Merge pull request #57 from devopshobbies/final-test

BVSTACK End-to-End test

Author: Shayan-Ghani

.github/workflows/ci.yml

@@ -35,5 +35,5 @@ jobs:
       - name: Create Release
         uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
         with:
-          body: ${{ steps.github_release.outputs.changelog }}
+          body: ${{ steps.bump.outputs.changelog }}
           tag_name: ${{ steps.bump.outputs.new_tag }}

.gitignore

@@ -51,4 +51,6 @@ to-research
 *VBox*.log
 **/bin/boundary**
 **test-play**
-virtualenv
+virtualenv
+
+**boundary*creds*.txt

README.md

@@ -37,7 +37,7 @@ This project provides a comprehensive, hands-on experience in Infrastructure as
     # Run in development:
     ./start.sh -e development
     ```
-
+> you'll be prompted to choose which NIC you want to bridge to by Vagrant.
 
 4. **Enter Vault Password**: You will be prompted to enter the Vault password four times to decrypt Ansible Vault-encrypted files (e.g., `inventory.ini`) unless the related [issue](https://github.com/devopshobbies/boundary-vault-stack/issues/24) is resolved.
 

ansible/handlers/container_healthcheck.yml

@@ -10,8 +10,21 @@
     - "{{ INFO.results }}"
   loop_control:
     label: "{{ item.container.Name | default('Unknown Container', true ) }}"
-  when: item.container.State.Running and item.container.State.Restarting != true
+  when: 
+    - item is defined
+    - item.container.State.Running | bool 
+    - item.container.State.Restarting != true
 
+- name: handle errors if occurred  
+  include_tasks: "{{handlers}}/fail_task.yml"
+  vars:
+    message: "Container {{ item.container.Name }} is NOT healthy"
+  with_items :
+    - "{{ INFO.results }}"
+  loop_control:
+    label: "ID : {{ item.container.Id | default('Unknown Container ID', true ) }} , NAME: {{ item.container.Name | default('Unknown Container ID', true ) }}"
+  when : 
+    - item is not defined or item.container.State.Running != true
 
 - name: handle errors if container not healthy 
   include_tasks: "{{handlers}}/service_healthcheck.yml"
@@ -20,7 +33,10 @@
     PATH: "{{ service_path }}"
   with_items :
     - "{{ INFO.results }}"
-  when: item.exists != true and item.container.Name != '/vault'
+  when: 
+   - item is defined
+   - item.exists != true
+   - item.container.Name != '/vault'
 
 - name: fetch the logfile for the unhealthy container(s)
   # become: true
@@ -35,12 +51,3 @@
     label: "{{ item.container.LogPath | default('Unknown Container', true )  }}" 
   when: item.container.State.Running != true
 
-- name: handle errors if occurred  
-  include_tasks: "{{handlers}}/fail_task.yml"
-  vars:
-    message: "Container {{ item.container.Name }} is NOT healthy"
-  with_items :
-    - "{{ INFO.results }}"
-  loop_control:
-    label: "ID : {{ item.container.Id | default('Unknown Container ID', true ) }} , NAME: {{ item.container.Name | default('Unknown Container ID', true ) }}"
-  when : item.container.State.Running != true

ansible/handlers/fail_task.yml

@@ -1,4 +1,4 @@
 - name: Fail if a task failed
   fail:
     msg: "{{ output.stderr | default(output.stdout, true) | default(message, true) }}"
-  when: output.rc|default(1) != 0
+  when: output.rc != 0

ansible/host_vars/localhost

@@ -6,6 +6,7 @@ vault_addr: "127.0.0.1:8200"
 boundary_addr: "127.0.0.1:9200"
 handlers: "{{ playbook_dir }}/handlers"
 log_dir: "{{ playbook_dir | dirname }}/logs"
+secret_dir : "{{stack_dir}}/secrets"
 
 # environment variables
 STACK_ENV: "{{ lookup('env', 'STACK_ENV') }}"

ansible/roles/boundary/defaults/main.yml

@@ -1,3 +1,4 @@
 ---
 STACK_INIT: true
 STACK_ENV: development
+SSH_INJECTION: false

artifacts/wiki/index.html

@@ -29,7 +29,7 @@
             <ul>
                 <li><a href="#getting-started">Getting Started</a></li>
                 <li><a href="#about-hashicorp-vault-and-boundary">About Hashicorp Vault and Boundary</a></li>
-                <li><a href="#workflows">Workflows</a>
+                <li><a href="#workflow">Workflow</a>
                     <ul>
                         <li><a href="#vault">Vault</a></li>
                         <li><a href="#boundary">Boundary</a></li>
@@ -84,12 +84,37 @@ <h2 id="about-hashicorp-vault-and-boundary" class="section-header">About Hashico
             </div>
 
