Skip to content

Commit 9840271

Browse files
arturdzmarturdzm
authored
Merge pull request #405 from application-stacks/test-manage-tls
Adding manageTLS tests
2 parents 6aef030 + 5c874d2 commit 9840271

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+1074
-1
lines changed

‎bundle/tests/scorecard/kuttl/manage-tls/00-assert.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 60
4+
---
5+
# Check creation of CertManager certificates and secret
6+
apiVersion: cert-manager.io/v1
7+
kind: Certificate
8+
metadata:
9+
labels:
10+
app.kubernetes.io/managed-by: runtime-component-operator
11+
spec:
12+
commonName: Runtime Component Operator
13+
isCA: true
14+
---
15+
apiVersion: cert-manager.io/v1
16+
kind: Certificate
17+
metadata:
18+
name: manage-tls-rc-svc-tls-cm
19+
spec:
20+
secretName: manage-tls-rc-svc-tls-cm
21+
---
22+
apiVersion: v1
23+
kind: Secret
24+
metadata:
25+
annotations:
26+
cert-manager.io/certificate-name: manage-tls-rc-svc-tls-cm
27+
name: manage-tls-rc-svc-tls-cm
28+
---
29+
# Verify the pod template spec uses *-cm naming convention
30+
apiVersion: apps/v1
31+
kind: Deployment
32+
metadata:
33+
name: manage-tls-rc
34+
status:
35+
replicas: 1
36+
readyReplicas: 1
37+
updatedReplicas: 1
38+
spec:
39+
template:
40+
spec:
41+
containers:
42+
- env:
43+
- name: TLS_DIR
44+
value: /etc/x509/certs
45+
- name: SA_RESOURCE_VERSION
46+
- name: SERVICE_CERT_SECRET_RESOURCE_VERSION
47+
volumeMounts:
48+
- name: svc-certificate
49+
mountPath: /etc/x509/certs
50+
readOnly: true
51+
volumes:
52+
- name: svc-certificate
53+
secret:
54+
defaultMode: 420
55+
secretName: manage-tls-rc-svc-tls-cm
56+
---
57+
apiVersion: v1
58+
kind: Service
59+
metadata:
60+
name: manage-tls-rc
61+
---
62+
apiVersion: route.openshift.io/v1
63+
kind: Route
64+
metadata:
65+
name: manage-tls-rc
66+
spec:
67+
host: runtimecomponentoperator.test
68+
to:
69+
kind: Service
70+
name: manage-tls-rc
71+
weight: 100
72+
port:
73+
targetPort: 9443-tcp
74+
tls:
75+
termination: reencrypt

‎bundle/tests/scorecard/kuttl/manage-tls/00-certmanager-with-manage-tls.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Verify that manageTLS=true is enabled by default
2+
apiVersion: rc.app.stacks/v1beta2
3+
kind: RuntimeComponent
4+
metadata:
5+
name: manage-tls-rc
6+
spec:
7+
applicationImage: k8s.gcr.io/pause:2.0
8+
replicas: 1
9+
expose: true
10+
service:
11+
port: 9443
12+
route:
13+
host: runtimecomponentoperator.test
14+
termination: reencrypt

‎bundle/tests/scorecard/kuttl/manage-tls/01-assert.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 60
4+
---
5+
kind: Deployment
6+
apiVersion: apps/v1
7+
metadata:
8+
name: manage-tls-rc
9+
spec:
10+
template:
11+
spec:
12+
containers:
13+
- ports:
14+
- name: 9443-tcp
15+
containerPort: 9443
16+
protocol: TCP
17+
status:
18+
replicas: 1
19+
readyReplicas: 1
20+
updatedReplicas: 1
21+
---
22+
apiVersion: v1
23+
kind: Service
24+
metadata:
25+
name: manage-tls-rc
26+
---
27+
apiVersion: route.openshift.io/v1
28+
kind: Route
29+
metadata:
30+
name: manage-tls-rc
31+
spec:
32+
host: runtimecomponentoperator.test
33+
to:
34+
kind: Service
35+
name: manage-tls-rc
36+
weight: 100
37+
port:
38+
targetPort: 9443-tcp
39+
tls:
40+
termination: reencrypt
41+
wildcardPolicy: None

‎bundle/tests/scorecard/kuttl/manage-tls/01-certmanager-without-manage-tls.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: rc.app.stacks/v1beta2
2+
kind: RuntimeComponent
3+
metadata:
4+
name: manage-tls-rc
5+
spec:
6+
applicationImage: k8s.gcr.io/pause:2.0
7+
replicas: 1
8+
expose: true
9+
manageTLS: false # Deletes the *-svc-tls-cm CertManager Certificate
10+
service:
11+
port: 9443
12+
route:
13+
host: runtimecomponentoperator.test
14+
termination: reencrypt

