Add configuration for the vault Connect CA provider

acceptance/framework/helpers/helpers.go

@@ -4,14 +4,15 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"github.com/gruntwork-io/terratest/modules/helm"
 	"os"
 	"os/signal"
 	"strings"
 	"syscall"
 	"testing"
 	"time"
 
+	"github.com/gruntwork-io/terratest/modules/helm"
+
 	terratestk8s "github.com/gruntwork-io/terratest/modules/k8s"
 	"github.com/gruntwork-io/terratest/modules/random"
 	"github.com/hashicorp/consul-k8s/acceptance/framework/logger"
@@ -85,6 +86,7 @@ func WaitForAllPodsToBeReady(t *testing.T, client kubernetes.Interface, namespac
 	retry.RunWith(counter, t, func(r *retry.R) {
 		pods, err := client.CoreV1().Pods(namespace).List(context.Background(), metav1.ListOptions{LabelSelector: podLabelSelector})
 		require.NoError(r, err)
+		require.NotEmpty(r, pods.Items)
 
 		var notReadyPods []string
 		for _, pod := range pods.Items {

acceptance/tests/fixtures/bases/intention/intention.yaml

@@ -0,0 +1,10 @@
+apiVersion: consul.hashicorp.com/v1alpha1
+kind: ServiceIntentions
+metadata:
+  name: client-to-server
+spec:
+  destination:
+    name: static-server
+  sources:
+    - name: static-client
+      action: allow

acceptance/tests/fixtures/bases/intention/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - intention.yaml

acceptance/tests/vault/vault_test.go

@@ -4,34 +4,50 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"fmt"
+	"testing"
+
 	"github.com/hashicorp/consul-k8s/acceptance/framework/consul"
 	"github.com/hashicorp/consul-k8s/acceptance/framework/helpers"
+	"github.com/hashicorp/consul-k8s/acceptance/framework/k8s"
 	"github.com/hashicorp/consul-k8s/acceptance/framework/logger"
 	"github.com/hashicorp/consul-k8s/acceptance/framework/vault"
 	"github.com/stretchr/testify/require"
-	"testing"
 )
 
-// generateGossipSecret generates a random 32 byte secret returned as a base64 encoded string.
-func generateGossipSecret() (string, error) {
-	// This code was copied from Consul's Keygen command:
-	// https://github.com/hashicorp/consul/blob/d652cc86e3d0322102c2b5e9026c6a60f36c17a5/command/keygen/keygen.go
+const (
+	gossipPolicy = `
+path "consul/data/secret/gossip" {
+  capabilities = ["read"]
+}`
 
-	key := make([]byte, 32)
-	n, err := rand.Reader.Read(key)
-	if err != nil {
-		return "", fmt.Errorf("error reading random data: %s", err)
-	}
-	if n != 32 {
-		return "", fmt.Errorf("couldn't read enough entropy")
-	}
+	// connectCAPolicy allows Consul to bootstrap all certificates for the service mesh in Vault.
+	// Adapted from https://www.consul.io/docs/connect/ca/vault#consul-managed-pki-paths.
+	connectCAPolicy = `
+path "/sys/mounts" {
+  capabilities = [ "read" ]
+}
 
-	return base64.StdEncoding.EncodeToString(key), nil
+path "/sys/mounts/connect_root" {
+  capabilities = [ "create", "read", "update", "delete", "list" ]
+}
+
+path "/sys/mounts/connect_inter" {
+  capabilities = [ "create", "read", "update", "delete", "list" ]
 }
 
-// Installs Vault, bootstraps it with secrets, policies, and Kube Auth Method
-// then creates a gossip encryption secret and uses this to bootstrap Consul.
-func TestVault_BootstrapConsulGossipEncryptionKey(t *testing.T) {
+path "/connect_root/*" {
+  capabilities = [ "create", "read", "update", "delete", "list" ]
+}
+
+path "/connect_inter/*" {
+  capabilities = [ "create", "read", "update", "delete", "list" ]
+}
+`
+)
+
+// TestVault installs Vault, bootstraps it with secrets, policies, and Kube Auth Method.
+// It then configures Consul to use vault as the backend and checks that it works.
+func TestVault(t *testing.T) {
 	cfg := suite.Config()
 	ctx := suite.Environment().DefaultContext(t)
 
