Support running plugins in isolated containers (#22712)

Implements running plugins in containers to give them some degree
of isolation from the main Vault process and other plugins. It only
supports running on Linux initially, where it is easiest to manage unix
socket communication across the container boundary.

Additionally

* Adds -env arg to vault plugin register.
* Don't return env from 'vault plugin info'

Historically it's been omitted, and it could conceivably have secret information in
it, so if we want to return it in the response, it should probably only be via explicit
opt-in. Skipping for now though as it's not the main purpose of the commit.

command/plugin_register_test.go

@@ -4,11 +4,16 @@
 package command
 
 import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
 	"reflect"
 	"sort"
 	"strings"
 	"testing"
 
+	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -229,3 +234,139 @@ func TestPluginRegisterCommand_Run(t *testing.T) {
 		assertNoTabs(t, cmd)
 	})
 }
+
+// TestFlagParsing ensures that flags passed to vault plugin register correctly
+// translate into the expected JSON body and request path.
+func TestFlagParsing(t *testing.T) {
+	for name, tc := range map[string]struct {
+		pluginType      api.PluginType
+		name            string
+		command         string
+		ociImage        string
+		version         string
+		sha256          string
+		args            []string
+		env             []string
+		expectedPayload string
+	}{
+		"minimal": {
+			pluginType:      api.PluginTypeUnknown,
+			name:            "foo",
+			sha256:          "abc123",
+			expectedPayload: `{"type":0,"command":"foo","sha256":"abc123"}`,
+		},
+		"full": {
+			pluginType:      api.PluginTypeCredential,
+			name:            "name",
+			command:         "cmd",
+			ociImage:        "image",
+			version:         "v1.0.0",
+			sha256:          "abc123",
+			args:            []string{"--a=b", "--b=c", "positional"},
+			env:             []string{"x=1", "y=2"},
+			expectedPayload: `{"type":1,"args":["--a=b","--b=c","positional"],"command":"cmd","sha256":"abc123","version":"v1.0.0","oci_image":"image","env":["x=1","y=2"]}`,
+		},
+		"command remains empty if oci_image specified": {
+			pluginType:      api.PluginTypeCredential,
+			name:            "name",
+			ociImage:        "image",
+			sha256:          "abc123",
+			expectedPayload: `{"type":1,"sha256":"abc123","oci_image":"image"}`,
+		},
+	} {
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			ui, cmd := testPluginRegisterCommand(t)
+			var requestLogger *recordingRoundTripper
+			cmd.client, requestLogger = mockClient(t)
+
+			var args []string
+			if tc.command != "" {
+				args = append(args, "-command="+tc.command)
+			}
+			if tc.ociImage != "" {
+				args = append(args, "-oci_image="+tc.ociImage)
+			}
+			if tc.sha256 != "" {
+				args = append(args, "-sha256="+tc.sha256)
+			}
+			if tc.version != "" {
+				args = append(args, "-version="+tc.version)
+			}
+			for _, arg := range tc.args {
+				args = append(args, "-args="+arg)
+			}
+			for _, env := range tc.env {
+				args = append(args, "-env="+env)
+			}
+			if tc.pluginType != api.PluginTypeUnknown {
+				args = append(args, tc.pluginType.String())
+			}
+			args = append(args, tc.name)
+			t.Log(args)
+
+			code := cmd.Run(args)
+			if exp := 0; code != exp {
+				t.Fatalf("expected %d to be %d\nstdout: %s\nstderr: %s", code, exp, ui.OutputWriter.String(), ui.ErrorWriter.String())
+			}
+
+			actual := &api.RegisterPluginInput{}
+			expected := &api.RegisterPluginInput{}
+			err := json.Unmarshal(requestLogger.body, actual)
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = json.Unmarshal([]byte(tc.expectedPayload), expected)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(expected, actual) {
+				t.Errorf("expected: %s\ngot: %s", tc.expectedPayload, requestLogger.body)
+			}
+			expectedPath := fmt.Sprintf("/v1/sys/plugins/catalog/%s/%s", tc.pluginType.String(), tc.name)
+			if tc.pluginType == api.PluginTypeUnknown {
+				expectedPath = fmt.Sprintf("/v1/sys/plugins/catalog/%s", tc.name)
+			}
+			if requestLogger.path != expectedPath {
+				t.Errorf("Expected path %s, got %s", expectedPath, requestLogger.path)
+			}
+		})
+	}
+}
+
+func mockClient(t *testing.T) (*api.Client, *recordingRoundTripper) {
+	t.Helper()
+
+	config := api.DefaultConfig()
+	httpClient := cleanhttp.DefaultClient()
+	roundTripper := &recordingRoundTripper{}
+	httpClient.Transport = roundTripper
+	config.HttpClient = httpClient
+	client, err := api.NewClient(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return client, roundTripper
+}
+
+var _ http.RoundTripper = (*recordingRoundTripper)(nil)
+
+type recordingRoundTripper struct {
+	path string
+	body []byte
+}
+
+func (r *recordingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	r.path = req.URL.Path
+	defer req.Body.Close()
+	body, err := io.ReadAll(req.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	r.body = body
+	return &http.Response{
+		StatusCode: 200,
+	}, nil
+}