Remove HCP Link from OpenBao

HCP Link is a service to link local Vault Enterprise instances to
HashiCorp's HCP cloud offering. This isn't useful for consumers of
OpenBao and we do not wish to have to maintain it. Thus, removal is
most prudent.

Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>

Makefile

@@ -230,7 +230,6 @@ proto: bootstrap
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative sdk/plugin/pb/*.proto
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative vault/tokens/token.proto
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative sdk/helper/pluginutil/*.proto
-	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative vault/hcp_link/proto/*/*.proto
 
 	# No additional sed expressions should be added to this list. Going forward
 	# we should just use the variable names choosen by protobuf. These are left

api/sys_seal.go

@@ -96,23 +96,21 @@ func sealStatusRequestWithContext(ctx context.Context, c *Sys, r *Request) (*Sea
 }
 
 type SealStatusResponse struct {
-	Type              string   `json:"type"`
-	Initialized       bool     `json:"initialized"`
-	Sealed            bool     `json:"sealed"`
-	T                 int      `json:"t"`
-	N                 int      `json:"n"`
-	Progress          int      `json:"progress"`
-	Nonce             string   `json:"nonce"`
-	Version           string   `json:"version"`
-	BuildDate         string   `json:"build_date"`
-	Migration         bool     `json:"migration"`
-	ClusterName       string   `json:"cluster_name,omitempty"`
-	ClusterID         string   `json:"cluster_id,omitempty"`
-	RecoverySeal      bool     `json:"recovery_seal"`
-	StorageType       string   `json:"storage_type,omitempty"`
-	HCPLinkStatus     string   `json:"hcp_link_status,omitempty"`
-	HCPLinkResourceID string   `json:"hcp_link_resource_ID,omitempty"`
-	Warnings          []string `json:"warnings,omitempty"`
+	Type         string   `json:"type"`
+	Initialized  bool     `json:"initialized"`
+	Sealed       bool     `json:"sealed"`
+	T            int      `json:"t"`
+	N            int      `json:"n"`
+	Progress     int      `json:"progress"`
+	Nonce        string   `json:"nonce"`
+	Version      string   `json:"version"`
+	BuildDate    string   `json:"build_date"`
+	Migration    bool     `json:"migration"`
+	ClusterName  string   `json:"cluster_name,omitempty"`
+	ClusterID    string   `json:"cluster_id,omitempty"`
+	RecoverySeal bool     `json:"recovery_seal"`
+	StorageType  string   `json:"storage_type,omitempty"`
+	Warnings     []string `json:"warnings,omitempty"`
 }
 
 type UnsealOpts struct {

command/format.go

@@ -356,12 +356,6 @@ func (t TableFormatter) OutputSealStatusStruct(ui cli.Ui, secret *api.Secret, da
 		out = append(out, fmt.Sprintf("Cluster ID | %s", status.ClusterID))
 	}
 
-	// Output if HCP link is configured
-	if status.HCPLinkStatus != "" {
-		out = append(out, fmt.Sprintf("HCP Link Status | %s", status.HCPLinkStatus))
-		out = append(out, fmt.Sprintf("HCP Link Resource ID | %s", status.HCPLinkResourceID))
-	}
-
 	// Output if HA is enabled
 	out = append(out, fmt.Sprintf("HA Enabled | %t", status.HAEnabled))
 

command/operator_diagnose.go

@@ -34,7 +34,6 @@ import (
 	srconsul "github.com/openbao/openbao/serviceregistration/consul"
 	"github.com/openbao/openbao/vault"
 	"github.com/openbao/openbao/vault/diagnose"
-	"github.com/openbao/openbao/vault/hcp_link"
 	"github.com/openbao/openbao/version"
 	"github.com/posener/complete"
 )
@@ -680,48 +679,6 @@ SEALFAIL:
 		return nil
 	})
 
