Skip to content

Commit d38e98d

Browse files
agullonagullon
committed
feat: port OTP etcd test cases to Robot Framework
Port MicroShiftOnly OTP etcd test cases to Robot Framework as part of USHIFT-6690. Add the following tests to existing suite files: etcd.robot (standard1): - Etcd Database Defragment Manually (OCP-71790): run etcdctl defrag and verify db size does not grow - Etcd Runs As Transient Systemd Scope Unit (OCP-62738): verify microshift-etcd.scope is running, transient, and has correct systemd wiring (BindsTo/Before microshift.service) - Etcd Scope Follows MicroShift Lifecycle (OCP-60945): verify etcd scope stops/starts with MicroShift validate-certificate-rotation.robot (standard2): - Manual Rotation Of Etcd Signer Certs (OCP-75224): delete etcd signer certs, restart MicroShift, verify all 4 certs are regenerated with valid dates and different fingerprints Also improves Restore System Date to skip when chronyd is already active, preventing timeout when the etcd cert test runs without the clock change test. USHIFT-6745 pre-commit.check-secrets: ENABLED
1 parent 8882ae3 commit d38e98d

File tree

2 files changed

+124
-4
lines changed

2 files changed

+124
-4
lines changed

‎test/suites/standard1/etcd.robot‎

Lines changed: 76 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,17 @@ Library Collections
1010
Suite Setup Setup
1111
Suite Teardown Teardown
1212

13-
Test Tags configuration etcd restart slow
13+
Test Tags etcd
1414

1515

1616
*** Variables ***
1717
${ETCD_SYSTEMD_UNIT} microshift-etcd.scope
18+
${ETCD_CA_CERT} /var/lib/microshift/certs/etcd-signer/ca.crt
19+
${ETCD_CLIENT_CERT} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client/client.crt
20+
${ETCD_CLIENT_KEY} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client/client.key
21+
${ETCD_ENDPOINT} https://localhost:2379
22+
${ETCDCTL_BIN} /tmp/etcdctl
23+
${ETCDCTL_CMD} ${ETCDCTL_BIN} --cacert=${ETCD_CA_CERT} --cert=${ETCD_CLIENT_CERT} --key=${ETCD_CLIENT_KEY} --endpoints=${ETCD_ENDPOINT}
1824
${MEMLIMIT256} SEPARATOR=\n
1925
... ---
2026
... etcd:
@@ -26,17 +32,53 @@ ${MEMLIMIT0} SEPARATOR=\n
2632

2733

2834
*** Test Cases ***
35+
Etcd Database Defragment Manually
36+
[Documentation] Verify that etcd database can be manually defragmented
37+
... using etcdctl and the database size does not grow.
38+
${size_before}= Get Etcd Database Size
39+
Command Should Work ${ETCDCTL_CMD} defrag
40+
${size_after}= Get Etcd Database Size
41+
Should Be True ${size_after} <= ${size_before}
42+
... msg=DB size after defrag (${size_after}) should not exceed size before (${size_before})
43+
[Teardown] Command Should Work ${ETCDCTL_CMD} alarm disarm
44+
45+
Etcd Runs As Transient Systemd Scope Unit
46+
[Documentation] Verify that etcd runs as a transient systemd scope unit
47+
... managed by MicroShift with the expected systemd wiring.
48+
Systemctl Check Service SubState ${ETCD_SYSTEMD_UNIT} running
49+
${transient}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} Transient
50+
Should Be Equal As Strings ${transient} yes
51+
${pid}= MicroShift Etcd Process ID
52+
Should Not Be Empty ${pid}
53+
${binds_to}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} BindsTo
54+
Should Contain ${binds_to} microshift.service
55+
${before}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} Before
56+
Should Contain ${before} microshift.service
57+
58+
Etcd Scope Follows MicroShift Lifecycle
59+
[Documentation] Verify that etcd scope stops with MicroShift and restarts with it.
60+
[Tags] restart slow
61+
Stop MicroShift
62+
Wait Until Etcd Scope Is Inactive
63+
Start MicroShift
64+
Wait For MicroShift
65+
Systemctl Check Service SubState ${ETCD_SYSTEMD_UNIT} running
66+
[Teardown] Run Keywords Start MicroShift AND Wait For MicroShift
67+
2968
Set MemoryHigh Limit Unlimited
3069
[Documentation] The default configuration should not limit RAM
3170
...
3271
... Since we cannot assume that the default configuration file is
3372
... being used, the test explicitly configures a '0' limit, which
3473
... is equivalent to not having any configuration at all.
74+
[Tags] configuration restart slow
3575
[Setup] Setup With Custom Config ${MEMLIMIT0}
3676
Expect MemoryHigh infinity
77+
[Teardown] Restore Default Config
3778

