feat: Vault volumen not persistent (#568)

* chore: remove vault volume mapping * chore: update clean-vault command * chore: change approach to authenticate with Vault
0xPolygonID · Dec 4, 2023 · c7e164e · c7e164e
1 parent 51cf2eb
commit c7e164e
Show file tree

Hide file tree

Showing 10 changed files with 24 additions and 33 deletions.
diff --git a/Makefile b/Makefile
@@ -115,13 +115,6 @@ stop:
 up-test:
 	$(DOCKER_COMPOSE_INFRA_CMD) up -d test_postgres vault test_local_files_apache
 
-.PHONY: clean-vault
-clean-vault:
-	rm -R infrastructure/local/.vault/data/init.out
-	rm -R infrastructure/local/.vault/file/core/
-	rm -R infrastructure/local/.vault/file/logical/
-	rm -R infrastructure/local/.vault/file/sys/
-
 $(BIN)/platformid-migrate:
 	$(BUILD_CMD) ./cmd/migrate
 

diff --git a/infrastructure/local/.vault/config/policies.hcl b/infrastructure/local/.vault/config/policies.hcl
@@ -2,6 +2,10 @@ path "iden3/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
 }
 
+path "secret/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
 path "kv/*" {
   capabilities = ["create", "read", "update", "delete", "list"]
 }

diff --git a/infrastructure/local/.vault/scripts/init.sh b/infrastructure/local/.vault/scripts/init.sh
@@ -14,6 +14,7 @@ sleep 5
 FILE=/vault/data/init.out
 if [ ! -e "$FILE" ]; then
     echo -e "===== Initialize the Vault ====="
+    mkdir /vault/data/
     vault operator init > /vault/data/init.out
 fi
 

diff --git a/infrastructure/local/docker-compose-infra.yml b/infrastructure/local/docker-compose-infra.yml
@@ -56,8 +56,6 @@ services:
     volumes:
       - ./.vault/config:/vault/config
       - ./.vault/policies:/vault/policies
-      - ./.vault/data:/vault/data
-      - ./.vault/file:/vault/file:rw
       - ./.vault/scripts:/vault/scripts
       - ./.vault/plugins:/vault/plugins
     ports:

diff --git a/internal/api/main_test.go b/internal/api/main_test.go
@@ -63,8 +63,9 @@ func TestMain(m *testing.M) {
 	cachex = cache.NewMemoryCache()
 
 	vaultCli, err = providers.VaultClient(ctx, providers.Config{
-		Address: cfgForTesting.KeyStore.Address,
-		Token:   cfgForTesting.KeyStore.Token,
+		Address:             cfgForTesting.KeyStore.Address,
+		UserPassAuthEnabled: cfgForTesting.KeyStore.UserPassEnabled,
+		Pass:                cfgForTesting.KeyStore.UserPassPassword,
 	})
 	if err != nil {
 		log.Error(ctx, "failed to acquire vault client", "err", err)

diff --git a/internal/api_ui/main_test.go b/internal/api_ui/main_test.go
@@ -61,10 +61,10 @@ func TestMain(m *testing.M) {
 	storage = s
 
 	cachex = cache.NewMemoryCache()
-
 	vaultCli, err = providers.VaultClient(context.Background(), providers.Config{
-		Address: cfgForTesting.KeyStore.Address,
-		Token:   cfgForTesting.KeyStore.Token,
+		Address:             cfgForTesting.KeyStore.Address,
+		UserPassAuthEnabled: cfgForTesting.KeyStore.UserPassEnabled,
+		Pass:                cfgForTesting.KeyStore.UserPassPassword,
 	})
 	if err != nil {
 		log.Error(ctx, "failed to acquire vault client", "err", err)

diff --git a/internal/config/config.go b/internal/config/config.go
@@ -106,6 +106,8 @@ type KeyStore struct {
 	Address              string `tip:"Keystore address"`
 	Token                string `tip:"Token"`
 	PluginIden3MountPath string `tip:"PluginIden3MountPath"`
+	UserPassEnabled      bool   `tip:"UserPassEnabled"`
+	UserPassPassword     string `tip:"UserPassPassword"`
 }
 
 // Log holds runtime configurations
@@ -353,23 +355,12 @@ func Load(fileName string) (*Configuration, error) {
 func VaultTest() KeyStore {
 	return KeyStore{
 		Address:              "http://localhost:8200",
-		Token:                lookupVaultTestToken(),
 		PluginIden3MountPath: "iden3",
+		UserPassEnabled:      true,
+		UserPassPassword:     "issuernodepwd",
 	}
 }
 
-func lookupVaultTestToken() string {
-	var err error
-	token, ok := os.LookupEnv("VAULT_TEST_TOKEN")
-	if !ok {
-		token, err = lookupVaultTokenFromFile("infrastructure/local/.vault/data/init.out")
-		if err != nil {
-			return ""
-		}
-	}
-	return token
-}
-
 // lookupVaultTokenFromFile parses the vault config file looking for the hvs token and returns it
 // pathVaultConfig MUST be a relative path starting from the root project folder
 // like "infrastructure/local/.vault/data/init.out"

diff --git a/internal/core/services/tests/main_test.go b/internal/core/services/tests/main_test.go
@@ -53,8 +53,9 @@ func TestMain(m *testing.M) {
 	storage = s
 
 	vaultCli, err = providers.VaultClient(ctx, providers.Config{
-		Address: cfgForTesting.KeyStore.Address,
-		Token:   cfgForTesting.KeyStore.Token,
+		Address:             cfgForTesting.KeyStore.Address,
+		UserPassAuthEnabled: cfgForTesting.KeyStore.UserPassEnabled,
+		Pass:                cfgForTesting.KeyStore.UserPassPassword,
 	})
 	if err != nil {
 		log.Error(ctx, "failed to acquire vault client", "err", err)

diff --git a/internal/kms/main_test.go b/internal/kms/main_test.go
@@ -38,8 +38,9 @@ func testKMSSetup(t testing.TB) TestKMS {
 	var err error
 
 	k.VaultCli, err = providers.VaultClient(context.Background(), providers.Config{
-		Address: cfg.Address,
-		Token:   cfg.Token,
+		Address:             cfg.Address,
+		UserPassAuthEnabled: cfg.UserPassEnabled,
+		Pass:                cfg.UserPassPassword,
 	})
 	require.NoError(t, err)
 

diff --git a/internal/kms/vaultPluginIden3KeyProvider_test.go b/internal/kms/vaultPluginIden3KeyProvider_test.go
@@ -127,8 +127,9 @@ func setupPluginBJJProvider(t *testing.T) (vaultCli *api.Client, mountPath strin
 	t.Helper()
 	var err error
 	vaultCli, err = providers.VaultClient(context.Background(), providers.Config{
-		Address: cfg.Address,
-		Token:   cfg.Token,
+		Address:             cfg.Address,
+		UserPassAuthEnabled: cfg.UserPassEnabled,
+		Pass:                cfg.UserPassPassword,
 	})
 	require.NoError(t, err)
 	mountPath = cfg.PluginIden3MountPath