Skip to content

Commit 2484f93

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #7129 from kasturinarra/trust-manager-tests
USHIFT-6838: Add RF cases for trust manager
2 parents ea9ff1a + 5e835e9 commit 2484f93

1 file changed

Lines changed: 119 additions & 7 deletions

File tree

‎test/suites/optional/cert-manager.robot‎

Lines changed: 119 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -130,15 +130,45 @@ Trust Manager Bundle With Cert Manager CA
130130
[Tags] trust-manager
131131
[Setup] Enable Trust Manager
132132

133-
Apply Template ${CLUSTER_ISSUER_TMPL}
134-
Oc Wait -n ${NAMESPACE} clusterissuer ${ISSUER_NAME}
135-
... --for="condition=Ready" --timeout=${DEFAULT_WAIT_TIMEOUT}
133+
Setup Trust Bundle With Cert Manager CA
136134

137-
Apply Template ${CA_CERTIFICATE_TMPL}
138-
Oc Wait -n ${TRUST_MANAGER_NS} certificate ca-certificate
135+
${cm_data}= Oc Get JsonPath
136+
... configmap
137+
... ${NAMESPACE}
138+
... ${TRUST_MANAGER_BUNDLE_NAME}
139+
... .data.ca-bundle\\.crt
140+
Should Contain ${cm_data} BEGIN CERTIFICATE msg=ConfigMap does not contain CA certificate data
141+
142+
[Teardown] Run Keywords
143+
... Cleanup Trust Bundle
144+
... AND Oc Delete certificate/ca-certificate -n ${TRUST_MANAGER_NS} --ignore-not-found
145+
... AND Remove ClusterIssuer
146+
... AND Disable Trust Manager
147+
148+
Trust Manager Bundle With Pebble ACME CA
149+
[Documentation] Verify trust-manager can distribute a Pebble ACME root CA via Bundle CR
150+
[Tags] trust-manager acme
151+
[Setup] Run Keywords
152+
... Enable Trust Manager
153+
... AND Setup Pebble Server ${NAMESPACE}
154+
155+
${DNS_NAME}= Generate Random HostName
156+
VAR ${DNS_NAME}= ${DNS_NAME} scope=TEST
157+
Setup DNS For Test ${USHIFT_HOST} ${DNS_NAME}
158+
159+
Apply Template ${HTTP01_ISSUER_TMPL}
160+
Oc Wait -n ${NAMESPACE} issuer ${HTTP01_ISSUER_NAME}
139161
... --for="condition=Ready" --timeout=${DEFAULT_WAIT_TIMEOUT}
140162

141-
Apply Template ${TRUST_BUNDLE_SECRET_TMPL}
163+
Apply Template ${HTTP01_CERTIFICATE_TMPL}
164+
Oc Wait -n ${NAMESPACE} certificate ${HTTP01_CERT_NAME} --for="condition=Ready" --timeout=300s
165+
166+
${pebble_ca}= Fetch Pebble Root CA ${NAMESPACE}
167+
${cert_file}= Create Random Temp File ${pebble_ca}
168+
Oc Create secret generic ca-source-secret -n ${TRUST_MANAGER_NS} --from-file=tls.crt=${cert_file}
169+
Remove File ${cert_file}
170+
171+
Apply Template ${TRUST_BUNDLE_SRC_SECRET_TMPL}
142172
Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME}
143173
... --for=jsonpath='{.status.conditions[?(@.type=="Synced")].status}'=True --timeout=${DEFAULT_WAIT_TIMEOUT}
144174

@@ -147,7 +177,38 @@ Trust Manager Bundle With Cert Manager CA
147177
... ${NAMESPACE}
148178
... ${TRUST_MANAGER_BUNDLE_NAME}
149179
... .data.ca-bundle\\.crt
150-
Should Contain ${cm_data} BEGIN CERTIFICATE msg=ConfigMap does not contain CA certificate data
180+
Should Contain ${cm_data} ${pebble_ca} msg=ConfigMap does not contain Pebble CA certificate data
181+
182+
[Teardown] Run Keywords
183+
... Cleanup Trust Bundle
184+
... AND Oc Delete secret ca-source-secret -n ${TRUST_MANAGER_NS} --ignore-not-found
185+
... AND Cleanup HTTP01 Resources
186+
... AND Cleanup DNS For Test ${DNS_NAME}
187+
... AND Disable Trust Manager
188+
189+
Trust Manager Survives MicroShift Restart
190+
[Documentation] Verify trust-manager Bundle CR and ConfigMap persist after MicroShift restart
191+
[Tags] trust-manager restart
192+
[Setup] Enable Trust Manager
193+
194+
Setup Trust Bundle With Cert Manager CA
195+
${cm_data_before}= Oc Get JsonPath
196+
... configmap
197+
... ${NAMESPACE}
198+
... ${TRUST_MANAGER_BUNDLE_NAME}
199+
... .data.ca-bundle\\.crt
200+
Should Contain ${cm_data_before} BEGIN CERTIFICATE
201+
202+
Restart MicroShift
203+
Wait For MicroShift Healthcheck Success
204+
Wait For Trust Manager After Restart
205+
206+
${cm_data_after}= Oc Get JsonPath
207+
... configmap
208+
... ${NAMESPACE}
209+
... ${TRUST_MANAGER_BUNDLE_NAME}
210+
... .data.ca-bundle\\.crt
211+
Should Be Equal ${cm_data_before} ${cm_data_after} msg=ConfigMap data changed after restart
151212