3879
Set MemoryHigh Limit 256MB
3980
[Documentation] Set the memory limit for etcd to 256MB and ensure it takes effect
81+
[Tags] configuration restart slow
4082
[Setup] Setup With Custom Config ${MEMLIMIT256}
4183
# Expecting the setting to be 256 * 1024 * 1024
4284
Expect MemoryHigh 268435456
@@ -49,6 +91,7 @@ Setup
4991
Check Required Env Variables
5092
Login MicroShift Host
5193
Setup Kubeconfig # for readiness checks
94+
Install Etcdctl
5295

5396
Teardown
5497
[Documentation] Test suite teardown
@@ -70,7 +113,38 @@ Setup With Custom Config
70113
Expect MemoryHigh
71114
[Documentation] Verify that the MemoryHigh setting for etcd matches the expected value
72115
[Arguments] ${expected}
73-
${actual}= Get Systemd Setting microshift-etcd.scope MemoryHigh
116+
${actual}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} MemoryHigh
74117
# Using integer comparison is complicated here because sometimes
75118
# the returned or expected value is 'infinity'.
76119
Should Be Equal ${expected} ${actual}
120+
121+
Etcd Scope Is Inactive
122+
[Documentation] Check that the etcd scope unit is not active.
123+
... Transient scopes disappear when stopped, so is-active returns
124+
... "inactive" or an error.
125+
${stdout} ${rc}= Execute Command
126+
... systemctl is-active ${ETCD_SYSTEMD_UNIT}
127+
... sudo=True return_rc=True
128+
Should Match Regexp ${stdout.strip()} ^inactive$
129+
130+
Wait Until Etcd Scope Is Inactive
131+
[Documentation] Wait for the etcd scope to become inactive
132+
Wait Until Keyword Succeeds 30x 5s
133+
... Etcd Scope Is Inactive
134+
135+
Install Etcdctl
136+
[Documentation] Download etcdctl from GitHub to /tmp.
137+
... Extracts the etcd version from microshift-etcd and downloads the matching release.
138+
${etcd_ver}= Command Should Work
139+
... microshift-etcd version 2>&1 | sed -n 's/.*Base etcd Version: //p'
140+
${arch}= Command Should Work uname -m
141+
${arch_suffix}= Set Variable If '${arch}' == 'aarch64' arm64 amd64
142+
Command Should Work
143+
... bash -c 'curl -sL https://github.com/etcd-io/etcd/releases/download/v${etcd_ver}/etcd-v${etcd_ver}-linux-${arch_suffix}.tar.gz | tar -xz -C /tmp --strip-components\=1 etcd-v${etcd_ver}-linux-${arch_suffix}/etcdctl'
144+
145+
Get Etcd Database Size
146+
[Documentation] Return the current etcd database size in bytes
147+
${output}= Command Should Work ${ETCDCTL_CMD} endpoint status --write-out\=json
148+
${size}= Command Should Work
149+
... printf '%s' '${output}' | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['Status']['dbSize'])"
150+
RETURN ${size}

‎test/suites/standard2/validate-certificate-rotation.robot‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,43 @@ Test Tags restart
1616

1717
*** Variables ***
1818
${KUBE_SCHEDULER_CLIENT_CERT} /var/lib/microshift/certs/kube-control-plane-signer/kube-scheduler/client.crt
19+
${ETCD_SIGNER_CA} /var/lib/microshift/certs/etcd-signer/ca.crt
20+
${ETCD_PEER_CERT} /var/lib/microshift/certs/etcd-signer/etcd-peer/peer.crt
21+
${ETCD_SERVING_CERT} /var/lib/microshift/certs/etcd-signer/etcd-serving/peer.crt
22+
${ETCD_APISERVER_CLIENT_CERT} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client/client.crt
1923
${OSSL_CMD} openssl x509 -noout -dates -in
2024
${OSSL_DATE_FORMAT} %b %d %Y
2125
${TIMEDATECTL_DATE_FORMAT} %Y-%m-%d %H:%M:%S
2226
${FUTURE_DAYS} 150
2327

2428

2529
*** Test Cases ***
30+
Manual Rotation Of Etcd Signer Certs
31+
[Documentation] Verify that deleting etcd signer certificates and restarting
32+
... MicroShift causes them to be regenerated.
33+
[Tags] etcd
34+
# Capture the original cert fingerprint before deletion
35+
${original_fp}= Get Cert Fingerprint ${ETCD_SIGNER_CA}
36+
Command Should Work bash -c 'rm -rf /var/lib/microshift/certs/etcd-signer/*'
37+
Restart MicroShift
38+
39+
VAR @{cert_files}=
40+
... ${ETCD_SIGNER_CA}
41+
... ${ETCD_PEER_CERT}
42+
... ${ETCD_SERVING_CERT}
43+
... ${ETCD_APISERVER_CLIENT_CERT}
44+
FOR ${cert_file} IN @{cert_files}
45+
Verify Remote File Exists With Sudo ${cert_file}
46+
Certificate Should Be Valid For Current Time ${cert_file}
47+
END
48+
49+
# Expiry comparison won't work: alignValidity() anchors all same-day
50+
# certs to the same notAfter (tomorrow_midnight + validity). Use
51+
# fingerprint instead — it covers key, serial, and all cert fields.
52+
${new_fp}= Get Cert Fingerprint ${ETCD_SIGNER_CA}
53+
Should Not Be Equal As Strings ${original_fp} ${new_fp}
54+
... msg=CA cert fingerprint should differ after regeneration
55+
2656
Certificate Rotation
2757
[Documentation] Performs Certificate Expiration Rotation test
2858
# Certificates expire at midnight of (tomorrow + validity). For short-lived certs,
@@ -53,7 +83,12 @@ Teardown
5383
Logout MicroShift Host
5484

5585
Restore System Date
56-
[Documentation] Reset Microshift date to current date
86+
[Documentation] Reset MicroShift date to current date.
87+
... Skips if chronyd is already active (date was never changed).
88+
${stdout} ${rc}= Execute Command
89+
... systemctl is-active chronyd
90+
... sudo=True return_rc=True
91+
IF '${stdout.strip()}' == 'active' RETURN
5792
${ushift_pid}= MicroShift Process ID
5893
Systemctl start chronyd
5994
Wait Until MicroShift Process ID Changes ${ushift_pid}
@@ -79,7 +114,7 @@ Compute Date After Days
79114
RETURN ${future_date}
80115

81116
Certs Should Expire On
82-
[Documentation] verify if the ceritifate expires at given date.
117+
[Documentation] verify if the certificate expires at given date.
83118
[Arguments] ${cert_file} ${cert_expected_date}
84119
${expiration_date}= Command Should Work
85120
... ${OSSL_CMD} ${cert_file} | grep notAfter | cut -f2 -d'=' | awk '{printf ("%s %02d %d",$1,$2,$4)}'
@@ -109,6 +144,17 @@ Certificate Should Be Valid For Current Time
109144

110145
${cert_not_before}= Command Should Work
111146
... ${OSSL_CMD} ${cert_file} | grep notBefore | cut -f2 -d'=' | xargs -I {} date -d "{}" +%s
147+
${cert_not_after}= Command Should Work
148+
... ${OSSL_CMD} ${cert_file} | grep notAfter | cut -f2 -d'=' | xargs -I {} date -d "{}" +%s
112149
${current_time}= Command Should Work date +%s
113150
Should Be True ${cert_not_before} <= ${current_time}
114151
... msg=Certificate NotBefore (${cert_not_before}) is after current time (${current_time})
152+
Should Be True ${current_time} <= ${cert_not_after}
153+
... msg=Certificate NotAfter (${cert_not_after}) is before current time (${current_time})
154+
155+
Get Cert Fingerprint
156+
[Documentation] Return the SHA256 fingerprint of a certificate
157+
[Arguments] ${cert_file}
158+
${fingerprint}= Command Should Work
159+
... openssl x509 -noout -fingerprint -sha256 -in ${cert_file}
160+
RETURN ${fingerprint}

0 commit comments

Comments
 (0)