Skip to content

Commit ac9cc76

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #248 from PillaiManish/master
CM-423: Improves e2e test for istio-csr controller to read from resource status
2 parents b7dc226 + a7393ed commit ac9cc76

File tree

4 files changed

+91
-134
lines changed

4 files changed

+91
-134
lines changed

‎test/e2e/config_template.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ package e2e
66
import (
77
"bytes"
88
"text/template"
9+
10+
"github.com/openshift/cert-manager-operator/api/operator/v1alpha1"
911
)
1012

1113
// IssuerConfig customizes fields in the issuer spec
@@ -19,6 +21,12 @@ type CertificateConfig struct {
1921
DNSName string
2022
}
2123

24+
// IstioCSRConfig customizes the fields in a job spec
25+
type IstioCSRGRPCurlJobConfig struct {
26+
CertificateSigningRequest string
27+
IstioCSRStatus v1alpha1.IstioCSRStatus
28+
}
29+
2230
// replaceWithTemplate puts field values from a template struct
2331
func replaceWithTemplate(sourceFileContents string, templatedValues any) ([]byte, error) {
2432
tmpl, err := template.New("template").Parse(sourceFileContents)

‎test/e2e/istio_csr_test.go‎

Lines changed: 9 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,10 @@ import (
1313
"net/url"
1414
"path/filepath"
1515

16-
batchv1 "k8s.io/api/batch/v1"
1716
corev1 "k8s.io/api/core/v1"
1817
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1918
"k8s.io/client-go/dynamic"
2019
"k8s.io/client-go/kubernetes"
21-
"k8s.io/utils/ptr"
2220

2321
"github.com/openshift/cert-manager-operator/test/library"
2422

@@ -74,7 +72,7 @@ var _ = Describe("Istio-CSR", Ordered, Label("TechPreview", "Feature:IstioCSR"),
7472
Context("grpc call istio.v1.auth.IstioCertificateService/CreateCertificate to istio-csr agent", func() {
7573
It("should return cert-chain as response", func() {
7674
serviceAccountName := "cert-manager-istio-csr"
77-
grpcAppName := "grpcurl"
75+
grpcAppName := "grpcurl-istio-csr"
7876

7977
By("creating cluster issuer")
8078
loader.CreateFromFile(testassets.ReadFile, filepath.Join("testdata", "self_signed", "cluster_issuer.yaml"), ns.Name)
@@ -115,7 +113,7 @@ var _ = Describe("Istio-CSR", Ordered, Label("TechPreview", "Feature:IstioCSR"),
115113
err = pollTillDeploymentAvailable(ctx, clientset, ns.Name, "cert-manager-istio-csr")
116114
Expect(err).Should(BeNil())
117115

118-
istioCSRGRPCEndpoint, err := pollTillIstioCSRAvailable(ctx, dynamicClient, ns.Name, "default")
116+
istioCSRStatus, err := pollTillIstioCSRAvailable(ctx, dynamicClient, ns.Name, "default")
119117
Expect(err).Should(BeNil())
120118

121119
By("poll till the service account is available")
@@ -142,109 +140,16 @@ var _ = Describe("Istio-CSR", Ordered, Label("TechPreview", "Feature:IstioCSR"),
142140
Expect(err).Should(BeNil())
143141

144142
By("creating an grpcurl job")
145-
job := &batchv1.Job{
146-
ObjectMeta: metav1.ObjectMeta{
147-
Name: "grpcurl-job",
148-
},
149-
Spec: batchv1.JobSpec{
150-
Completions: ptr.To(int32(1)),
151-
BackoffLimit: ptr.To(backOffLimit),
152-
Template: corev1.PodTemplateSpec{
153-
ObjectMeta: metav1.ObjectMeta{
154-
Name: grpcAppName,
155-
Labels: map[string]string{
156-
"app": grpcAppName,
157-
},
158-
},
159-
Spec: corev1.PodSpec{
160-
ServiceAccountName: serviceAccountName,
161-
AutomountServiceAccountToken: ptr.To(false),
162-
RestartPolicy: corev1.RestartPolicyOnFailure,
163-
Containers: []corev1.Container{
164-
{
165-
Name: grpcAppName,
166-
Image: "registry.redhat.io/rhel9/go-toolset",
167-
Command: []string{
168-
"/bin/sh",
169-
"-c",
170-
},
171-
Env: []corev1.EnvVar{
172-
{
173-
Name: "GOCACHE",
174-
Value: "/tmp/go-cache",
175-
},
176-
{
177-
Name: "GOPATH",
178-
Value: "/tmp/go",
179-
},
180-
},
181-
Args: []string{
182-
"go install github.com/fullstorydev/grpcurl/cmd/[email protected] >/dev/null 2>&1 && " +
183-
"TOKEN=$(cat /var/run/secrets/istio-ca/token) && " +
184-
"/tmp/go/bin/grpcurl " +
185-
"-import-path /proto " +
186-
"-proto /proto/ca.proto " +
187-
"-H \"Authorization: Bearer $TOKEN\" " +
188-
fmt.Sprintf("-d '{\"csr\": \"%s\", \"validity_duration\": 3600}' ", csr) +
189-
"-cacert /etc/root-secret/ca.crt " +
190-
"-key /etc/root-secret/tls.key " +
191-
"-cert /etc/root-secret/tls.crt " +
192-
fmt.Sprintf("%s istio.v1.auth.IstioCertificateService/CreateCertificate", istioCSRGRPCEndpoint),
193-
},
194-
VolumeMounts: []corev1.VolumeMount{
195-
{Name: "root-secret", MountPath: "/etc/root-secret"},
196-
{Name: "proto", MountPath: "/proto"},
197-
{Name: "sa-token", MountPath: "/var/run/secrets/istio-ca"},
198-
},
199-
},
200-
},
201-
Volumes: []corev1.Volume{
202-
{
203-
Name: "sa-token",
204-
VolumeSource: corev1.VolumeSource{
205-
Projected: &corev1.ProjectedVolumeSource{
206-
DefaultMode: ptr.To(int32(420)),
207-
Sources: []corev1.VolumeProjection{
208-
{
209-
ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
210-
Audience: "istio-ca",
211-
ExpirationSeconds: ptr.To(int64(3600)),
212-
Path: "token",
213-
},
214-
},
215-
},
216-
},
217-
},
218-
},
219-
{
220-
Name: "root-secret",
221-
VolumeSource: corev1.VolumeSource{
222-
Secret: &corev1.SecretVolumeSource{
223-
SecretName: "istiod-tls",
224-
},
225-
},
226-
},
227-
{
228-
Name: "proto",
229-
VolumeSource: corev1.VolumeSource{
230-
ConfigMap: &corev1.ConfigMapVolumeSource{
231-
LocalObjectReference: corev1.LocalObjectReference{
232-
Name: "proto-cm",
233-
},
234-
},
235-
},
236-
},
237-
},
238-
},
239-
},
143+
loader.CreateFromFile(AssetFunc(testassets.ReadFile).WithTemplateValues(
144+
IstioCSRGRPCurlJobConfig{
145+
CertificateSigningRequest: csr,
146+
IstioCSRStatus: istioCSRStatus,
240147
},
241-
}
242-
_, err = clientset.BatchV1().Jobs(ns.Name).Create(context.TODO(), job, metav1.CreateOptions{})
243-
Expect(err).Should(BeNil())
244-
defer clientset.BatchV1().Jobs(ns.Name).Delete(ctx, job.Name, metav1.DeleteOptions{})
148+
), filepath.Join("testdata", "istio", "grpcurl_job.yaml"), ns.Name)
149+
defer loader.DeleteFromFile(testassets.ReadFile, filepath.Join("testdata", "istio", "grpcurl_job.yaml"), ns.Name)
245150

246151
By("waiting for the job to be completed")
247-
err = pollTillJobCompleted(ctx, clientset, ns.Name, "grpcurl-job")
152+
err = pollTillJobCompleted(ctx, clientset, ns.Name, grpcAppName)
248153
Expect(err).Should(BeNil())
249154

250155
By("fetching logs of the grpcurl job")

‎test/e2e/testdata/istio/grpcurl_job.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: grpcurl-istio-csr
5+
spec:
6+
backoffLimit: 10
7+
completions: 1
8+
template:
9+
metadata:
10+
labels:
11+
app: grpcurl-istio-csr
12+
name: grpcurl-istio-csr
13+
spec:
14+
automountServiceAccountToken: false
15+
containers:
16+
- args:
17+
- |
18+
go install github.com/fullstorydev/grpcurl/cmd/[email protected] >/dev/null 2>&1 && \
19+
TOKEN=$(cat /var/run/secrets/istio-ca/token) && \
20+
/tmp/go/bin/grpcurl \
21+
-import-path /proto \
22+
-proto /proto/ca.proto \
23+
-H "Authorization: Bearer $TOKEN" \
24+
-d '{"csr": "{{.CertificateSigningRequest}}", "validity_duration": 3600}' \
25+
-cacert /etc/root-secret/ca.crt \
26+
-key /etc/root-secret/tls.key \
27+
-cert /etc/root-secret/tls.crt \
28+
{{.IstioCSRStatus.IstioCSRGRPCEndpoint}} istio.v1.auth.IstioCertificateService/CreateCertificate
29+
command:
30+
- /bin/sh
31+
- -c
32+
env:
33+
- name: GOCACHE
34+
value: /tmp/go-cache
35+
- name: GOPATH
36+
value: /tmp/go
37+
image: registry.redhat.io/rhel9/go-toolset
38+
name: grpcurl
39+
volumeMounts:
40+
- mountPath: /etc/root-secret
41+
name: root-secret
42+
- mountPath: /proto
43+
name: proto
44+
- mountPath: /var/run/secrets/istio-ca
45+
name: sa-token
46+
restartPolicy: OnFailure
47+
serviceAccountName: '{{.IstioCSRStatus.ServiceAccount}}'
48+
volumes:
49+
- name: sa-token
50+
projected:
51+
defaultMode: 420
52+
sources:
53+
- serviceAccountToken:
54+
audience: istio-ca
55+
expirationSeconds: 3600
56+
path: token
57+
- name: root-secret
58+
secret:
59+
secretName: istiod-tls
60+
- configMap:
61+
name: proto-cm
62+
name: proto

‎test/e2e/utils_test.go‎

Lines changed: 12 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88
"context"
99
"encoding/json"
1010
"fmt"
11-
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
1211
"math/rand"
1312
"regexp"
1413
"strings"
@@ -32,7 +31,10 @@ import (
3231
networkingv1 "k8s.io/api/networking/v1"
3332
"k8s.io/apimachinery/pkg/api/equality"
3433
apierrors "k8s.io/apimachinery/pkg/api/errors"
34+
"k8s.io/apimachinery/pkg/api/meta"
3535
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
36+
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
37+
"k8s.io/apimachinery/pkg/runtime"
3638
"k8s.io/apimachinery/pkg/runtime/schema"
3739
"k8s.io/apimachinery/pkg/types"
3840
"k8s.io/apimachinery/pkg/util/errors"
@@ -611,10 +613,10 @@ func pollTillServiceAccountAvailable(ctx context.Context, clientset *kubernetes.
611613
return err
612614
}
613615

614-
// pollTillIstioCSRAvailable poll the istioCSR object and returns non-nil error and istio-grpc-endpoint
616+
// pollTillIstioCSRAvailable poll the istioCSR object and returns non-nil error and istioCSRStatus
615617
// once the istiocsr is available, otherwise should return a time-out error
616-
func pollTillIstioCSRAvailable(ctx context.Context, dynamicClient *dynamic.DynamicClient, namespace, istioCsrName string) (string, error) {
617-
var istioCSRGRPCEndpoint string
618+
func pollTillIstioCSRAvailable(ctx context.Context, dynamicClient *dynamic.DynamicClient, namespace, istioCsrName string) (v1alpha1.IstioCSRStatus, error) {
619+
var istioCSRStatus v1alpha1.IstioCSRStatus
618620
err := wait.PollUntilContextTimeout(ctx, PollInterval, TestTimeout, true, func(ctx context.Context) (bool, error) {
619621
gvr := schema.GroupVersionResource{
620622
Group: "operator.openshift.io",
@@ -636,44 +638,24 @@ func pollTillIstioCSRAvailable(ctx context.Context, dynamicClient *dynamic.Dynam
636638
return false, nil
637639
}
638640

639-
conditions, found, err := unstructured.NestedSlice(customResource.Object, "status", "conditions")
641+
err = runtime.DefaultUnstructuredConverter.FromUnstructured(status, &istioCSRStatus)
640642
if err != nil {
641643
return false, nil
642644
}
643645

644-
if !found {
645-
return false, nil
646-
}
647-
648-
for _, condition := range conditions {
649-
condMap, ok := condition.(map[string]interface{})
650-
if !ok {
651-
continue
652-
}
653-
654-
condType, _ := condMap["type"].(string)
655-
condStatus, _ := condMap["status"].(string)
656-
657-
if condType != "Ready" {
658-
continue
659-
}
660-
661-
if condStatus == string(metav1.ConditionTrue) {
662-
break
663-
} else {
664-
return false, nil
665-
}
646+
readyCondition := meta.FindStatusCondition(istioCSRStatus.Conditions, v1alpha1.Ready)
666647

648+
if readyCondition == nil || readyCondition.Status != metav1.ConditionTrue {
649+
return false, nil
667650
}
668651

669-
if !library.IsEmptyString(status["istioCSRGRPCEndpoint"]) && !library.IsEmptyString(status["clusterRoleBinding"]) && !library.IsEmptyString(status["istioCSRImage"]) && !library.IsEmptyString(status["serviceAccount"]) {
670-
istioCSRGRPCEndpoint = status["istioCSRGRPCEndpoint"].(string)
652+
if !library.IsEmptyString(istioCSRStatus.IstioCSRGRPCEndpoint) && !library.IsEmptyString(istioCSRStatus.ClusterRoleBinding) && !library.IsEmptyString(istioCSRStatus.IstioCSRImage) && !library.IsEmptyString(istioCSRStatus.ServiceAccount) {
671653
return true, nil
672654
}
673655
return false, nil
674656
})
675657

676-
return istioCSRGRPCEndpoint, err
658+
return istioCSRStatus, err
677659
}
678660

679661
func pollTillDeploymentAvailable(ctx context.Context, clientSet *kubernetes.Clientset, namespace, deploymentName string) error {

0 commit comments

Comments
 (0)