Merge branch 'main' into automate-version-bump
Muhammad Atif Ali
1 year ago
committed by
GitHub
commit
d88c65becf
@ -1,43 +0,0 @@
|
||||
import { describe, expect, it } from "bun:test";
|
||||
import {
|
||||
executeScriptInContainer,
|
||||
runTerraformApply,
|
||||
runTerraformInit,
|
||||
testRequiredVariables,
|
||||
} from "../test";
|
||||
|
||||
describe("git-config", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
testRequiredVariables(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
|
||||
it("fails without git", async () => {
|
||||
const state = await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
const output = await executeScriptInContainer(state, "alpine");
|
||||
expect(output.exitCode).toBe(1);
|
||||
expect(output.stdout).toEqual([
|
||||
"\u001B[0;1mChecking git-config!",
|
||||
"Git is not installed!",
|
||||
]);
|
||||
});
|
||||
|
||||
it("runs with git", async () => {
|
||||
const state = await runTerraformApply(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
});
|
||||
const output = await executeScriptInContainer(state, "alpine/git");
|
||||
expect(output.exitCode).toBe(0);
|
||||
expect(output.stdout).toEqual([
|
||||
"\u001B[0;1mChecking git-config!",
|
||||
"git-config: No user.email found, setting to ",
|
||||
"git-config: No user.name found, setting to default",
|
||||
"",
|
||||
"\u001B[0;1mgit-config: using email: ",
|
||||
"\u001B[0;1mgit-config: using username: default",
|
||||
]);
|
||||
});
|
||||
});
|
||||
@ -1,24 +0,0 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
BOLD='\033[0;1m'
|
||||
printf "$${BOLD}Checking git-config!\n"
|
||||
|
||||
# Check if git is installed
|
||||
command -v git > /dev/null 2>&1 || {
|
||||
echo "Git is not installed!"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Set git username and email if missing
|
||||
if [ -z $(git config --get user.email) ]; then
|
||||
printf "git-config: No user.email found, setting to ${GIT_EMAIL}\n"
|
||||
git config --global user.email "${GIT_EMAIL}"
|
||||
fi
|
||||
|
||||
if [ -z $(git config --get user.name) ]; then
|
||||
printf "git-config: No user.name found, setting to ${GIT_USERNAME}\n"
|
||||
git config --global user.name "${GIT_USERNAME}"
|
||||
fi
|
||||
|
||||
printf "\n$${BOLD}git-config: using email: $(git config --get user.email)\n"
|
||||
printf "$${BOLD}git-config: using username: $(git config --get user.name)\n\n"
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
display_name: "HCP Vault Secrets"
|
||||
description: "Fetch secrets from HCP Vault"
|
||||
icon: ../.icons/vault.svg
|
||||
maintainer_github: coder
|
||||
partner_github: hashicorp
|
||||
verified: true
|
||||
tags: [helper, integration, vault, hashicorp, hvs]
|
||||
---
|
||||
|
||||
# HCP Vault Secrets
|
||||
|
||||
This module lets you fetch all or selective secrets from a [HCP Vault Secrets](https://developer.hashicorp.com/hcp/docs/vault-secrets) app into your [Coder](https://coder.com) workspaces. It makes use of the [`hcp_vault_secrets_app`](https://registry.terraform.io/providers/hashicorp/hcp/latest/docs/data-sources/vault_secrets_app) data source from the [HCP provider](https://registry.terraform.io/providers/hashicorp/hcp/latest).
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.3"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
}
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
To configure the HCP Vault Secrets module, you must create an HCP Service Principal from the HCP Vault Secrets app in the HCP console. This will give you the `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` that you need to authenticate with HCP Vault Secrets. See the [HCP Vault Secrets documentation](https://developer.hashicorp.com/hcp/docs/vault-secrets) for more information.
|
||||
|
||||
## Fetch All Secrets
|
||||
|
||||
To fetch all secrets from the HCP Vault Secrets app, skip the `secrets` input.
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.3"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
}
|
||||
```
|
||||
|
||||
## Fetch Selective Secrets
|
||||
|
||||
To fetch selective secrets from the HCP Vault Secrets app, set the `secrets` input.
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.3"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
secrets = ["MY_SECRET_1", "MY_SECRET_2"]
|
||||
}
|
||||
```
|
||||
|
||||
## Set Client ID and Client Secret as Inputs
|
||||
|
||||
Set `client_id` and `client_secret` as module inputs.
|
||||
|
||||
```tf
|
||||
module "vault" {
|
||||
source = "registry.coder.com/modules/hcp-vault-secrets/coder"
|
||||
version = "1.0.3"
|
||||
agent_id = coder_agent.example.id
|
||||
app_name = "demo-app"
|
||||
client_id = "HCP_CLIENT_ID"
|
||||
client_secret = "HCP_CLIENT_SECRET"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,67 @@
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
coder = {
|
||||
source = "coder/coder"
|
||||
version = ">= 0.12.4"
|
||||
}
|
||||
hcp = {
|
||||
source = "hashicorp/hcp"
|
||||
version = ">= 0.82.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "hcp" {
|
||||
client_id = var.client_id
|
||||
client_secret = var.client_secret
|
||||
}
|
||||
|
||||
provider "coder" {}
|
||||
|
||||
variable "agent_id" {
|
||||
type = string
|
||||
description = "The ID of a Coder agent."
|
||||
}
|
||||
|
||||
variable "client_id" {
|
||||
type = string
|
||||
description = <<-EOF
|
||||
The client ID for the HCP Vault Secrets service principal. (Optional if HCP_CLIENT_ID is set as an environment variable.)
|
||||
EOF
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "client_secret" {
|
||||
type = string
|
||||
description = <<-EOF
|
||||
The client secret for the HCP Vault Secrets service principal. (Optional if HCP_CLIENT_SECRET is set as an environment variable.)
|
||||
EOF
|
||||
default = null
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "app_name" {
|
||||
type = string
|
||||
description = "The name of the secrets app in HCP Vault Secrets"
|
||||
}
|
||||
|
||||
variable "secrets" {
|
||||
type = list(string)
|
||||
description = "The names of the secrets to retrieve from HCP Vault Secrets"
|
||||
default = null
|
||||
}
|
||||
|
||||
data "hcp_vault_secrets_app" "secrets" {
|
||||
app_name = var.app_name
|
||||
}
|
||||
|
||||
resource "coder_env" "hvs_secrets" {
|
||||
# https://support.hashicorp.com/hc/en-us/articles/4538432032787-Variable-has-a-sensitive-value-and-cannot-be-used-as-for-each-arguments
|
||||
for_each = var.secrets != null ? toset(var.secrets) : nonsensitive(toset(keys(data.hcp_vault_secrets_app.secrets.secrets)))
|
||||
agent_id = var.agent_id
|
||||
name = each.key
|
||||
value = data.hcp_vault_secrets_app.secrets.secrets[each.key]
|
||||
}
|
||||
@ -0,0 +1,11 @@
|
||||
import { describe } from "bun:test";
|
||||
import { runTerraformInit, testRequiredVariables } from "../test";
|
||||
|
||||
describe("vault-token", async () => {
|
||||
await runTerraformInit(import.meta.dir);
|
||||
|
||||
testRequiredVariables(import.meta.dir, {
|
||||
agent_id: "foo",
|
||||
vault_addr: "foo",
|
||||
});
|
||||
});
|
||||
Loading…
Reference in New Issue