Update to v2.3.1 (#242 )

chore(deps): bump path-parse from 1.0.6 to 1.0.7 (#239 )
set vault license for enterprise tests (#240 )
2026-07-26 00:13:16 +03:00 · 2021-08-23 08:36:01 -07:00 · 2021-08-12 19:00:07 +00:00 · 2021-08-12 11:55:16 -07:00 · 2021-08-12 17:15:05 +00:00 · 2021-06-23 14:03:57 -07:00
10 changed files with 211 additions and 66 deletions
@@ -74,6 +74,8 @@ jobs:

    - name: Run docker-compose
      run: docker-compose up -d vault-enterprise
+      env:
+        VAULT_LICENSE_CI: ${{ secrets.VAULT_LICENSE_CI }}

    - uses: actions/setup-node@v1
      with:
@@ -93,7 +95,7 @@ jobs:
    - name: NPM Build
      run: npm run build

-    - name: NPM Run test:intergration:enterprise
+    - name: NPM Run test:integration:enterprise
      run: npm run test:integration:enterprise
      env:
        VAULT_HOST: localhost
@@ -1,5 +1,17 @@
 ## Unreleased

+## 2.3.1 (August 18th, 2021)
+
+Improvements:
+* bump normalize-url from 4.5.0 to 4.5.1 [GH-227](https://github.com/hashicorp/vault-action/pull/227)
+* bump path-parse from 1.0.6 to 1.0.7 [GH-239](https://github.com/hashicorp/vault-action/pull/239)
+
+## 2.3.0 (June 23rd, 2021)
+
+Features:
+* K8s auth method is now supported [GH-218](https://github.com/hashicorp/vault-action/pull/218)
+* Custom auth method mount points is configurable [GH-218](https://github.com/hashicorp/vault-action/pull/218)
+
 ## 2.2.0 (May 6th, 2021)

 Security:
@@ -10,20 +10,20 @@ A helper action for easily pulling secrets from HashiCorp Vault™.

 <!-- TOC -->

- [Example Usage](#example-usage)
- [Authentication method](#authentication-method)
- [Key Syntax](#key-syntax)
+- [Vault GitHub Action](#vault-github-action)
+  - [Example Usage](#example-usage)
+  - [Authentication method](#authentication-method)
+  - [Key Syntax](#key-syntax)
    - [Simple Key](#simple-key)
    - [Set Output Variable Name](#set-output-variable-name)
    - [Multiple Secrets](#multiple-secrets)
-    - [Nested Secrets](#nested-secrets)
- [Other Secret Engines](#other-secret-engines)
- [Adding Extra Headers](#adding-extra-headers)
- [Vault Enterprise Features](#vault-enterprise-features)
+  - [Other Secret Engines](#other-secret-engines)
+  - [Adding Extra Headers](#adding-extra-headers)
+  - [Vault Enterprise Features](#vault-enterprise-features)
    - [Namespace](#namespace)
- [Reference](#reference)
- [Masking - Hiding Secrets from Logs](#masking---hiding-secrets-from-logs)
- [Normalization](#normalization)
+  - [Reference](#reference)
+  - [Masking - Hiding Secrets from Logs](#masking---hiding-secrets-from-logs)
+  - [Normalization](#normalization)

 <!-- /TOC -->

@@ -36,7 +36,7 @@ jobs:
        steps:
            # ...
            - name: Import Secrets
-              uses: hashicorp/vault-action@v2.1.2
+              uses: hashicorp/vault-action@v2.3.1
              with:
                url: https://vault.mycompany.com:8200
                token: ${{ secrets.VaultToken }}
@@ -98,6 +98,15 @@ with:
  jwtTtl: 3600 # 1 hour, default value
 ```

+- **kubernetes**: you must provide the `role` paramaters. You can optionally override the `kubernetesTokenPath` paramater for custom mounted serviceAccounts. Consider [kubernetes auth](https://www.vaultproject.io/docs/auth/kubernetes) when using self-hosted runners on Kubernetes:
+```yaml
+...
+with:
+  url: https://vault.mycompany.com:8200
+  method: kubernetes
+  role: ${{ secrets.KUBE_ROLE }}
+```
+
 If any other method is specified and you provide an `authPayload`, the action will attempt to `POST` to `auth/${method}/login` with the provided payload and parse out the client token.

