Skip to content

Commit e59c94a

Browse files
jasonodonnelljasonodonnell
committed
Add TLS and mTLS support
1 parent cd01494 commit e59c94a

19 files changed

Lines changed: 6710 additions & 4157 deletions

‎.github/FUNDING.yml‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎.github/workflows/build.yml‎

Lines changed: 180 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -3,144 +3,256 @@ on:
33
branches:
44
- master
55
pull_request:
6+
branches:
7+
- master
68

79
jobs:
810
build:
911
runs-on: ubuntu-latest
1012
steps:
1113
- uses: actions/checkout@v1
14+
1215
- uses: actions/setup-node@v1
1316
with:
1417
node-version: ''
15-
- name: setup npm cache
18+
19+
- name: Setup NPM Cache
1620
uses: actions/cache@v1
1721
with:
1822
path: ~/.npm
1923
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
2024
restore-keys: |
2125
${{ runner.os }}-node-
22-
- name: npm install
26+
27+
- name: NPM Install
2328
run: npm ci
24-
- name: npm build
29+
30+
- name: NPM Build
2531
run: npm run build
26-
- name: npm run test
32+
33+
- name: NPM Run Test
2734
run: npm run test
2835

29-
integration:
36+
integrationOSS:
3037
runs-on: ubuntu-latest
3138

32-
services:
33-
vaultBasic:
34-
image: vault:1.2.3
35-
ports:
36-
- 8200/tcp
37-
env:
38-
VAULT_DEV_ROOT_TOKEN_ID: testtoken
39-
options: --cap-add=IPC_LOCK
40-
vaultEnterprise:
41-
image: hashicorp/vault-enterprise:1.3.0_ent
42-
ports:
43-
- 8200/tcp
44-
env:
45-
VAULT_DEV_ROOT_TOKEN_ID: testtoken
46-
options: --cap-add=IPC_LOCK
39+
steps:
40+
- uses: actions/checkout@v1
41+
42+
- name: Run docker-compose
43+
run: docker-compose up -d vault
44+
45+
- uses: actions/setup-node@v1
46+
with:
47+
node-version: ''
48+
49+
- name: Setup NPM Cache
50+
uses: actions/cache@v1
51+
with:
52+
path: ~/.npm
53+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
54+
restore-keys: |
55+
${{ runner.os }}-node-
56+
57+
- name: NPM Install
58+
run: npm ci
59+
60+
- name: NPM Build
61+
run: npm run build
62+
63+
- name: NPM Run test;integration:basic
64+
run: npm run test:integration:basic
65+
env:
66+
VAULT_HOST: localhost
67+
VAULT_PORT: 8200
68+
CI: true
69+
70+
integrationEnterprise:
71+
runs-on: ubuntu-latest
4772

4873
steps:
49-
- uses: actions/checkout@v1
50-
- uses: actions/setup-node@v1
51-
with:
52-
node-version: ''
53-
- name: setup npm cache
54-
uses: actions/cache@v1
55-
with:
56-
path: ~/.npm
57-
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
58-
restore-keys: |
59-
${{ runner.os }}-node-
60-
- name: npm install
61-
run: npm ci
62-
- name: npm build
63-
run: npm run build
64-
- name: npm run test:integration:basic
65-
run: npm run test:integration:basic
66-
env:
67-
VAULT_HOST: localhost
68-
VAULT_PORT: ${{ job.services.vaultBasic.ports[8200] }}
69-
CI: true
70-
- name: npm run test:integration:enterprise
71-
run: npm run test:integration:enterprise
72-
env:
73-
VAULT_HOST: localhost
74-
VAULT_PORT: ${{ job.services.vaultEnterprise.ports[8200] }}
75-
CI: true
74+
- uses: actions/checkout@v1
75+
76+
- name: Run docker-compose
77+
run: docker-compose up -d vault-enterprise
78+
79+
- uses: actions/setup-node@v1
80+
with:
81+
node-version: ''
82+
83+
- name: Setup NPM Cache
84+
uses: actions/cache@v1
85+
with:
86+
path: ~/.npm
87+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
88+
restore-keys: |
89+
${{ runner.os }}-node-
90+
91+
- name: NPM Install
92+
run: npm ci
93+
94+
- name: NPM Build
95+
run: npm run build
96+
97+
- name: NPM Run test:intergration:enterprise
98+
run: npm run test:integration:enterprise
99+
env:
100+
VAULT_HOST: localhost
101+
VAULT_PORT: 8200
102+
CI: true
76103

77104
e2e:
78105
runs-on: ubuntu-latest
79106

80-
services:
81-
vault:
82-
image: vault:1.3.0
83-
ports:
84-
- 8200/tcp
85-
env:
86-
VAULT_DEV_ROOT_TOKEN_ID: testtoken
87-
options: --cap-add=IPC_LOCK
88-
89107
steps:
90108
- uses: actions/checkout@v1
109+
110+
- name: Run docker-compose
111+
run: docker-compose up -d vault
112+
91113
- uses: actions/setup-node@v1
92114
with:
93115
node-version: ''
94-
- name: setup npm cache
116+
117+
- name: Setup NPM Cache
95118
uses: actions/cache@v1
96119
with:
97120
path: ~/.npm
98121
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
99122
restore-keys: |
100123
${{ runner.os }}-node-
101-
- name: npm install
124+
125+
- name: NPM Install
102126
run: npm ci
103-
- name: npm build
127+
128+
- name: NPM Build
104129
run: npm run build
105-
- name: setup vault
130+
131+
- name: Setup Vault
106132
run: node ./integrationTests/e2e/setup.js
107133
env:
108134
VAULT_HOST: localhost
109-
VAULT_PORT: ${{ job.services.vault.ports[8200] }}
110-
- name: use vault action (default K/V version 2)
135+
VAULT_PORT: 8200
136+
137+
- name: Test Vault Action (default KV V2)
111138
uses: ./
112139
id: kv-secrets
113140
with:
114-
url: http://localhost:${{ job.services.vault.ports[8200] }}
141+
url: http://localhost:8200
115142
token: testtoken
116143
secrets: |
117144
test secret ;
118145
test secret | NAMED_SECRET ;
119146
nested/test otherSecret ;
120-
- name: use vault action (custom K/V version 1)
147+
148+
- name: Test Vault Action (default KV V1)
121149
uses: ./
122150
with:
123-
url: http://localhost:${{ job.services.vault.ports[8200] }}
151+
url: http://localhost:8200
124152
token: testtoken
125153
path: my-secret
126154
kv-version: 1
127155
secrets: |
128156
test altSecret ;
129157
test altSecret | NAMED_ALTSECRET ;
130158
nested/test otherAltSecret ;
131-
- name: use vault action (using cubbyhole engine)
159+
160+
- name: Test Vault Action (cubbyhole)
132161
uses: ./
133162
with:
134-
url: http://localhost:${{ job.services.vault.ports[8200] }}
163+
url: http://localhost:8200
135164
token: testtoken
136165
secrets: |
137166
/cubbyhole/test foo ;
138167
/cubbyhole/test zip | NAMED_CUBBYSECRET ;
139-
- name: verify
168+
169+
- name: Verify Vault Action Outputs
140170
run: npm run test:e2e
141171
env:
142172
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
143173

174+
e2e-tls:
175+
runs-on: ubuntu-latest
176+
177+
steps:
178+
- uses: actions/checkout@v1
179+
180+
- name: Run docker-compose
181+
run: docker-compose up -d vault-tls
182+
183+
- uses: actions/setup-node@v1
184+
with:
185+
node-version: ''
186+
187+
- name: Setup NPM Cache
188+
uses: actions/cache@v1
189+
with:
190+
path: ~/.npm
191+
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
192+
restore-keys: |
193+
${{ runner.os }}-node-
194+
195+
- name: NPM Install
196+
run: npm ci
197+
198+
- name: NPM Build
199+
run: npm run build
200+
201+
- name: Setup Vault
202+
run: node ./integrationTests/e2e-tls/setup.js
203+
env:
204+
VAULT_HOST: localhost
205+
VAULT_PORT: 8200
206+
VAULTCA: ${{ secrets.VAULTCA }}
207+
VAULT_CLIENT_CERT: ${{ secrets.VAULT_CLIENT_CERT }}
208+
VAULT_CLIENT_KEY: ${{ secrets.VAULT_CLIENT_KEY }}
209+
210+
- name: Test Vault Action (default KV V2)
211+
uses: ./
212+
id: kv-secrets
213+
with:
214+
url: https://localhost:8200
215+
token: ${{ env.VAULT_TOKEN }}
216+
caCertificate: ${{ secrets.VAULTCA }}
217+
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
218+
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
219+
secrets: |
220+
test secret ;
221+
test secret | NAMED_SECRET ;
222+
nested/test otherSecret ;
223+
224+
- name: Test Vault Action (default KV V1)
225+
uses: ./
226+
with:
227+
url: https://localhost:8200
228+
token: ${{ env.VAULT_TOKEN }}
229+
path: my-secret
230+
kv-version: 1
231+
caCertificate: ${{ secrets.VAULTCA }}
232+
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
233+
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
234+
secrets: |
235+
test altSecret ;
236+
test altSecret | NAMED_ALTSECRET ;
237+
nested/test otherAltSecret ;
238+
239+
- name: Test Vault Action (cubbyhole)
240+
uses: ./
241+
with:
242+
url: https://localhost:8200
243+
token: ${{ env.VAULT_TOKEN }}
244+
secrets: |
245+
/cubbyhole/test foo ;
246+
/cubbyhole/test zip | NAMED_CUBBYSECRET ;
247+
caCertificate: ${{ secrets.VAULTCA }}
248+
clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
249+
clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
250+
251+
- name: Verify Vault Action Outputs
252+
run: npm run test:e2e-tls
253+
env:
254+
OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
255+
144256
# Removing publish step for now.
145257
# publish:
146258
# if: github.event_name == 'push' && contains(github.ref, 'master')

‎action.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,19 @@ inputs:
4343
description: 'Whether or not export secrets as environment variables.'
4444
default: 'true'
4545
required: false
46+
caCertificate:
47+
description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
48+
required: false
49+
clientCertificate:
50+
description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
51+
required: false
52+
clientKey:
53+
description: 'Base64 encoded client key for mTLS communication with the Vault server.'
54+
required: false
55+
tlsSkipVerify:
56+
description: 'When set to true, disables verification of the Vault server certificate. Setting this to true in production is not recommended.'
57+
required: false
58+
default: "false"
4659
runs:
4760
using: 'node12'
4861
main: 'dist/index.js'

0 commit comments

Comments
 (0)