‎bundle/tests/scorecard/kuttl/manage-tls/01-errors.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Verify that CertManager Certificate *-svc-tls-cm is deleted
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: manage-tls-rc-svc-tls-cm
6+
---
7+
# Verify that the pod template spec does not manage TLS
8+
apiVersion: apps/v1
9+
kind: Deployment
10+
metadata:
11+
name: manage-tls-rc
12+
status:
13+
replicas: 1
14+
readyReplicas: 1
15+
updatedReplicas: 1
16+
spec:
17+
template:
18+
spec:
19+
containers:
20+
- env:
21+
- name: TLS_DIR
22+
value: /etc/x509/certs
23+
- name: SA_RESOURCE_VERSION
24+
- name: SERVICE_CERT_SECRET_RESOURCE_VERSION
25+
volumeMounts:
26+
- name: svc-certificate
27+
mountPath: /etc/x509/certs
28+
readOnly: true
29+
volumes:
30+
- name: svc-certificate
31+
secret:
32+
defaultMode: 420
33+
secretName: manage-tls-rc-svc-tls-cm

‎bundle/tests/scorecard/kuttl/manage-tls/02-assert.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 60
4+
---
5+
# Verify that the deleted Certificate has been restored
6+
apiVersion: cert-manager.io/v1
7+
kind: Certificate
8+
metadata:
9+
name: manage-tls-rc-svc-tls-cm
10+
spec:
11+
secretName: manage-tls-rc-svc-tls-cm
12+
---
13+
# Verify the pod template spec defaults and that secretName uses *-cm naming convention
14+
apiVersion: apps/v1
15+
kind: StatefulSet
16+
metadata:
17+
name: manage-tls-rc
18+
status:
19+
replicas: 1
20+
readyReplicas: 1
21+
updatedReplicas: 1
22+
spec:
23+
template:
24+
spec:
25+
containers:
26+
- env:
27+
- name: TLS_DIR
28+
value: /etc/x509/certs
29+
- name: SA_RESOURCE_VERSION
30+
- name: SERVICE_CERT_SECRET_RESOURCE_VERSION
31+
volumeMounts:
32+
- name: svc-certificate
33+
mountPath: /etc/x509/certs
34+
readOnly: true
35+
- name: pvc
36+
mountPath: /mnt/data
37+
volumes:
38+
- name: svc-certificate
39+
secret:
40+
defaultMode: 420
41+
secretName: manage-tls-rc-svc-tls-cm
42+
---
43+
kind: Service
44+
apiVersion: v1
45+
metadata:
46+
name: manage-tls-rc

‎bundle/tests/scorecard/kuttl/manage-tls/02-certmanager-statefulset-with-manage-tls.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: rc.app.stacks/v1beta2
2+
kind: RuntimeComponent
3+
metadata:
4+
name: manage-tls-rc
5+
spec:
6+
applicationImage: k8s.gcr.io/pause:2.0
7+
replicas: 1
8+
expose: true
9+
manageTLS: true
10+
service:
11+
port: 9443
12+
statefulSet:
13+
storage:
14+
size: "10Mi"
15+
mountPath: "/mnt/data"
16+
route:
17+
host: runtimecomponentoperator.test
18+
termination: reencrypt

‎bundle/tests/scorecard/kuttl/manage-tls/02-errors.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Verify removal of the Deployment
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: manage-tls-rc

‎bundle/tests/scorecard/kuttl/manage-tls/03-assert.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 60
4+
---
5+
# Verify the pod template spec defaults and that secretName uses *-ocp naming convention
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: manage-tls-rc
10+
status:
11+
replicas: 1
12+
readyReplicas: 1
13+
updatedReplicas: 1
14+
spec:
15+
template:
16+
spec:
17+
containers:
18+
- env:
19+
- name: TLS_DIR
20+
value: /etc/x509/certs
21+
- name: SA_RESOURCE_VERSION
22+
- name: SERVICE_CERT_SECRET_RESOURCE_VERSION
23+
volumeMounts:
24+
- name: svc-certificate
25+
mountPath: /etc/x509/certs
26+
readOnly: true
27+
- name: pvc
28+
mountPath: /mnt/data
29+
volumes:
30+
- name: svc-certificate
31+
secret:
32+
defaultMode: 420
33+
secretName: manage-tls-rc-svc-tls-ocp
34+
---
35+
# Verify the service annotation
36+
kind: Service
37+
apiVersion: v1
38+
metadata:
39+
annotations:
40+
service.beta.openshift.io/serving-cert-secret-name: manage-tls-rc-svc-tls-ocp
41+
name: manage-tls-rc
42+
---
43+
# Check that Openshift service CA generates the secret
44+
kind: Secret
45+
apiVersion: v1
46+
metadata:
47+
name: manage-tls-rc-svc-tls-ocp
48+
annotations:
49+
service.beta.openshift.io/originating-service-name: manage-tls-rc

‎bundle/tests/scorecard/kuttl/manage-tls/03-service-ca-statefulset-with-manage-tls.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rc.app.stacks/v1beta2
2+
kind: RuntimeComponent
3+
metadata:
4+
name: manage-tls-rc
5+
spec:
6+
applicationImage: k8s.gcr.io/pause:2.0
7+
replicas: 1
8+
expose: true
9+
service:
10+
annotations:
11+
service.beta.openshift.io/serving-cert-secret-name: manage-tls-rc-svc-tls-ocp # Enables usage of OpenShift service CA
12+
port: 9443
13+
statefulSet:
14+
storage:
15+
size: "10Mi"
16+
mountPath: "/mnt/data"

0 commit comments

Comments
 (0)