 ## Key Syntax
@@ -261,14 +270,16 @@ Here are all the inputs available through `with`:
 | `secrets`           | A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details |         | ✔        |
 | `namespace`         | The Vault namespace from which to query secrets. Vault Enterprise only, unset by default                                                             |         |          |
 | `method`            | The method to use to authenticate with Vault.                                                                                                        | `token` |          |
+| `role`              | Vault role for specified auth method                                                                                                                 |         |          |
+| `path`              | Custom vault path, if the auth method was enabled at a different path                                                                                                |         |          |
 | `token`             | The Vault Token to be used to authenticate with Vault                                                                                                |         |          |
 | `roleId`            | The Role Id for App Role authentication                                                                                                              |         |          |
 | `secretId`          | The Secret Id for App Role authentication                                                                                                            |         |          |
 | `githubToken`       | The Github Token to be used to authenticate with Vault                                                                                               |         |          |
-| `role`              | Vault role for specified auth method                                                                                                                 |         |          |
 | `jwtPrivateKey`     | Base64 encoded Private key to sign JWT                                                                                                               |         |          |
 | `jwtKeyPassword`    | Password for key stored in jwtPrivateKey (if needed)                                                                                                 |         |          |
 | `jwtTtl`            | Time in seconds, after which token expires                                                                                                           |         | 3600     |
+| `kubernetesTokenPath`         | The path to the service-account secret with the jwt token for kubernetes based authentication                                                                                               |`/var/run/secrets/kubernetes.io/serviceaccount/token`         |          |
 | `authPayload`       | The JSON payload to be sent to Vault when using a custom authentication method.                                                                      |         |          |
 | `extraHeaders`      | A string of newline separated extra headers to include on every request.                                                                             |         |          |
 | `exportEnv`         | Whether or not export secrets as environment variables.                                                                                              | `true`  |          |
@@ -14,6 +14,12 @@ inputs:
    description: 'The method to use to authenticate with Vault.'
    default: 'token'
    required: false
+  role:
+    description: 'Vault role for specified auth method'
+    required: false
+  path:
+    description: 'Custom Vault path, if the auth method was mounted at a different path'
+    required: false
  token:
    description: 'The Vault Token to be used to authenticate with Vault'
    required: false
@@ -26,6 +32,10 @@ inputs:
  githubToken:
    description: 'The Github Token to be used to authenticate with Vault'
    required: false
+  kubernetesTokenPath:
+    description: 'The path to the Kubernetes service account secret'
+    required: false
+    default: '/var/run/secrets/kubernetes.io/serviceaccount/token'
  authPayload:
    description: 'The JSON payload to be sent to Vault when using a custom authentication method.'
    required: false
@@ -52,10 +62,7 @@ inputs:
  tlsSkipVerify:
    description: 'When set to true, disables verification of the Vault server certificate.  Setting this to true in production is not recommended.'
    required: false
-    default: "false"
-  role:
-    description: 'Vault role for specified auth method'
-    required: false
+    default: 'false'
  jwtPrivateKey:
    description: 'Base64 encoded Private key to sign JWT'
    required: false
@@ -434,7 +434,7 @@ const testParameter = (name, filters) => {
 };

 const normalizeDataURL = (urlString, {stripHash}) => {
-	const parts = urlString.match(/^data:(.*?),(.*?)(?:#(.*))?$/);
+	const parts = urlString.match(/^data:([^,]*?),([^#]*?)(?:#(.*))?$/);

 	if (!parts) {
 		throw new Error(`Invalid URL: ${urlString}`);
@@ -976,22 +976,26 @@ exports.default = parseBody;
 // @ts-check
 const core = __webpack_require__(470);
 const rsasign = __webpack_require__(758);
+const fs = __webpack_require__(747);

+const defaultKubernetesTokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token'
 /***
 * Authenticate with Vault and retrieve a Vault token that can be used for requests.
