Add Vault 1.15.x to integration tests

[briantist]

I tried to add Vault 1.15.x in #1074 but there's some behavior difference in the kubernetes auth method that I won't have time to investigate before 2.0.0.

We'll likely have to investigate and fix that at the same time as adding 1.15.x to CI.

[tot19]

I'd be happy to lend a hand here. I am new to GitHub actions, so would be a fun way to learn!

[briantist]

@tot19 Sure any help is appreciated! Ultimately you won't learn much about GHA with this though, the only GHA workflow change is to uncomment this line:

hvac/.github/workflows/lint-and-test.yml

Line 191 in 9161044

# - "vault=1.15.*"

The issue is that when we do that, some of the kubernetes tests fail, so the work on this issue is to:

• figure out what behavior changed in that version of Vault
• determine if any actual code changes to the library need to be made
  • this one could get complicated depending on the changes, but I can help once I know details
• ensure the tests are updated to accommodate the differences in Vault or our code or both

You could demonstrate the failing result without GHA at all, by ensuring that the version of Vault in your PATH is 1.15.x, and then running the integration tests locally:

poetry run pytest tests/integration_tests/

You can also speed that up by running only the k8s tests:

poetry run pytest tests/integration_tests/api/auth_methods/test_kubernetes.py

[tot19]

Will give this a crack next!

[tot19]

Ok, so looks like these set of parameters are not resulting in the expected internal server error on the 'test_configure' method. Working out why now

param(
"set invalid token_reviewer_jwt",
kubernetes_ca_cert="-----BEGIN CERTIFICATE-----\n.....\n-----END CERTIFICATE-----",
token_reviewer_jwt="reviewer_jwt",
issuer="bob",
raises=exceptions.InternalServerError,
exception_message="* not a compact JWS"
if utils.vault_version_lt("1.11.0")
else "compact JWS format must have three parts",
),

[tot19]

This is the method that was raising an error but is no longer raising in 1.15.0

[tot19]

Ok, so the issue is that the request is succeeding now (confirmed with a 204 response) instead of failing like it was previously. Going to see if I can work out why it is working now since the token_reviewer_jwt does appear to be faulty

https://github.com/tot19/hvac/actions/runs/6677317761/job/18147220209#step:8:109

[tot19]

This looks to be the culprit:

hashicorp/vault-plugin-auth-kubernetes#207

If there is no longer a requirement for valid jwt tokens, I think it would be valid to make this test only work versions le 1.14.0