.config.SecretBackendMetadataFactory=\ org.springframework.cloud.vault.config.databases.VaultConfigDatabaseBootstrapConfiguration.DatabaseSecretBackendMetadataFactory org.springframework.cloud.vault.config.VaultSecretBackendDescriptor=\ -org.springframework.cloud.vault.config.databases.VaultMySqlProperties,\ -org.springframework.cloud.vault.config.databases.VaultPostgreSqlProperties,\ org.springframework.cloud.vault.config.databases.VaultCassandraProperties,\ -org.springframework.cloud.vault.config.databases.VaultMongoProperties,\ +org.springframework.cloud.vault.config.databases.VaultCouchbaseProperties,\ +org.springframework.cloud.vault.config.databases.VaultDatabaseProperties,\ org.springframework.cloud.vault.config.databases.VaultElasticsearchProperties,\ -org.springframework.cloud.vault.config.databases.VaultDatabaseProperties +org.springframework.cloud.vault.config.databases.VaultMongoProperties,\ +org.springframework.cloud.vault.config.databases.VaultMySqlProperties,\ +org.springframework.cloud.vault.config.databases.VaultPostgreSqlProperties diff --git a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/CouchbaseSecretIntegrationTests.java b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/CouchbaseSecretIntegrationTests.java new file mode 100644 index 00000000..5f4d13df --- /dev/null +++ b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/CouchbaseSecretIntegrationTests.java @@ -0,0 +1,102 @@ +/* + * Copyright 2016-2020 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.vault.config.databases; + +import java.net.InetSocketAddress; +import java.util.HashMap; +import java.util.Map; + +import org.junit.Before; +import org.junit.Test; + +import org.springframework.cloud.vault.config.VaultConfigOperations; +import org.springframework.cloud.vault.config.VaultConfigTemplate; +import org.springframework.cloud.vault.config.VaultProperties; +import org.springframework.cloud.vault.util.CanConnect; +import org.springframework.cloud.vault.util.IntegrationTestSupport; +import org.springframework.cloud.vault.util.Settings; +import org.springframework.cloud.vault.util.Version; +import org.springframework.vault.core.VaultOperations; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.junit.Assume.assumeTrue; +import static org.springframework.cloud.vault.config.databases.VaultConfigDatabaseBootstrapConfiguration.DatabaseSecretBackendMetadataFactory.forDatabase; + +/** + * Integration tests for {@link VaultConfigTemplate} using the couchbase secret backend. + * This test requires a running Couchbase instance, see {@link #COUCHBASE_HOST}. + * + * @author Mark Paluch + */ +public class CouchbaseSecretIntegrationTests extends IntegrationTestSupport { + + private static final int COUCHBASE_PORT = 8091; + + private static final String COUCHBASE_HOST = "localhost"; + + private VaultProperties vaultProperties = Settings.createVaultProperties(); + + private VaultConfigOperations configOperations; + + private VaultCouchbaseProperties couchbaseProperties = new VaultCouchbaseProperties(); + + /** + * Initialize couchbase secret backend. + */ + @Before + public void setUp() { + + assumeTrue(CanConnect.to(new InetSocketAddress(COUCHBASE_HOST, COUCHBASE_PORT))); + assumeTrue(this.vaultRule.prepare().getVersion().isGreaterThanOrEqualTo(Version.parse("1.3.0"))); + + this.couchbaseProperties.setEnabled(true); + this.couchbaseProperties.setRole("couchbase-readonly"); + + if (!prepare().hasSecretBackend(this.couchbaseProperties.getBackend())) { + prepare().mountSecret(this.couchbaseProperties.getBackend()); + } + + VaultOperations vaultOperations = this.vaultRule.prepare().getVaultOperations(); + + Map config = new HashMap<>(); + config.put("plugin_name", "couchbase-database-plugin"); + config.put("hosts", "couchbase://localhost"); + config.put("username", "Administrator"); + config.put("password", "password"); + config.put("allowed_roles", "*"); + + vaultOperations.write("database/config/spring-cloud-vault-couchbase", config); + + Map body = new HashMap<>(); + body.put("db_name", "spring-cloud-vault-couchbase"); + body.put("creation_statements", "{\"roles\":[{\"role\":\"ro_admin\"}]}"); + + vaultOperations.write("database/roles/couchbase-readonly", body); + + this.configOperations = new VaultConfigTemplate(vaultOperations, this.vaultProperties); + } + + @Test + public void shouldCreateCredentialsCorrectly() { + + Map secretProperties = this.configOperations.read(forDatabase(this.couchbaseProperties)) + .getData(); + + assertThat(secretProperties).containsKeys("spring.couchbase.username", "spring.couchbase.password"); + } + +} diff --git a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseStaticTests.java b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseStaticTests.java deleted file mode 100644 index 454477eb..00000000 --- a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseStaticTests.java +++ /dev/null @@ -1,139 +0,0 @@ -/* - * Copyright 2017-2020 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package org.springframework.cloud.vault.config.databases; - -import java.net.InetSocketAddress; - -import com.couchbase.client.java.Cluster; -import com.couchbase.client.core.error.UnambiguousTimeoutException; - -import java.util.HashMap; -import java.util.Map; -import java.time.Duration; - -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; - -import org.springframework.beans.factory.annotation.Value; -import org.springframework.boot.SpringApplication; -import org.springframework.boot.autoconfigure.SpringBootApplication; -import org.springframework.boot.test.context.SpringBootTest; -import org.springframework.cloud.vault.util.CanConnect; -import org.springframework.cloud.vault.util.VaultRule; -import org.springframework.cloud.vault.util.Version; -import org.springframework.test.context.junit4.SpringRunner; -import org.springframework.vault.core.VaultOperations; - -import static org.junit.Assume.assumeTrue; - -/** - * Integration tests using the database secret backend. In case this test should fail - * because of SSL make sure you run the test within the - * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is - * referenced with {@code ../work/keystore.jks}. - * - * Uses the existing admin user that comes with the couchbase/sandbox-server docker image - * provided by Couchbase. The test will fail if this user does not exits. - * - * @author Francis Hitchens - */ -@RunWith(SpringRunner.class) -@SpringBootTest(classes = VaultConfigCouchbaseDatabaseStaticTests.TestApplication.class, - properties = { "spring.cloud.vault.couchbase.enabled=true", - "spring.cloud.vault.couchbase.role=staticreadonly", - "spring.cloud.vault.couchbase.staticRole=true", - "spring.data.couchbase.username=foo", - "spring.data.couchbase.password=bar", - "spring.main.allow-bean-definition-overriding=true" }) -public class VaultConfigCouchbaseDatabaseStaticTests { - - private static final int COUCHBASE_PORT = 8091; - - private static final String COUCHBASE_HOST = "localhost"; - - @Value("${spring.data.couchbase.username}") - String username; - - @Value("${spring.data.couchbase.password}") - String password; - - Cluster cluster; - - /** - * Initialize the couchbase secret backend. - */ - @BeforeClass - public static void beforeClass() { - - VaultRule vaultRule = new VaultRule(); - vaultRule.before(); - - assumeTrue(CanConnect.to(new InetSocketAddress(COUCHBASE_HOST, COUCHBASE_PORT))); - assumeTrue(vaultRule.prepare().getVersion() - .isGreaterThanOrEqualTo(Version.parse("0.7.1"))); - - if (!vaultRule.prepare().hasSecretBackend("database")) { - vaultRule.prepare().mountSecret("database"); - } - - VaultOperations vaultOperations = vaultRule.prepare().getVaultOperations(); - - Map config = new HashMap<>(); - config.put("plugin_name", "couchbase-database-plugin"); - config.put("hosts", "couchbase://localhost"); - config.put("username", "Administrator"); - config.put("password", "password"); - config.put("allowed_roles", "*"); - - vaultOperations.write("database/config/spring-cloud-vault-couchbase", config); - - Map body = new HashMap<>(); - body.put("db_name", "spring-cloud-vault-couchbase"); - body.put("username", "admin"); - body.put("rotation_period", "5m"); - body.put("creation_statements", "[{\"name\":\"ro_admin\"}]"); - - vaultOperations.write("database/static-roles/staticreadonly", body); - } - - @Test - public void shouldConnectConnection() throws UnambiguousTimeoutException { - - this.cluster = Cluster.connect("127.0.0.1", this.username, this.password); - this.cluster.waitUntilReady(Duration.ofSeconds(5)); - this.cluster.disconnect(); - } - - @Test(expected = UnambiguousTimeoutException.class) - public void shouldFailConnectConnection() throws UnambiguousTimeoutException { - - this.cluster = Cluster.connect("127.0.0.1", this.username, "fake.pwd"); - this.cluster.waitUntilReady(Duration.ofSeconds(5)); - this.cluster.disconnect(); - } - - @SpringBootApplication - public static class TestApplication { - - public static void main(String[] args) { - SpringApplication.run(TestApplication.class, args); - } - - } - -} diff --git a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseTests.java b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseTests.java index 97093a2a..30fc6e6a 100644 --- a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseTests.java +++ b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseDatabaseTests.java @@ -51,10 +51,8 @@ import static org.junit.Assume.assumeTrue; */ @RunWith(SpringRunner.class) @SpringBootTest(classes = VaultConfigCouchbaseDatabaseTests.TestApplication.class, - properties = { "spring.cloud.vault.couchbase.enabled=true", - "spring.cloud.vault.couchbase.role=readonly", - "spring.data.couchbase.username=foo", - "spring.data.couchbase.password=bar", + properties = { "spring.cloud.vault.couchbase.enabled=true", "spring.config.import=vault://", + "spring.cloud.vault.couchbase.role=couchbase-readonly", "spring.main.allow-bean-definition-overriding=true" }) public class VaultConfigCouchbaseDatabaseTests { @@ -62,10 +60,10 @@ public class VaultConfigCouchbaseDatabaseTests { private static final String COUCHBASE_HOST = "localhost"; - @Value("${spring.data.couchbase.username}") + @Value("${spring.couchbase.username}") String username; - @Value("${spring.data.couchbase.password}") + @Value("${spring.couchbase.password}") String password; Cluster cluster; @@ -80,8 +78,7 @@ public class VaultConfigCouchbaseDatabaseTests { vaultRule.before(); assumeTrue(CanConnect.to(new InetSocketAddress(COUCHBASE_HOST, COUCHBASE_PORT))); - assumeTrue(vaultRule.prepare().getVersion() - .isGreaterThanOrEqualTo(Version.parse("0.7.1"))); + assumeTrue(vaultRule.prepare().getVersion().isGreaterThanOrEqualTo(Version.parse("1.3.0"))); if (!vaultRule.prepare().hasSecretBackend("database")) { vaultRule.prepare().mountSecret("database"); @@ -102,7 +99,7 @@ public class VaultConfigCouchbaseDatabaseTests { body.put("db_name", "spring-cloud-vault-couchbase"); body.put("creation_statements", "{\"roles\":[{\"role\":\"ro_admin\"}]}"); - vaultOperations.write("database/roles/readonly", body); + vaultOperations.write("database/roles/couchbase-readonly", body); } @Test diff --git a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseTests.java b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseTests.java index 52f7c5f9..93ba1c6b 100644 --- a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseTests.java +++ b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigCouchbaseTests.java @@ -20,7 +20,7 @@ import java.net.InetSocketAddress; import java.util.HashMap; import java.util.Map; -import com.datastax.oss.driver.api.core.CqlSession; +import com.couchbase.client.java.Cluster; import org.junit.BeforeClass; import org.junit.Test; import org.junit.runner.RunWith; @@ -32,6 +32,7 @@ import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.cloud.vault.util.CanConnect; import org.springframework.cloud.vault.util.VaultRule; +import org.springframework.cloud.vault.util.Version; import org.springframework.test.context.junit4.SpringRunner; import org.springframework.vault.core.VaultOperations; @@ -48,30 +49,23 @@ import static org.junit.Assume.assumeTrue; */ @RunWith(SpringRunner.class) @SpringBootTest(classes = VaultConfigCouchbaseTests.TestApplication.class, - properties = { "spring.cloud.vault.couchbase.enabled=true", - "spring.cloud.vault.couchbase.role=readonly", - "spring.data.couchbase.jmx-enabled=false" }) + properties = { "spring.cloud.vault.couchbase.enabled=true", "spring.config.import=vault://", + "spring.cloud.vault.couchbase.role=couchbase-readonly", + "spring.couchbase.connection-string=couchbase://localhost" }) public class VaultConfigCouchbaseTests { + private static final int COUCHBASE_PORT = 8091; + private static final String COUCHBASE_HOST = "localhost"; - private static final int COUCHBASE_PORT = 65535; - - private static final String COUCHBASE_USERNAME = "springvault"; - - private static final String COUCHBASE_PASSWORD = "springvault"; - - private static final String CREATE_USER_AND_GRANT_CQL = "CREATE USER '{{username}}' WITH PASSWORD '{{password}}' NOSUPERUSER;" - + "GRANT SELECT ON ALL KEYSPACES TO {{username}};"; - - @Value("${spring.data.couchbase.username}") + @Value("${spring.couchbase.username}") String username; - @Value("${spring.data.couchbase.password}") + @Value("${spring.couchbase.password}") String password; @Autowired - CqlSession cqlSession; + Cluster cluster; /** * Initialize the couchbase secret backend. @@ -79,47 +73,37 @@ public class VaultConfigCouchbaseTests { @BeforeClass public static void beforeClass() { - assumeTrue(CanConnect.to(new InetSocketAddress(COUCHBASE_HOST, COUCHBASE_PORT))); - VaultRule vaultRule = new VaultRule(); vaultRule.before(); - if (!vaultRule.prepare().hasSecretBackend("couchbase")) { - vaultRule.prepare().mountSecret("couchbase"); - } + assumeTrue(CanConnect.to(new InetSocketAddress(COUCHBASE_HOST, COUCHBASE_PORT))); + assumeTrue(vaultRule.prepare().getVersion().isGreaterThanOrEqualTo(Version.parse("1.3.0"))); VaultOperations vaultOperations = vaultRule.prepare().getVaultOperations(); - Map connection = new HashMap<>(); - connection.put("hosts", COUCHBASE_HOST); - connection.put("username", COUCHBASE_USERNAME); - connection.put("password", COUCHBASE_PASSWORD); - connection.put("protocol_version", 3); + if (!vaultRule.prepare().hasSecretBackend("database")) { + vaultRule.prepare().mountSecret("database"); + } - vaultOperations.write(String.format("%s/config/connection", "couchbase"), - connection); + Map config = new HashMap<>(); + config.put("plugin_name", "couchbase-database-plugin"); + config.put("hosts", "couchbase://localhost"); + config.put("username", "Administrator"); + config.put("password", "password"); + config.put("allowed_roles", "*"); - Map role = new HashMap<>(); + vaultOperations.write("database/config/spring-cloud-vault-couchbase", config); - role.put("creation_cql", CREATE_USER_AND_GRANT_CQL); - role.put("consistency", "All"); + Map body = new HashMap<>(); + body.put("db_name", "spring-cloud-vault-couchbase"); + body.put("creation_statements", "{\"roles\":[{\"role\":\"ro_admin\"}]}"); - vaultOperations.write("couchbase/roles/readonly", role); + vaultOperations.write("database/roles/couchbase-readonly", body); } @Test public void shouldUseAuthenticatedSession() { - assertThat(this.cqlSession.getMetadata().getKeyspace("system")).isNotEmpty(); - } - - @Test - public void shouldConnectUsingCouchbaseClient() { - - try (CqlSession session = CqlSession.builder().withLocalDatacenter("dc1") - .addContactPoint(new InetSocketAddress(COUCHBASE_HOST, COUCHBASE_PORT)) - .withAuthCredentials(this.username, this.password).build()) { - assertThat(session.getMetadata().getKeyspace("system")).isNotEmpty(); - } + assertThat(this.cluster.buckets().getAllBuckets()).isNotEmpty(); } @SpringBootApplication diff --git a/src/test/bash/install_vault.sh b/src/test/bash/install_vault.sh index df831430..cba75067 100755 --- a/src/test/bash/install_vault.sh +++ b/src/test/bash/install_vault.sh @@ -8,7 +8,7 @@ set -o errexit EDITION="${EDITION:-oss}" -VAULT_OSS="${VAULT_OSS:-1.3.4}" +VAULT_OSS="${VAULT_OSS:-1.5.0}" VAULT_ENT="${VAULT_ENT:-0.11.0}" UNAME=$(uname -s | tr '[:upper:]' '[:lower:]') VERBOSE=false diff --git a/src/test/bash/vault.conf b/src/test/bash/vault.conf index bbb4510e..8f61a021 100644 --- a/src/test/bash/vault.conf +++ b/src/test/bash/vault.conf @@ -7,4 +7,6 @@ listener "tcp" { tls_key_file = "work/ca/private/localhost.decrypted.key.pem" } +plugin_directory = "plugins" +api_addr = "https://127.0.0.1:8200" disable_mlock = true