 * @param {string} method
 * @param {import('got').Got} client
 */
 async function retrieveToken(method, client) {
+    const path = core.getInput('path', { required: false }) || method;
+
    switch (method) {
        case 'approle': {
            const vaultRoleId = core.getInput('roleId', { required: true });
            const vaultSecretId = core.getInput('secretId', { required: true });
-            return await getClientToken(client, method, { role_id: vaultRoleId, secret_id: vaultSecretId });
+            return await getClientToken(client, method, path, { role_id: vaultRoleId, secret_id: vaultSecretId });
        }
        case 'github': {
            const githubToken = core.getInput('githubToken', { required: true });
-            return await getClientToken(client, method, { token: githubToken });
+            return await getClientToken(client, method, path, { token: githubToken });
        }
        case 'jwt': {
            const role = core.getInput('role', { required: true });
@@ -1000,8 +1004,18 @@ async function retrieveToken(method, client) {
            const keyPassword = core.getInput('jwtKeyPassword', { required: false });
            const tokenTtl = core.getInput('jwtTtl', { required: false }) || '3600'; // 1 hour
            const jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl));
-            return await getClientToken(client, method, { jwt: jwt, role: role });
+            return await getClientToken(client, method, path, { jwt: jwt, role: role });
        }
+        case 'kubernetes': {
+            const role = core.getInput('role', { required: true })
+            const tokenPath = core.getInput('kubernetesTokenPath', { required: false }) || defaultKubernetesTokenPath
+            const data = fs.readFileSync(tokenPath, 'utf8')
+            if (!(role && data) && data != "") {
+                throw new Error("Role Name must be set and a kubernetes token must set")
+            }
+            return await getClientToken(client, method, path, { jwt: data, role: role })
+        }
+
        default: {
            if (!method || method === 'token') {
                return core.getInput('token', { required: true });
@@ -1011,7 +1025,7 @@ async function retrieveToken(method, client) {
                if (!payload) {
                    throw Error('When using a custom authentication method, you must provide the payload');
                }
-                return await getClientToken(client, method, JSON.parse(payload.trim()));
+                return await getClientToken(client, method, path, JSON.parse(payload.trim()));
            }
        }
    }
@@ -1047,9 +1061,10 @@ function generateJwt(privateKey, keyPassword, ttl) {
 * Call the appropriate login endpoint and parse out the token in the response.
 * @param {import('got').Got} client
 * @param {string} method
+ * @param {string} path
 * @param {any} payload
 */
-async function getClientToken(client, method, payload) {
+async function getClientToken(client, method, path, payload) {
    /** @type {'json'} */
    const responseType = 'json';
    var options = {
@@ -1057,10 +1072,10 @@ async function getClientToken(client, method, payload) {
        responseType,
    };

-    core.debug(`Retrieving Vault Token from v1/auth/${method}/login endpoint`);
+    core.debug(`Retrieving Vault Token from v1/auth/${path}/login endpoint`);

    /** @type {import('got').Response<VaultLoginResponse>} */
-    const response = await client.post(`v1/auth/${method}/login`, options);
+    const response = await client.post(`v1/auth/${path}/login`, options);
    if (response && response.body && response.body.auth && response.body.auth.client_token) {
        core.debug('✔ Vault Token successfully retrieved');

@@ -14577,7 +14592,7 @@ const got = __webpack_require__(77).default;
 const jsonata = __webpack_require__(350);
 const { auth: { retrieveToken }, secrets: { getSecrets } } = __webpack_require__(676);

-const AUTH_METHODS = ['approle', 'token', 'github', 'jwt'];
+const AUTH_METHODS = ['approle', 'token', 'github', 'jwt', 'kubernetes'];

 async function exportSecrets() {
    const vaultUrl = core.getInput('url', { required: true });
@@ -12,6 +12,7 @@ services:
    image: hashicorp/vault-enterprise:latest
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: testtoken
+      VAULT_LICENSE: ${VAULT_LICENSE_CI}
    ports:
      - 8200:8200
    privileged: true
@@ -2346,9 +2346,9 @@
          "dev": true
        },
        "normalize-url": {
-          "version": "5.3.0",
-          "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-5.3.0.tgz",
