kitchen-google 2.8.0 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d96f1f6b4c605799e8b3af57a4e8966a786f808f1c3e5e2c201d34e306da454d
-  data.tar.gz: 2f8f62792d8c6b15a568dd5f8abdf177acafad3762df1e04ccacf4b69f502fe2
+  metadata.gz: 0b723b02e719da68e14ea28e557e7288ebf83e3f7770fe26b7a24c67b5edfa2a
+  data.tar.gz: 7fc550f1fa2ee2ef1803849c04ed561eeb8417ea34c7a9dec37a336d02223d90
 SHA512:
-  metadata.gz: cb7e05264bf801fc495576aca5ebd797193ea5e6140702e26d4248a0a3c54892702422fef3a563b2e78882f92dc2abedbae99b00371afcefdadeecc4bafa27bc
-  data.tar.gz: de05cdf3ae3b40aac2d40fb7fb3e3154dafb16d01979632a83ea7de5b4fdc249343c10d63407c0a36e09bd22ec945a829468a9d61f1caca58e52a2bfffa1fbfa
+  metadata.gz: 619b786dc4939d75e666676eace51b0b87623ee800333e9569bd3ccc31204773badc2d5bcb449e2e9852faec5dc1cce997fd7d83dae58c07bb2651f265769081
+  data.tar.gz: e260b90a3249fe4f5de2469e9777b0f6a6a3e8c21cb86989c8470ee575d17155b7505df325f792321f91d098549278cf368026ff6275dee369c56be26cfc904c

data/lib/kitchen/driver/gce/windows_password.rb

@@ -0,0 +1,288 @@
+#
+# Author:: Chef Partner Engineering (<partnereng@chef.io>)
+#
+# Copyright (C) 2016, Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "base64" unless defined?(Base64)
+require "date" unless defined?(DateTime)
+require "json" unless defined?(JSON)
+require "openssl" unless defined?(OpenSSL)
+require "timeout" unless defined?(Timeout)
+require "google/apis/compute_v1"
+require "kitchen"
+
+module Kitchen
+  module Driver
+    class Gce < Kitchen::Driver::Base
+      # Resets the password of a Windows account on a GCE instance.
+      #
+      # Google does not expose Windows credentials through the API. Instead, an
+      # agent inside the guest watches the instance's `windows-keys` metadata
+      # for an RSA public key, resets the named account, and writes the new
+      # password back to the instance's serial port, encrypted with that key.
+      #
+      # This class performs the client half of that exchange: it publishes a
+      # freshly generated public key, watches the serial port for the matching
+      # response, and decrypts the password with the private key, which never
+      # leaves this process.
+      #
+      # It borrows the driver's authorised API client, project, zone and
+      # operation handling rather than establishing its own.
+      #
+      # @see https://cloud.google.com/compute/docs/instances/windows/automate-pw-generation
+      #
+      # @example
+      #   WindowsPassword.new(driver,
+      #     instance_name: "tk-win-1",
+      #     email: "user@example.com",
+      #     username: "Administrator").new_password #=> "hR2$k9..."
+      class WindowsPassword
+        # Seconds to wait for the in-guest agent when no timeout is configured.
+        #
+        # @return [Integer] the default timeout
+        DEFAULT_TIMEOUT = 120
+
+        # Serial port the Windows agent writes its response to.
+        #
+        # @return [Integer] the serial port number
+        SERIAL_PORT = 4
+
+        # Instance metadata key the agent watches for a public key.
+        #
+        # @return [String] the metadata key
+        METADATA_KEY = "windows-keys".freeze
+
+        # Size, in bits, of the RSA key generated for the exchange.
+        #
+        # @return [Integer] the key size
+        KEY_SIZE = 2048
+
+        # How long, in seconds, the published key remains valid.
+        #
+        # @return [Integer] the key lifetime
+        KEY_TTL = 300
+
+        # @return [Kitchen::Driver::Gce] the driver this request runs through
+        attr_reader :driver
+
+        # @return [String] the GCE instance whose password is being reset
+        attr_reader :instance_name
+
+        # @return [String] the email address of the GCE user making the request
+        attr_reader :email
+
+        # @return [String] the Windows account being reset
+        attr_reader :username
+
+        # @return [Integer] seconds to wait for the in-guest agent
+        attr_reader :timeout
+
+        # @param driver [Kitchen::Driver::Gce] driver supplying the API client,
+        #   project, zone, operation handling and logging
+        # @param instance_name [String] the GCE instance to reset a password on
+        # @param email [String] email address of the GCE user making the request
+        # @param username [String, nil] the Windows account, defaulting to
+        #   `Administrator`
+        # @param timeout [Integer, nil] seconds to wait for the in-guest agent,
+        #   defaulting to {DEFAULT_TIMEOUT}
+        # @raise [ArgumentError] if the instance name or email is missing
+        def initialize(driver, instance_name:, email:, username: nil, timeout: nil)
+          raise ArgumentError, "Instance name not specified" if instance_name.nil?
+          raise ArgumentError, "Email address of GCE user not specified" if email.nil?
+
+          @driver        = driver
+          @instance_name = instance_name
+          @email         = email
+          @username      = username || "Administrator"
+          @timeout       = (timeout || DEFAULT_TIMEOUT).to_i
+        end
+
+        # Runs the full exchange and returns the new password.
+        #
+        # @return [String] the plaintext password the agent generated
+        # @raise [RuntimeError] if the instance is missing, or the agent reports
+        #   that it could not reset the password
+        # @raise [Timeout::Error] if the agent does not respond within {#timeout}
+        def new_password
+          publish_public_key
+          decrypt(await_response)
+        end
+
+        # Replaces the instance's `windows-keys` metadata with our public key,
+        # leaving every other metadata entry untouched, and waits for the update
+        # to take effect.
+        #
+        # @return [void]
+        def publish_public_key
+          metadata = instance_metadata
+          items    = Array(metadata.items).reject { |item| item.key == METADATA_KEY }
+          items << key_metadata_item
+          metadata.items = items
+
+          driver.debug("Publishing a Windows password key to #{instance_name} for #{username}")
+          driver.wait_for_operation(
+            driver.connection.set_instance_metadata(driver.project, driver.zone, instance_name, metadata)
+          )
+        end
+
+        # The instance's current metadata.
+        #
+        # @return [Google::Apis::ComputeV1::Metadata] the metadata
+        # @raise [RuntimeError] if the instance cannot be found
+        def instance_metadata
+          driver.server_instance(instance_name).metadata
+        rescue Google::Apis::ClientError
+          raise "Unable to locate instance #{instance_name} in project #{driver.project}, zone #{driver.zone}"
+        end
+
+        # The metadata entry describing the key exchange request.
+        #
+        # @return [Google::Apis::ComputeV1::Metadata::Item] the entry
+        def key_metadata_item
+          Google::Apis::ComputeV1::Metadata::Item.new(
+            key: METADATA_KEY,
+            value: key_request.to_json
+          )
+        end
+
+        # The payload the in-guest agent reads to perform the reset.
+        #
+        # @return [Hash] the request, in the shape the agent expects
+        def key_request
+          {
+            "userName" => username,
+            "modulus" => modulus,
+            "exponent" => exponent,
+            "email" => email,
+            "expireOn" => expiration,
+          }
+        end
+
+        # When the published key stops being valid.
+        #
+        # @return [String] an RFC 3339 timestamp
+        def expiration
+          (Time.now + KEY_TTL).to_datetime.rfc3339
+        end
+
+        # Polls the serial port until the agent answers our key.
+        #
+        # @return [Hash] the agent's response
+        # @raise [Timeout::Error] if the agent does not respond in time
+        def await_response
+          Timeout.timeout(timeout) do
+            loop do
+              response = response_from_serial_port
+              return response unless response.nil?
+
+              driver.debug("No password response yet for #{instance_name}, waiting...")
+              sleep driver.refresh_rate
+            end
+          end
+        rescue Timeout::Error
+          raise Timeout::Error, "Timed out after #{timeout} seconds waiting for the GCE agent " \
+                                "to reset the password for #{username} on #{instance_name}"
+        end
+
+        # Scans the serial port output for a response matching our key.
+        #
+        # The port carries arbitrary boot logging, so every line that is not
+        # JSON, or is JSON but not an object, is skipped. The newest lines are
+        # examined first.
+        #
+        # @return [Hash, nil] the matching response, or nil if none is present
+        def response_from_serial_port
+          serial_port_output.to_s.lines.reverse_each do |line|
+            event = parse_event(line)
+            next if event.nil?
+
+            return event if event["modulus"] == modulus && event["exponent"] == exponent
+          end
+
+          nil
+        end
+
+        # The current contents of the instance's serial port.
+        #
+        # @return [String, nil] the serial port output
+        def serial_port_output
+          driver.connection.get_instance_serial_port_output(
+            driver.project, driver.zone, instance_name, port: SERIAL_PORT
+          ).contents
+        end
+
+        # Parses one line of serial port output.
+        #
+        # @param line [String] the line to parse
+        # @return [Hash, nil] the parsed object, or nil if the line is not a
+        #   JSON object
+        def parse_event(line)
+          event = JSON.parse(line.strip)
+          event.is_a?(Hash) ? event : nil
+        rescue JSON::ParserError
+          nil
+        end
+
+        # Decrypts the password from the agent's response.
+        #
+        # OpenSSL hands back binary-tagged bytes. The agent sends UTF-8, so the
+        # result is retagged rather than left as ASCII-8BIT, which would other-
+        # wise be written into the state file as a binary blob.
+        #
+        # @param response [Hash] the agent's response
+        # @return [String] the plaintext password, encoded as UTF-8
+        # @raise [RuntimeError] if the agent reported a failed reset
+        def decrypt(response)
+          unless response["passwordFound"]
+            raise "The GCE agent could not reset the password for #{username} on #{instance_name}"
+          end
+
+          private_key.private_decrypt(
+            Base64.strict_decode64(response["encryptedPassword"]),
+            OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING
+          ).force_encoding(Encoding::UTF_8)
+        end
+
+        # The private key for this exchange, which never leaves the process.
+        #
+        # @return [OpenSSL::PKey::RSA] the key pair
+        def private_key
+          @private_key ||= OpenSSL::PKey::RSA.new(KEY_SIZE)
+        end
+
+        # The public half of {#private_key}.
+        #
+        # @return [OpenSSL::PKey::RSA] the public key
+        def public_key
+          private_key.public_key
+        end
+
+        # The public key's modulus, as the agent expects it.
+        #
+        # @return [String] the Base64-encoded big-endian modulus
+        def modulus
+          @modulus ||= Base64.strict_encode64(public_key.n.to_s(2))
+        end
+
+        # The public key's exponent, as the agent expects it.
+        #
+        # @return [String] the Base64-encoded big-endian exponent
+        def exponent
+          @exponent ||= Base64.strict_encode64(public_key.e.to_s(2))
+        end
+      end
+    end
+  end
+end

data/lib/kitchen/driver/gce.rb

@@ -16,10 +16,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require "gcewinpass"
 require "google/apis/compute_v1"
 require "kitchen"
 require_relative "gce_version"
+require_relative "gce/windows_password"
 require "securerandom" unless defined?(SecureRandom)
 require "timeout" unless defined?(Timeout)
 
@@ -125,11 +125,17 @@ module Kitchen
 
       # Configuration applied to every disk before the user's own settings.
       #
+      # Deliberately sets no `disk_type`. GCE derives an omitted disk type from
+      # the instance's machine series -- pd-standard on first- and
+      # second-generation series such as N1 and N2, pd-balanced on C3, C3D and
+      # M3, and hyperdisk-balanced on C4, N4 and newer -- so leaving it unset is
+      # the only default that is compatible with every machine type. Naming one
+      # here would fail outright on the families that no longer accept it.
+      #
       # @return [Hash] the per-disk defaults
       DISK_DEFAULT_CONFIG = {
         autodelete_disk: true,
         disk_size: 10,
-        disk_type: "pd-standard",
       }.freeze
 
       # Human-readable driver name shown in Test Kitchen output.
@@ -269,9 +275,12 @@ module Kitchen
           boot: true,
           autodelete_disk: config.fetch(:autodelete_disk, DISK_DEFAULT_CONFIG[:autodelete_disk]),
           disk_size: config.fetch(:disk_size, DISK_DEFAULT_CONFIG[:disk_size]),
-          disk_type: config.fetch(:disk_type, DISK_DEFAULT_CONFIG[:disk_type]),
         }
 
+        # Carry the key only when the user set it, so that an unset type stays
+        # absent rather than becoming an explicit nil. See DISK_DEFAULT_CONFIG.
+        disk_config[:disk_type] = config[:disk_type] if config[:disk_type]
+
         raise "Disk type #{disk_config[:disk_type]} is not valid" unless valid_disk_type?(disk_config[:disk_type])
 
         disk_config
@@ -437,6 +446,8 @@ module Kitchen
       #
       # @param server_name [String] the GCE instance name
       # @return [void]
+      # @raise [RuntimeError] if the in-guest agent could not reset the password
+      # @raise [Timeout::Error] if the agent does not respond in time
       def update_windows_password(server_name)
         return unless winrm_transport?
 
