Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update GCP auth to add support for regional instance groups #16435

Merged
merged 3 commits into from Jul 22, 2022
Merged

Update GCP auth to add support for regional instance groups #16435

merged 3 commits into from Jul 22, 2022

Conversation

robmonte
Copy link
Member

@robmonte robmonte commented Jul 22, 2022 •
edited

Manual test steps documented below for the new feature. A GCE instance group was created in the us-east1 region with 1 running instance for the test. Then the same steps were performed on a us-central1 instance to demonstrate failure.

Setup steps:

vault policy write gce-reader gce-reader.hcl
vault kv put secret/gcp-info/key name="secret" value="abc"

vault auth enable gcp

vault write auth/gcp/config \
credentials=@credentials.json

vault write auth/gcp/role/reader \
type="gce" \
policies="gce-reader" \
bound_regions="us-east1" \
bound_instance_groups="my-region-group" \

New session steps:

vault login \
-method=gcp \
role=reader

vault kv get secret/gcp-info/key

Success output:

robmonte@my-region-group-pdfb:~$ vault login -method=gcp role=reader
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

robmonte@my-region-group-pdfb:~$ vault kv get secret/gcp-info/key
====== Secret Path ======
secret/data/gcp-info/key
⋮
==== Data ====
Key      Value
---      -----
name     secret
value    abc

Failure output:

robmonte@instance-1:~$ vault login -method=gcp role=admin
Error authenticating: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/auth/gcp/login
Code: 400. Errors:

* instance not in bound regions ["us-east1"]

@robmonte robmonte added this to the 1.12.0-rc1 milestone Jul 22, 2022
@robmonte robmonte requested a review from a team July 22, 2022 21:07
austingebauer
austingebauer reviewed Jul 22, 2022
View reviewed changes
go.mod Show resolved Hide resolved
austingebauer
austingebauer approved these changes Jul 22, 2022
View reviewed changes
Copy link
Member

@austingebauer austingebauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@robmonte robmonte merged commit 69e9eb4 into main Jul 22, 2022
@robmonte robmonte deleted the update-gcp-auth-regional-instances branch July 22, 2022 22:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@austingebauer austingebauer austingebauer approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
1.12.0-rc1
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@robmonte @austingebauer