Skip to content

Commit 59f31f7

Browse files
jageejagee
committed
LDAP Adoption tests
IPA is enabled on OSP17 when testing TLS-E adoption. Since it contains an LDAP server, we can use it to run additional LDAP adoption tests. Depends-On: openstack-k8s-operators/install_yamls#1079 Jira: https://issues.redhat.com/browse/OSPRH-6861
1 parent 92ed30a commit 59f31f7

File tree

6 files changed

+268
-1
lines changed

6 files changed

+268
-1
lines changed

‎tests/roles/development_environment/defaults/main.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
# IPA-related variables
3+
ipa_admin_password: "fce95318204114530f31f885c9df588f"
4+
ipa_user_password: "nomoresecrets"
15
prelaunch_test_instance: true
26
prelaunch_test_instance_scripts:
37
- pre_launch.bash

‎tests/roles/development_environment/tasks/main.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,3 +169,34 @@
169169
{% else %}
170170
mkdir -p ~/ci-framework-data/tests/test_operator; scp -i ${EDPM_PRIVATEKEY_PATH} -o StrictHostKeyChecking=no -r ${OS_CLOUD_IP}:~/.ssh/id_ecdsa* ~/ci-framework-data/tests/test_operator/
171171
{% endif %}
172+
173+
- name: Add IPA domain to Keystone and create IPA users
174+
when: enable_tlse is defined and enable_tlse
175+
block:
176+
- name: SSH into standalone VM and execute IPA commands
177+
ansible.builtin.shell: |
178+
{{ shell_header }}
179+
ssh {{ edpm_node_ip }} "sudo podman exec freeipa-server-container bash -c '\
180+
echo {{ ipa_admin_password }} | kinit admin;\
181+
ipa user-add svc-ldap --first=Openstack --last=LDAP;\
182+
echo {{ ipa_admin_password }} | ipa passwd svc-ldap;\
183+
ipa user-add ipauser1 --first=ipa1 --last=user1;\
184+
echo {{ ipa_user_password }} | ipa passwd ipauser1;\
185+
ipa user-add ipauser2 --first=ipa2 --last=user2;\
186+
echo {{ ipa_user_password }} | ipa passwd ipauser2;\
187+
ipa user-add ipauser3 --first=ipa3 --last=user3;\
188+
echo {{ ipa_user_password }} | ipa passwd ipauser3;\
189+
ipa group-add --desc=\"OpenStack Users\" grp-openstack;\
190+
ipa group-add --desc=\"OpenStack Admin Users\" grp-openstack-admin;\
191+
ipa group-add --desc=\"OpenStack Demo Users\" grp-openstack-demo;\
192+
ipa group-add-member --users=svc-ldap grp-openstack;\
193+
ipa group-add-member --users=ipauser1 grp-openstack;\
194+
ipa group-add-member --users=ipauser1 grp-openstack-admin;\
195+
ipa group-add-member --users=ipauser2 grp-openstack;\
196+
ipa group-add-member --users=ipauser2 grp-openstack-demo;\
197+
ipa group-add-member --users=ipauser3 grp-openstack;\
198+
'"
199+
- name: Add REDHAT domain to Keystone
200+
ansible.builtin.shell: |
201+
{{ shell_header }}
202+
{{ openstack_command }} domain create --description \"Test LDAP Domain\" REDHAT

‎tests/roles/keystone_adoption/defaults/main.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,48 @@ keystone_patch: |
2828
databaseInstance: openstack
2929
secret: osp-secret
3030
keystone_retry_delay: 30
31+
32+
33+
keystone_patch_ldap: |
34+
spec:
35+
keystone:
36+
enabled: true
37+
apiOverride:
38+
route: {}
39+
template:
40+
customServiceConfig: |
41+
[token]
42+
expiration = 360000
43+
[identity]
44+
domain_specific_drivers_enabled = true
45+
extraMounts:
46+
- name: v1
47+
region: r1
48+
extraVol:
49+
- propagation:
50+
- Keystone
51+
extraVolType: Conf
52+
volumes:
53+
- name: keystone-domains
54+
secret:
55+
secretName: keystone-domains
56+
mounts:
57+
- name: keystone-domains
58+
mountPath: "/etc/keystone/domains"
59+
readOnly: true
60+
override:
61+
service:
62+
internal:
63+
metadata:
64+
annotations:
65+
metallb.universe.tf/address-pool: internalapi
66+
metallb.universe.tf/allow-shared-ip: internalapi
67+
metallb.universe.tf/loadBalancerIPs: {{ internalapi_prefix | default('172.17.0') }}.80
68+
spec:
69+
type: LoadBalancer
70+
databaseInstance: openstack
71+
secret: osp-secret
72+
# IPA-related variables
73+
edpm_node_hostname: ipa.example.testing
74+
ipa_admin_password: "fce95318204114530f31f885c9df588f"
75+
ipa_user_password: "nomoresecrets"

