Add TLS and mTLS support

Author: jasonodonnell

.github/workflows/build.yml

@@ -3,6 +3,8 @@ on:
     branches:
       - master
   pull_request:
+    branches:
+      - master
 
 jobs:
   build:
@@ -26,68 +28,15 @@ jobs:
     - name: npm run test
       run: npm run test
 
-  integration:
+  e2e-tls:
     runs-on: ubuntu-latest
 
-    services:
-      vaultBasic:
-        image: vault:1.2.3
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-      vaultEnterprise:
-        image: hashicorp/vault-enterprise:1.3.0_ent
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
-
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-node@v1
-        with:
-          node-version: ''
-      - name: setup npm cache
-        uses: actions/cache@v1
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - name: npm install
-        run: npm ci
-      - name: npm build
-        run: npm run build
-      - name: npm run test:integration:basic
-        run: npm run test:integration:basic
-        env:
-          VAULT_HOST: localhost
-          VAULT_PORT: ${{ job.services.vaultBasic.ports[8200] }}
-          CI: true
-      - name: npm run test:integration:enterprise
-        run: npm run test:integration:enterprise
-        env:
-          VAULT_HOST: localhost
-          VAULT_PORT: ${{ job.services.vaultEnterprise.ports[8200] }}
-          CI: true
-
-  e2e:
-    runs-on: ubuntu-latest
+    - uses: actions/checkout@v1
 
-    services:
-      vault:
-        image: vault:1.3.0
-        ports:
-          - 8200/tcp
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: testtoken
-        options: --cap-add=IPC_LOCK
+    - name: Run docker-compose
+      run: docker-compose up -d vault-tls
 
-    steps:
-    - uses: actions/checkout@v1
     - uses: actions/setup-node@v1
       with:
         node-version: ''
@@ -103,41 +52,54 @@ jobs:
     - name: npm build
       run: npm run build
     - name: setup vault
-      run: node ./integrationTests/e2e/setup.js
+      run: node ./integrationTests/e2e-tls/setup.js
       env:
         VAULT_HOST: localhost
-        VAULT_PORT: ${{ job.services.vault.ports[8200] }}
+        VAULT_PORT: 8200
+        VAULTCA: ${{ secrets.VAULTCA }}
+        VAULT_CLIENT_CERT: ${{ secrets.VAULT_CLIENT_CERT }}
+        VAULT_CLIENT_KEY: ${{ secrets.VAULT_CLIENT_KEY }}
     - name: use vault action (default K/V version 2)
       uses: ./
       id: kv-secrets
       with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
-        token: testtoken
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
         secrets: |
           test secret ;
           test secret | NAMED_SECRET ;
           nested/test otherSecret ;
+
     - name: use vault action (custom K/V version 1)
       uses: ./
       with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
-        token: testtoken
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
         path: my-secret
         kv-version: 1
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
         secrets: |
           test altSecret ;
           test altSecret | NAMED_ALTSECRET ;
           nested/test otherAltSecret ;
     - name: use vault action (using cubbyhole engine)
       uses: ./
       with:
-        url: http://localhost:${{ job.services.vault.ports[8200] }}
-        token: testtoken
+        url: https://localhost:8200
+        token: ${{ env.VAULT_TOKEN }}
         secrets: |
           /cubbyhole/test foo ;
           /cubbyhole/test zip | NAMED_CUBBYSECRET ;
+        caCertificate: ${{ secrets.VAULTCA }}
+        clientCertificate: ${{ secrets.VAULT_CLIENT_CERT }}
+        clientKey: ${{ secrets.VAULT_CLIENT_KEY }}
     - name: verify
-      run: npm run test:e2e
+      run: npm run test:e2e-tls
       env:
         OTHER_SECRET_OUTPUT: ${{ steps.kv-secrets.outputs.otherSecret }}
 

action.yml

@@ -43,6 +43,19 @@ inputs:
     description: 'Whether or not export secrets as environment variables.'
     default: 'true'
     required: false
+  caCertificate:
+    description: 'Base64 encoded CA certificate to verify the Vault server certificate.'
+    required: false
+  clientCertificate:
+    description: 'Base64 encoded client certificate for mTLS communication with the Vault server.'
+    required: false
+  clientKey:
+    description: 'Base64 encoded client key for mTLS communication with the Vault server.'
+    required: false
+  tlsSkipVerify:
+    description: 'When set to true, disables verification of the Vault server certificate.  Setting this to true in production is not recommended.'
+    required: false
+    default: "false"
 runs:
   using: 'node12'
   main: 'dist/index.js'