diff --git a/docs/configuration.md b/docs/configuration.md index 9d87e0735..c741e2f60 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -1,7 +1,7 @@ # Configuration The `*.env` file provides additional configuration for the Magento Functional Testing Framework (MFTF). -To run the MFTF on your Magento testing instance, specify the basic configuration values. +To run the MFTF on your Magento instance, specify the basic configuration values. Advanced users can create custom configurations based on requirements and environment. ## Basic configuration @@ -204,7 +204,7 @@ Example: FW_BP=~/magento/magento2-functional-testing-framework ``` -#### TESTS_MODULE_PATH +### TESTS_MODULE_PATH The path to where the MFTF modules mirror Magento modules. @@ -234,8 +234,8 @@ It points to `MAGENTO_BASE_URL` + `dev/tests/acceptance/utils/command.php` Modify the default value: -- for non-default Magento installation -- when use a subdirectory in the `MAGENTO_BASE_URL` +- for non-default Magento installation +- when use a subdirectory in the `MAGENTO_BASE_URL` Example: `dev/tests/acceptance/utils/command.php` @@ -251,9 +251,35 @@ Example: BROWSER=firefox ``` +### CREDENTIAL_VAULT_ADDRESS + +The Api address for a vault server. + +Default: http://127.0.0.1:8200 + +Example: + +```conf +# Default api address for local vault dev server +CREDENTIAL_VAULT_ADDRESS=http://127.0.0.1:8200 +``` + +### CREDENTIAL_VAULT_SECRET_BASE_PATH + +Vault secret engine base path. + +Default: secret + +Example: + +```conf +# Default base path for kv secret engine in local vault dev server +CREDENTIAL_VAULT_SECRET_BASE_PATH=secret +``` + [`MAGENTO_CLI_COMMAND_PATH`]: #magento_cli_command_path [generateDate]: test/actions.md#generatedate [mftf]: commands/mftf.md -[timezones]: http://php.net/manual/en/timezones.php \ No newline at end of file +[timezones]: http://php.net/manual/en/timezones.php diff --git a/docs/credentials.md b/docs/credentials.md index 7afa9b805..4b1e2cc2d 100644 --- a/docs/credentials.md +++ b/docs/credentials.md @@ -1,15 +1,21 @@ # Credentials -When you test functionality that involves external services such as UPS, FedEx, PayPal, or SignifyD, use the MFTF credentials feature to hide sensitive [data][] like integration tokens and API keys. +When you test functionality that involves external services such as UPS, FedEx, PayPal, or SignifyD, +use the MFTF credentials feature to hide sensitive [data][] like integration tokens and API keys. -## Define sensitive data in `.credentials` +Currently the MFTF supports two types of credential storage: + +- **.credentials file** +- **HashiCorp vault** + +## Configure File Storage The MFTF creates a sample file for credentials during [initial setup][]: `magento2/dev/tests/acceptance/.credentials.example`. The file contains an example list of keys for fields that can require credentials. ### Create `.credentials` -To make the MFTF process the file with credentials, change directories to `magento2/dev/tests/acceptance/` and copy `.credentials.example` to `.credentials`. +To make the MFTF process the file with credentials, in the command line, navigate to `magento2/dev/tests/acceptance/` and rename `.credentials.example` to `.credentials`. ```bash cd dev/tests/acceptance/ @@ -33,49 +39,119 @@ The command outputs the path if the file is excluded: .credentials ``` -### Define sensitive data +### Define sensitive data in the `.credentials` file -Open the `.credentials` file, uncomment the fields you want to use, and add your values: +Open the `.credentials` file and, for Magento core credentials, uncomment the fields you want to use and add your values: -```config +```conf ... # Credentials for the USPS service -carriers_usps_userid=test_user -carriers_usps_password=Lmgxvrq89uPwECeV +magento/carriers_usps_userid=usps_test_user +magento/carriers_usps_password=Lmgxvrq89uPwECeV # Credentials for the DHL service -#carriers/dhl/id_us= -#carriers/dhl/password_us= +#magento/carriers_dhl_id_us=dhl_test_user +#magento/carriers_dhl_password_us=Mlgxv3dsagVeG .... +``` + +Or add new key & value pairs for your own credentials. The keys use the following format: + +```conf +/= ```
-The `/` symbol is not supported in a key name. +The `/` symbol is not supported in a `key_name` other than the one after your vendor or extension name.