152213
[Teardown] Run Keywords
153214
... Cleanup Trust Bundle
@@ -271,6 +332,7 @@ Cleanup HTTP01 Resources
271332
Oc Delete issuer/${HTTP01_ISSUER_NAME} -n ${NAMESPACE} --ignore-not-found
272333
Oc Delete deployment/pebble -n ${NAMESPACE} --ignore-not-found
273334
Oc Delete service/pebble -n ${NAMESPACE} --ignore-not-found
335+
Oc Delete configmap/pebble -n ${NAMESPACE} --ignore-not-found
274336

275337
Configure DNS For Domain
276338
[Documentation] Configure DNS configmap in openshift-dns namespace and restart DNS pod
@@ -403,3 +465,53 @@ Cleanup Trust Bundle
403465
[Documentation] Remove the test trust-manager Bundle CR and its target ConfigMap
404466
Oc Delete bundle ${TRUST_MANAGER_BUNDLE_NAME} --ignore-not-found
405467
Oc Delete configmap ${TRUST_MANAGER_BUNDLE_NAME} -n ${NAMESPACE} --ignore-not-found
468+
469+
Setup Trust Bundle With Cert Manager CA
470+
[Documentation] Create a self-signed CA via cert-manager and configure a trust Bundle
471+
Apply Template ${CLUSTER_ISSUER_TMPL}
472+
Oc Wait -n ${NAMESPACE} clusterissuer ${ISSUER_NAME}
473+
... --for="condition=Ready" --timeout=${DEFAULT_WAIT_TIMEOUT}
474+
Apply Template ${CA_CERTIFICATE_TMPL}
475+
Oc Wait -n ${TRUST_MANAGER_NS} certificate ca-certificate
476+
... --for="condition=Ready" --timeout=${DEFAULT_WAIT_TIMEOUT}
477+
Apply Template ${TRUST_BUNDLE_SECRET_TMPL}
478+
Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME}
479+
... --for=jsonpath='{.status.conditions[?(@.type=="Synced")].status}'=True --timeout=${DEFAULT_WAIT_TIMEOUT}
480+
481+
Wait For Trust Manager After Restart
482+
[Documentation] Wait for trust-manager components to be ready after a MicroShift restart
483+
Wait Until Keyword Succeeds 30x 10s
484+
... Labeled Pod Should Be Ready app.kubernetes.io/name=cert-manager-trust-manager ns=${TRUST_MANAGER_NS}
485+
Wait Until Keyword Succeeds 30x 10s
486+
... TrustManager CR Should Be Ready
487+
Oc Wait bundle ${TRUST_MANAGER_BUNDLE_NAME}
488+
... --for=jsonpath='{.status.conditions[?(@.type=="Synced")].status}'=True --timeout=${DEFAULT_WAIT_TIMEOUT}
489+
490+
Fetch Pebble Root CA
491+
[Documentation] Fetch the root CA certificate from Pebble management API via port-forward
492+
[Arguments] ${namespace}
493+
${port_fwd}= Process.Start Process
494+
... oc port-forward deployment/pebble 15000:15000
495+
... -n ${namespace} --kubeconfig ${KUBECONFIG}
496+
... stderr=STDOUT
497+
Sleep 5s
498+
${running}= Process.Is Process Running ${port_fwd}
499+
IF not ${running}
500+
${fwd_result}= Process.Wait For Process ${port_fwd}
501+
Fail Port-forward failed to start: ${fwd_result.stdout}
502+
END
503+
TRY
504+
${pem}= Wait Until Keyword Succeeds 10x 3s
505+
... Pebble Root CA Should Be Available
506+
RETURN ${pem}
507+
FINALLY
508+
Process.Terminate Process ${port_fwd}
509+
END
510+
511+
Pebble Root CA Should Be Available
512+
[Documentation] Check that the Pebble management API returns a valid CA certificate
513+
${result}= Process.Run Process curl -skf https://localhost:15000/roots/0
514+
... stderr=STDOUT
515+
Should Be Equal As Integers ${result.rc} 0 msg=Failed to fetch Pebble root CA
516+
Should Contain ${result.stdout} BEGIN CERTIFICATE msg=Pebble root CA response missing certificate data
517+
RETURN ${result.stdout}

0 commit comments

Comments
 (0)