‎tests/roles/keystone_adoption/tasks/main.yaml‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,51 @@
1616
type: Opaque
1717
EOF
1818
19+
- name: Set IPA BaseDN var
20+
ansible.builtin.set_fact:
21+
ipa_basedn: "dc={{ edpm_node_hostname.split('.')[1:] | join(',dc=') }}"
22+
when: enable_tlse is defined and enable_tlse
23+
24+
- name: Create Keystone domain config secret for LDAP
25+
ansible.builtin.shell: |
26+
{{ shell_header }}
27+
{{ oc_header }}
28+
cat <<EOF | oc apply -n openstack -f -
29+
apiVersion: v1
30+
kind: Secret
31+
metadata:
32+
name: keystone-domains
33+
type: Opaque
34+
stringData:
35+
keystone.{{ ipa_domain | default('REDHAT') }}.conf: |
36+
[identity]
37+
driver = ldap
38+
[ldap]
39+
url = ldaps://ipa.apps-crc.testing
40+
user = uid=svc-ldap,cn=users,cn=accounts,{{ ipa_basedn }}
41+
password = {{ ipa_admin_password | default('nomoresecrets') }}
42+
suffix = {{ ipa_basedn }}
43+
user_tree_dn = cn=users,cn=accounts,{{ ipa_basedn }}
44+
user_objectclass = person
45+
user_id_attribute = uid
46+
user_name_attribute = uid
47+
user_mail_attribute = mail
48+
group_tree_dn = cn=groups,cn=accounts,{{ ipa_basedn }}
49+
group_objectclass = groupOfNames
50+
group_id_attribute = cn
51+
group_name_attribute = cn
52+
group_member_attribute = member
53+
group_desc_attribute = description
54+
EOF
55+
when: enable_tlse is defined and enable_tlse
56+
1957
- name: deploy podified Keystone
2058
ansible.builtin.shell: |
2159
{{ shell_header }}
2260
{{ oc_header }}
23-
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch }}'
61+
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch_to_use }}'
62+
vars:
63+
keystone_patch_to_use: "{{ keystone_patch_ldap if (enable_tlse is defined and enable_tlse) else keystone_patch }}"
2464

2565
- name: wait for Keystone to start up
2666
ansible.builtin.shell: |
@@ -106,3 +146,7 @@
106146
${BASH_ALIASES[openstack]} credential show {{ before_adoption_credential.stdout }} -f value -c blob
107147
register: after_adoption_credential
108148
failed_when: after_adoption_credential.stdout != 'test'
149+
150+
- name: Run IPA tests if enable_tlse is true
151+
ansible.builtin.include_tasks: run_ipa_test.yml
152+
when: enable_tlse is defined and enable_tlse

