From f550b8aeb0ba75c871582502cf5ee1924029e6cd Mon Sep 17 00:00:00 2001 From: Moritz Sanft <58110325+msanft@users.noreply.github.com> Date: Wed, 1 Feb 2023 11:32:01 +0100 Subject: [PATCH] cli: refactor iam create command (#1034) * AB#2788 refactor iam create * AB#2788 go mod tidy * AB#2788 encode b64 at runtime * AB#2788 rename receiver --- cli/internal/cmd/cloud.go | 2 +- cli/internal/cmd/iam.go | 487 +++++++++++++++ cli/internal/cmd/iam_test.go | 753 ++++++++++++++++++++++++ cli/internal/cmd/iamcreateaws.go | 165 ------ cli/internal/cmd/iamcreateaws_test.go | 227 ------- cli/internal/cmd/iamcreateazure.go | 171 ------ cli/internal/cmd/iamcreateazure_test.go | 236 -------- cli/internal/cmd/iamcreategcp.go | 215 ------- cli/internal/cmd/iamcreategcp_test.go | 298 ---------- 9 files changed, 1241 insertions(+), 1313 deletions(-) create mode 100644 cli/internal/cmd/iam_test.go delete mode 100644 cli/internal/cmd/iamcreateaws.go delete mode 100644 cli/internal/cmd/iamcreateaws_test.go delete mode 100644 cli/internal/cmd/iamcreateazure.go delete mode 100644 cli/internal/cmd/iamcreateazure_test.go delete mode 100644 cli/internal/cmd/iamcreategcp.go delete mode 100644 cli/internal/cmd/iamcreategcp_test.go diff --git a/cli/internal/cmd/cloud.go b/cli/internal/cmd/cloud.go index 39ea907fd..04f7a216e 100644 --- a/cli/internal/cmd/cloud.go +++ b/cli/internal/cmd/cloud.go @@ -26,7 +26,7 @@ type cloudCreator interface { ) (clusterid.File, error) } -type iamCreator interface { +type cloudIAMCreator interface { Create( ctx context.Context, provider cloudprovider.Provider, diff --git a/cli/internal/cmd/iam.go b/cli/internal/cmd/iam.go index c051546fd..a277973ce 100644 --- a/cli/internal/cmd/iam.go +++ b/cli/internal/cmd/iam.go @@ -6,9 +6,32 @@ SPDX-License-Identifier: AGPL-3.0-only package cmd import ( + "context" + "encoding/base64" + "encoding/json" + "fmt" + "regexp" + "strings" + + "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd" + "github.com/edgelesssys/constellation/v2/cli/internal/iamid" + "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" + "github.com/edgelesssys/constellation/v2/internal/config" + "github.com/edgelesssys/constellation/v2/internal/constants" + "github.com/edgelesssys/constellation/v2/internal/file" + "github.com/spf13/afero" "github.com/spf13/cobra" ) +var ( + // GCP-specific validation regexes + // Source: https://cloud.google.com/resource-manager/reference/rest/v1/projects. + zoneRegex = regexp.MustCompile(`^\w+-\w+-[abc]$`) + regionRegex = regexp.MustCompile(`^\w+-\w+[0-9]$`) + projectIDRegex = regexp.MustCompile(`^[a-z][-a-z0-9]{4,28}[a-z0-9]{1}$`) + serviceAccIDRegex = regexp.MustCompile(`^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$`) +) + // NewIAMCmd returns a new cobra.Command for the iam parent command. It needs another verb and does nothing on its own. func NewIAMCmd() *cobra.Command { cmd := &cobra.Command{ @@ -33,6 +56,7 @@ func newIAMCreateCmd() *cobra.Command { } cmd.PersistentFlags().Bool("generate-config", false, "automatically generate a configuration file and fill in the required fields") + cmd.PersistentFlags().Bool("yes", false, "create the IAM configuration without further confirmation") cmd.AddCommand(newIAMCreateAWSCmd()) cmd.AddCommand(newIAMCreateAzureCmd()) @@ -40,3 +64,466 @@ func newIAMCreateCmd() *cobra.Command { return cmd } + +// newIAMCreateAWSCmd returns a new cobra.Command for the iam create aws command. +func newIAMCreateAWSCmd() *cobra.Command { + cmd := &cobra.Command{ + Use: "aws", + Short: "Create IAM configuration on AWS for your Constellation cluster", + Long: "Create IAM configuration on AWS for your Constellation cluster.", + Args: cobra.ExactArgs(0), + RunE: createRunIAMFunc(cloudprovider.AWS), + } + + cmd.Flags().String("prefix", "", "name prefix for all resources (required)") + must(cobra.MarkFlagRequired(cmd.Flags(), "prefix")) + cmd.Flags().String("zone", "", "AWS availability zone the resources will be created in, e.g. us-east-2a (required)\n"+ + "Find available zones here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones. "+ + "Note that we do not support every zone / region. You can find a list of all supported regions in our docs.") + must(cobra.MarkFlagRequired(cmd.Flags(), "zone")) + + return cmd +} + +// newIAMCreateAzureCmd returns a new cobra.Command for the iam create azure command. +func newIAMCreateAzureCmd() *cobra.Command { + cmd := &cobra.Command{ + Use: "azure", + Short: "Create IAM configuration on Microsoft Azure for your Constellation cluster", + Long: "Create IAM configuration on Microsoft Azure for your Constellation cluster.", + Args: cobra.ExactArgs(0), + RunE: createRunIAMFunc(cloudprovider.Azure), + } + + cmd.Flags().String("resourceGroup", "", "name prefix of the two resource groups your cluster / IAM resources will be created in (required)") + must(cobra.MarkFlagRequired(cmd.Flags(), "resourceGroup")) + cmd.Flags().String("region", "", "region the resources will be created in, e.g. westus (required)") + must(cobra.MarkFlagRequired(cmd.Flags(), "region")) + cmd.Flags().String("servicePrincipal", "", "name of the service principal that will be created (required)") + must(cobra.MarkFlagRequired(cmd.Flags(), "servicePrincipal")) + + return cmd +} + +// NewIAMCreateGCPCmd returns a new cobra.Command for the iam create gcp command. +func newIAMCreateGCPCmd() *cobra.Command { + cmd := &cobra.Command{ + Use: "gcp", + Short: "Create IAM configuration on GCP for your Constellation cluster", + Long: "Create IAM configuration on GCP for your Constellation cluster.", + Args: cobra.ExactArgs(0), + RunE: createRunIAMFunc(cloudprovider.GCP), + } + + cmd.Flags().String("zone", "", "GCP zone the cluster will be deployed in (required)\n"+ + "Find a list of available zones here: https://cloud.google.com/compute/docs/regions-zones#available.") + must(cobra.MarkFlagRequired(cmd.Flags(), "zone")) + cmd.Flags().String("serviceAccountID", "", "ID for the service account that will be created (required)\n"+ + "Must match ^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$.") + must(cobra.MarkFlagRequired(cmd.Flags(), "serviceAccountID")) + cmd.Flags().String("projectID", "", "ID of the GCP project the configuration will be created in (required)\n"+ + "Find it on the welcome screen of your project: https://console.cloud.google.com/welcome.") + must(cobra.MarkFlagRequired(cmd.Flags(), "projectID")) + + return cmd +} + +// createRunIAMFunc is the entrypoint for the iam create command. It sets up the iamCreator +// and starts IAM creation for the specific cloud provider. +func createRunIAMFunc(provider cloudprovider.Provider) func(cmd *cobra.Command, args []string) error { + var providerCreator providerIAMCreator + switch provider { + case cloudprovider.AWS: + providerCreator = &awsIAMCreator{} + case cloudprovider.Azure: + providerCreator = &azureIAMCreator{} + case cloudprovider.GCP: + providerCreator = &gcpIAMCreator{} + default: + return func(cmd *cobra.Command, args []string) error { + return fmt.Errorf("unknown provider %s", provider) + } + } + return func(cmd *cobra.Command, args []string) error { + iamCreator := newIAMCreator(cmd) + defer iamCreator.spinner.Stop() + iamCreator.provider = provider + iamCreator.providerCreator = providerCreator + return iamCreator.create(cmd.Context()) + } +} + +// newIAMCreator creates a new iamiamCreator. +func newIAMCreator(cmd *cobra.Command) *iamCreator { + spinner := newSpinner(cmd.ErrOrStderr()) + + return &iamCreator{ + cmd: cmd, + spinner: spinner, + creator: cloudcmd.NewIAMCreator(spinner), + fileHandler: file.NewHandler(afero.NewOsFs()), + iamConfig: &cloudcmd.IAMConfig{}, + } +} + +// iamCreator is the iamCreator for the iam create command. +type iamCreator struct { + cmd *cobra.Command + spinner spinnerInterf + creator cloudIAMCreator + fileHandler file.Handler + provider cloudprovider.Provider + providerCreator providerIAMCreator + iamConfig *cloudcmd.IAMConfig +} + +// create IAM configuration on the iamCreator's cloud provider. +func (c *iamCreator) create(ctx context.Context) error { + flags, err := c.parseFlagsAndSetupConfig() + if err != nil { + return err + } + + if !flags.yesFlag { + c.cmd.Printf("The following IAM configuration will be created:\n\n") + c.providerCreator.printConfirmValues(c.cmd, flags) + if flags.generateConfig { + c.cmd.Printf("The configuration file %s will be automatically generated and populated with the IAM values.\n", flags.configPath) + } + ok, err := askToConfirm(c.cmd, "Do you want to create the configuration?") + if err != nil { + return err + } + if !ok { + c.cmd.Println("The creation of the configuration was aborted.") + return nil + } + } + + c.spinner.Start("Creating", false) + + conf := createConfig(c.provider) + + iamFile, err := c.creator.Create(ctx, c.provider, c.iamConfig) + c.spinner.Stop() + if err != nil { + return err + } + c.cmd.Println() // Print empty line to separate after spinner ended. + + err = c.providerCreator.parseAndWriteIDFile(iamFile, c.fileHandler) + if err != nil { + return err + } + + if flags.generateConfig { + c.providerCreator.writeOutputValuesToConfig(conf, flags, iamFile) + if err := c.fileHandler.WriteYAML(flags.configPath, conf, file.OptMkdirAll); err != nil { + return err + } + c.cmd.Printf("Your IAM configuration was created and filled into %s successfully.