-
Notifications
You must be signed in to change notification settings - Fork 4.2k
/
sealhelper.go
76 lines (67 loc) · 2.08 KB
/
sealhelper.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
package sealhelper
import (
"path"
"github.com/hashicorp/go-hclog"
"github.com/hashicorp/vault/api"
"github.com/hashicorp/vault/builtin/logical/transit"
"github.com/hashicorp/vault/helper/testhelpers/teststorage"
"github.com/hashicorp/vault/http"
"github.com/hashicorp/vault/internalshared/configutil"
"github.com/hashicorp/vault/sdk/helper/logging"
"github.com/hashicorp/vault/sdk/logical"
"github.com/hashicorp/vault/vault"
"github.com/hashicorp/vault/vault/seal"
"github.com/mitchellh/go-testing-interface"
)
type TransitSealServer struct {
*vault.TestCluster
}
func NewTransitSealServer(t testing.T) *TransitSealServer {
conf := &vault.CoreConfig{
LogicalBackends: map[string]logical.Factory{
"transit": transit.Factory,
},
}
opts := &vault.TestClusterOptions{
NumCores: 1,
HandlerFunc: http.Handler,
Logger: logging.NewVaultLogger(hclog.Trace).Named(t.Name()).Named("transit"),
}
teststorage.InmemBackendSetup(conf, opts)
cluster := vault.NewTestCluster(t, conf, opts)
cluster.Start()
if err := cluster.Cores[0].Client.Sys().Mount("transit", &api.MountInput{
Type: "transit",
}); err != nil {
t.Fatal(err)
}
return &TransitSealServer{cluster}
}
func (tss *TransitSealServer) MakeKey(t testing.T, key string) {
client := tss.Cores[0].Client
if _, err := client.Logical().Write(path.Join("transit", "keys", key), nil); err != nil {
t.Fatal(err)
}
if _, err := client.Logical().Write(path.Join("transit", "keys", key, "config"), map[string]interface{}{
"deletion_allowed": true,
}); err != nil {
t.Fatal(err)
}
}
func (tss *TransitSealServer) MakeSeal(t testing.T, key string) vault.Seal {
client := tss.Cores[0].Client
wrapperConfig := map[string]string{
"address": client.Address(),
"token": client.Token(),
"mount_path": "transit",
"key_name": key,
"tls_ca_cert": tss.CACertPEMFile,
}
transitSeal, _, err := configutil.GetTransitKMSFunc(nil, &configutil.KMS{Config: wrapperConfig})
if err != nil {
t.Fatalf("error setting wrapper config: %v", err)
}
return vault.NewAutoSeal(&seal.Access{
Wrapper: transitSeal,
})
}