‎tests/roles/keystone_adoption/tasks/run_ipa_test.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# Tasks for testing IPA integration with Keystone
2+
- name: Check if IPA is enabled
3+
ansible.builtin.fail:
4+
msg: "IPA is not enabled (enable_tlse is not true). Skipping IPA tests."
5+
when: enable_tlse is not defined or not enable_tlse
6+
7+
- name: Wait for Keystone to be fully operational
8+
ansible.builtin.shell: |
9+
{{ shell_header }}
10+
{{ oc_header }}
11+
oc wait pod --for condition=Ready --selector=service=keystone
12+
register: keystone_wait_result
13+
until: keystone_wait_result is success
14+
retries: 60
15+
delay: 2
16+
17+
- name: Wait for openstackclient pod to be ready
18+
ansible.builtin.shell: |
19+
{{ shell_header }}
20+
{{ oc_header }}
21+
oc wait pod --for condition=Ready --selector=service=openstackclient
22+
register: osc_wait_result
23+
until: osc_wait_result is success
24+
retries: 60
25+
delay: 2
26+
27+
- name: Get Keystone route
28+
ansible.builtin.shell: |
29+
{{ shell_header }}
30+
{{ oc_header }}
31+
oc get route keystone-public -n openstack -o jsonpath='{.spec.host}'
32+
register: keystone_route
33+
34+
- name: Create files directory if it does not exist
35+
ansible.builtin.file:
36+
path: "{{ role_path }}/files"
37+
state: directory
38+
mode: '0755'
39+
40+
- name: Create IPA test user cloudrc file
41+
ansible.builtin.template:
42+
src: ipauser.j2
43+
dest: "{{ role_path }}/files/ipauser"
44+
mode: "0600"
45+
vars:
46+
auth_url: "https://{{ keystone_route.stdout }}/v3"
47+
username: "ipauser1"
48+
password: "{{ ipa_user_password }}"
49+
domain: "REDHAT"
50+
51+
- name: Copy IPA test user cloudrc to openstackclient pod
52+
ansible.builtin.shell: |
53+
{{ shell_header }}
54+
{{ oc_header }}
55+
oc cp {{ role_path }}/files/ipauser openstackclient:/home/cloud-admin/ipauser
56+
- name: Test IPA user authentication
57+
ansible.builtin.shell: |
58+
{{ shell_header }}
59+
{{ oc_header }}
60+
oc exec -t openstackclient -- bash -c "
61+
source /home/cloud-admin/ipauser &&
62+
export OS_IDENTITY_API_VERSION=3 &&
63+
openstack token issue -f value -c id > /dev/null &&
64+
echo 'IPA user authentication successful' ||
65+
echo 'IPA user authentication failed'"
66+
register: ipa_auth_test
67+
failed_when: "'IPA user authentication failed' in ipa_auth_test.stdout"
68+
retries: 60
69+
delay: 2
70+
71+
- name: List IPA users via Keystone
72+
ansible.builtin.shell: |
73+
{{ shell_header }}
74+
{{ oc_header }}
75+
oc exec -t openstackclient -- bash -c "
76+
source /home/cloud-admin/ipauser &&
77+
export OS_IDENTITY_API_VERSION=3 &&
78+
openstack user list --domain REDHAT"
79+
register: ipa_user_list
80+
81+
- name: Verify IPA users are accessible
82+
ansible.builtin.assert:
83+
that:
84+
- "'ipauser1' in ipa_user_list.stdout"
85+
- "'ipauser2' in ipa_user_list.stdout"
86+
- "'ipauser3' in ipa_user_list.stdout"
87+
88+
- name: List IPA groups via Keystone
89+
ansible.builtin.shell: |
90+
{{ shell_header }}
91+
{{ oc_header }}
92+
oc exec -t openstackclient -- bash -c "
93+
source /home/cloud-admin/ipauser &&
94+
export OS_IDENTITY_API_VERSION=3 &&
95+
openstack group list --domain REDHAT"
96+
register: ipa_group_list
97+
98+
- name: Verify IPA groups are accessible
99+
ansible.builtin.assert:
100+
that:
101+
- "'grp-openstack' in ipa_group_list.stdout"
102+
- "'grp-openstack-admin' in ipa_group_list.stdout"
103+
- "'grp-openstack-demo' in ipa_group_list.stdout"
104+
105+
- name: Check ipauser1 in grp-openstack-admin
106+
ansible.builtin.shell: |
107+
{{ shell_header }}
108+
{{ oc_header }}
109+
oc exec -t openstackclient -- bash -c "
110+
source /home/cloud-admin/ipauser &&
111+
export OS_IDENTITY_API_VERSION=3 &&
112+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack-admin ipauser1"
113+
register: user1_group_result
114+
failed_when: "'ipauser1 in group grp-openstack-admin' not in user1_group_result.stdout"
115+
116+
- name: Check ipauser2 in grp-openstack-demo
117+
ansible.builtin.shell: |
118+
{{ shell_header }}
119+
{{ oc_header }}
120+
oc exec -t openstackclient -- bash -c "
121+
source /home/cloud-admin/ipauser &&
122+
export OS_IDENTITY_API_VERSION=3 &&
123+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack-demo ipauser2"
124+
register: user2_group_result
125+
failed_when: "'ipauser2 in group grp-openstack-demo' not in user2_group_result.stdout"
126+
127+
- name: Check ipauser3 in grp-openstack
128+
ansible.builtin.shell: |
129+
{{ shell_header }}
130+
{{ oc_header }}
131+
oc exec -t openstackclient -- bash -c "
132+
source /home/cloud-admin/ipauser &&
133+
export OS_IDENTITY_API_VERSION=3 &&
134+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack ipauser3"
135+
register: user3_group_result
136+
failed_when: "'ipauser3 in group grp-openstack' not in user3_group_result.stdout"

‎tests/roles/keystone_adoption/templates/ipauser.j2‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
unset OS_CLOUD
3+
export OS_IDENTITY_API_VERSION=3
4+
export OS_AUTH_URL="{{ auth_url }}"
5+
export OS_USER_DOMAIN_NAME="{{ domain }}"
6+
export OS_USERNAME="{{ username }}"
7+
export OS_PASSWORD="{{ password }}"

0 commit comments

Comments
 (0)