debug vault daemon in CI

Author: nzlosh

.github/workflows/build_and_test.yaml

@@ -19,14 +19,17 @@ jobs:
         include:
           - python-version-short: "3.9"
             python-version: 3.9.21
+            consul-version: "1.22.7-1"
             vault-version: "2.0.0-1"
             hvac-gh-tag: "v2.4.0"
           - python-version-short: "3.10"
             python-version: 3.10.16
+            consul-version: "1.22.7-1"
             vault-version: "2.0.0-1"
             hvac-gh-tag: "v2.4.0"
           - python-version-short: "3.11"
             python-version: 3.11.11
+            consul-version: "1.22.7-1"
             vault-version: "2.0.0-1"
             hvac-gh-tag: "v2.4.0"
     steps:
@@ -59,22 +62,7 @@ jobs:
         working-directory: pack
         shell: bash
         run: |
-          wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/hashicorp.gpg
-          echo "deb [arch=amd64, signed-by=/etc/apt/trusted.gpg.d/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" \
-            | sudo tee /etc/apt/sources.list.d/hashicorp.list
-
-          sudo apt update \
-            -o Dir::Etc::sourceparts="-" \
-            -o APT::Get::List-Cleanup="0" \
-            -o Dir::Etc::sourcelist="sources.list.d/hashicorp.list"
-
-          sudo apt install consul vault=${{ matrix.vault-version }}
-
-          # We disble cap_ipc_lock here as its generally incompatabile with GitHub
-          # Actions' runtime environments.
-          sudo setcap cap_ipc_lock= /usr/bin/vault
-          sudo systemctl restart consul vault
-          sudo systemctl status consul vault
+          ${ROOT_DIR}/tests/scripts/install_vault ${{ matrix.vault-version }} ${{ matrix.consul-version }}
 
       - name: Setup hvac symlinks
         shell: bash
@@ -94,6 +82,10 @@ jobs:
 
       - name: Run pack tests
         uses: StackStorm-Exchange/ci/.github/actions/test@master
+        env:
+          VAULT_ADDR: "https://127.0.0.1:8200"
+          VAULT_TOKEN: "root"
+          VAULT_CACERT: "/home/vault/vault-ca.pem"
         with:
           enable-common-libs: false
 

tests/scripts/install_vault

@@ -0,0 +1,59 @@
+#!/bin/bash
+
+set -eux
+
+# Installing consul and vault in the CI/CD environment is complex.  That
+# complexity is now wrapped inside this shell script for a clearer CI/CD YAML.
+
+VAULT_VERSION="$1"
+CONSUL_VERSION="$2"
+
+# Get the hashicorp public signing key for the APT repo.
+wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/hashicorp.gpg
+
+# Configure the APT source list to trust the signing key
+sudo tee /etc/apt/sources.list.d/hashicorp.list <<<"deb [arch=amd64, signed-by=/etc/apt/trusted.gpg.d/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
+
+# Update the package list
+sudo apt update -o Dir::Etc::sourceparts="-" -o APT::Get::List-Cleanup="0" -o Dir::Etc::sourcelist="sources.list.d/hashicorp.list"
+
+# Install Vault and Consul
+#~ sudo apt install consul=${CONSUL_VERSION} vault=${VAULT_VERSION}
+sudo apt install vault=${VAULT_VERSION}
+
+# We disble cap_ipc_lock here as its generally incompatabile with GitHub Actions' runtime environments.
+sudo setcap cap_ipc_lock= /usr/bin/vault
+
+#~ # Consul needs to be explicitly configured to start in the CI/CD environment.
+#~ sudo mkdir -p /srv/consul && sudo chown -R consul:consul /srv/consul
+
+#~ sudo tee /etc/consul.d/consul.hcl >/dev/null <<EOF
+#~ enable_debug = false
+#~ datacenter = "cicd"
+#~ data_dir = "/srv/consul"
+#~ ui_config{
+#~ enabled = false
+#~ }
+#~ server = true
+#~ bind_addr = "127.0.0.1"
+#~ client_addr = "127.0.0.1"
+#~ advertise_addr = "127.0.0.1"
+#~ retry_join = ["localhost"]
+#~ bootstrap_expect = 0
+#~ encrypt = "katpv2wgyY5Za8bGAHh7+URaeLJWh4g+gK0GBjmvQXA="
+#~ EOF
+
+#~ sudo systemctl restart consul
+
+# Run Vault dev instance for tests
+sudo mkdir -p /home/vault /etc/systemd/system/vault.service.d
+sudo chown -R vault:vault /home/vault
+
+sudo tee /etc/systemd/system/vault.service.d/override.conf >/dev/null <<EOF
+[Service]
+ExecStart=
+ExecStart=/usr/bin/vault server -dev -dev-root-token-id root -dev-tls -dev-tls-cert-dir=/home/vault
+ProtectHome=no
+EOF
+sudo systemctl daemon-reload
+sudo systemctl restart vault

tests/vault_action_tests_base.py

@@ -1,6 +1,6 @@
 from st2tests.base import BaseActionTestCase
 
-from tests.utils import get_config_file_path
+# #from tests.utils import get_config_file_path
 from tests.utils.hvac_integration_test_case import HvacIntegrationTestCase
 
 
@@ -59,9 +59,12 @@ def tearDown(self):
 
     def build_dummy_pack_config(self, url="https://localhost:8200"):
         # based on create_client() in hvac/tests/utils/__init__.py
-        server_cert_path = get_config_file_path("server-cert.pem")
+        # CI/CD only has a self-signed cert.
+        # #server_cert_path = get_config_file_path("server-cert.pem")
+        server_cert_path = False
 
         token_result = self.client.auth.token.create(ttl=self.default_token_lease)
+        print(f"token_result: {token_result}")
         token = token_result["auth"]["client_token"]
 
         dummy_pack_config = {