Skip to content

Enable encryption in backup operator test #2355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+68 −4
Open

Enable encryption in backup operator test #2355

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions e2e/fixtures/factory.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ package fixtures

import (
"context"
cryptorand "crypto/rand"
"fmt"
"io"
"log"
Expand All @@ -39,6 +40,7 @@ import (
corev1 "k8s.io/api/core/v1"
storagev1 "k8s.io/api/storage/v1"
k8serrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/duration"
"k8s.io/client-go/rest"
"sigs.k8s.io/controller-runtime/pkg/client"
Expand Down Expand Up @@ -132,6 +134,33 @@ func (factory *Factory) GetBackupSecretName() string {
return "backup-credentials"
}

// GetEncryptionKeySecretName returns the name for the encryption key secret
func (factory *Factory) GetEncryptionKeySecretName() string {
return "backup-encryption-key"
}

// CreateEncryptionKeySecret creates a 32-byte encryption key secret.
func (factory *Factory) CreateEncryptionKeySecret(namespace string) {
secretName := factory.GetEncryptionKeySecretName()

// Create 32-byte encryption key.
key := make([]byte, 32)
_, err := cryptorand.Read(key)
gomega.Expect(err).NotTo(gomega.HaveOccurred())

secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: secretName,
Namespace: namespace,
},
Data: map[string][]byte{
"key.bin": key,
},
}

gomega.Expect(factory.CreateIfAbsent(secret)).NotTo(gomega.HaveOccurred())
}

func (factory *Factory) getConfig() *rest.Config {
return factory.config
}
Expand Down
14 changes: 14 additions & 0 deletions e2e/fixtures/fdb_backup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ func (factory *Factory) CreateBackupForCluster(
AllowTagOverride: ptr.To(true),
ClusterName: fdbCluster.Name(),
Version: fdbVersion.String(),
EncryptionKeyPath: "/tmp/encryption-key/key.bin",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This means all tests will be running with encryption enabled. I would prefer having an option in the FdbBackupConfiguration to enabled encryption if wanted.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the review! I'm new to this repo so didn't know exactly where to add the encryption key logic.
I will check the FdbBackupConfiguration and update the logic there.

BlobStoreConfiguration: &fdbv1beta2.BlobStoreConfiguration{
AccountName: "seaweedfs@seaweedfs:8333",
URLParameters: []fdbv1beta2.URLParameter{
Expand Down Expand Up @@ -123,6 +124,11 @@ func (factory *Factory) CreateBackupForCluster(
ReadOnly: true,
MountPath: "/tmp/backup-credentials",
},
{
Name: "encryption-key",
ReadOnly: true,
MountPath: "/tmp/encryption-key",
},
},
},
},
Expand All @@ -143,6 +149,14 @@ func (factory *Factory) CreateBackupForCluster(
},
},
},
{
Name: "encryption-key",
VolumeSource: corev1.VolumeSource{
Secret: &corev1.SecretVolumeSource{
SecretName: factory.GetEncryptionKeySecretName(),
},
},
},
},
},
},
Expand Down
23 changes: 19 additions & 4 deletions e2e/fixtures/fdb_operator_client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,6 +325,9 @@ spec:
- name: backup-credentials
mountPath: /tmp/backup-credentials
readOnly: true
- name: encryption-key
mountPath: /tmp/encryption-key
readOnly: true
securityContext:
fsGroup: 4059
runAsGroup: 4059
Expand All @@ -339,6 +342,9 @@ spec:
- name: backup-credentials
secret:
secretName: {{ .BackupSecretName }}
- name: encryption-key
secret:
secretName: {{ .EncryptionKeySecretName }}
- name: fdb-certs
secret:
secretName: {{ .SecretName }}
Expand Down Expand Up @@ -459,6 +465,9 @@ spec:
- name: backup-credentials
mountPath: /tmp/backup-credentials
readOnly: true
- name: encryption-key
mountPath: /tmp/encryption-key
readOnly: true
securityContext:
fsGroup: 4059
runAsGroup: 4059
Expand All @@ -473,6 +482,9 @@ spec:
- name: backup-credentials
secret:
secretName: {{ .BackupSecretName }}
- name: encryption-key
secret:
secretName: {{ .EncryptionKeySecretName }}
- name: fdb-certs
secret:
secretName: {{ .SecretName }}
Expand Down Expand Up @@ -505,6 +517,8 @@ type operatorConfig struct {
SecretName string
// BackupSecretName represents the secret that should be used to communicate with the backup blobstore.
BackupSecretName string
// EncryptionKeySecretName represents the secret that contains the encryption key for backup operations.
EncryptionKeySecretName string
// SidecarVersions represents the sidecar configurations for different FoundationDB versions.
SidecarVersions []SidecarConfig
// Namespace represents the namespace for the Deployment and all associated resources
Expand Down Expand Up @@ -602,10 +616,11 @@ func (factory *Factory) getOperatorConfig(namespace string) *operatorConfig {
}

return &operatorConfig{
OperatorImage: factory.GetOperatorImage(),
SecretName: factory.GetSecretName(),
BackupSecretName: factory.GetBackupSecretName(),
Namespace: namespace,
OperatorImage: factory.GetOperatorImage(),
SecretName: factory.GetSecretName(),
BackupSecretName: factory.GetBackupSecretName(),
EncryptionKeySecretName: factory.GetEncryptionKeySecretName(),
Namespace: namespace,
SidecarVersions: factory.GetSidecarConfigs(),
ImagePullPolicy: factory.getImagePullPolicy(),
CPURequests: cpuRequests,
Expand Down
1 change: 1 addition & 0 deletions e2e/fixtures/fdb_restore.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ func (factory *Factory) CreateRestoreForCluster(backup *FdbBackup) {
DestinationClusterName: backup.fdbCluster.Name(),
BlobStoreConfiguration: backup.backup.Spec.BlobStoreConfiguration,
CustomParameters: backup.backup.Spec.CustomParameters,
EncryptionKeyPath: backup.backup.Spec.EncryptionKeyPath,
},
}
gomega.Expect(factory.CreateIfAbsent(restore)).NotTo(gomega.HaveOccurred())
Expand Down
3 changes: 3 additions & 0 deletions e2e/fixtures/kubernetes_fixtures.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,9 @@ func (factory *Factory) createNamespace(suffix string) string {
}
gomega.Expect(factory.CreateIfAbsent(backupCredentials)).NotTo(gomega.HaveOccurred())

// Create the encryption key secret for backup encryption operations.
factory.CreateEncryptionKeySecret(namespace)

factory.ensureRBACSetupExists(namespace)
gomega.Expect(factory.ensureFDBOperatorExists(namespace)).ToNot(gomega.HaveOccurred())
log.Printf("using namespace %s for testing", namespace)
Expand Down
2 changes: 2 additions & 0 deletions e2e/test_operator_backups/operator_backup_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,8 @@ var _ = BeforeSuite(func() {

// Create a blobstore for testing backups and restore
factory.CreateBlobstoreIfAbsent(fdbCluster.Namespace())

// Note: Encryption key secret is automatically created during namespace setup
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there anything we should change in the e2e test case to ensure we test backups with and without encryption (and also validate that the backup is actually encrypted)?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a great point.
I'm trying to add a file - metadata that contains if backup is encrypted or not.
After that we can check that metadata file has encryption enabled in the test and
if encryption is enabled and restore works then that can give us a some kind of gurantee.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also I'm trying to change this test to include both encryption and without encryption test.

})

var _ = AfterSuite(func() {
Expand Down
Loading