- -You are free to use any other keys you like, as they are merely the keys to reference from your tests. + +Otherwise you are free to use any other `key_name` you like, as they are merely the keys to reference from your tests. ```conf # Credentials for the MyAwesome service -my_awesome_service_token=rRVSVnh3cbDsVG39oTMz4A +vendor/my_awesome_service_token=rRVSVnh3cbDsVG39oTMz4A +``` -# Credentials for the USPS service -carriers_usps_userid=test_user -carriers_usps_password=Lmgxvrq89uPwECeV -.... +## Configure Vault Storage + +Hashicorp vault secures, stores, and tightly controls access to data in modern computing. +It provides advanced data protection for your testing credentials. + +The MFTF works with both `vault enterprise` and `vault open source` that use `KV Version 2` secret engine. + +### Install vault CLI + +Download and install vault CLI tool if you want to run or develop MFTF tests locally. [Download Vault][Download Vault] + +### Authenticate to vault via vault CLI + +Authenticate to vault server via the vault CLI tool: [Login Vault][Login Vault]. + +```bash +vault login -method -path +``` + +**Do not** use `-no-store` command option, as the MFTF will rely on the persisted token in the token helper (usually the local filesystem) for future API requests. + +### Store secrets in vault + +The MFTF uses the `KV Version 2` secret engine for secret storage. +More information for working with `KV Version 2` can be found in [Vault KV2][Vault KV2]. + +#### Secrets path and key convention + +The path and key for secret data must follow the format: + +```conf +/mftf// +``` + +```conf +# Secret path and key for carriers_usps_userid +secret/mftf/magento/carriers_usps_userid + +# Secret path and key for carriers_usps_password +secret/mftf/magento/carriers_usps_password +``` + +#### Write secrets to vault + +You can use vault CLI or API to write secret data (credentials, etc) to vault. Here is a CLI example: + +```bash +vault kv put secret/mftf/magento/carriers_usps_userid carriers_usps_userid=usps_test_user +vault kv put secret/mftf/magento/carriers_usps_password carriers_usps_password=Lmgxvrq89uPwECeV ``` +### Setup MFTF to use vault + +Add vault configuration environment variables [`CREDENTIAL_VAULT_ADDRESS`][] and [`CREDENTIAL_VAULT_SECRET_BASE_PATH`][] +from `etc/config/.env.example` in `.env`. +Set values according to your vault server configuration. + +```conf +# Default vault dev server +CREDENTIAL_VAULT_ADDRESS=http://127.0.0.1:8200 +CREDENTIAL_VAULT_SECRET_BASE_PATH=secret +``` + +## Configure both File Storage and Vault Storage + +It is possible and sometimes useful to setup and use both `.credentials` file and vault for secret storage at the same time. +In this case, the MFTF tests are able to read secret data at runtime from both storage options, but the local `.credentials` file will take precedence. + ## Use credentials in a test -Access the data defined in the `.credentials` file using the [`fillField`][] action with the `userInput` attribute. -Define the value as a reference to the corresponding key in the credentials file such as `{{_CREDS.my_data_key}}`: +Credentials can be used in actions: [`fillField`][], [`magentoCLI`][], and [`createData`][]. + +Define the value as a reference to the corresponding key in the credentials file or vault such as `{{_CREDS.my_data_key}}`: - `_CREDS` is an environment constant pointing to the `.credentials` file -- `my_data_key` is a key in the the `.credentials` file that contains the value to be used in a test step +- `my_data_key` is a key in the the `.credentials` file or vault that contains the value to be used in a test step -For example: +For example, reference secret data in the [`fillField`][] action with the `userInput` attribute. ```xml @@ -88,13 +164,21 @@ For example: The generated tests do not contain credentials values. The MFTF dynamically retrieves, encrypts, and decrypts the sensitive data during test execution. Decrypted credentials do not appear in the console, error logs, or [test reports][]. -The decrypted values are only available in the `.credentials` file. +The decrypted values are only available in the `.credentials` file or within vault.
-The MFTF tests delivered with Magento application do not use credentials and do not cover external services, because of sensitivity of the data.
+The MFTF tests delivered with Magento application do not use credentials and do not cover external services, because of sensitivity of the data. + [`fillField`]: test/actions.md#fillfield +[`magentoCLI`]: test/actions.md#magentocli +[`createData`]: test/actions.md#createdata [data]: data.md [initial setup]: getting-started.md [test reports]: reporting.md +[Download Vault]: https://www.hashicorp.com/products/vault/ +[Login Vault]: https://www.vaultproject.io/docs/commands/login.html +[Vault KV2]: https://www.vaultproject.io/docs/secrets/kv/kv-v2.html +[`CREDENTIAL_VAULT_ADDRESS`]: configuration.md#CREDENTIAL_VAULT_ADDRESS +[`CREDENTIAL_VAULT_SECRET_BASE_PATH`]: configuration.md#CREDENTIAL_VAULT_SECRET_BASE_PATH