\n", flags.configPath) + return nil + } + + c.providerCreator.printOutputValues(c.cmd, flags, iamFile) + c.cmd.Println("Your IAM configuration was created successfully. Please fill the above values into your configuration file.") + + return nil +} + +// parseFlagsAndSetupConfig parses the flags of the iam create command and fills the values into the IAM config (output values of the command). +func (c *iamCreator) parseFlagsAndSetupConfig() (iamFlags, error) { + configPath, err := c.cmd.Flags().GetString("config") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing config string: %w", err) + } + generateConfig, err := c.cmd.Flags().GetBool("generate-config") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing generate-config bool: %w", err) + } + yesFlag, err := c.cmd.Flags().GetBool("yes") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing yes bool: %w", err) + } + + flags := iamFlags{ + generateConfig: generateConfig, + configPath: configPath, + yesFlag: yesFlag, + } + + flags, err = c.providerCreator.parseFlagsAndSetupConfig(c.cmd, flags, c.iamConfig) + if err != nil { + return iamFlags{}, fmt.Errorf("parsing provider-specific value: %w", err) + } + + return flags, nil +} + +// iamFlags contains the parsed flags of the iam create command, including the parsed flags of the selected cloud provider. +type iamFlags struct { + aws awsFlags + azure azureFlags + gcp gcpFlags + generateConfig bool + configPath string + yesFlag bool +} + +// awsFlags contains the parsed flags of the iam create aws command. +type awsFlags struct { + prefix string + region string + zone string +} + +// azureFlags contains the parsed flags of the iam create azure command. +type azureFlags struct { + region string + resourceGroup string + servicePrincipal string +} + +// gcpFlags contains the parsed flags of the iam create gcp command. +type gcpFlags struct { + serviceAccountID string + zone string + region string + projectID string +} + +// providerIAMCreator is an interface for the IAM actions of different cloud providers. +type providerIAMCreator interface { + // printConfirmValues prints the values that will be created on the cloud provider and need to be confirmed by the user. + printConfirmValues(cmd *cobra.Command, flags iamFlags) + // printOutputValues prints the values that were created on the cloud provider. + printOutputValues(cmd *cobra.Command, flags iamFlags, iamFile iamid.File) + // writeOutputValuesToConfig writes the output values of the IAM creation to the constellation config file. + writeOutputValuesToConfig(conf *config.Config, flags iamFlags, iamFile iamid.File) + // parseFlagsAndSetupConfig parses the provider-specific flags and fills the values into the IAM config (output values of the command). + parseFlagsAndSetupConfig(cmd *cobra.Command, flags iamFlags, iamConfig *cloudcmd.IAMConfig) (iamFlags, error) + // parseAndWriteIDFile parses the GCP service account key and writes it to a keyfile. It is only implemented for GCP. + parseAndWriteIDFile(iamFile iamid.File, fileHandler file.Handler) error +} + +// awsIAMCreator implements the providerIAMCreator interface for AWS. +type awsIAMCreator struct{} + +func (c *awsIAMCreator) parseFlagsAndSetupConfig(cmd *cobra.Command, flags iamFlags, iamConfig *cloudcmd.IAMConfig) (iamFlags, error) { + prefix, err := cmd.Flags().GetString("prefix") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing prefix string: %w", err) + } + zone, err := cmd.Flags().GetString("zone") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing zone string: %w", err) + } + + flags.aws = awsFlags{ + prefix: prefix, + zone: zone, + } + + if strings.HasPrefix(zone, "eu-central-1") { + flags.aws.region = "eu-central-1" + } else if strings.HasPrefix(zone, "us-east-2") { + flags.aws.region = "us-east-2" + } else if strings.HasPrefix(zone, "ap-south-1") { + flags.aws.region = "ap-south-1" + } else { + return iamFlags{}, fmt.Errorf("invalid AWS region, to find a correct region please refer to our docs and https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones") + } + + // Setup IAM config. + iamConfig.AWS = cloudcmd.AWSIAMConfig{ + Region: flags.aws.region, + Prefix: flags.aws.prefix, + } + + return flags, nil +} + +func (c *awsIAMCreator) printConfirmValues(cmd *cobra.Command, flags iamFlags) { + cmd.Printf("Region:\t\t%s\n", flags.aws.region) + cmd.Printf("Name Prefix:\t%s\n\n", flags.aws.prefix) +} + +func (c *awsIAMCreator) printOutputValues(cmd *cobra.Command, flags iamFlags, iamFile iamid.File) { + cmd.Printf("region:\t\t\t%s\n", flags.aws.region) + cmd.Printf("zone:\t\t\t%s\n", flags.aws.zone) + cmd.Printf("iamProfileControlPlane:\t%s\n", iamFile.AWSOutput.ControlPlaneInstanceProfile) + cmd.Printf("iamProfileWorkerNodes:\t%s\n\n", iamFile.AWSOutput.WorkerNodeInstanceProfile) +} + +func (c *awsIAMCreator) writeOutputValuesToConfig(conf *config.Config, flags iamFlags, iamFile iamid.File) { + conf.Provider.AWS.Region = flags.aws.region + conf.Provider.AWS.Zone = flags.aws.zone + conf.Provider.AWS.IAMProfileControlPlane = iamFile.AWSOutput.ControlPlaneInstanceProfile + conf.Provider.AWS.IAMProfileWorkerNodes = iamFile.AWSOutput.WorkerNodeInstanceProfile +} + +func (c *awsIAMCreator) parseAndWriteIDFile(iamFile iamid.File, fileHandler file.Handler) error { + return nil +} + +// azureIAMCreator implements the providerIAMCreator interface for Azure. +type azureIAMCreator struct{} + +func (c *azureIAMCreator) parseFlagsAndSetupConfig(cmd *cobra.Command, flags iamFlags, iamConfig *cloudcmd.IAMConfig) (iamFlags, error) { + region, err := cmd.Flags().GetString("region") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing region string: %w", err) + } + + resourceGroup, err := cmd.Flags().GetString("resourceGroup") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing resourceGroup string: %w", err) + } + + servicePrincipal, err := cmd.Flags().GetString("servicePrincipal") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing servicePrincipal string: %w", err) + } + + flags.azure = azureFlags{ + region: region, + resourceGroup: resourceGroup, + servicePrincipal: servicePrincipal, + } + + // Setup IAM config. + iamConfig.Azure = cloudcmd.AzureIAMConfig{ + Region: flags.azure.region, + ResourceGroup: flags.azure.resourceGroup, + ServicePrincipal: flags.azure.servicePrincipal, + } + + return flags, nil +} + +func (c *azureIAMCreator) printConfirmValues(cmd *cobra.Command, flags iamFlags) { + cmd.Printf("Region:\t\t\t%s\n", flags.azure.region) + cmd.Printf("Resource Group:\t\t%s\n", flags.azure.resourceGroup) + cmd.Printf("Service Principal:\t%s\n\n", flags.azure.servicePrincipal) +} + +func (c *azureIAMCreator) printOutputValues(cmd *cobra.Command, flags iamFlags, iamFile iamid.File) { + cmd.Printf("subscription:\t\t%s\n", iamFile.AzureOutput.SubscriptionID) + cmd.Printf("tenant:\t\t\t%s\n", iamFile.AzureOutput.TenantID) + cmd.Printf("location:\t\t%s\n", flags.azure.region) + cmd.Printf("resourceGroup:\t\t%s\n", flags.azure.resourceGroup) + cmd.Printf("userAssignedIdentity:\t%s\n", iamFile.AzureOutput.UAMIID) + cmd.Printf("appClientID:\t\t%s\n", iamFile.AzureOutput.ApplicationID) + cmd.Printf("clientSecretValue:\t%s\n\n", iamFile.AzureOutput.ApplicationClientSecretValue) + cmd.Println("Your IAM configuration was created successfully. Please fill the above values into your configuration file.") +} + +func (c *azureIAMCreator) writeOutputValuesToConfig(conf *config.Config, flags iamFlags, iamFile iamid.File) { + conf.Provider.Azure.SubscriptionID = iamFile.AzureOutput.SubscriptionID + conf.Provider.Azure.TenantID = iamFile.AzureOutput.TenantID + conf.Provider.Azure.Location = flags.azure.region + conf.Provider.Azure.ResourceGroup = flags.azure.resourceGroup + conf.Provider.Azure.UserAssignedIdentity = iamFile.AzureOutput.UAMIID + conf.Provider.Azure.AppClientID = iamFile.AzureOutput.ApplicationID + conf.Provider.Azure.ClientSecretValue = iamFile.AzureOutput.ApplicationClientSecretValue +} + +func (c *azureIAMCreator) parseAndWriteIDFile(iamFile iamid.File, fileHandler file.Handler) error { + return nil +} + +// gcpIAMCreator implements the providerIAMCreator interface for GCP. +type gcpIAMCreator struct{} + +func (c *gcpIAMCreator) parseFlagsAndSetupConfig(cmd *cobra.Command, flags iamFlags, iamConfig *cloudcmd.IAMConfig) (iamFlags, error) { + zone, err := cmd.Flags().GetString("zone") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing zone string: %w", err) + } + if !zoneRegex.MatchString(zone) { + return iamFlags{}, fmt.Errorf("invalid zone string: %s", zone) + } + + // Infer region from zone. + zoneParts := strings.Split(zone, "-") + region := fmt.Sprintf("%s-%s", zoneParts[0], zoneParts[1]) + if !regionRegex.MatchString(region) { + return iamFlags{}, fmt.Errorf("invalid region string: %s", region) + } + + projectID, err := cmd.Flags().GetString("projectID") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing projectID string: %w", err) + } + if !projectIDRegex.MatchString(projectID) { + return iamFlags{}, fmt.Errorf("invalid projectID string: %s", projectID) + } + + serviceAccID, err := cmd.Flags().GetString("serviceAccountID") + if err != nil { + return iamFlags{}, fmt.Errorf("parsing serviceAccountID string: %w", err) + } + if !serviceAccIDRegex.MatchString(serviceAccID) { + return iamFlags{}, fmt.Errorf("invalid serviceAccountID string: %s", serviceAccID) + } + + flags.gcp = gcpFlags{ + zone: zone, + region: region, + projectID: projectID, + serviceAccountID: serviceAccID, + } + + // Setup IAM config. + iamConfig.GCP = cloudcmd.GCPIAMConfig{ + Zone: flags.gcp.zone, + Region: flags.gcp.region, + ProjectID: flags.gcp.projectID, + ServiceAccountID: flags.gcp.serviceAccountID, + } + + return flags, nil +} + +func (c *gcpIAMCreator) printConfirmValues(cmd *cobra.Command, flags iamFlags) { + cmd.Printf("Project ID:\t\t%s\n", flags.gcp.projectID) + cmd.Printf("Service Account ID:\t%s\n", flags.gcp.serviceAccountID) + cmd.Printf("Region:\t\t\t%s\n", flags.gcp.region) + cmd.Printf("Zone:\t\t\t%s\n\n", flags.gcp.zone) +} + +func (c *gcpIAMCreator) printOutputValues(cmd *cobra.Command, flags iamFlags, iamFile iamid.File) { + cmd.Println(fmt.Sprintf("serviceAccountKeyPath:\t%s\n", constants.GCPServiceAccountKeyFile)) +} + +func (c *gcpIAMCreator) writeOutputValuesToConfig(conf *config.Config, flags iamFlags, iamFile iamid.File) { + conf.Provider.GCP.ServiceAccountKeyPath = constants.GCPServiceAccountKeyFile +} + +func (c *gcpIAMCreator) parseAndWriteIDFile(iamFile iamid.File, fileHandler file.Handler) error { + // GCP needs to write the service account key to a file. + tmpOut, err := parseIDFile(iamFile.GCPOutput.ServiceAccountKey) + if err != nil { + return err + } + + if err := fileHandler.WriteJSON(constants.GCPServiceAccountKeyFile, tmpOut, file.OptNone); err != nil { + return err + } + + return nil +} + +// parseIDFile parses the given base64 encoded JSON string of the GCP service account key and returns a map. +func parseIDFile(serviceAccountKeyBase64 string) (map[string]string, error) { + dec, err := base64.StdEncoding.DecodeString(serviceAccountKeyBase64) + if err != nil { + return nil, err + } + + out := make(map[string]string) + if err = json.Unmarshal(dec, &out); err != nil { + return nil, err + } + return out, nil +} diff --git a/cli/internal/cmd/iam_test.go b/cli/internal/cmd/iam_test.go new file mode 100644 index 000000000..efd0f6b56 --- /dev/null +++ b/cli/internal/cmd/iam_test.go @@ -0,0 +1,753 @@ +/* +Copyright (c) Edgeless Systems GmbH +SPDX-License-Identifier: AGPL-3.0-only +*/ + +package cmd + +import ( + "bytes" + "encoding/base64" + "strings" + "testing" + + "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd" + "github.com/edgelesssys/constellation/v2/cli/internal/iamid" + "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" + "github.com/edgelesssys/constellation/v2/internal/config" + "github.com/edgelesssys/constellation/v2/internal/constants" + "github.com/edgelesssys/constellation/v2/internal/file" + "github.com/spf13/afero" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestParseIDFile(t *testing.T) { + validIAMIDFile := iamid.File{ + CloudProvider: cloudprovider.GCP, + GCPOutput: iamid.GCPFile{ + ServiceAccountKey: base64.RawStdEncoding.EncodeToString([]byte(`{"private_key_id":"not_a_secret"}`)), + }, + } + invalidIAMIDFile := iamid.File{ + CloudProvider: cloudprovider.GCP, + GCPOutput: iamid.GCPFile{ + ServiceAccountKey: "ey_Jwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // invalid b64 + }, + } + testCases := map[string]struct { + idFile iamid.File + wantPrivateKeyID string + wantErr bool + }{ + "valid base64": { + idFile: validIAMIDFile, + wantPrivateKeyID: "not_a_secret", + }, + "invalid base64": { + idFile: invalidIAMIDFile, + wantErr: true, + }, + } + + for name, tc := range testCases { + t.Run(name, func(t *testing.T) { + assert := assert.New(t) + outMap, err := parseIDFile(tc.idFile.GCPOutput.ServiceAccountKey) + + if tc.wantErr { + assert.Error(err) + } else { + assert.NoError(err) + assert.Equal(tc.wantPrivateKeyID, outMap["private_key_id"]) + } + }) + } +} + +func TestIAMCreateAWS(t *testing.T) { + defaultFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { + fs := afero.NewMemMapFs() + fileHandler := file.NewHandler(fs) + for _, f := range existingFiles { + require.NoError(fileHandler.Write(f, []byte{1, 2, 3}, file.OptNone)) + } + return fs + } + readOnlyFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { + fs := afero.NewReadOnlyFs(afero.NewMemMapFs()) + return fs + } + validIAMIDFile := iamid.File{ + CloudProvider: cloudprovider.AWS, + AWSOutput: iamid.AWSFile{ + ControlPlaneInstanceProfile: "test_control_plane_instance_profile", + WorkerNodeInstanceProfile: "test_worker_nodes_instance_profile", + }, + } + + testCases := map[string]struct { + setupFs func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs + creator *stubIAMCreator + provider cloudprovider.Provider + zoneFlag string + prefixFlag string + yesFlag bool + generateConfigFlag bool + configFlag string + existingFiles []string + stdin string + wantAbort bool + wantErr bool + }{ + "iam create aws": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + yesFlag: true, + }, + "iam create aws generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + yesFlag: true, + configFlag: constants.ConfigFilename, + generateConfigFlag: true, + }, + "iam create aws generate config custom path": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + yesFlag: true, + generateConfigFlag: true, + configFlag: "custom-config.yaml", + }, + "iam create aws generate config path already exists": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + yesFlag: true, + generateConfigFlag: true, + wantErr: true, + configFlag: constants.ConfigFilename, + existingFiles: []string{constants.ConfigFilename}, + }, + "iam create aws generate config custom path already exists": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + yesFlag: true, + generateConfigFlag: true, + wantErr: true, + configFlag: "custom-config.yaml", + existingFiles: []string{"custom-config.yaml"}, + }, + "interactive": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + stdin: "yes\n", + }, + "interactive generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + stdin: "yes\n", + configFlag: constants.ConfigFilename, + generateConfigFlag: true, + }, + "interactive abort": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + stdin: "no\n", + wantAbort: true, + }, + "interactive generate config abort": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + stdin: "no\n", + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + wantAbort: true, + }, + "invalid zone": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-west-5b", + prefixFlag: "test", + yesFlag: true, + wantErr: true, + }, + "unwritable fs": { + setupFs: readOnlyFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.AWS, + zoneFlag: "us-east-2a", + prefixFlag: "test", + yesFlag: true, + generateConfigFlag: true, + wantErr: true, + configFlag: constants.ConfigFilename, + }, + } + + for name, tc := range testCases { + t.Run(name, func(t *testing.T) { + assert := assert.New(t) + require := require.New(t) + + cmd := newIAMCreateAWSCmd() + cmd.SetOut(&bytes.Buffer{}) + cmd.SetErr(&bytes.Buffer{}) + cmd.SetIn(bytes.NewBufferString(tc.stdin)) + + cmd.Flags().String("config", constants.ConfigFilename, "") // register persistent flag manually + cmd.Flags().Bool("generate-config", false, "") // register persistent flag manually + cmd.Flags().Bool("yes", false, "") // register persistent flag manually + + if tc.zoneFlag != "" { + require.NoError(cmd.Flags().Set("zone", tc.zoneFlag)) + } + if tc.prefixFlag != "" { + require.NoError(cmd.Flags().Set("prefix", tc.prefixFlag)) + } + if tc.yesFlag { + require.NoError(cmd.Flags().Set("yes", "true")) + } + if tc.generateConfigFlag { + require.NoError(cmd.Flags().Set("generate-config", "true")) + } + if tc.configFlag != "" { + require.NoError(cmd.Flags().Set("config", tc.configFlag)) + } + + fileHandler := file.NewHandler(tc.setupFs(require, tc.provider, tc.existingFiles)) + + iamCreator := &iamCreator{ + cmd: cmd, + spinner: &nopSpinner{}, + creator: tc.creator, + fileHandler: fileHandler, + iamConfig: &cloudcmd.IAMConfig{}, + provider: tc.provider, + providerCreator: &awsIAMCreator{}, + } + err := iamCreator.create(cmd.Context()) + + if tc.wantErr { + assert.Error(err) + return + } + + if tc.wantAbort { + assert.False(tc.creator.createCalled) + return + } + + if tc.generateConfigFlag { + readConfig := &config.Config{} + readErr := fileHandler.ReadYAML(tc.configFlag, readConfig) + require.NoError(readErr) + assert.Equal(tc.creator.id.AWSOutput.ControlPlaneInstanceProfile, readConfig.Provider.AWS.IAMProfileControlPlane) + assert.Equal(tc.creator.id.AWSOutput.WorkerNodeInstanceProfile, readConfig.Provider.AWS.IAMProfileWorkerNodes) + assert.Equal(tc.zoneFlag, readConfig.Provider.AWS.Zone) + assert.True(strings.HasPrefix(readConfig.Provider.AWS.Zone, readConfig.Provider.AWS.Region)) + } + require.NoError(err) + assert.True(tc.creator.createCalled) + assert.Equal(tc.creator.id.AWSOutput, validIAMIDFile.AWSOutput) + }) + } +} + +func TestIAMCreateAzure(t *testing.T) { + defaultFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { + fs := afero.NewMemMapFs() + fileHandler := file.NewHandler(fs) + for _, f := range existingFiles { + require.NoError(fileHandler.Write(f, []byte{1, 2, 3}, file.OptNone)) + } + return fs + } + readOnlyFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { + fs := afero.NewReadOnlyFs(afero.NewMemMapFs()) + return fs + } + validIAMIDFile := iamid.File{ + CloudProvider: cloudprovider.Azure, + AzureOutput: iamid.AzureFile{ + SubscriptionID: "test_subscription_id", + TenantID: "test_tenant_id", + ApplicationID: "test_application_id", + ApplicationClientSecretValue: "test_application_client_secret_value", + UAMIID: "test_uami_id", + }, + } + + testCases := map[string]struct { + setupFs func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs + creator *stubIAMCreator + provider cloudprovider.Provider + regionFlag string + servicePrincipalFlag string + resourceGroupFlag string + yesFlag bool + generateConfigFlag bool + configFlag string + existingFiles []string + stdin string + wantAbort bool + wantErr bool + }{ + "iam create azure": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + yesFlag: true, + }, + "iam create azure generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + yesFlag: true, + }, + "iam create azure generate config custom path": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + generateConfigFlag: true, + configFlag: "custom-config.yaml", + yesFlag: true, + }, + "iam create azure generate config custom path already exists": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + generateConfigFlag: true, + yesFlag: true, + wantErr: true, + configFlag: "custom-config.yaml", + existingFiles: []string{"custom-config.yaml"}, + }, + "iam create generate config path already exists": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + existingFiles: []string{constants.ConfigFilename}, + yesFlag: true, + wantErr: true, + }, + "interactive": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + stdin: "yes\n", + }, + "interactive generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + stdin: "yes\n", + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + }, + "interactive abort": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + stdin: "no\n", + wantAbort: true, + }, + "interactive generate config abort": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + stdin: "no\n", + generateConfigFlag: true, + wantAbort: true, + }, + "unwritable fs": { + setupFs: readOnlyFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.Azure, + regionFlag: "westus", + servicePrincipalFlag: "constell-test-sp", + resourceGroupFlag: "constell-test-rg", + yesFlag: true, + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + wantErr: true, + }, + } + + for name, tc := range testCases { + t.Run(name, func(t *testing.T) { + assert := assert.New(t) + require := require.New(t) + + cmd := newIAMCreateAzureCmd() + cmd.SetOut(&bytes.Buffer{}) + cmd.SetErr(&bytes.Buffer{}) + cmd.SetIn(bytes.NewBufferString(tc.stdin)) + + cmd.Flags().String("config", constants.ConfigFilename, "") // register persistent flag manually + cmd.Flags().Bool("generate-config", false, "") // register persistent flag manually + cmd.Flags().Bool("yes", false, "") // register persistent flag + + if tc.regionFlag != "" { + require.NoError(cmd.Flags().Set("region", tc.regionFlag)) + } + if tc.resourceGroupFlag != "" { + require.NoError(cmd.Flags().Set("resourceGroup", tc.resourceGroupFlag)) + } + if tc.servicePrincipalFlag != "" { + require.NoError(cmd.Flags().Set("servicePrincipal", tc.servicePrincipalFlag)) + } + if tc.yesFlag { + require.NoError(cmd.Flags().Set("yes", "true")) + } + if tc.generateConfigFlag { + require.NoError(cmd.Flags().Set("generate-config", "true")) + } + if tc.configFlag != "" { + require.NoError(cmd.Flags().Set("config", tc.configFlag)) + } + + fileHandler := file.NewHandler(tc.setupFs(require, tc.provider, tc.existingFiles)) + + iamCreator := &iamCreator{ + cmd: cmd, + spinner: &nopSpinner{}, + creator: tc.creator, + fileHandler: fileHandler, + iamConfig: &cloudcmd.IAMConfig{}, + provider: tc.provider, + providerCreator: &azureIAMCreator{}, + } + err := iamCreator.create(cmd.Context()) + + if tc.wantErr { + assert.Error(err) + return + } + + if tc.wantAbort { + assert.False(tc.creator.createCalled) + return + } + + if tc.generateConfigFlag { + readConfig := &config.Config{} + readErr := fileHandler.ReadYAML(tc.configFlag, readConfig) + require.NoError(readErr) + assert.Equal(tc.creator.id.AzureOutput.SubscriptionID, readConfig.Provider.Azure.SubscriptionID) + assert.Equal(tc.creator.id.AzureOutput.TenantID, readConfig.Provider.Azure.TenantID) + assert.Equal(tc.creator.id.AzureOutput.ApplicationID, readConfig.Provider.Azure.AppClientID) + assert.Equal(tc.creator.id.AzureOutput.ApplicationClientSecretValue, readConfig.Provider.Azure.ClientSecretValue) + assert.Equal(tc.creator.id.AzureOutput.UAMIID, readConfig.Provider.Azure.UserAssignedIdentity) + assert.Equal(tc.regionFlag, readConfig.Provider.Azure.Location) + assert.Equal(tc.resourceGroupFlag, readConfig.Provider.Azure.ResourceGroup) + } + require.NoError(err) + assert.True(tc.creator.createCalled) + assert.Equal(tc.creator.id.AzureOutput, validIAMIDFile.AzureOutput) + }) + } +} + +func TestIAMCreateGCP(t *testing.T) { + defaultFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { + fs := afero.NewMemMapFs() + fileHandler := file.NewHandler(fs) + for _, f := range existingFiles { + require.NoError(fileHandler.Write(f, []byte{1, 2, 3}, file.OptNone)) + } + return fs + } + readOnlyFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { + fs := afero.NewReadOnlyFs(afero.NewMemMapFs()) + return fs + } + validIAMIDFile := iamid.File{ + CloudProvider: cloudprovider.GCP, + GCPOutput: iamid.GCPFile{ + ServiceAccountKey: "eyJwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // {"private_key_id":"not_a_secret"} + }, + } + invalidIAMIDFile := iamid.File{ + CloudProvider: cloudprovider.GCP, + GCPOutput: iamid.GCPFile{ + ServiceAccountKey: "ey_Jwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // invalid b64 + }, + } + + testCases := map[string]struct { + setupFs func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs + creator *stubIAMCreator + provider cloudprovider.Provider + zoneFlag string + serviceAccountIDFlag string + projectIDFlag string + yesFlag bool + generateConfigFlag bool + configFlag string + existingFiles []string + stdin string + wantAbort bool + wantErr bool + }{ + "iam create gcp": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + yesFlag: true, + }, + "iam create gcp generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + yesFlag: true, + }, + "iam create gcp generate config custom path": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + generateConfigFlag: true, + configFlag: "custom-config.yaml", + yesFlag: true, + }, + "iam create gcp generate config path already exists": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + existingFiles: []string{constants.ConfigFilename}, + yesFlag: true, + wantErr: true, + }, + "iam create gcp generate config custom path already exists": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + generateConfigFlag: true, + configFlag: "custom-config.yaml", + existingFiles: []string{"custom-config.yaml"}, + yesFlag: true, + wantErr: true, + }, + "iam create gcp invalid flags": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "-a", + yesFlag: true, + wantErr: true, + }, + "iam create gcp invalid b64": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: invalidIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + yesFlag: true, + wantErr: true, + }, + "interactive": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + stdin: "yes\n", + }, + "interactive generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + stdin: "yes\n", + configFlag: constants.ConfigFilename, + generateConfigFlag: true, + }, + "interactive abort": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + stdin: "no\n", + wantAbort: true, + }, + "interactive abort generate config": { + setupFs: defaultFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + stdin: "no\n", + wantAbort: true, + configFlag: constants.ConfigFilename, + generateConfigFlag: true, + }, + "unwritable fs": { + setupFs: readOnlyFs, + creator: &stubIAMCreator{id: validIAMIDFile}, + provider: cloudprovider.GCP, + zoneFlag: "europe-west1-a", + serviceAccountIDFlag: "constell-test", + projectIDFlag: "constell-1234", + yesFlag: true, + generateConfigFlag: true, + configFlag: constants.ConfigFilename, + wantErr: true, + }, + } + + for name, tc := range testCases { + t.Run(name, func(t *testing.T) { + assert := assert.New(t) + require := require.New(t) + + cmd := newIAMCreateGCPCmd() + cmd.SetOut(&bytes.Buffer{}) + cmd.SetErr(&bytes.Buffer{}) + cmd.SetIn(bytes.NewBufferString(tc.stdin)) + + cmd.Flags().String("config", constants.ConfigFilename, "") // register persistent flag manually + cmd.Flags().Bool("generate-config", false, "") // register persistent flag manually + cmd.Flags().Bool("yes", false, "") // register persistent flag + + if tc.zoneFlag != "" { + require.NoError(cmd.Flags().Set("zone", tc.zoneFlag)) + } + if tc.serviceAccountIDFlag != "" { + require.NoError(cmd.Flags().Set("serviceAccountID", tc.serviceAccountIDFlag)) + } + if tc.projectIDFlag != "" { + require.NoError(cmd.Flags().Set("projectID", tc.projectIDFlag)) + } + if tc.yesFlag { + require.NoError(cmd.Flags().Set("yes", "true")) + } + if tc.generateConfigFlag { + require.NoError(cmd.Flags().Set("generate-config", "true")) + } + if tc.configFlag != "" { + require.NoError(cmd.Flags().Set("config", tc.configFlag)) + } + + fileHandler := file.NewHandler(tc.setupFs(require, tc.provider, tc.existingFiles)) + + iamCreator := &iamCreator{ + cmd: cmd, + spinner: &nopSpinner{}, + creator: tc.creator, + fileHandler: fileHandler, + iamConfig: &cloudcmd.IAMConfig{}, + provider: tc.provider, + providerCreator: &gcpIAMCreator{}, + } + err := iamCreator.create(cmd.Context()) + + if tc.wantErr { + assert.Error(err) + return + } + + if tc.wantAbort { + assert.False(tc.creator.createCalled) + return + } + + if tc.generateConfigFlag { + readConfig := &config.Config{} + readErr := fileHandler.ReadYAML(tc.configFlag, readConfig) + require.NoError(readErr) + assert.Equal(constants.GCPServiceAccountKeyFile, readConfig.Provider.GCP.ServiceAccountKeyPath) + } + require.NoError(err) + assert.True(tc.creator.createCalled) + assert.Equal(tc.creator.id.GCPOutput, validIAMIDFile.GCPOutput) + readServiceAccountKey := &map[string]string{} + readErr := fileHandler.ReadJSON(constants.GCPServiceAccountKeyFile, readServiceAccountKey) + require.NoError(readErr) + assert.Equal("not_a_secret", (*readServiceAccountKey)["private_key_id"]) + }) + } +} diff --git a/cli/internal/cmd/iamcreateaws.go b/cli/internal/cmd/iamcreateaws.go deleted file mode 100644 index 28261ef79..000000000 --- a/cli/internal/cmd/iamcreateaws.go +++ /dev/null @@ -1,165 +0,0 @@ -/* -Copyright (c) Edgeless Systems GmbH -SPDX-License-Identifier: AGPL-3.0-only -*/ - -package cmd - -import ( - "fmt" - "strings" - - "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" - "github.com/edgelesssys/constellation/v2/internal/file" - "github.com/spf13/afero" - "github.com/spf13/cobra" -) - -// newIAMCreateAWSCmd returns a new cobra.Command for the iam create aws command. -func newIAMCreateAWSCmd() *cobra.Command { - cmd := &cobra.Command{ - Use: "aws", - Short: "Create IAM configuration on AWS for your Constellation cluster", - Long: "Create IAM configuration on AWS for your Constellation cluster.", - Args: cobra.ExactArgs(0), - RunE: runIAMCreateAWS, - } - - cmd.Flags().String("prefix", "", "name prefix for all resources (required)") - must(cobra.MarkFlagRequired(cmd.Flags(), "prefix")) - cmd.Flags().String("zone", "", "AWS availability zone the resources will be created in, e.g. us-east-2a (required)\n"+ - "Find available zones here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones. "+ - "Note that we do not support every zone / region. You can find a list of all supported regions in our docs.") - must(cobra.MarkFlagRequired(cmd.Flags(), "zone")) - cmd.Flags().Bool("yes", false, "create the IAM configuration without further confirmation") - - return cmd -} - -func runIAMCreateAWS(cmd *cobra.Command, args []string) error { - spinner := newSpinner(cmd.ErrOrStderr()) - defer spinner.Stop() - fileHandler := file.NewHandler(afero.NewOsFs()) - creator := cloudcmd.NewIAMCreator(spinner) - - return iamCreateAWS(cmd, spinner, creator, fileHandler) -} - -func iamCreateAWS(cmd *cobra.Command, spinner spinnerInterf, creator iamCreator, fileHandler file.Handler) error { - // Get input variables. - awsFlags, err := parseAWSFlags(cmd) - if err != nil { - return err - } - - // Confirmation. - if !awsFlags.yesFlag { - cmd.Printf("The following IAM configuration will be created:\n\n") - cmd.Printf("Region:\t\t%s\n", awsFlags.region) - cmd.Printf("Name Prefix:\t%s\n\n", awsFlags.prefix) - if awsFlags.generateConfig { - cmd.Printf("The configuration file %s will be automatically generated and populated with the IAM values.\n", awsFlags.configPath) - } - ok, err := askToConfirm(cmd, "Do you want to create the configuration?") - if err != nil { - return err - } - if !ok { - cmd.Println("The creation of the configuration was aborted.") - return nil - } - } - - // Creation. - spinner.Start("Creating", false) - - conf := createConfig(cloudprovider.AWS) - - iamFile, err := creator.Create(cmd.Context(), cloudprovider.AWS, &cloudcmd.IAMConfig{ - AWS: cloudcmd.AWSIAMConfig{ - Region: awsFlags.region, - Prefix: awsFlags.prefix, - }, - }) - - spinner.Stop() - if err != nil { - return err - } - cmd.Println() // Print empty line to separate after spinner ended. - - if awsFlags.generateConfig { - conf.Provider.AWS.Region = awsFlags.region - conf.Provider.AWS.Zone = awsFlags.zone - conf.Provider.AWS.IAMProfileControlPlane = iamFile.AWSOutput.ControlPlaneInstanceProfile - conf.Provider.AWS.IAMProfileWorkerNodes = iamFile.AWSOutput.WorkerNodeInstanceProfile - - if err := fileHandler.WriteYAML(awsFlags.configPath, conf, file.OptMkdirAll); err != nil { - return err - } - cmd.Printf("Your IAM configuration was created and filled into %s successfully.\n", awsFlags.configPath) - return nil - } - - cmd.Printf("region:\t\t\t%s\n", awsFlags.region) - cmd.Printf("zone:\t\t\t%s\n", awsFlags.zone) - cmd.Printf("iamProfileControlPlane:\t%s\n", iamFile.AWSOutput.ControlPlaneInstanceProfile) - cmd.Printf("iamProfileWorkerNodes:\t%s\n\n", iamFile.AWSOutput.WorkerNodeInstanceProfile) - cmd.Println("Your IAM configuration was created successfully. Please fill the above values into your configuration file.") - - return nil -} - -// parseAWSFlags parses and validates the flags of the iam create aws command. -func parseAWSFlags(cmd *cobra.Command) (awsFlags, error) { - var region string - - prefix, err := cmd.Flags().GetString("prefix") - if err != nil { - return awsFlags{}, fmt.Errorf("parsing prefix string: %w", err) - } - zone, err := cmd.Flags().GetString("zone") - if err != nil { - return awsFlags{}, fmt.Errorf("parsing zone string: %w", err) - } - if strings.HasPrefix(zone, "eu-central-1") { - region = "eu-central-1" - } else if strings.HasPrefix(zone, "us-east-2") { - region = "us-east-2" - } else if strings.HasPrefix(zone, "ap-south-1") { - region = "ap-south-1" - } else { - return awsFlags{}, fmt.Errorf("invalid AWS region, to find a correct region please refer to our docs and https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-availability-zones") - } - configPath, err := cmd.Flags().GetString("config") - if err != nil { - return awsFlags{}, fmt.Errorf("parsing config string: %w", err) - } - generateConfig, err := cmd.Flags().GetBool("generate-config") - if err != nil { - return awsFlags{}, fmt.Errorf("parsing generate-config bool: %w", err) - } - yesFlag, err := cmd.Flags().GetBool("yes") - if err != nil { - return awsFlags{}, fmt.Errorf("parsing yes bool: %w", err) - } - return awsFlags{ - zone: zone, - prefix: prefix, - region: region, - generateConfig: generateConfig, - configPath: configPath, - yesFlag: yesFlag, - }, nil -} - -// awsFlags contains the parsed flags of the iam create aws command. -type awsFlags struct { - prefix string - region string - zone string - generateConfig bool - configPath string - yesFlag bool -} diff --git a/cli/internal/cmd/iamcreateaws_test.go b/cli/internal/cmd/iamcreateaws_test.go deleted file mode 100644 index 335cc60b6..000000000 --- a/cli/internal/cmd/iamcreateaws_test.go +++ /dev/null @@ -1,227 +0,0 @@ -/* -Copyright (c) Edgeless Systems GmbH -SPDX-License-Identifier: AGPL-3.0-only -*/ - -package cmd - -import ( - "bytes" - "strings" - "testing" - - "github.com/edgelesssys/constellation/v2/cli/internal/iamid" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" - "github.com/edgelesssys/constellation/v2/internal/config" - "github.com/edgelesssys/constellation/v2/internal/constants" - "github.com/edgelesssys/constellation/v2/internal/file" - "github.com/spf13/afero" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" -) - -func TestIAMCreateAWS(t *testing.T) { - defaultFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { - fs := afero.NewMemMapFs() - fileHandler := file.NewHandler(fs) - for _, f := range existingFiles { - require.NoError(fileHandler.Write(f, []byte{1, 2, 3}, file.OptNone)) - } - return fs - } - readOnlyFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { - fs := afero.NewReadOnlyFs(afero.NewMemMapFs()) - return fs - } - validIAMIDFile := iamid.File{ - CloudProvider: cloudprovider.AWS, - AWSOutput: iamid.AWSFile{ - ControlPlaneInstanceProfile: "test_control_plane_instance_profile", - WorkerNodeInstanceProfile: "test_worker_nodes_instance_profile", - }, - } - - testCases := map[string]struct { - setupFs func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs - creator *stubIAMCreator - provider cloudprovider.Provider - zoneFlag string - prefixFlag string - yesFlag bool - generateConfigFlag bool - configFlag string - existingFiles []string - stdin string - wantAbort bool - wantErr bool - }{ - "iam create aws": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - yesFlag: true, - }, - "iam create aws generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - yesFlag: true, - configFlag: constants.ConfigFilename, - generateConfigFlag: true, - }, - "iam create aws generate config custom path": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - yesFlag: true, - generateConfigFlag: true, - configFlag: "custom-config.yaml", - }, - "iam create aws generate config path already exists": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - yesFlag: true, - generateConfigFlag: true, - wantErr: true, - configFlag: constants.ConfigFilename, - existingFiles: []string{constants.ConfigFilename}, - }, - "iam create aws generate config custom path already exists": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - yesFlag: true, - generateConfigFlag: true, - wantErr: true, - configFlag: "custom-config.yaml", - existingFiles: []string{"custom-config.yaml"}, - }, - "interactive": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - stdin: "yes\n", - }, - "interactive generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - stdin: "yes\n", - configFlag: constants.ConfigFilename, - generateConfigFlag: true, - }, - "interactive abort": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - stdin: "no\n", - wantAbort: true, - }, - "interactive generate config abort": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - stdin: "no\n", - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - wantAbort: true, - }, - "invalid