-          "integrity": "sha512-9/nOVLYYe/dO/eJeQUNaGUF4m4Z5E7cb9oNTKabH+bNf19mqj60txTcveQxL0GlcWLXCxkOu2/LwL8oW0idIDA==",
+          "version": "5.3.1",
+          "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-5.3.1.tgz",
+          "integrity": "sha512-K1c7+vaAP+Yh5bOGmA10PGPpp+6h7WZrl7GwqKhUflBc9flU9pzG27DDeB9+iuhZkE3BJZOcgN1P/2sS5pqrWw==",
          "dev": true
        },
        "npm-run-path": {
@@ -4863,13 +4863,10 @@
      "dev": true
    },
    "hosted-git-info": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.7.tgz",
-      "integrity": "sha512-fWqc0IcuXs+BmE9orLDyVykAG9GJtGLGuZAAqgcckPgv5xad4AcXGIv8galtQvlwutxSlaMcdw7BUtq2EIvqCQ==",
-      "dev": true,
-      "requires": {
-        "lru-cache": "^6.0.0"
-      }
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
+      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
+      "dev": true
    },
    "html-encoding-sniffer": {
      "version": "2.0.1",
@@ -9498,6 +9495,15 @@
        "validate-npm-package-license": "^3.0.1"
      },
      "dependencies": {
+        "hosted-git-info": {
+          "version": "3.0.8",
+          "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.8.tgz",
+          "integrity": "sha512-aXpmwoOhRBrw6X3j0h5RloK4x1OzsxMPyxqIHyNfSe2pypkVTZFpEiRoSipPEPlMrh0HW/XsjkJ5WgnCirpNUw==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        },
        "resolve": {
          "version": "1.19.0",
          "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.19.0.tgz",
@@ -9526,9 +9532,9 @@
      "dev": true
    },
    "normalize-url": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.0.tgz",
-      "integrity": "sha512-2s47yzUxdexf1OhyRi4Em83iQk0aPvwTddtFz4hnSSw9dCEsLEGf6SwIO8ss/19S9iBb5sJaOuTvTGDeZI00BQ=="
+      "version": "4.5.1",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.1.tgz",
+      "integrity": "sha512-9UZCFRHQdNrfTpGg8+1INIg93B6zE0aXMVFkw1WFwvO4SlZywU6aLg5Of0Ap/PgcbSw4LNxvMWXMeugwMCX0AA=="
    },
    "npm": {
      "version": "6.14.9",
@@ -10843,11 +10849,6 @@
          "bundled": true,
          "dev": true
        },
-        "hosted-git-info": {
-          "version": "2.8.8",
-          "bundled": true,
-          "dev": true
-        },
        "http-cache-semantics": {
          "version": "3.8.1",
          "bundled": true,
@@ -11935,11 +11936,6 @@
          "bundled": true,
          "dev": true
        },
-        "path-parse": {
-          "version": "1.0.6",
-          "bundled": true,
-          "dev": true
-        },
        "performance-now": {
          "version": "2.1.0",
          "bundled": true,
@@ -13285,9 +13281,9 @@
      "dev": true
    },
    "path-parse": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz",
-      "integrity": "sha512-GSmOT2EbHrINBf9SR7CDELwlJ8AENk3Qn7OikK4nFYAu3Ote2+JYNVvkpAEQm3/TLNEJFD/xZJjzyxg3KBWOzw==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
      "dev": true
    },
    "path-type": {
@@ -13496,12 +13492,6 @@
        "type-fest": "^0.6.0"
      },
      "dependencies": {
-        "hosted-git-info": {
-          "version": "2.8.8",
-          "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz",
-          "integrity": "sha512-f/wzC2QaWBs7t9IYqB4T3sR1xviIViXJRJTWBlx2Gf3g0Xi5vI7Yy4koXQ1c9OYDGHN9sBy1DQ2AB8fqZBWhUg==",
-          "dev": true
-        },
        "normalize-package-data": {
          "version": "2.5.0",
          "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
@@ -13959,6 +13949,15 @@
            "pump": "^3.0.0"
          }
        },
+        "hosted-git-info": {
+          "version": "3.0.8",
+          "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.8.tgz",
+          "integrity": "sha512-aXpmwoOhRBrw6X3j0h5RloK4x1OzsxMPyxqIHyNfSe2pypkVTZFpEiRoSipPEPlMrh0HW/XsjkJ5WgnCirpNUw==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        },
        "is-number": {
          "version": "7.0.0",
          "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
@@ -5,7 +5,7 @@ const got = require('got').default;
 const jsonata = require('jsonata');
 const { auth: { retrieveToken }, secrets: { getSecrets } } = require('./index');

-const AUTH_METHODS = ['approle', 'token', 'github', 'jwt'];
+const AUTH_METHODS = ['approle', 'token', 'github', 'jwt', 'kubernetes'];

 async function exportSecrets() {
    const vaultUrl = core.getInput('url', { required: true });
@@ -1,22 +1,26 @@
 // @ts-check
 const core = require('@actions/core');
 const rsasign = require('jsrsasign');
+const fs = require('fs');

+const defaultKubernetesTokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token'
 /***
 * Authenticate with Vault and retrieve a Vault token that can be used for requests.
 * @param {string} method
 * @param {import('got').Got} client
 */
 async function retrieveToken(method, client) {
+    const path = core.getInput('path', { required: false }) || method;
+
    switch (method) {
        case 'approle': {
            const vaultRoleId = core.getInput('roleId', { required: true });
            const vaultSecretId = core.getInput('secretId', { required: true });
-            return await getClientToken(client, method, { role_id: vaultRoleId, secret_id: vaultSecretId });
+            return await getClientToken(client, method, path, { role_id: vaultRoleId, secret_id: vaultSecretId });
        }
        case 'github': {
            const githubToken = core.getInput('githubToken', { required: true });
-            return await getClientToken(client, method, { token: githubToken });
+            return await getClientToken(client, method, path, { token: githubToken });
        }
        case 'jwt': {
            const role = core.getInput('role', { required: true });
@@ -25,8 +29,18 @@ async function retrieveToken(method, client) {
            const keyPassword = core.getInput('jwtKeyPassword', { required: false });
            const tokenTtl = core.getInput('jwtTtl', { required: false }) || '3600'; // 1 hour
            const jwt = generateJwt(privateKey, keyPassword, Number(tokenTtl));
-            return await getClientToken(client, method, { jwt: jwt, role: role });
+            return await getClientToken(client, method, path, { jwt: jwt, role: role });
        }
+        case 'kubernetes': {
+            const role = core.getInput('role', { required: true })
+            const tokenPath = core.getInput('kubernetesTokenPath', { required: false }) || defaultKubernetesTokenPath
+            const data = fs.readFileSync(tokenPath, 'utf8')
+            if (!(role && data) && data != "") {
+                throw new Error("Role Name must be set and a kubernetes token must set")
+            }
+            return await getClientToken(client, method, path, { jwt: data, role: role })
+        }
+
        default: {
            if (!method || method === 'token') {
                return core.getInput('token', { required: true });
@@ -36,7 +50,7 @@ async function retrieveToken(method, client) {
                if (!payload) {
                    throw Error('When using a custom authentication method, you must provide the payload');
                }
-                return await getClientToken(client, method, JSON.parse(payload.trim()));
+                return await getClientToken(client, method, path, JSON.parse(payload.trim()));
            }
        }
    }
@@ -72,9 +86,10 @@ function generateJwt(privateKey, keyPassword, ttl) {
 * Call the appropriate login endpoint and parse out the token in the response.
 * @param {import('got').Got} client
 * @param {string} method
+ * @param {string} path
 * @param {any} payload
 */
-async function getClientToken(client, method, payload) {
+async function getClientToken(client, method, path, payload) {
    /** @type {'json'} */
    const responseType = 'json';
    var options = {
@@ -82,10 +97,10 @@ async function getClientToken(client, method, payload) {
        responseType,
    };

-    core.debug(`Retrieving Vault Token from v1/auth/${method}/login endpoint`);
+    core.debug(`Retrieving Vault Token from v1/auth/${path}/login endpoint`);

    /** @type {import('got').Response<VaultLoginResponse>} */
-    const response = await client.post(`v1/auth/${method}/login`, options);
+    const response = await client.post(`v1/auth/${path}/login`, options);
    if (response && response.body && response.body.auth && response.body.auth.client_token) {
        core.debug('✔ Vault Token successfully retrieved');

@@ -0,0 +1,83 @@
+jest.mock('got');
+jest.mock('@actions/core');
+jest.mock('@actions/core/lib/command');
+jest.mock("fs")
+
+const core = require('@actions/core');
+const got = require('got');
+const fs = require("fs")
+const { when } = require('jest-when');
+
+
+const {
+    retrieveToken
+} = require('./auth');
+
+
+function mockInput(name, key) {