-	// Checking HCP link to make sure Vault could connect to SCADA.
-	// If it could not connect to SCADA in 5 seconds, diagnose reports an issue
-	if !constants.IsEnterprise {
-		diagnose.Skipped(ctx, "HCP link check will not run on OSS Vault.")
-	} else {
-		if config.HCPLinkConf != nil {
-			// we need to override API and Passthrough capabilities
-			// as they could not be initialized when Vault http handler
-			// is not fully initialized
-			config.HCPLinkConf.EnablePassThroughCapability = false
-			config.HCPLinkConf.EnableAPICapability = false
-
-			diagnose.Test(ctx, "Check HCP Connection", func(ctx context.Context) error {
-				hcpLink, err := hcp_link.NewHCPLink(config.HCPLinkConf, vaultCore, server.logger)
-				if err != nil || hcpLink == nil {
-					return fmt.Errorf("failed to start HCP link, %w", err)
-				}
-
-				// check if a SCADA session is established successfully
-				deadline := time.Now().Add(5 * time.Second)
-				linkSessionStatus := "disconnected"
-				for time.Now().Before(deadline) {
-					linkSessionStatus = hcpLink.GetConnectionStatusMessage(hcpLink.GetScadaSessionStatus())
-					if linkSessionStatus == "connected" {
-						break
-					}
-					time.Sleep(500 * time.Millisecond)
-				}
-				if linkSessionStatus != "connected" {
-					return fmt.Errorf("failed to connect to HCP in 5 seconds. HCP session status is: %s", linkSessionStatus)
-				}
-
-				err = hcpLink.Shutdown()
-				if err != nil {
-					return fmt.Errorf("failed to shutdown HCP link: %w", err)
-				}
-
-				return nil
-			})
-		}
-	}
-
 	return nil
 }
 

command/server.go

@@ -58,7 +58,6 @@ import (
 	"github.com/openbao/openbao/sdk/physical"
 	sr "github.com/openbao/openbao/serviceregistration"
 	"github.com/openbao/openbao/vault"
-	"github.com/openbao/openbao/vault/hcp_link"
 	vaultseal "github.com/openbao/openbao/vault/seal"
 	"github.com/openbao/openbao/version"
 	"github.com/pkg/errors"
@@ -1421,17 +1420,6 @@ func (c *ServerCommand) Run(args []string) int {
 		info["fips"] = fipsStatus
 	}
 
-	if config.HCPLinkConf != nil {
-		infoKeys = append(infoKeys, "HCP organization")
-		info["HCP organization"] = config.HCPLinkConf.Resource.Organization
-
-		infoKeys = append(infoKeys, "HCP project")
-		info["HCP project"] = config.HCPLinkConf.Resource.Project
-
-		infoKeys = append(infoKeys, "HCP resource ID")
-		info["HCP resource ID"] = config.HCPLinkConf.Resource.ID
-	}
-
 	infoKeys = append(infoKeys, "administrative namespace")
 	info["administrative namespace"] = config.AdministrativeNamespacePath
 
@@ -1505,14 +1493,6 @@ func (c *ServerCommand) Run(args []string) int {
 		return 1
 	}
 
-	hcpLogger := c.logger.Named("hcp-connectivity")
-	hcpLink, err := hcp_link.NewHCPLink(config.HCPLinkConf, core, hcpLogger)
-	if err != nil {
-		c.logger.Error("failed to establish HCP connection", "error", err)
-	} else if hcpLink != nil {
-		c.logger.Trace("established HCP connection")
-	}
-
 	if c.flagTestServerConfig {
 		return 0
 	}
@@ -1651,12 +1631,6 @@ func (c *ServerCommand) Run(args []string) int {
 			// Setting log request with the new value in the config after reload
 			core.ReloadLogRequestsLevel()
 
-			// reloading HCP link
-			hcpLink, err = c.reloadHCPLink(hcpLink, config, core, hcpLogger)
-			if err != nil {
-				c.logger.Error(err.Error())
-			}
-
 			// Reload log level for loggers
 			if config.LogLevel != "" {
 				level, err := loghelper.ParseLogLevel(config.LogLevel)
@@ -1778,12 +1752,6 @@ func (c *ServerCommand) Run(args []string) int {
 	// Stop the listeners so that we don't process further client requests.
 	c.cleanupGuard.Do(listenerCloseFunc)
 
-	if hcpLink != nil {
-		if err := hcpLink.Shutdown(); err != nil {
-			c.UI.Error(fmt.Sprintf("Error with HCP Link shutdown: %v", err.Error()))
-		}
-	}
-
 	// Finalize will wait until after Vault is sealed, which means the
 	// request forwarding listeners will also be closed (and also
 	// waited for).
@@ -1829,31 +1797,6 @@ func (c *ServerCommand) configureLogging(config *server.Config) (hclog.Intercept
 	return loghelper.Setup(logCfg, c.logWriter)
 }
 
-func (c *ServerCommand) reloadHCPLink(hcpLinkVault *hcp_link.HCPLinkVault, conf *server.Config, core *vault.Core, hcpLogger hclog.Logger) (*hcp_link.HCPLinkVault, error) {
-	// trigger a shutdown
-	if hcpLinkVault != nil {
-		err := hcpLinkVault.Shutdown()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	if conf.HCPLinkConf == nil {
-		// if cloud stanza is not configured, we should not show anything
-		// in the seal-status related to HCP link
-		core.SetHCPLinkStatus("", "")
-		return nil, nil
-	}
-
-	// starting HCP link
-	hcpLink, err := hcp_link.NewHCPLink(conf.HCPLinkConf, core, hcpLogger)
-	if err != nil {
-		return nil, fmt.Errorf("failed to restart HCP Link and it is no longer running, %w", err)
-	}
-
-	return hcpLink, nil
-}
-
 func (c *ServerCommand) notifySystemd(status string) {
 	sent, err := systemd.SdNotify(false, status)
 	if err != nil {

command/server_test.go

@@ -279,13 +279,6 @@ func TestServer(t *testing.T) {
 			0,
 			[]string{"-test-verify-only"},
 		},
-		{
-			"cloud_config",
-			testBaseHCL(t, "") + inmemHCL + cloudHCL,
-			"HCP Organization: bc58b3d0-2eab-4ab8-abf4-f61d3c9975ff",
-			0,
-			[]string{"-test-verify-only"},
-		},
 		{
 			"recovery_mode",
 			testBaseHCL(t, "") + inmemHCL,

go.mod

@@ -22,8 +22,6 @@ replace github.com/openbao/openbao/api/auth/userpass => ./api/auth/userpass
 
 replace github.com/openbao/openbao/sdk => ./sdk
 
-replace github.com/openbao/openbao/vault/hcp_link/proto => ./vault/hcp_link/proto
-
 require (
 	cloud.google.com/go/monitoring v1.15.1
 	github.com/ProtonMail/go-crypto v0.0.0-20230626094100-7e9e0395ebec
@@ -88,9 +86,6 @@ require (
 	github.com/hashicorp/golang-lru v0.5.4
 	github.com/hashicorp/hcl v1.0.1-vault-5
 	github.com/hashicorp/hcl/v2 v2.16.2
-	github.com/hashicorp/hcp-link v0.2.1
-	github.com/hashicorp/hcp-scada-provider v0.2.3
-	github.com/hashicorp/hcp-sdk-go v0.77.0
 	github.com/hashicorp/raft v1.3.10
 	github.com/hashicorp/raft-autopilot v0.2.0
 	github.com/hashicorp/raft-boltdb/v2 v2.0.0-20210421194847-a7e34179d62c
@@ -130,7 +125,6 @@ require (
 	github.com/openbao/openbao/api/auth/approle v0.1.0
 	github.com/openbao/openbao/api/auth/userpass v0.1.0
 	github.com/openbao/openbao/sdk v0.9.2
-	github.com/openbao/openbao/vault/hcp_link/proto v0.0.0-00010101000000-000000000000
 	github.com/ory/dockertest/v3 v3.10.0
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pires/go-proxyproto v0.6.1
@@ -239,17 +233,9 @@ require (
 	github.com/go-logr/logr v1.2.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/analysis v0.21.4 // indirect
-	github.com/go-openapi/errors v0.20.4 // indirect
 	github.com/go-openapi/jsonpointer v0.20.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.26.0 // indirect
-	github.com/go-openapi/spec v0.20.9 // indirect
-	github.com/go-openapi/strfmt v0.21.7 // indirect
 	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/go-openapi/validate v0.22.2 // indirect
-	github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect
 	github.com/gofrs/uuid v4.3.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
@@ -267,11 +253,9 @@ require (
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/cronexpr v1.1.1 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-msgpack/v2 v2.0.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/awsutil v0.2.3 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/mdns v1.0.4 // indirect
-	github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0 // indirect
 	github.com/hashicorp/nomad/api v0.0.0-20230519153805-2275a83cbfdf // indirect
 	github.com/hashicorp/serf v0.10.1 // indirect
 	github.com/hashicorp/vault/api v1.9.2 // indirect
@@ -305,7 +289,6 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/miekg/dns v1.1.43 // indirect
-	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/hashstructure v1.1.0 // indirect
 	github.com/moby/patternmatcher v0.5.0 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
@@ -316,11 +299,9 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
 	github.com/nwaples/rardecode v1.1.2 // indirect
-	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
 	github.com/opencontainers/runc v1.1.6 // indirect
-	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
 	github.com/packethost/packngo v0.1.1-0.20180711074735-b9cb5096f54c // indirect
 	github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
@@ -334,7 +315,6 @@ require (
 	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
 	github.com/sirupsen/logrus v1.9.0 // indirect
-	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d // indirect
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect