CLOUDP-71332: TLS internal cluster auth tests (#169)

chatton · web-flow · commit 4b79e74bda3e · 2020-09-07T17:47:07.000+01:00
diff --git a/test/e2e/feature_compatibility_version/feature_compatibility_version_test.go b/test/e2e/feature_compatibility_version/feature_compatibility_version_test.go
@@ -40,7 +40,7 @@ func TestFeatureCompatibilityVersion(t *testing.T) {
 
 	t.Run("Create MongoDB Resource", mongodbtests.CreateMongoDBResource(&mdb, ctx))
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
-
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 	t.Run("Test FeatureCompatibilityVersion is 4.0", tester.HasFCV("4.0", 3))
 
 	// Upgrade version to 4.2.6 while keeping the FCV set to 4.0
diff --git a/test/e2e/feature_compatibility_version_upgrade/feature_compatibility_version_upgrade_test.go b/test/e2e/feature_compatibility_version_upgrade/feature_compatibility_version_upgrade_test.go
@@ -35,15 +35,21 @@ func TestFeatureCompatibilityVersionUpgrade(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	_, err = setup.GeneratePasswordForUser(user, ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	tester, err := mongotester.FromResource(t, mdb)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	t.Run("Create MongoDB Resource", mongodbtests.CreateMongoDBResource(&mdb, ctx))
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
-
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 	t.Run("Test FeatureCompatibilityVersion is 4.0", tester.HasFCV("4.0", 3))
+
 	// Upgrade version to 4.2.6 while keeping the FCV set to 4.0
 	t.Run("MongoDB is reachable", func(t *testing.T) {
 		defer tester.StartBackgroundConnectivityTest(t, time.Second*10)()
diff --git a/test/e2e/replica_set/replica_set_test.go b/test/e2e/replica_set/replica_set_test.go
@@ -37,5 +37,6 @@ func TestReplicaSet(t *testing.T) {
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
 	t.Run("Keyfile authentication is configured", tester.HasKeyfileAuth(3))
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds())
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 	t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))
 }
diff --git a/test/e2e/replica_set_change_version/replica_set_test.go b/test/e2e/replica_set_change_version/replica_set_test.go
@@ -44,6 +44,7 @@ func TestReplicaSetUpgradeVersion(t *testing.T) {
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds())
 	t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 
 	// Upgrade version to 4.4.0
 	t.Run("MongoDB is reachable while version is upgraded", func(t *testing.T) {
diff --git a/test/e2e/replica_set_mongod_config/replica_set_mongod_config_test.go b/test/e2e/replica_set_mongod_config/replica_set_mongod_config_test.go
@@ -43,6 +43,7 @@ func TestReplicaSet(t *testing.T) {
 
 	t.Run("Create MongoDB Resource", mongodbtests.CreateMongoDBResource(&mdb, ctx))
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds())
 	t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))
 	t.Run("Mongod config has been set", tester.EnsureMongodConfig(setting, value))
diff --git a/test/e2e/replica_set_multiple/replica_set_multiple_test.go b/test/e2e/replica_set_multiple/replica_set_multiple_test.go
@@ -61,6 +61,9 @@ func TestReplicaSet(t *testing.T) {
 	t.Run("mdb0: AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb0, 1))
 	t.Run("mdb1: AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb1, 1))
 
+	t.Run("mdb0: Ensure Authentication", tester0.EnsureAuthenticationIsConfigured(3))
+	t.Run("mdb1: Ensure Authentication", tester1.EnsureAuthenticationIsConfigured(3))
+
 	t.Run("MongoDB is reachable while being scaled up", func(t *testing.T) {
 		defer tester0.StartBackgroundConnectivityTest(t, time.Second*10)()
 		t.Run("Scale MongoDB Resource Up", mongodbtests.Scale(&mdb0, 5))
diff --git a/test/e2e/replica_set_readiness_probe/replica_set_readiness_probe_test.go b/test/e2e/replica_set_readiness_probe/replica_set_readiness_probe_test.go
@@ -43,6 +43,8 @@ func TestReplicaSetReadinessProbeScaling(t *testing.T) {
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds())
 	t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
+
 	t.Run("MongoDB is reachable", func(t *testing.T) {
 		defer tester.StartBackgroundConnectivityTest(t, time.Second*10)()
 		t.Run("Delete Random Pod", mongodbtests.DeletePod(&mdb, rand.Intn(mdb.Spec.Members)))
diff --git a/test/e2e/replica_set_scale/replica_set_scaling_test.go b/test/e2e/replica_set_scale/replica_set_scaling_test.go
@@ -40,6 +40,7 @@ func TestReplicaSetScale(t *testing.T) {
 	t.Run("Create MongoDB Resource", mongodbtests.CreateMongoDBResource(&mdb, ctx))
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds())
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 	t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))
 	t.Run("MongoDB is reachable", func(t *testing.T) {
 		defer tester.StartBackgroundConnectivityTest(t, time.Second*10)()
diff --git a/test/e2e/replica_set_tls/replica_set_tls_test.go b/test/e2e/replica_set_tls/replica_set_tls_test.go
@@ -43,4 +43,5 @@ func TestReplicaSetTLS(t *testing.T) {
 	t.Run("Wait for TLS to be enabled", tester.HasTlsMode("requireSSL", 60))
 	t.Run("Test Basic TLS Connectivity", tester.ConnectivitySucceeds(WithTls()))
 	t.Run("Test TLS required", tester.ConnectivityFails(WithoutTls()))
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3, WithTls()))
 }
diff --git a/test/e2e/replica_set_tls_rotate/replica_set_tls_rotate_test.go b/test/e2e/replica_set_tls_rotate/replica_set_tls_rotate_test.go
@@ -44,6 +44,7 @@ func TestReplicaSetTLSRotate(t *testing.T) {
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
 	t.Run("Wait for TLS to be enabled", tester.HasTlsMode("requireSSL", 60, WithTls()))
 	t.Run("Test Basic TLS Connectivity", tester.ConnectivitySucceeds(WithTls()))
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3, WithTls()))
 	t.Run("Test TLS required", tester.ConnectivityFails(WithoutTls()))
 
 	t.Run("MongoDB is reachable while certificate is rotated", func(t *testing.T) {
diff --git a/test/e2e/replica_set_tls_upgrade/replica_set_tls_upgrade_test.go b/test/e2e/replica_set_tls_upgrade/replica_set_tls_upgrade_test.go
@@ -42,6 +42,7 @@ func TestReplicaSetTLSUpgrade(t *testing.T) {
 	t.Run("Create MongoDB Resource", mongodbtests.CreateMongoDBResource(&mdb, ctx))
 	t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds(WithoutTls()))
+	t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))
 
 	// Enable TLS as optional
 	t.Run("MongoDB is reachable while TLS is being enabled", func(t *testing.T) {
@@ -54,6 +55,7 @@ func TestReplicaSetTLSUpgrade(t *testing.T) {
 	// Ensure MongoDB is reachable both with and without TLS
 	t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds(WithoutTls()))
 	t.Run("Test Basic TLS Connectivity", tester.ConnectivitySucceeds(WithTls()))
+	t.Run("Internal cluster keyfile authentication is enabled", tester.HasKeyfileAuth(3, WithTls()))
 
 	// Make TLS required
 	t.Run("MongoDB is reachable over TLS while making TLS required", func(t *testing.T) {
diff --git a/test/e2e/util/mongotester/mongotester.go b/test/e2e/util/mongotester/mongotester.go
@@ -120,6 +120,17 @@ func (m *Tester) HasFCV(fcv string, tries int, opts ...OptionApplier) func(t *te
 	return m.hasAdminParameter("featureCompatibilityVersion", map[string]interface{}{"version": fcv}, tries, opts...)
 }
 
+func (m *Tester) ScramIsConfigured(tries int, opts ...OptionApplier) func(t *testing.T) {
+	return m.hasAdminParameter("authenticationMechanisms", primitive.A{"SCRAM-SHA-256"}, tries, opts...)
+}
+
+func (m *Tester) EnsureAuthenticationIsConfigured(tries int, opts ...OptionApplier) func(t *testing.T) {
+	return func(t *testing.T) {
+		t.Run("Ensure keyFile authentication is configured", m.HasKeyfileAuth(tries, opts...))
+		t.Run("SCRAM-SHA-256 is configured", m.ScramIsConfigured(tries, opts...))
+	}
+}
+
 func (m *Tester) HasTlsMode(tlsMode string, tries int, opts ...OptionApplier) func(t *testing.T) {
 	return m.hasAdminParameter("sslMode", tlsMode, tries, opts...)
 }
@@ -142,7 +153,7 @@ func (m *Tester) hasAdminParameter(key string, expectedValue interface{}, tries
 		for !found && tries > 0 {
 			<-time.After(10 * time.Second)
 			actualValue, err := m.getAdminSetting(key)
-			t.Logf("Actual Value: %+v", actualValue)
+			t.Logf("Actual Value: %+v, type: %s", actualValue, reflect.TypeOf(actualValue))
 			if err != nil {
 				t.Logf("Unable to get admin setting %s with error : %s", key, err)
 				continue

Original file line number	Diff line number	Diff line change
`@@ -37,5 +37,6 @@ func TestReplicaSet(t *testing.T) {`
`37`	`37`	`t.Run("Basic tests", mongodbtests.BasicFunctionality(&mdb))`
`38`	`38`	`t.Run("Keyfile authentication is configured", tester.HasKeyfileAuth(3))`
`39`	`39`	`t.Run("Test Basic Connectivity", tester.ConnectivitySucceeds())`
	`40`	`+ t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3))`
`40`	`41`	`t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))`
`41`	`42`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,4 +43,5 @@ func TestReplicaSetTLS(t *testing.T) {`
`43`	`43`	`t.Run("Wait for TLS to be enabled", tester.HasTlsMode("requireSSL", 60))`
`44`	`44`	`t.Run("Test Basic TLS Connectivity", tester.ConnectivitySucceeds(WithTls()))`
`45`	`45`	`t.Run("Test TLS required", tester.ConnectivityFails(WithoutTls()))`
	`46`	`+ t.Run("Ensure Authentication", tester.EnsureAuthenticationIsConfigured(3, WithTls()))`
`46`	`47`	`}`