+    when(core.getInput)
+        .calledWith(name)
+        .mockReturnValueOnce(key);
+}
+
+function mockApiResponse() {
+    const response = { body: { auth: { client_token: testToken, renewable: true, policies: [], accessor: "accessor" } } }
+    got.post = jest.fn()
+    got.post.mockReturnValue(response)
+}
+const testToken = "testoken";
+
+describe("test retrival for token", () => {
+
+    beforeEach(() => {
+        jest.resetAllMocks();
+    });
+
+    it("test retrival with approle", async () => {
+        const method = 'approle'
+        mockApiResponse()
+        const testRoleId = "testRoleId"
+        const testSecretId = "testSecretId"
+        mockInput("roleId", testRoleId)
+        mockInput("secretId", testSecretId)
+        const token = await retrieveToken(method, got)
+        expect(token).toEqual(testToken)
+        const payload = got.post.mock.calls[0][1].json
+        expect(payload).toEqual({ role_id: testRoleId, secret_id: testSecretId })
+        const url = got.post.mock.calls[0][0]
+        expect(url).toContain('approle')
+    })
+
+    it("test retrival with github token", async () => {
+        const method = 'github'
+        mockApiResponse()
+        const githubToken = "githubtoken"
+        mockInput("githubToken", githubToken)
+        const token = await retrieveToken(method, got)
+        expect(token).toEqual(testToken)
+        const payload = got.post.mock.calls[0][1].json
+        expect(payload).toEqual({ token: githubToken })
+        const url = got.post.mock.calls[0][0]
+        expect(url).toContain('github')
+    })
+
+    it("test retrival with kubernetes", async () => {
+        const method = 'kubernetes'
+        const jwtToken = "someJwtToken"
+        const testRole = "testRole"
+        const testTokenPath = "testTokenPath"
+        const testPath = 'differentK8sPath'
+        mockApiResponse()
+        mockInput("kubernetesTokenPath", testTokenPath)
+        mockInput("role", testRole)
+        mockInput("path", testPath)
+        fs.readFileSync = jest.fn()
+        fs.readFileSync.mockReturnValueOnce(jwtToken)
+        const token = await retrieveToken(method, got)
+        expect(token).toEqual(testToken)
+        const payload = got.post.mock.calls[0][1].json
+        expect(payload).toEqual({ jwt: jwtToken, role: testRole })
+        const url = got.post.mock.calls[0][0]
+        expect(url).toContain('differentK8sPath')
+    })
+})
Author	SHA1	Message	Date
Theron Voran	d5a69ceca1	Update to v2.3.1 (#242 )	2021-08-23 08:36:01 -07:00
dependabot[bot]	f3e4110f8d	chore(deps): bump path-parse from 1.0.6 to 1.0.7 (#239 )	2021-08-12 19:00:07 +00:00
Theron Voran	8c00f7e4fd	set vault license for enterprise tests (#240 ) Since hashicorp/vault-enterprise:latest now requires a license to do anything, we need to set $VAULT_LICENSE when provisioning the enterprise docker container.	2021-08-12 11:55:16 -07:00
dependabot[bot]	ab957d2aec	chore(deps): bump normalize-url from 4.5.0 to 4.5.1 (#227 )	2021-08-12 17:15:05 +00:00
Theron Voran	0451f06f9f	Update to v2.3.0 (#231 )	2021-06-23 14:03:57 -07:00
dependabot[bot]	b6210c5a51	chore(deps): bump hosted-git-info from 2.8.8 to 2.8.9 (#216 ) Bumps [hosted-git-info](https://github.com/npm/hosted-git-info) from 2.8.8 to 2.8.9. - [Release notes](https://github.com/npm/hosted-git-info/releases) - [Changelog](https://github.com/npm/hosted-git-info/blob/v2.8.9/CHANGELOG.md) - [Commits](https://github.com/npm/hosted-git-info/compare/v2.8.8...v2.8.9) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2021-06-03 11:10:25 -04:00
Jason O'Donnell	09740f679f	changelog++	2021-06-03 11:01:06 -04:00
Falcon Taylor-Carter	72c7a899ca	Implement kubernetes auth / Add customizable auth path (#218 ) * Implement kubernetes auth / Add customizable auth path * Fix typo * Apply suggestions from code review Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com> Co-authored-by: Jason O'Donnell <2160810+jasonodonnell@users.noreply.github.com>	2021-06-03 10:59:51 -04:00
Jason O'Donnell	0cf3bd6a39	Update version in example doc (#215 )	2021-05-06 14:27:48 -04:00