@@ -48,16 +64,20 @@ func TestVault_BootstrapConsulGossipEncryptionKey(t *testing.T) {
 	vaultClient := vaultCluster.VaultClient(t)
 
 	// Create the Vault Policy for the gossip key.
-	logger.Log(t, "Creating the gossip policy")
-	rules := `
-path "consul/data/secret/gossip" {
-  capabilities = ["read"]
-}`
-	err := vaultClient.Sys().PutPolicy("consul-gossip", rules)
+	logger.Log(t, "Creating policies")
+	err := vaultClient.Sys().PutPolicy("consul-gossip", gossipPolicy)
+	require.NoError(t, err)
+
+	err = vaultClient.Sys().PutPolicy("connect-ca", connectCAPolicy)
 	require.NoError(t, err)
 
-	// Create the Auth Roles for consul-server + consul-client.
-	logger.Log(t, "Creating the consul-server and consul-client-roles")
+	// Create the Auth Roles for consul-server and consul-client.
+	// Auth roles bind policies to Kubernetes service accounts, which
+	// then enables the Vault agent init container to call 'vault login'
+	// with the Kubernetes auth method to obtain a Vault token.
+	// Please see https://www.vaultproject.io/docs/auth/kubernetes#configuration
+	// for more details.
+	logger.Log(t, "Creating the consul-server and consul-client roles")
 	params := map[string]interface{}{
 		"bound_service_account_names":      consulClientServiceAccountName,
 		"bound_service_account_namespaces": "default",
@@ -70,7 +90,7 @@ path "consul/data/secret/gossip" {
 	params = map[string]interface{}{
 		"bound_service_account_names":      consulServerServiceAccountName,
 		"bound_service_account_namespaces": "default",
-		"policies":                         "consul-gossip",
+		"policies":                         "consul-gossip,connect-ca",
 		"ttl":                              "24h",
 	}
 	_, err = vaultClient.Logical().Write("auth/kubernetes/role/consul-server", params)
@@ -88,17 +108,23 @@ path "consul/data/secret/gossip" {
 	}
 	_, err = vaultClient.Logical().Write("consul/data/secret/gossip", params)
 	require.NoError(t, err)
-
 	consulHelmValues := map[string]string{
+		"global.image": "docker.mirror.hashicorp.services/hashicorpdev/consul:latest",
+
 		"server.enabled":  "true",
 		"server.replicas": "1",
 
 		"connectInject.enabled": "true",
+		"controller.enabled":    "true",
 
 		"global.secretsBackend.vault.enabled":          "true",
 		"global.secretsBackend.vault.consulServerRole": "consul-server",
 		"global.secretsBackend.vault.consulClientRole": "consul-client",
 
+		"global.secretsBackend.vault.connectCA.address":             fmt.Sprintf("http://%s-vault:8200", vaultReleaseName),
+		"global.secretsBackend.vault.connectCA.rootPKIPath":         "connect_root",
+		"global.secretsBackend.vault.connectCA.intermediatePKIPath": "connect_inter",
+
 		"global.acls.manageSystemACLs":       "true",
 		"global.tls.enabled":                 "true",
 		"global.gossipEncryption.secretName": "consul/data/secret/gossip",
@@ -113,6 +139,49 @@ path "consul/data/secret/gossip" {
 	consulClient := consulCluster.SetupConsulClient(t, true)
 	keys, err := consulClient.Operator().KeyringList(nil)
 	require.NoError(t, err)
-	// We use keys[0] because KeyringList returns a list of keyrings for each dc, in this case there is only 1 dc.
+	// There are two identical keys for LAN and WAN since there is only 1 dc.
+	require.Len(t, keys, 2)
 	require.Equal(t, 1, keys[0].PrimaryKeys[gossipKey])
+
+	// Confirm that the Vault Connect CA has been bootstrapped correctly.
+	caConfig, _, err := consulClient.Connect().CAGetConfig(nil)
+	require.NoError(t, err)
+	require.Equal(t, caConfig.Provider, "vault")
+
+	// Deploy two services and check that they can talk to each other.
+	logger.Log(t, "creating static-server and static-client deployments")
+	k8s.DeployKustomize(t, ctx.KubectlOptions(t), cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-server-inject")
+	if cfg.EnableTransparentProxy {
+		k8s.DeployKustomize(t, ctx.KubectlOptions(t), cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-tproxy")
+	} else {
+		k8s.DeployKustomize(t, ctx.KubectlOptions(t), cfg.NoCleanupOnFailure, cfg.DebugDirectory, "../fixtures/cases/static-client-inject")
+	}
+	helpers.Cleanup(t, cfg.NoCleanupOnFailure, func() {
+		k8s.KubectlDeleteK(t, ctx.KubectlOptions(t), "../fixtures/bases/intention")
+	})
+	k8s.KubectlApplyK(t, ctx.KubectlOptions(t), "../fixtures/bases/intention")
+
+	logger.Log(t, "checking that connection is successful")
+	if cfg.EnableTransparentProxy {
+		k8s.CheckStaticServerConnectionSuccessful(t, ctx.KubectlOptions(t), "http://static-server")
+	} else {
+		k8s.CheckStaticServerConnectionSuccessful(t, ctx.KubectlOptions(t), "http://localhost:1234")
+	}
+}
+
+// generateGossipSecret generates a random 32 byte secret returned as a base64 encoded string.
+func generateGossipSecret() (string, error) {
+	// This code was copied from Consul's Keygen command:
+	// https://github.com/hashicorp/consul/blob/d652cc86e3d0322102c2b5e9026c6a60f36c17a5/command/keygen/keygen.go
+
+	key := make([]byte, 32)
+	n, err := rand.Reader.Read(key)
+	if err != nil {
+		return "", fmt.Errorf("error reading random data: %s", err)
+	}
+	if n != 32 {
+		return "", fmt.Errorf("couldn't read enough entropy")
+	}
+
+	return base64.StdEncoding.EncodeToString(key), nil
 }

charts/consul/templates/server-config-configmap.yaml

@@ -11,6 +11,36 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
 data:
+  {{- $vaultConnectCAEnabled := and .Values.global.secretsBackend.vault.connectCA.address .Values.global.secretsBackend.vault.connectCA.rootPKIPath .Values.global.secretsBackend.vault.connectCA.intermediatePKIPath -}}
+  {{- if and .Values.global.secretsBackend.vault.enabled $vaultConnectCAEnabled }}
+  {{- with .Values.global.secretsBackend.vault }}
+  connect-ca-config.json: |
+    {
+      "connect": [
+        {
+          "ca_config": [
+            {
+              "address": "{{ .connectCA.address }}",
+              "intermediate_pki_path": "{{ .connectCA.intermediatePKIPath }}",
+              "root_pki_path": "{{ .connectCA.rootPKIPath }}",
+              "auth_method": {
+                "type": "kubernetes",
+                "params": {
+                  "role": "{{.consulServerRole}}"
+                }
+              }
+            }
+          ],
+          "ca_provider": "vault"
+        }
+      ]
+    }
+  {{- if .connectCA.additionalConfig }}
+  additional-connect-ca-config.json: |
+{{ tpl .connectCA.additionalConfig $ | trimAll "\"" | indent 4 }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
   extra-from-values.json: |-
 {{ tpl .Values.server.extraConfig . | trimAll "\"" | indent 4 }}
   {{- if .Values.global.acls.manageSystemACLs }}