enos/enos-globals.hcl
Rama main · réplica de lectura del repositorio original.
// Copyright IBM Corp. 2016, 2025
// SPDX-License-Identifier: BUSL-1.1
globals {
archs = ["amd64", "arm64"]
artifact_sources = ["local", "crt", "artifactory"]
artifact_types = ["bundle", "package"]
backends = ["consul", "raft"]
backend_license_path = abspath(var.backend_license_path != null ? var.backend_license_path : joinpath(path.root, "./support/consul.hclic"))
backend_tag_key = "VaultStorage"
build_tags = {
"ce" = ["ui"]
"ent" = ["ui", "enterprise", "ent"]
"ent.fips1403" = ["ui", "enterprise", "cgo", "hsm", "fips", "fips_140_3", "ent.fips1403"]
"ent.hsm" = ["ui", "enterprise", "cgo", "hsm", "venthsm"]
"ent.hsm.fips1403" = ["ui", "enterprise", "cgo", "hsm", "fips", "fips_140_3", "ent.hsm.fips1403"]
}
config_modes = ["env", "file"]
consul_editions = ["ce", "ent"]
consul_versions = ["1.18.2", "1.19.2", "1.20.6", "1.21.1"]
distros_aws = ["amzn", "rhel", "sles", "ubuntu"]
distros_fyre = ["centos", "rhel", "rocky", "sles", "ubuntu"]
// Different distros may require different packages, or use different aliases for the same package
distro_packages = {
// NOTE: These versions must always match the output of enos_host_info.target_distro. They are
// also used in various modules `artifact`, `ec2_info`, and `softhsm_install`. If you are adding
// or modifying keys you probably have to update those modules.
amzn = {
"2" = ["nc", "openldap-clients"]
"2023" = ["nc", "openldap-clients"]
}
centos = {
"9" = ["nc", "openldap-clients"]
"10" = ["nc", "openldap-clients"]
}
rhel = {
"8.10" = ["nc", "openldap-clients"]
"9.6" = ["nc", "openldap-clients"]
"9.7" = ["nc", "openldap-clients"]
"9.8" = ["nc", "openldap-clients"]
"10.0" = ["nc", "openldap-clients"]
"10.1" = ["nc", "openldap-clients"]
"10.2" = ["nc", "openldap-clients"]
}
rocky = {
"8.10" = ["nc", "openldap-clients"]
"9.7" = ["nc", "openldap-clients"]
"9.8" = ["nc", "openldap-clients"]
"10.1" = ["nc", "openldap-clients"]
"10.2" = ["nc", "openldap-clients"]
}
sles = {
// When installing Vault RPM packages on a SLES AMI, the openssl package provided
// isn't named "openssl, which rpm doesn't know how to handle. Therefore we add the
// "correctly" named one in our package installation before installing Vault.
"15.7" = ["netcat-openbsd", "openssl", "openldap2-client"]
"16.0" = ["netcat-openbsd", "openssl", "openldap2-client"]
}
ubuntu = {
"22.04" = ["netcat", "ldap-utils"]
"24.04" = ["netcat-openbsd", "ldap-utils"]
"26.04" = ["netcat-openbsd", "ldap-utils"]
}
}
distro_version = {
amzn = var.distro_version_amzn
centos = var.distro_version_centos
rhel = var.distro_version_rhel
rocky = var.distro_version_rhel
sles = var.distro_version_sles
ubuntu = var.distro_version_ubuntu
}
# NOTE: These were generated from fyre_os_info for SVL on 6/9/25. They're a
# moving target so it's likely they'll need to be updated in the future.
# Make sure distro_packages is updated for any changes that are made here.
distro_versions_fyre = {
amd64 = {
centos = ["10", "9"]
rhel = ["10.1", "10.0", "9.6", "8.10"]
rocky = ["10.1", "9.7", "8.10"]
sles = ["16.0", "15.7"]
ubuntu = ["26.04", "24.04", "22.04"]
}
ppc64le = {
centos = ["10", "9"]
rhel = ["10.2", "10.0", "9.8", "9.6", "8.10"]
rocky = ["10.2", "10.1", "9.7", "9.8"]
sles = ["16.0", "15.7"]
ubuntu = ["26.04", "24.04", "22.04"]
}
s390x = {
centos = []
rhel = ["10.0", "8.10", "9.6"]
rocky = []
sles = ["16.0", "15.7"]
ubuntu = ["24.04", "22.04"]