zone": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-west-5b", - prefixFlag: "test", - yesFlag: true, - wantErr: true, - }, - "unwritable fs": { - setupFs: readOnlyFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.AWS, - zoneFlag: "us-east-2a", - prefixFlag: "test", - yesFlag: true, - generateConfigFlag: true, - wantErr: true, - configFlag: constants.ConfigFilename, - }, - } - - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - assert := assert.New(t) - require := require.New(t) - - cmd := newIAMCreateAWSCmd() - cmd.SetOut(&bytes.Buffer{}) - cmd.SetErr(&bytes.Buffer{}) - cmd.SetIn(bytes.NewBufferString(tc.stdin)) - - cmd.Flags().String("config", constants.ConfigFilename, "") // register persistent flag manually - cmd.Flags().Bool("generate-config", false, "") // register persistent flag manually - - if tc.zoneFlag != "" { - require.NoError(cmd.Flags().Set("zone", tc.zoneFlag)) - } - if tc.prefixFlag != "" { - require.NoError(cmd.Flags().Set("prefix", tc.prefixFlag)) - } - if tc.yesFlag { - require.NoError(cmd.Flags().Set("yes", "true")) - } - if tc.generateConfigFlag { - require.NoError(cmd.Flags().Set("generate-config", "true")) - } - if tc.configFlag != "" { - require.NoError(cmd.Flags().Set("config", tc.configFlag)) - } - - fileHandler := file.NewHandler(tc.setupFs(require, tc.provider, tc.existingFiles)) - - err := iamCreateAWS(cmd, &nopSpinner{}, tc.creator, fileHandler) - - if tc.wantErr { - assert.Error(err) - return - } - - if tc.wantAbort { - assert.False(tc.creator.createCalled) - return - } - - if tc.generateConfigFlag { - readConfig := &config.Config{} - readErr := fileHandler.ReadYAML(tc.configFlag, readConfig) - require.NoError(readErr) - assert.Equal(tc.creator.id.AWSOutput.ControlPlaneInstanceProfile, readConfig.Provider.AWS.IAMProfileControlPlane) - assert.Equal(tc.creator.id.AWSOutput.WorkerNodeInstanceProfile, readConfig.Provider.AWS.IAMProfileWorkerNodes) - assert.Equal(tc.zoneFlag, readConfig.Provider.AWS.Zone) - assert.True(strings.HasPrefix(readConfig.Provider.AWS.Zone, readConfig.Provider.AWS.Region)) - } - require.NoError(err) - assert.True(tc.creator.createCalled) - assert.Equal(tc.creator.id.AWSOutput, validIAMIDFile.AWSOutput) - }) - } -} diff --git a/cli/internal/cmd/iamcreateazure.go b/cli/internal/cmd/iamcreateazure.go deleted file mode 100644 index 2f001a5b2..000000000 --- a/cli/internal/cmd/iamcreateazure.go +++ /dev/null @@ -1,171 +0,0 @@ -/* -Copyright (c) Edgeless Systems GmbH -SPDX-License-Identifier: AGPL-3.0-only -*/ - -package cmd - -import ( - "fmt" - - "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" - "github.com/edgelesssys/constellation/v2/internal/file" - "github.com/spf13/afero" - "github.com/spf13/cobra" -) - -// newIAMCreateAzureCmd returns a new cobra.Command for the iam create azure command. -func newIAMCreateAzureCmd() *cobra.Command { - cmd := &cobra.Command{ - Use: "azure", - Short: "Create IAM configuration on Microsoft Azure for your Constellation cluster", - Long: "Create IAM configuration on Microsoft Azure for your Constellation cluster.", - Args: cobra.ExactArgs(0), - RunE: runIAMCreateAzure, - } - - cmd.Flags().String("resourceGroup", "", "name prefix of the two resource groups your cluster / IAM resources will be created in (required)") - must(cobra.MarkFlagRequired(cmd.Flags(), "resourceGroup")) - cmd.Flags().String("region", "", "region the resources will be created in, e.g. westus (required)") - must(cobra.MarkFlagRequired(cmd.Flags(), "region")) - cmd.Flags().String("servicePrincipal", "", "name of the service principal that will be created (required)") - must(cobra.MarkFlagRequired(cmd.Flags(), "servicePrincipal")) - cmd.Flags().Bool("yes", false, "create the IAM configuration without further confirmation") - - return cmd -} - -func runIAMCreateAzure(cmd *cobra.Command, args []string) error { - spinner := newSpinner(cmd.ErrOrStderr()) - defer spinner.Stop() - fileHandler := file.NewHandler(afero.NewOsFs()) - creator := cloudcmd.NewIAMCreator(spinner) - - return iamCreateAzure(cmd, spinner, creator, fileHandler) -} - -func iamCreateAzure(cmd *cobra.Command, spinner spinnerInterf, creator iamCreator, fileHandler file.Handler) error { - // Get input variables. - azureFlags, err := parseAzureFlags(cmd) - if err != nil { - return err - } - - // Confirmation. - if !azureFlags.yesFlag { - cmd.Printf("The following IAM configuration will be created:\n\n") - cmd.Printf("Region:\t\t\t%s\n", azureFlags.region) - cmd.Printf("Resource Group:\t\t%s\n", azureFlags.resourceGroup) - cmd.Printf("Service Principal:\t%s\n\n", azureFlags.servicePrincipal) - if azureFlags.generateConfig { - cmd.Printf("The configuration file %s will be automatically generated and populated with the IAM values.\n", azureFlags.configPath) - } - ok, err := askToConfirm(cmd, "Do you want to create the configuration?") - if err != nil { - return err - } - if !ok { - cmd.Println("The creation of the configuration was aborted.") - return nil - } - } - - // Creation. - spinner.Start("Creating", false) - - conf := createConfig(cloudprovider.Azure) - - iamFile, err := creator.Create(cmd.Context(), cloudprovider.Azure, &cloudcmd.IAMConfig{ - Azure: cloudcmd.AzureIAMConfig{ - Region: azureFlags.region, - ServicePrincipal: azureFlags.servicePrincipal, - ResourceGroup: azureFlags.resourceGroup, - }, - }) - - spinner.Stop() - if err != nil { - return err - } - cmd.Println() // Print empty line to separate after spinner ended. - - if azureFlags.generateConfig { - conf.Provider.Azure.SubscriptionID = iamFile.AzureOutput.SubscriptionID - conf.Provider.Azure.TenantID = iamFile.AzureOutput.TenantID - conf.Provider.Azure.Location = azureFlags.region - conf.Provider.Azure.ResourceGroup = azureFlags.resourceGroup - conf.Provider.Azure.UserAssignedIdentity = iamFile.AzureOutput.UAMIID - conf.Provider.Azure.AppClientID = iamFile.AzureOutput.ApplicationID - conf.Provider.Azure.ClientSecretValue = iamFile.AzureOutput.ApplicationClientSecretValue - if err := fileHandler.WriteYAML(azureFlags.configPath, conf, file.OptMkdirAll); err != nil { - return err - } - cmd.Printf("Your IAM configuration was created and filled into %s successfully.\n", azureFlags.configPath) - return nil - } - - cmd.Printf("subscription:\t\t%s\n", iamFile.AzureOutput.SubscriptionID) - cmd.Printf("tenant:\t\t\t%s\n", iamFile.AzureOutput.TenantID) - cmd.Printf("location:\t\t%s\n", azureFlags.region) - cmd.Printf("resourceGroup:\t\t%s\n", azureFlags.resourceGroup) - cmd.Printf("userAssignedIdentity:\t%s\n", iamFile.AzureOutput.UAMIID) - cmd.Printf("appClientID:\t\t%s\n", iamFile.AzureOutput.ApplicationID) - cmd.Printf("appClientSecretValue:\t%s\n\n", iamFile.AzureOutput.ApplicationClientSecretValue) - cmd.Println("Your IAM configuration was created successfully. Please fill the above values into your configuration file.") - - return nil -} - -// parseAzureFlags parses and validates the flags of the iam create azure command. -func parseAzureFlags(cmd *cobra.Command) (azureFlags, error) { - region, err := cmd.Flags().GetString("region") - if err != nil { - return azureFlags{}, fmt.Errorf("parsing region string: %w", err) - } - - resourceGroup, err := cmd.Flags().GetString("resourceGroup") - if err != nil { - return azureFlags{}, fmt.Errorf("parsing resourceGroup string: %w", err) - } - - servicePrincipal, err := cmd.Flags().GetString("servicePrincipal") - if err != nil { - return azureFlags{}, fmt.Errorf("parsing servicePrincipal string: %w", err) - } - - configPath, err := cmd.Flags().GetString("config") - if err != nil { - return azureFlags{}, fmt.Errorf("parsing config string: %w", err) - } - - generateConfig, err := cmd.Flags().GetBool("generate-config") - if err != nil { - return azureFlags{}, fmt.Errorf("parsing generate-config bool: %w", err) - } - - yesFlag, err := cmd.Flags().GetBool("yes") - if err != nil { - return azureFlags{}, fmt.Errorf("parsing yes bool: %w", err) - } - - return azureFlags{ - servicePrincipal: servicePrincipal, - resourceGroup: resourceGroup, - region: region, - generateConfig: generateConfig, - configPath: configPath, - yesFlag: yesFlag, - }, nil -} - -// azureFlags contains the parsed flags of the iam create azure command. -type azureFlags struct { - region string - resourceGroup string - servicePrincipal string - - generateConfig bool - configPath string - yesFlag bool -} diff --git a/cli/internal/cmd/iamcreateazure_test.go b/cli/internal/cmd/iamcreateazure_test.go deleted file mode 100644 index d8320cb94..000000000 --- a/cli/internal/cmd/iamcreateazure_test.go +++ /dev/null @@ -1,236 +0,0 @@ -/* -Copyright (c) Edgeless Systems GmbH -SPDX-License-Identifier: AGPL-3.0-only -*/ - -package cmd - -import ( - "bytes" - "testing" - - "github.com/edgelesssys/constellation/v2/cli/internal/iamid" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" - "github.com/edgelesssys/constellation/v2/internal/config" - "github.com/edgelesssys/constellation/v2/internal/constants" - "github.com/edgelesssys/constellation/v2/internal/file" - "github.com/spf13/afero" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" -) - -func TestIAMCreateAzure(t *testing.T) { - defaultFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { - fs := afero.NewMemMapFs() - fileHandler := file.NewHandler(fs) - for _, f := range existingFiles { - require.NoError(fileHandler.Write(f, []byte{1, 2, 3}, file.OptNone)) - } - return fs - } - readOnlyFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { - fs := afero.NewReadOnlyFs(afero.NewMemMapFs()) - return fs - } - validIAMIDFile := iamid.File{ - CloudProvider: cloudprovider.Azure, - AzureOutput: iamid.AzureFile{ - SubscriptionID: "test_subscription_id", - TenantID: "test_tenant_id", - ApplicationID: "test_application_id", - ApplicationClientSecretValue: "test_application_client_secret_value", - UAMIID: "test_uami_id", - }, - } - - testCases := map[string]struct { - setupFs func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs - creator *stubIAMCreator - provider cloudprovider.Provider - regionFlag string - servicePrincipalFlag string - resourceGroupFlag string - yesFlag bool - generateConfigFlag bool - configFlag string - existingFiles []string - stdin string - wantAbort bool - wantErr bool - }{ - "iam create azure": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - yesFlag: true, - }, - "iam create azure generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - yesFlag: true, - }, - "iam create azure generate config custom path": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - generateConfigFlag: true, - configFlag: "custom-config.yaml", - yesFlag: true, - }, - "iam create azure generate config custom path already exists": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - generateConfigFlag: true, - yesFlag: true, - wantErr: true, - configFlag: "custom-config.yaml", - existingFiles: []string{"custom-config.yaml"}, - }, - "iam create generate config path already exists": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - existingFiles: []string{constants.ConfigFilename}, - yesFlag: true, - wantErr: true, - }, - "interactive": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - stdin: "yes\n", - }, - "interactive generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - stdin: "yes\n", - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - }, - "interactive abort": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - stdin: "no\n", - wantAbort: true, - }, - "interactive generate config abort": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - stdin: "no\n", - generateConfigFlag: true, - wantAbort: true, - }, - "unwritable fs": { - setupFs: readOnlyFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.Azure, - regionFlag: "westus", - servicePrincipalFlag: "constell-test-sp", - resourceGroupFlag: "constell-test-rg", - yesFlag: true, - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - wantErr: true, - }, - } - - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - assert := assert.New(t) - require := require.New(t) - - cmd := newIAMCreateAzureCmd() - cmd.SetOut(&bytes.Buffer{}) - cmd.SetErr(&bytes.Buffer{}) - cmd.SetIn(bytes.NewBufferString(tc.stdin)) - - cmd.Flags().String("config", constants.ConfigFilename, "") // register persistent flag manually - cmd.Flags().Bool("generate-config", false, "") // register persistent flag manually - - if tc.regionFlag != "" { - require.NoError(cmd.Flags().Set("region", tc.regionFlag)) - } - if tc.resourceGroupFlag != "" { - require.NoError(cmd.Flags().Set("resourceGroup", tc.resourceGroupFlag)) - } - if tc.servicePrincipalFlag != "" { - require.NoError(cmd.Flags().Set("servicePrincipal", tc.servicePrincipalFlag)) - } - if tc.yesFlag { - require.NoError(cmd.Flags().Set("yes", "true")) - } - if tc.generateConfigFlag { - require.NoError(cmd.Flags().Set("generate-config", "true")) - } - if tc.configFlag != "" { - require.NoError(cmd.Flags().Set("config", tc.configFlag)) - } - - fileHandler := file.NewHandler(tc.setupFs(require, tc.provider, tc.existingFiles)) - - err := iamCreateAzure(cmd, &nopSpinner{}, tc.creator, fileHandler) - - if tc.wantErr { - assert.Error(err) - return - } - - if tc.wantAbort { - assert.False(tc.creator.createCalled) - return - } - - if tc.generateConfigFlag { - readConfig := &config.Config{} - readErr := fileHandler.ReadYAML(tc.configFlag, readConfig) - require.NoError(readErr) - assert.Equal(tc.creator.id.AzureOutput.SubscriptionID, readConfig.Provider.Azure.SubscriptionID) - assert.Equal(tc.creator.id.AzureOutput.TenantID, readConfig.Provider.Azure.TenantID) - assert.Equal(tc.creator.id.AzureOutput.ApplicationID, readConfig.Provider.Azure.AppClientID) - assert.Equal(tc.creator.id.AzureOutput.ApplicationClientSecretValue, readConfig.Provider.Azure.ClientSecretValue) - assert.Equal(tc.creator.id.AzureOutput.UAMIID, readConfig.Provider.Azure.UserAssignedIdentity) - assert.Equal(tc.regionFlag, readConfig.Provider.Azure.Location) - assert.Equal(tc.resourceGroupFlag, readConfig.Provider.Azure.ResourceGroup) - } - require.NoError(err) - assert.True(tc.creator.createCalled) - assert.Equal(tc.creator.id.AzureOutput, validIAMIDFile.AzureOutput) - }) - } -} diff --git a/cli/internal/cmd/iamcreategcp.go b/cli/internal/cmd/iamcreategcp.go deleted file mode 100644 index 16fa20543..000000000 --- a/cli/internal/cmd/iamcreategcp.go +++ /dev/null @@ -1,215 +0,0 @@ -/* -Copyright (c) Edgeless Systems GmbH -SPDX-License-Identifier: AGPL-3.0-only -*/ - -package cmd - -import ( - "encoding/base64" - "encoding/json" - "fmt" - "regexp" - "strings" - - "github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" - "github.com/edgelesssys/constellation/v2/internal/constants" - "github.com/edgelesssys/constellation/v2/internal/file" - "github.com/spf13/afero" - "github.com/spf13/cobra" -) - -var ( - zoneRegex = regexp.MustCompile(`^\w+-\w+-[abc]$`) - regionRegex = regexp.MustCompile(`^\w+-\w+[0-9]$`) - projectIDRegex = regexp.MustCompile(`^[a-z][-a-z0-9]{4,28}[a-z0-9]{1}$`) - serviceAccIDRegex = regexp.MustCompile(`^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$`) -) - -// NewIAMCreateGCPCmd returns a new cobra.Command for the iam create gcp command. -func newIAMCreateGCPCmd() *cobra.Command { - cmd := &cobra.Command{ - Use: "gcp", - Short: "Create IAM configuration on GCP for your Constellation cluster", - Long: "Create IAM configuration on GCP for your Constellation cluster.", - Args: cobra.ExactArgs(0), - RunE: runIAMCreateGCP, - } - - cmd.Flags().String("zone", "", "GCP zone the cluster will be deployed in (required)\n"+ - "Find a list of available zones here: https://cloud.google.com/compute/docs/regions-zones#available.") - must(cobra.MarkFlagRequired(cmd.Flags(), "zone")) - cmd.Flags().String("serviceAccountID", "", "ID for the service account that will be created (required)\n"+ - "Must match ^[a-z](?:[-a-z0-9]{4,28}[a-z0-9])$.") - must(cobra.MarkFlagRequired(cmd.Flags(), "serviceAccountID")) - cmd.Flags().String("projectID", "", "ID of the GCP project the configuration will be created in (required)\n"+ - "Find it on the welcome screen of your project: https://console.cloud.google.com/welcome.") - must(cobra.MarkFlagRequired(cmd.Flags(), "projectID")) - cmd.Flags().Bool("yes", false, "create the IAM configuration without further confirmation") - - return cmd -} - -func runIAMCreateGCP(cmd *cobra.Command, args []string) error { - fileHandler := file.NewHandler(afero.NewOsFs()) - spinner := newSpinner(cmd.ErrOrStderr()) - defer spinner.Stop() - creator := cloudcmd.NewIAMCreator(spinner) - - return iamCreateGCP(cmd, spinner, creator, fileHandler) -} - -func iamCreateGCP(cmd *cobra.Command, spinner spinnerInterf, creator iamCreator, fileHandler file.Handler) error { - // Get input variables. - gcpFlags, err := parseGCPFlags(cmd) - if err != nil { - return err - } - - // Confirmation. - if !gcpFlags.yesFlag { - cmd.Printf("The following IAM configuration will be created:\n\n") - cmd.Printf("Project ID:\t\t%s\n", gcpFlags.projectID) - cmd.Printf("Service Account ID:\t%s\n", gcpFlags.serviceAccountID) - cmd.Printf("Region:\t\t\t%s\n", gcpFlags.region) - cmd.Printf("Zone:\t\t\t%s\n\n", gcpFlags.zone) - if gcpFlags.generateConfig { - cmd.Printf("The configuration file %s will be automatically generated and populated with the IAM values.\n", gcpFlags.configPath) - } - ok, err := askToConfirm(cmd, "Do you want to create the configuration?") - if err != nil { - return err - } - if !ok { - cmd.Println("The creation of the configuration was aborted.") - return nil - } - } - - // Creation. - spinner.Start("Creating", false) - - conf := createConfig(cloudprovider.GCP) - - iamFile, err := creator.Create(cmd.Context(), cloudprovider.GCP, &cloudcmd.IAMConfig{ - GCP: cloudcmd.GCPIAMConfig{ - ServiceAccountID: gcpFlags.serviceAccountID, - Region: gcpFlags.region, - Zone: gcpFlags.zone, - ProjectID: gcpFlags.projectID, - }, - }) - - spinner.Stop() - if err != nil { - return err - } - cmd.Println() // Print empty line to separate after spinner ended. - - // Write back values. - tmpOut, err := parseIDFile(iamFile.GCPOutput.ServiceAccountKey) - if err != nil { - return err - } - - if err := fileHandler.WriteJSON(constants.GCPServiceAccountKeyFile, tmpOut, file.OptNone); err != nil { - return err - } - - if gcpFlags.generateConfig { - conf.Provider.GCP.ServiceAccountKeyPath = constants.GCPServiceAccountKeyFile - - if err := fileHandler.WriteYAML(gcpFlags.configPath, conf, file.OptMkdirAll); err != nil { - return err - } - cmd.Printf("Your IAM configuration was created and filled into %s successfully.