             <div class="workflows section">
-                <h2 id="workflows" class="section-header">Workflows</h2>
+                <h2 id="workflow" class="section-header">Workflow</h2>
+                <p>After the environment is prepared, Ansible deploys Vault using Docker Compose. The Vault server is
+                    first initialized by the <span class="bold">vault-init</span> service, which runs the `init.sh`
+                    script and calls the `init_vault_setup` function. This process unseals Vault, creates the necessary
+                    secret engines, policies, tokens, and other basic configurations. Once the deployment is complete, the
+                    <span class="bold">Transit-token</span> and <span class="bold">secrets.txt</span> file, containing
+                    all the essential tokens and keys, are generated and stored in the `secrets/secrets.txt` file on the
+                    controller machine.
+
+                    Next, the Terraform role is applied to configure Vault, utilizing the generated tokens and
+                    variables. Following this, the deployment shifts focus to Boundary. To enable Boundary to use
+                    Vault's Transit Engine for Encryption as a Service (EaaS), the Transit token (already stored in
+                    `secrets.txt`) is passed to the Boundary role. Once the Boundary database (PostgreSQL) is up and
+                    running, it is initialized using the <span class="bold">db-init</span> service. Finally, Boundary is
+                    deployed with the initial credentials saved in <span
+                        class="bold">secrets/boundary-init-creds.txt</span>. Terraform resources are then applied using
+                    the <span class="bold">Vault Transit recovery key</span> and <span class="bold">Transit
+                        token</span>.
+
+                    To use the stack, you need to install the Boundary and Vault clients (ensure the server and client
+                    versions match). Once installed, you can start using BVSTACK.
+
+                    You can checkout the boundary UI at <span class="bold"><a href="http://192.168.1.15:9200">http://192.168.1.15:9200</a> </span> and Vault at  <span class="bold"><a href="http://192.168.1.15:8200">http://192.168.1.15:8200</a> .</span>
+
+                </p>
+
                 <h3 id="vault" class="section-header">Vault</h3>
                 <p>Vault workflow involves setting up authentication methods, secret engines, and policies. The key
                     components of Vault server setup include:</p>
                 <img src="./vault.png" alt="vault diagram">
-          
+
                 <h3 id="boundary" class="section-header">Boundary</h3>
                 <p>Boundary workflow involves managing sessions, targets, and credentials. The key
                     components of Boundary server setup include:
@@ -137,7 +162,9 @@ <h4>SSH_INJECTION (optional)</h4>
                 <p class="default">default : false</p>
 
                 <h4>STACK_SERVER (optional)</h4>
-                <p>If set to false, vagrant and virtualbox won't be used to spin up BVSTACK. Instead you must create both Controller, BVSTACK and Client machines <span class="bold">manually</span> using your prefered method; ensure to address them in the inventory file accordingly.</p>
+                <p>If set to false, vagrant and virtualbox won't be used to spin up BVSTACK. Instead you must create
+                    both Controller, BVSTACK and Client machines <span class="bold">manually</span> using your prefered
+                    method; ensure to address them in the inventory file accordingly.</p>
                 <ul class="options">
                     <li>true</li>
                     <li>false</li>
@@ -276,6 +303,11 @@ <h3>Exit Code 4: Arguments and Options are Invalid.</h3>
                 <h2 id="bear-in-mind">Bear In Mind</h2>
                 <p>Keep the following in mind when working with the Boundary-Vault stack:</p>
                 <ul>
+                    <li>Since Boundary Terraform uses Vault recovery transit key you must export the transit-token as
+                        VAULT_TOKEN
+                        <span class="bold">(secrets/secrets.txt)</span> before planning/applying the code. Otherwise,
+                        you should use auth-method credentials to communicate with the boundary api.
+                    </li>
                     <li>If you have issues with DockerHub make sure you change the image registry in deployments and
                         `prepare_env` role.</li>
                     <li>If the target node(s) get restarted, the <span class="bold">vault</span> gets sealed and <span

boundary/config/boundary.hcl

@@ -20,7 +20,7 @@ worker {
     type   = ["prod", "servers"]
   }
 
-  public_addr = "127.0.0.1"
+  public_addr = "192.168.1.15"
 }
 
 listener "tcp" {

boundary/terraform/main.tf

@@ -9,6 +9,7 @@ data "boundary_user" "global_scope_admin" {
 #----------
 
 resource "boundary_scope" "global" {
+  name = "Global"
   global_scope = true
   description  = "highest-level Scope for administrators"
   scope_id     = "global"