}
}
# The default versions we each architecture/distro combo. We currently use
# the latest as that's how things are ordered up above. When we start running
# these scenarios we'll use the distro_versions_fyre as sample attributes to
# distribute over all versions.
distro_version_fyre = {
amd64 = {
centos = global.distro_versions_fyre["amd64"]["centos"][0]
rhel = global.distro_versions_fyre["amd64"]["rhel"][0]
rocky = global.distro_versions_fyre["amd64"]["rocky"][0]
sles = global.distro_versions_fyre["amd64"]["sles"][0]
ubuntu = global.distro_versions_fyre["amd64"]["ubuntu"][0]
}
ppc64le = {
centos = global.distro_versions_fyre["ppc64le"]["centos"][0]
rhel = global.distro_versions_fyre["ppc64le"]["rhel"][0]
rocky = global.distro_versions_fyre["ppc64le"]["rocky"][0]
sles = global.distro_versions_fyre["ppc64le"]["sles"][0]
ubuntu = global.distro_versions_fyre["ppc64le"]["ubuntu"][0]
}
s390x = {
centos = null
rhel = global.distro_versions_fyre["s390x"]["rhel"][0]
rocky = null
sles = global.distro_versions_fyre["s390x"]["sles"][0]
ubuntu = global.distro_versions_fyre["s390x"]["ubuntu"][0]
}
}
editions = ["ce", "ent", "ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
enterprise_editions = [for e in global.editions : e if e != "ce"]
ip_versions = ["4", "6"]
package_manager = {
"amzn" = "yum"
"centos" = "yum"
"rhel" = "yum"
"rocky" = "yum"
"sles" = "zypper"
"ubuntu" = "apt"
}
packages = ["jq"]
// Ports that we'll open up for ingress in the security group for all target machines.
// Port protocol maps to the IpProtocol schema: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html
// Ports that we'll open up for ingress in the security group for all Vault target machines.
vault_cluster_ports = {
vault_agent : {
description = "Vault Agent"
port = 8100
protocol = "tcp"
},
vault_proxy : {
description = "Vault Proxy"
port = 8101
protocol = "tcp"
},
vault_listener : {
description = "Vault Addr listener"
port = 8200
protocol = "tcp"
},
vault_cluster : {
description = "Vault Cluster listener"
port = 8201
protocol = "tcp"
}
}
// Ports that we'll open up for ingress in the security group for all Consul target machines.
consul_cluster_ports = {
consul_rpc : {
description = "Consul internal communication"
port = 8300
protocol = "tcp"
},
consul_serf_lan_tcp : {
description = "Consul Serf LAN TCP"
port = 8301
protocol = "tcp"
},
consul_serf_lan_udp : {
description = "Consul Serf LAN UDP"
port = 8301
protocol = "udp"
},
consul_serf_wan_tcp : {
description = "Consul Serf WAN TCP"
port = 8302
protocol = "tcp"
},
consul_serf_wan_udp : {
description = "Consul Serf WAN UDP"
port = 8302
protocol = "udp"
},
consul_http : {
description = "Consul HTTP API"
port = 8500
protocol = "tcp"
},
consul_https : {
description = "Consul HTTPS API"
port = 8501
protocol = "tcp"
},
consul_grpc : {
description = "Consul gRPC API"
port = 8502
protocol = "tcp"
},
consul_grpc_tls : {
description = "Consul gRPC TLS API"
port = 8503
protocol = "tcp"
},
consul_dns_tcp : {
description = "Consul TCP DNS Server"
port = 8600
protocol = "tcp"
},
consul_dns_udp : {
description = "Consul UDP DNS Server"
port = 8600
protocol = "udp"
}
}
ingress_ports = {
ssh : {
description = "SSH"
port = 22
protocol = "tcp"
}
}
// Database configurations for Vault database secrets engine testing
database_configs = {
postgres : {
port = 5432
version = "16-alpine"
username = "postgres"
password = "secret"
database = "postgres"
description = "PostgreSQL Server"
},
mongodb : {
port = 27017
version = "7.0"
username = "admin"
password = "secret"
database = "admin"
description = "MongoDB Server"
},
mysql : {
port = 3306
version = "8.0"
username = "root"
password = "secret"
database = "mysql"
description = "MySQL Server"
}
}
// Ports that we'll open up for ingress in the security group for all external integration target machines.
integration_host_ports = merge(
{
ldap : {
description = "LDAP"
port = 389
protocol = "tcp"
},
ldaps : {
description = "LDAPS"
port = 636
protocol = "tcp"
},
kmip : {
description = "KMIP Server"
port = 5696
protocol = "tcp"
}
},
// Add database ports dynamically from database_configs
{ for db_name, db_config in global.database_configs : db_name => {
description = db_config.description
port = db_config.port
protocol = "tcp"
} }
)
// Combine all ports into a single map
ports = merge(
global.vault_cluster_ports,
global.consul_cluster_ports,
global.ingress_ports,
global.integration_host_ports
)
seals = ["awskms", "pkcs11", "shamir"]
tags = merge({
"Project Name" : var.project_name
"Project" : "Enos",
"Environment" : "ci"
}, var.tags)
aws_api_config = {
max_retries = 5
default_timeout = "5m"
resource_timeout = "10m"
}
vault_install_dir = {
bundle = "/opt/vault/bin"
package = "/usr/bin"
}
vault_license_path = abspath(var.vault_license_path != null ? var.vault_license_path : joinpath(path.root, "./support/vault.hclic"))
vault_tag_key = "vault-cluster"
vault_disable_mlock = false
}