\n", gcpFlags.configPath) - return nil - } - - cmd.Println(fmt.Sprintf("serviceAccountKeyPath:\t%s\n", constants.GCPServiceAccountKeyFile)) - cmd.Println("Your IAM configuration was created successfully. Please fill the above values into your configuration file.") - - return nil -} - -func parseIDFile(serviceAccountKeyBase64 string) (map[string]string, error) { - dec, err := base64.StdEncoding.DecodeString(serviceAccountKeyBase64) - if err != nil { - return nil, err - } - - out := make(map[string]string) - if err = json.Unmarshal(dec, &out); err != nil { - return nil, err - } - return out, nil -} - -// parseGCPFlags parses and validates the flags of the iam create gcp command. -func parseGCPFlags(cmd *cobra.Command) (gcpFlags, error) { - zone, err := cmd.Flags().GetString("zone") - if err != nil { - return gcpFlags{}, fmt.Errorf("parsing zone string: %w", err) - } - if !zoneRegex.MatchString(zone) { - return gcpFlags{}, fmt.Errorf("invalid zone string: %s", zone) - } - - // Infer region from zone. - zoneParts := strings.Split(zone, "-") - region := fmt.Sprintf("%s-%s", zoneParts[0], zoneParts[1]) - if !regionRegex.MatchString(region) { - return gcpFlags{}, fmt.Errorf("invalid region string: %s", region) - } - - projectID, err := cmd.Flags().GetString("projectID") - if err != nil { - return gcpFlags{}, fmt.Errorf("parsing projectID string: %w", err) - } - // Source for regex: https://cloud.google.com/resource-manager/reference/rest/v1/projects. - if !projectIDRegex.MatchString(projectID) { - return gcpFlags{}, fmt.Errorf("invalid projectID string: %s", projectID) - } - - serviceAccID, err := cmd.Flags().GetString("serviceAccountID") - if err != nil { - return gcpFlags{}, fmt.Errorf("parsing serviceAccountID string: %w", err) - } - if !serviceAccIDRegex.MatchString(serviceAccID) { - return gcpFlags{}, fmt.Errorf("invalid serviceAccountID string: %s", serviceAccID) - } - configPath, err := cmd.Flags().GetString("config") - if err != nil { - return gcpFlags{}, fmt.Errorf("parsing config string: %w", err) - } - generateConfig, err := cmd.Flags().GetBool("generate-config") - if err != nil { - return gcpFlags{}, fmt.Errorf("parsing generate-config bool: %w", err) - } - yesFlag, err := cmd.Flags().GetBool("yes") - if err != nil { - return gcpFlags{}, fmt.Errorf("parsing yes bool: %w", err) - } - - return gcpFlags{ - serviceAccountID: serviceAccID, - zone: zone, - region: region, - projectID: projectID, - generateConfig: generateConfig, - configPath: configPath, - yesFlag: yesFlag, - }, nil -} - -// gcpFlags contains the parsed flags of the iam create gcp command. -type gcpFlags struct { - serviceAccountID string - zone string - region string - projectID string - generateConfig bool - configPath string - yesFlag bool -} diff --git a/cli/internal/cmd/iamcreategcp_test.go b/cli/internal/cmd/iamcreategcp_test.go deleted file mode 100644 index 9e657b65c..000000000 --- a/cli/internal/cmd/iamcreategcp_test.go +++ /dev/null @@ -1,298 +0,0 @@ -/* -Copyright (c) Edgeless Systems GmbH -SPDX-License-Identifier: AGPL-3.0-only -*/ - -package cmd - -import ( - "bytes" - "testing" - - "github.com/edgelesssys/constellation/v2/cli/internal/iamid" - "github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider" - "github.com/edgelesssys/constellation/v2/internal/config" - "github.com/edgelesssys/constellation/v2/internal/constants" - "github.com/edgelesssys/constellation/v2/internal/file" - "github.com/spf13/afero" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" -) - -func TestIAMCreateGCP(t *testing.T) { - defaultFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { - fs := afero.NewMemMapFs() - fileHandler := file.NewHandler(fs) - for _, f := range existingFiles { - require.NoError(fileHandler.Write(f, []byte{1, 2, 3}, file.OptNone)) - } - return fs - } - readOnlyFs := func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs { - fs := afero.NewReadOnlyFs(afero.NewMemMapFs()) - return fs - } - validIAMIDFile := iamid.File{ - CloudProvider: cloudprovider.GCP, - GCPOutput: iamid.GCPFile{ - ServiceAccountKey: "eyJwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // {"private_key_id":"not_a_secret"} - }, - } - invalidIAMIDFile := iamid.File{ - CloudProvider: cloudprovider.GCP, - GCPOutput: iamid.GCPFile{ - ServiceAccountKey: "ey_Jwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // invalid b64 - }, - } - - testCases := map[string]struct { - setupFs func(require *require.Assertions, provider cloudprovider.Provider, existingFiles []string) afero.Fs - creator *stubIAMCreator - provider cloudprovider.Provider - zoneFlag string - serviceAccountIDFlag string - projectIDFlag string - yesFlag bool - generateConfigFlag bool - configFlag string - existingFiles []string - stdin string - wantAbort bool - wantErr bool - }{ - "iam create gcp": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - yesFlag: true, - }, - "iam create gcp generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - yesFlag: true, - }, - "iam create gcp generate config custom path": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - generateConfigFlag: true, - configFlag: "custom-config.yaml", - yesFlag: true, - }, - "iam create gcp generate config path already exists": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - existingFiles: []string{constants.ConfigFilename}, - yesFlag: true, - wantErr: true, - }, - "iam create gcp generate config custom path already exists": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - generateConfigFlag: true, - configFlag: "custom-config.yaml", - existingFiles: []string{"custom-config.yaml"}, - yesFlag: true, - wantErr: true, - }, - "iam create gcp invalid flags": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "-a", - yesFlag: true, - wantErr: true, - }, - "iam create gcp invalid b64": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: invalidIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - yesFlag: true, - wantErr: true, - }, - "interactive": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - stdin: "yes\n", - }, - "interactive generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - stdin: "yes\n", - configFlag: constants.ConfigFilename, - generateConfigFlag: true, - }, - "interactive abort": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - stdin: "no\n", - wantAbort: true, - }, - "interactive abort generate config": { - setupFs: defaultFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - stdin: "no\n", - wantAbort: true, - configFlag: constants.ConfigFilename, - generateConfigFlag: true, - }, - "unwritable fs": { - setupFs: readOnlyFs, - creator: &stubIAMCreator{id: validIAMIDFile}, - provider: cloudprovider.GCP, - zoneFlag: "europe-west1-a", - serviceAccountIDFlag: "constell-test", - projectIDFlag: "constell-1234", - yesFlag: true, - generateConfigFlag: true, - configFlag: constants.ConfigFilename, - wantErr: true, - }, - } - - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - assert := assert.New(t) - require := require.New(t) - - cmd := newIAMCreateGCPCmd() - cmd.SetOut(&bytes.Buffer{}) - cmd.SetErr(&bytes.Buffer{}) - cmd.SetIn(bytes.NewBufferString(tc.stdin)) - - cmd.Flags().String("config", constants.ConfigFilename, "") // register persistent flag manually - cmd.Flags().Bool("generate-config", false, "") // register persistent flag manually - - if tc.zoneFlag != "" { - require.NoError(cmd.Flags().Set("zone", tc.zoneFlag)) - } - if tc.serviceAccountIDFlag != "" { - require.NoError(cmd.Flags().Set("serviceAccountID", tc.serviceAccountIDFlag)) - } - if tc.projectIDFlag != "" { - require.NoError(cmd.Flags().Set("projectID", tc.projectIDFlag)) - } - if tc.yesFlag { - require.NoError(cmd.Flags().Set("yes", "true")) - } - if tc.generateConfigFlag { - require.NoError(cmd.Flags().Set("generate-config", "true")) - } - if tc.configFlag != "" { - require.NoError(cmd.Flags().Set("config", tc.configFlag)) - } - - fileHandler := file.NewHandler(tc.setupFs(require, tc.provider, tc.existingFiles)) - - err := iamCreateGCP(cmd, &nopSpinner{}, tc.creator, fileHandler) - - if tc.wantErr { - assert.Error(err) - return - } - - if tc.wantAbort { - assert.False(tc.creator.createCalled) - return - } - - if tc.generateConfigFlag { - readConfig := &config.Config{} - readErr := fileHandler.ReadYAML(tc.configFlag, readConfig) - require.NoError(readErr) - assert.Equal(constants.GCPServiceAccountKeyFile, readConfig.Provider.GCP.ServiceAccountKeyPath) - } - require.NoError(err) - assert.True(tc.creator.createCalled) - assert.Equal(tc.creator.id.GCPOutput, validIAMIDFile.GCPOutput) - readServiceAccountKey := &map[string]string{} - readErr := fileHandler.ReadJSON(constants.GCPServiceAccountKeyFile, readServiceAccountKey) - require.NoError(readErr) - assert.Equal("not_a_secret", (*readServiceAccountKey)["private_key_id"]) - }) - } -} - -func TestParseIDFile(t *testing.T) { - validIAMIDFile := iamid.File{ - CloudProvider: cloudprovider.GCP, - GCPOutput: iamid.GCPFile{ - ServiceAccountKey: "eyJwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // {"private_key_id":"not_a_secret"} - }, - } - invalidIAMIDFile := iamid.File{ - CloudProvider: cloudprovider.GCP, - GCPOutput: iamid.GCPFile{ - ServiceAccountKey: "ey_Jwcml2YXRlX2tleV9pZCI6Im5vdF9hX3NlY3JldCJ9Cg==", // invalid b64 - }, - } - testCases := map[string]struct { - idFile iamid.File - wantPrivateKeyID string - wantErr bool - }{ - "valid base64": { - idFile: validIAMIDFile, - wantPrivateKeyID: "not_a_secret", - }, - "invalid base64": { - idFile: invalidIAMIDFile, - wantErr: true, - }, - } - - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - assert := assert.New(t) - outMap, err := parseIDFile(tc.idFile.GCPOutput.ServiceAccountKey) - - if tc.wantErr { - assert.Error(err) - } else { - assert.NoError(err) - assert.Equal(tc.wantPrivateKeyID, outMap["private_key_id"]) - } - }) - } -}