Google Plugin for HashiCorp Boundary

This repo contains the google plugin for HashiCorp Boundary.

[!IMPORTANT] This is a prototype. Not officially supported by HashiCorp.

Credentials

This plugin uses Application Default Credentials (ADC) to authenticate to Google and retrieve a list of instances and instance groups.

As a result, it does not support rotation of the credentials since they are inferred from the environment.

Dynamic Hosts

This plugin supports dynamically sourcing instances from Google Compute Engine.

Host sets created with this plugin define filters or instance groups which select and group like instances within Google; these host sets can in turn be added to targets within Boundary as host sources.

At creation, update or deletion of a host catalog of this type, configuration of the plugin is performed via the attribute/secret values passed to the create, update, or delete calls actions. The values passed in to the plugin here are the attributes set on on a host catalog in Boundary.

Google IAM permissions

The plugin requires the following permissions:

• compute.instances.get
• compute.instances.list
• compute.instanceGroups.get
• compute.instanceGroups.list

Attributes

Host Catalog

The following attributes are valid on a Google host catalog resource:

• project (string): required. Project ID of the instances you want to add to host catalog.
• zone (string): required. Zone of the instances you want to add to host catalog.

Example:

$ boundary host-catalogs create plugin -scope-id p_1234567890 -plugin-name google -attr zone=us-central1-a -attr project=$GOOGLE_PROJECT

Host Set

The following attributes are valid on a Google host set resource:

• filter (string): Google Cloud filter expression to filter instances.

• instance_group (string): Name of instance group to get a list of instances.

You can only set a filter or instance_group attribute, you cannot set both.

Example:

$ boundary host-sets create plugin -host-catalog-id $HOST_CATALOG_ID -name "filter-example" -description "example using filters" -attr filter="status=RUNNING"

$ boundary host-sets create plugin -host-catalog-id $HOST_CATALOG_ID -name "group-example" -description "example using instance groups" -attr instance_group="instance-group-name"

After generating the host set, create a target.

$ boundary targets create tcp -name google -description "Google Cloud" -scope-id p_1234567890 -default-port 22
$ boundary targets add-host-sources -id $TARGET_ID -host-source $HOST_SET_ID

Setup

You will need to build your own Boundary binary, as Boundary imports the plugins as a dependency.

As a reference, you can review this fork for changes.

To build the fork, go into the repository.

1. Run make build.
2. Authenticate to Google Cloud using gcloud auth application-default login.
3. Run Boundary with ./bin/boundary dev.