Skip to content

Error handling for identity_oidc_key vault calls - #1142

Merged
tvoran merged 1 commit into
masterfrom
fix-identity-oidc-test
Aug 12, 2021
Merged

Error handling for identity_oidc_key vault calls#1142
tvoran merged 1 commit into
masterfrom
fix-identity-oidc-test

Conversation

@tvoran

@tvoran tvoran commented Aug 9, 2021

Copy link
Copy Markdown
Member

Checks the err from identityOidcKeyApiWrite() and adds tests to
exercise the error handling. Updates allowed client id test to satisfy
rotation_period and verification_ttl restrictions that are now
enforced in Vault 1.8.1 per hashicorp/vault#12151.

Since CI is using the latest vault image, TestAccIdentityOidcKeyAllowedClientId() started failing because the config change in ttl's wasn't being successfully applied to Vault, because 3600 was lower than the associated role's token ttl. The error being ignored from Vault was of the form:

unable to update key "test-role-8337740116836207150" because it is currently referenced by one or more roles with a token ttl greater than 3600 seconds

Community Note

  • Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
  • Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Relates to hashicorp/vault#12151

Release note for CHANGELOG:

resource/identity_oidc_key: Error handling for identity oidc key vault calls

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccIdentityOidc -count=1'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test $(go list ./...) -v -run=TestAccIdentityOidc -count=1 -timeout 120m
[...]
=== RUN   TestAccIdentityOidcKeyAllowedClientId
--- PASS: TestAccIdentityOidcKeyAllowedClientId (0.53s)
=== RUN   TestAccIdentityOidcKey
--- PASS: TestAccIdentityOidcKey (0.30s)
=== RUN   TestAccIdentityOidcKeyUpdate
--- PASS: TestAccIdentityOidcKeyUpdate (0.55s)
=== RUN   TestAccIdentityOidcRole
--- PASS: TestAccIdentityOidcRole (0.23s)
=== RUN   TestAccIdentityOidcRoleWithClientId
--- PASS: TestAccIdentityOidcRoleWithClientId (0.31s)
=== RUN   TestAccIdentityOidcRoleUpdate
--- PASS: TestAccIdentityOidcRoleUpdate (0.45s)
=== RUN   TestAccIdentityOidc
--- PASS: TestAccIdentityOidc (0.20s)
PASS
ok  	github.com/hashicorp/terraform-provider-vault/vault	4.632s

Checks the err from `identityOidcKeyApiWrite()` and adds tests to
exercise the error handling. Updates allowed client id test to satisfy
rotation_period and verification_ttl restrictions that are now
enforced in Vault 1.8.1.
@github-actions github-actions Bot added the size/S label Aug 9, 2021
@tvoran
tvoran requested review from austingebauer and calvn August 9, 2021 21:42
@tvoran
tvoran merged commit 06651b1 into master Aug 12, 2021
@tvoran
tvoran deleted the fix-identity-oidc-test branch August 12, 2021 21:17
davidmontoyago pushed a commit to davidmontoyago/terraform-provider-vault that referenced this pull request Aug 17, 2021
Checks the err from `identityOidcKeyApiWrite()` and adds tests to
exercise the error handling. Updates allowed client id test to satisfy
rotation_period and verification_ttl restrictions that are now
enforced in Vault 1.8.1.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants