Secretless MSSQL Connector is Beta Quality

[izgeri]

Based on the [draft quality guidelines](), to get the MSSQL connector to beta quality we will need to:

• Be clear about the known limitations of the MSSQL connector (cyberark/secretless-docs#206)
• Be clear about the supported MSSQL versions (cyberark/secretless-docs#206)
• A documentation page exists for the MSSQL connector (cyberark/secretless-docs#206)
• MSSQL connector has sufficient automated tests
  • MSSQL connector has integration tests that run in a docker-compose network and validate (at a minimum) that:
  • A client can connect to MSSQL via Secretless and query a database
  • MSSQL connector has unit tests that validate (at a minimum): (#1010)
  • The most relevant messages sent between client and server are transmitted with high fidelity, eg
    • Client options and arguments 
    • Errors 
    • Success messages
  • All main positive tests exist. Many negative tests & other focuses. Might be some edge cases remaining to test.
• All acceptance criteria are met (see below)
• MSSQL connector has initial security review (conjurinc/aam-rd-leads#31)
• Project with MSSQL has undergone security scan with gosec with no high or critical issues (#976)
• MSSQL has undergone initial XA (#977)
• MSSQL connector no longer has hardcoded server handshake responses (see #975)
• MSSQL connector has troubleshooting documentation (cyberark/secretless-docs#210)

We are deferring until the GA stage:

• Initial performance metrics on this connector

Acceptance Criteria for Beta Release of MSSQL Connector

• Users can use Secretless with the MSSQL connector to deploy applications to Kubernetes or OpenShift that require an MSSQL Server 2017 v14.x database that the apps authenticate to using using SQL Server authentication
• Users can create applications that connect to MSSQL instance with no credential knowledge
• New connections to MSSQL always use fresh credentials from the configured credential provider(s)
• MSSQL connector config is consistent with config for other Secretless database connectors (eg username, password, host, and (optional) port), and the standard default for port (eg 1433) is enforced
• MSSQL Connector meets the Core Acceptance Criteria
• Secretless MSSQL connector has had a security review, and has no high or critical bugs
  • Secretless MSSQL connector has undergone STRIDE threat modeling
• Secretless with MSSQL has been scanned with gosec with no high or critical issues
• Secretless documentation is clear about the known limitations of the MSSQL connector
• Secretless MSSQL connector has undergone initial XA to validate that it can be used to connect to and query a realistic database (eg an AWS RDS MSSQL 2017 instance or an Azure MSSQL 2017 instance)
• MSSQL connector has sufficient automated tests
  • MSSQL connector has integration tests that run in a docker-compose network and validate (at a minimum) that:
  • A client can connect to MSSQL via Secretless and query a database
  • The current test suite includes:
    • Application can connect to MSSQL through Secretless without creds in the request
    • Application cannot connect directly to MSSQL without creds in the request
  • MSSQL connector has unit tests that validate (at a minimum):
  • The most relevant messages sent between client and server are transmitted with high fidelity, eg
    • Client options and arguments 
    • Errors 
    • Success messages
  • All main positive tests exist. Many negative tests & other focuses. Might be some edge cases remaining to test.

Work remaining to get to beta:

There is cleanup work from the initial POC that needs to be completed, including creating generic constants for some hardcoded data now and generalizing other hardcoded data. We also need to add unit test and e2e test coverage for the MSSQL connector, add documentation and troubleshooting info, perform a security review, and improve the integration test coverage.

[andytinkham]

I started a list of possible acceptance criteria for the connector. Some probably don't apply to us. Others might apply but not for beta. Before tying this to the beta, I'd love to get feedback on whether these are even reasonable expectations. Thanks!

https://gist.github.com/andytinkham/f6c46967423fbb0cf2cc66563adc5f65