@@ -444,15 +455,13 @@ module Kitchen
 
         info("Resetting the Windows password for user #{username} on #{server_name}...")
 
-        opts = {
-          project: project,
-          zone: zone,
+        state[:password] = WindowsPassword.new(
+          self,
           instance_name: server_name,
           email: config[:email],
           username: username,
-        }
-        opts[:timeout] = config[:winpass_timeout] unless config[:winpass_timeout].nil?
-        state[:password] = GoogleComputeWindowsPassword.new(**opts).new_password
+          timeout: config[:winpass_timeout]
+        ).new_password
 
         info("Password reset complete on #{server_name}.")
       end
@@ -525,10 +534,13 @@ module Kitchen
 
       # Whether a disk type exists in the target zone.
       #
+      # An unset type is valid: the driver sends no `diskType` at all and GCE
+      # substitutes the default for the instance's machine series.
+      #
       # @param disk_type [String, nil] the disk type to check
-      # @return [Boolean] true if the disk type is valid
+      # @return [Boolean] true if the disk type is valid or unset
       def valid_disk_type?(disk_type)
-        return false if disk_type.nil?
+        return true if disk_type.nil?
 
         check_api_call { connection.get_disk_type(project, zone, disk_type) }
       end
@@ -753,7 +765,7 @@ module Kitchen
         disk.boot           = true if disk_config[:boot]
         disk.auto_delete    = disk_config[:autodelete_disk]
         params.disk_size_gb = disk_config[:disk_size]
-        params.disk_type    = disk_type_url_for(disk_config[:disk_type])
+        params.disk_type    = disk_type_url_for(disk_config[:disk_type]) if disk_config[:disk_type]
 
         if local_ssd?(disk_config)
           info("Creating a #{LOCAL_SSD_SIZE_GB} GB local ssd as scratch disk (https://cloud.google.com/compute/docs/disks/#localssds).")
@@ -781,7 +793,7 @@ module Kitchen
         disk = Google::Apis::ComputeV1::Disk.new
         disk.name    = unique_disk_name
         disk.size_gb = disk_config[:disk_size]
-        disk.type    = disk_type_url_for(disk_config[:disk_type])
+        disk.type    = disk_type_url_for(disk_config[:disk_type]) if disk_config[:disk_type]
 
         info("Creating a #{disk_config[:disk_size]} GB disk named #{unique_disk_name}...")
         wait_for_operation(connection.insert_disk(project, zone, disk))

data/lib/kitchen/driver/gce_version.rb

@@ -28,6 +28,6 @@ module Kitchen
     # release. Keep it on one line.
     #
     # @return [String] the gem version
-    GCE_VERSION = "2.8.0"
+    GCE_VERSION = "3.0.1"
   end
 end

metadata

@@ -1,63 +1,119 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-google
 version: !ruby/object:Gem::Version
-  version: 2.8.0
+  version: 3.0.1
 platform: ruby
 authors:
 - Test Kitchen Team
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-22 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: gcewinpass
+  name: google-apis-compute_v1
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '0.75'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '0.75'
 - !ruby/object:Gem::Dependency
-  name: google-apis-compute_v1
+  name: test-kitchen
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.75'
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0.75'
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
-  name: test-kitchen
+  name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.0
-    - - "<"
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '0.1'
+- !ruby/object:Gem::Dependency
+  name: date
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.0
-    - - "<"
+        version: '3.2'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '2.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.5'
+- !ruby/object:Gem::Dependency
+  name: securerandom
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.1'
+- !ruby/object:Gem::Dependency
+  name: timeout
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.2'
 description: A Test-Kitchen driver for Google Compute Engine
 email:
 - help@sous-chefs.org
@@ -67,6 +123,7 @@ extra_rdoc_files: []
 files:
 - LICENSE
 - lib/kitchen/driver/gce.rb
+- lib/kitchen/driver/gce/windows_password.rb
 - lib/kitchen/driver/gce_version.rb
 homepage: https://github.com/test-kitchen/kitchen-google
 licenses: