Skip to content

Commit f1846af

Browse files
agullonagullon
committed
feat: port OTP etcd test cases to Robot Framework
Port MicroShiftOnly OTP etcd test cases to Robot Framework as part of USHIFT-6690. Add the following tests to existing suite files: etcd.robot (standard1): - Etcd Database Defragment Manually (OCP-71790): run etcdctl defrag and verify db size does not grow - Etcd Runs As Transient Systemd Scope Unit (OCP-62738): verify microshift-etcd.scope is running, transient, and has correct systemd wiring (BindsTo/Before microshift.service) - Etcd Scope Follows MicroShift Lifecycle (OCP-60945): verify etcd scope stops/starts with MicroShift validate-certificate-rotation.robot (standard2): - Manual Rotation Of Etcd Signer Certs (OCP-75224): delete etcd signer certs, restart MicroShift, verify all 4 certs are regenerated with valid dates and different fingerprints Also improves Restore System Date to skip when chronyd is already active, preventing timeout when the etcd cert test runs without the clock change test. USHIFT-6745 pre-commit.check-secrets: ENABLED
1 parent 8882ae3 commit f1846af

File tree

2 files changed

+123
-4
lines changed

2 files changed

+123
-4
lines changed

‎test/suites/standard1/etcd.robot‎

Lines changed: 79 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,16 @@ Library Collections
1010
Suite Setup Setup
1111
Suite Teardown Teardown
1212

13-
Test Tags configuration etcd restart slow
13+
Test Tags etcd
1414

1515

1616
*** Variables ***
1717
${ETCD_SYSTEMD_UNIT} microshift-etcd.scope
18+
${ETCD_CA_CERT} /var/lib/microshift/certs/etcd-signer/ca.crt
19+
${ETCD_CLIENT_CERT} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client/client.crt
20+
${ETCD_CLIENT_KEY} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client/client.key
21+
${ETCD_ENDPOINT} https://localhost:2379
22+
${ETCDCTL_CMD} /usr/local/bin/etcdctl --cacert=${ETCD_CA_CERT} --cert=${ETCD_CLIENT_CERT} --key=${ETCD_CLIENT_KEY} --endpoints=${ETCD_ENDPOINT}
1823
${MEMLIMIT256} SEPARATOR=\n
1924
... ---
2025
... etcd:
@@ -26,17 +31,53 @@ ${MEMLIMIT0} SEPARATOR=\n
2631

2732

2833
*** Test Cases ***
34+
Etcd Database Defragment Manually
35+
[Documentation] Verify that etcd database can be manually defragmented
36+
... using etcdctl and the database size does not grow.
37+
${size_before}= Get Etcd Database Size
38+
Command Should Work ${ETCDCTL_CMD} defrag
39+
${size_after}= Get Etcd Database Size
40+
Should Be True ${size_after} <= ${size_before}
41+
... msg=DB size after defrag (${size_after}) should not exceed size before (${size_before})
42+
[Teardown] Command Should Work ${ETCDCTL_CMD} alarm disarm
43+
44+
Etcd Runs As Transient Systemd Scope Unit
45+
[Documentation] Verify that etcd runs as a transient systemd scope unit
46+
... managed by MicroShift with the expected systemd wiring.
47+
Systemctl Check Service SubState ${ETCD_SYSTEMD_UNIT} running
48+
${transient}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} Transient
49+
Should Be Equal As Strings ${transient} yes
50+
${pid}= MicroShift Etcd Process ID
51+
Should Not Be Empty ${pid}
52+
${binds_to}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} BindsTo
53+
Should Contain ${binds_to} microshift.service
54+
${before}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} Before
55+
Should Contain ${before} microshift.service
56+
57+
Etcd Scope Follows MicroShift Lifecycle
58+
[Documentation] Verify that etcd scope stops with MicroShift and restarts with it.
59+
[Tags] restart slow
60+
Stop MicroShift
61+
Wait Until Etcd Scope Is Inactive
62+
Start MicroShift
63+
Wait For MicroShift
64+
Systemctl Check Service SubState ${ETCD_SYSTEMD_UNIT} running
65+
[Teardown] Run Keywords Start MicroShift AND Wait For MicroShift
66+
2967
Set MemoryHigh Limit Unlimited
3068
[Documentation] The default configuration should not limit RAM
3169
...
3270
... Since we cannot assume that the default configuration file is
3371
... being used, the test explicitly configures a '0' limit, which
3472
... is equivalent to not having any configuration at all.
73+
[Tags] configuration restart slow
3574
[Setup] Setup With Custom Config ${MEMLIMIT0}
3675
Expect MemoryHigh infinity
76+
[Teardown] Restore Default Config
3777

3878
Set MemoryHigh Limit 256MB
3979
[Documentation] Set the memory limit for etcd to 256MB and ensure it takes effect
80+
[Tags] configuration restart slow
4081
[Setup] Setup With Custom Config ${MEMLIMIT256}
4182
# Expecting the setting to be 256 * 1024 * 1024
4283
Expect MemoryHigh 268435456
@@ -49,6 +90,7 @@ Setup
4990
Check Required Env Variables
5091
Login MicroShift Host
5192
Setup Kubeconfig # for readiness checks
93+
Install Etcdctl If Missing
5294

5395
Teardown
5496
[Documentation] Test suite teardown
@@ -70,7 +112,42 @@ Setup With Custom Config
70112
Expect MemoryHigh
71113
[Documentation] Verify that the MemoryHigh setting for etcd matches the expected value
72114
[Arguments] ${expected}
73-
${actual}= Get Systemd Setting microshift-etcd.scope MemoryHigh
115+
${actual}= Get Systemd Setting ${ETCD_SYSTEMD_UNIT} MemoryHigh
74116
# Using integer comparison is complicated here because sometimes
75117
# the returned or expected value is 'infinity'.
76118
Should Be Equal ${expected} ${actual}
119+
120+
Etcd Scope Is Inactive
121+
[Documentation] Check that the etcd scope unit is not active.
122+
... Transient scopes disappear when stopped, so is-active returns
123+
... "inactive" or an error.
124+
${stdout} ${rc}= Execute Command
125+
... systemctl is-active ${ETCD_SYSTEMD_UNIT}
126+
... sudo=True return_rc=True
127+
Should Not Be Equal As Strings ${stdout.strip()} active
128+
129+
Wait Until Etcd Scope Is Inactive
130+
[Documentation] Wait for the etcd scope to become inactive
131+
Wait Until Keyword Succeeds 30x 5s
132+
... Etcd Scope Is Inactive
133+
134+
Install Etcdctl If Missing
135+
[Documentation] Download and install etcdctl from GitHub if not already present.
136+
... Extracts the etcd version from microshift-etcd and downloads the matching release.
137+
${stdout} ${rc}= Execute Command
138+
... test -x /usr/local/bin/etcdctl
139+
... sudo=True return_rc=True
140+
IF ${rc} == 0 RETURN
141+
${etcd_ver}= Command Should Work
142+
... microshift-etcd version 2>&1 | sed -n 's/.*Base etcd Version: //p'
143+
${arch}= Command Should Work uname -m
144+
${arch_suffix}= Set Variable If '${arch}' == 'aarch64' arm64 amd64
145+
Command Should Work
146+
... bash -c 'curl -sL https://github.com/etcd-io/etcd/releases/download/v${etcd_ver}/etcd-v${etcd_ver}-linux-${arch_suffix}.tar.gz | tar -xz -C /usr/local/bin --strip-components\=1 etcd-v${etcd_ver}-linux-${arch_suffix}/etcdctl'
147+
148+
Get Etcd Database Size
149+
[Documentation] Return the current etcd database size in bytes
150+
${output}= Command Should Work ${ETCDCTL_CMD} endpoint status --write-out\=json
151+
${size}= Command Should Work
152+
... echo '${output}' | python3 -c "import sys,json; print(json.load(sys.stdin)[0]['Status']['dbSize'])"
153+
RETURN ${size}

‎test/suites/standard2/validate-certificate-rotation.robot‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,43 @@ Test Tags restart
1616

1717
*** Variables ***
1818
${KUBE_SCHEDULER_CLIENT_CERT} /var/lib/microshift/certs/kube-control-plane-signer/kube-scheduler/client.crt
19+
${ETCD_SIGNER_CA} /var/lib/microshift/certs/etcd-signer/ca.crt
20+
${ETCD_PEER_CERT} /var/lib/microshift/certs/etcd-signer/etcd-peer/peer.crt
21+
${ETCD_SERVING_CERT} /var/lib/microshift/certs/etcd-signer/etcd-serving/peer.crt
22+
${ETCD_APISERVER_CLIENT_CERT} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client/client.crt
1923
${OSSL_CMD} openssl x509 -noout -dates -in
2024
${OSSL_DATE_FORMAT} %b %d %Y
2125
${TIMEDATECTL_DATE_FORMAT} %Y-%m-%d %H:%M:%S
2226
${FUTURE_DAYS} 150
2327

2428

2529
*** Test Cases ***
30+
Manual Rotation Of Etcd Signer Certs
31+
[Documentation] Verify that deleting etcd signer certificates and restarting
32+
... MicroShift causes them to be regenerated.
33+
[Tags] etcd
34+
# Capture the original cert fingerprint before deletion
35+
${original_fp}= Get Cert Fingerprint ${ETCD_SIGNER_CA}
36+
Command Should Work bash -c 'rm -rf /var/lib/microshift/certs/etcd-signer/*'
37+
Restart MicroShift
38+
39+
VAR @{cert_files}=
40+
... ${ETCD_SIGNER_CA}
41+
... ${ETCD_PEER_CERT}
42+
... ${ETCD_SERVING_CERT}
43+
... ${ETCD_APISERVER_CLIENT_CERT}
44+
FOR ${cert_file} IN @{cert_files}
45+
Verify Remote File Exists With Sudo ${cert_file}
46+
Certificate Should Be Valid For Current Time ${cert_file}
47+
END
48+
49+
# Expiry comparison won't work: alignValidity() anchors all same-day
50+
# certs to the same notAfter (tomorrow_midnight + validity). Use
51+
# fingerprint instead — it covers key, serial, and all cert fields.
52+
${new_fp}= Get Cert Fingerprint ${ETCD_SIGNER_CA}
53+
Should Not Be Equal As Strings ${original_fp} ${new_fp}
54+
... msg=CA cert fingerprint should differ after regeneration
55+
2656
Certificate Rotation
2757
[Documentation] Performs Certificate Expiration Rotation test
2858
# Certificates expire at midnight of (tomorrow + validity). For short-lived certs,
@@ -53,7 +83,12 @@ Teardown
5383
Logout MicroShift Host
5484

5585
Restore System Date
56-
[Documentation] Reset Microshift date to current date
86+
[Documentation] Reset MicroShift date to current date.
87+
... Skips if chronyd is already active (date was never changed).
88+
${stdout} ${rc}= Execute Command
89+
... systemctl is-active chronyd
90+
... sudo=True return_rc=True
91+
IF '${stdout.strip()}' == 'active' RETURN
5792
${ushift_pid}= MicroShift Process ID
5893
Systemctl start chronyd
5994
Wait Until MicroShift Process ID Changes ${ushift_pid}
@@ -79,7 +114,7 @@ Compute Date After Days
79114
RETURN ${future_date}
80115

81116
Certs Should Expire On
82-
[Documentation] verify if the ceritifate expires at given date.
117+
[Documentation] verify if the certificate expires at given date.
83118
[Arguments] ${cert_file} ${cert_expected_date}
84119
${expiration_date}= Command Should Work
85120
... ${OSSL_CMD} ${cert_file} | grep notAfter | cut -f2 -d'=' | awk '{printf ("%s %02d %d",$1,$2,$4)}'
@@ -112,3 +147,10 @@ Certificate Should Be Valid For Current Time
112147
${current_time}= Command Should Work date +%s
113148
Should Be True ${cert_not_before} <= ${current_time}
114149
... msg=Certificate NotBefore (${cert_not_before}) is after current time (${current_time})
150+
151+
Get Cert Fingerprint
152+
[Documentation] Return the SHA256 fingerprint of a certificate
153+
[Arguments] ${cert_file}
154+
${fingerprint}= Command Should Work
155+
... openssl x509 -noout -fingerprint -sha256 -in ${cert_file}
156+
RETURN ${fingerprint}

0 commit comments

Comments
 (0)