Skip to content

Commit 8637276

Browse files
QiWang19QiWang19
committed
OCPFeatureGate:SigstoreImageVerification update test on v1 (Cluster)ImagePolicy
Signed-off-by: Qi Wang <[email protected]>
1 parent bb3f979 commit 8637276

File tree

2 files changed

+133
-45
lines changed

2 files changed

+133
-45
lines changed

‎pkg/monitortestlibrary/pathologicaleventlibrary/duplicated_event_patterns.go‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -490,6 +490,12 @@ func NewUniversalPathologicalEventMatchers(kubeConfig *rest.Config, finalInterva
490490
newDeferringOperatorNodeUpdateTooOftenEventMatcher := newDeferringOperatorNodeUpdateTooOftenEventMatcher(finalIntervals)
491491
registry.AddPathologicalEventMatcherOrDie(newDeferringOperatorNodeUpdateTooOftenEventMatcher)
492492

493+
newAnnotationChangeTooOftenEventMatcher := newAnnotationChangeTooOftenEventMatcher(finalIntervals)
494+
registry.AddPathologicalEventMatcherOrDie(newAnnotationChangeTooOftenEventMatcher)
495+
496+
newSetDesiredConfigTooOftenEventMatcher := newSetDesiredConfigTooOftenEventMatcher(finalIntervals)
497+
registry.AddPathologicalEventMatcherOrDie(newSetDesiredConfigTooOftenEventMatcher)
498+
493499
newCrioReloadedTooOftenEventMatcher := newCrioReloadedTooOftenEventMatcher(finalIntervals)
494500
registry.AddPathologicalEventMatcherOrDie(newCrioReloadedTooOftenEventMatcher)
495501

@@ -1088,6 +1094,46 @@ func newDeferringOperatorNodeUpdateTooOftenEventMatcher(finalIntervals monitorap
10881094
}
10891095
}
10901096

1097+
func newAnnotationChangeTooOftenEventMatcher(finalIntervals monitorapi.Intervals) EventMatcher {
1098+
AnnotationChangeIntervals := finalIntervals.Filter(func(eventInterval monitorapi.Interval) bool {
1099+
return eventInterval.Source == monitorapi.SourceE2ETest &&
1100+
strings.Contains(eventInterval.Locator.Keys[monitorapi.LocatorE2ETestKey], "imagepolicy signature validation")
1101+
})
1102+
for i := range AnnotationChangeIntervals {
1103+
AnnotationChangeIntervals[i].To = AnnotationChangeIntervals[i].To.Add(time.Minute * 10)
1104+
AnnotationChangeIntervals[i].From = AnnotationChangeIntervals[i].From.Add(time.Minute * -10)
1105+
}
1106+
1107+
return &OverlapOtherIntervalsPathologicalEventMatcher{
1108+
delegate: &SimplePathologicalEventMatcher{
1109+
name: "AnnotationChangeTooOften",
1110+
messageReasonRegex: regexp.MustCompile(`^AnnotationChange$`),
1111+
jira: "https://issues.redhat.com/browse/OCPBUGS-58376",
1112+
},
1113+
allowIfWithinIntervals: AnnotationChangeIntervals,
1114+
}
1115+
}
1116+
1117+
func newSetDesiredConfigTooOftenEventMatcher(finalIntervals monitorapi.Intervals) EventMatcher {
1118+
SetDesiredConfigIntervals := finalIntervals.Filter(func(eventInterval monitorapi.Interval) bool {
1119+
return eventInterval.Source == monitorapi.SourceE2ETest &&
1120+
strings.Contains(eventInterval.Locator.Keys[monitorapi.LocatorE2ETestKey], "imagepolicy signature validation")
1121+
})
1122+
for i := range SetDesiredConfigIntervals {
1123+
SetDesiredConfigIntervals[i].To = SetDesiredConfigIntervals[i].To.Add(time.Minute * 10)
1124+
SetDesiredConfigIntervals[i].From = SetDesiredConfigIntervals[i].From.Add(time.Minute * -10)
1125+
}
1126+
1127+
return &OverlapOtherIntervalsPathologicalEventMatcher{
1128+
delegate: &SimplePathologicalEventMatcher{
1129+
name: "SetDesiredConfigTooOften",
1130+
messageReasonRegex: regexp.MustCompile(`^SetDesiredConfig$`),
1131+
jira: "https://issues.redhat.com/browse/OCPBUGS-58376",
1132+
},
1133+
allowIfWithinIntervals: SetDesiredConfigIntervals,
1134+
}
1135+
}
1136+
10911137
func newCrioReloadedTooOftenEventMatcher(finalInternals monitorapi.Intervals) EventMatcher {
10921138
crioReloadedIntervals := finalInternals.Filter(func(eventInterval monitorapi.Interval) bool {
10931139
return eventInterval.Source == monitorapi.SourceE2ETest &&

‎test/extended/imagepolicy/imagepolicy.go‎

Lines changed: 87 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,12 @@ package imagepolicy
33
import (
44
"context"
55
"fmt"
6+
"net"
67
"time"
78

89
g "github.com/onsi/ginkgo/v2"
910
o "github.com/onsi/gomega"
10-
configv1alpha1 "github.com/openshift/api/config/v1alpha1"
11+
configv1 "github.com/openshift/api/config/v1"
1112
machineconfighelper "github.com/openshift/origin/test/extended/machine_config"
1213
exutil "github.com/openshift/origin/test/extended/util"
1314
kapiv1 "k8s.io/api/core/v1"
@@ -50,6 +51,25 @@ var _ = g.Describe("[sig-imagepolicy][OCPFeatureGate:SigstoreImageVerification][
5051
if !exutil.IsTechPreviewNoUpgrade(tctx, oc.AdminConfigClient()) {
5152
g.Skip("skipping, this feature is only supported on TechPreviewNoUpgrade clusters")
5253
}
54+
// skip test on disconnected clusters.
55+
networkConfig, err := oc.AdminConfigClient().ConfigV1().Networks().Get(context.Background(), "cluster", metav1.GetOptions{})
56+
if err != nil {
57+
e2e.Failf("unable to get cluster network config: %v", err)
58+
}
59+
usingIPv6 := false
60+
for _, clusterNetworkEntry := range networkConfig.Status.ClusterNetwork {
61+
addr, _, err := net.ParseCIDR(clusterNetworkEntry.CIDR)
62+
if err != nil {
63+
continue
64+
}
65+
if addr.To4() == nil {
66+
usingIPv6 = true
67+
break
68+
}
69+
}
70+
if usingIPv6 {
71+
g.Skip("skipping test on disconnected platform")
72+
}
5373
})
5474

5575
g.It("Should fail clusterimagepolicy signature validation root of trust does not match the identity in the signature", func() {
@@ -227,67 +247,78 @@ func waitForTestPodContainerToFailSignatureValidation(ctx context.Context, f *e2
227247
return e2epod.WaitForPodContainerToFail(ctx, f.ClientSet, pod.Namespace, pod.Name, 0, SignatureValidationFaildReason, e2e.PodStartShortTimeout)
228248
}
229249

230-
func createClusterImagePolicy(oc *exutil.CLI, policy configv1alpha1.ClusterImagePolicy) {
231-
_, err := oc.AdminConfigClient().ConfigV1alpha1().ClusterImagePolicies().Create(context.TODO(), &policy, metav1.CreateOptions{})
250+
func createClusterImagePolicy(oc *exutil.CLI, policy configv1.ClusterImagePolicy) {
251+
_, err := oc.AdminConfigClient().ConfigV1().ClusterImagePolicies().Create(context.TODO(), &policy, metav1.CreateOptions{})
232252
o.Expect(err).NotTo(o.HaveOccurred())
233253
}
234254

235255
func deleteClusterImagePolicy(oc *exutil.CLI, policyName string) error {
236-
if err := oc.AdminConfigClient().ConfigV1alpha1().ClusterImagePolicies().Delete(context.TODO(), policyName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
256+
if err := oc.AdminConfigClient().ConfigV1().ClusterImagePolicies().Delete(context.TODO(), policyName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
237257
return fmt.Errorf("failed to delete cluster image policy %s: %v", policyName, err)
238258
}
239259
waitForPoolComplete(oc)
240260
return nil
241261
}
242262

243-
func createImagePolicy(oc *exutil.CLI, policy configv1alpha1.ImagePolicy, namespace string) {
244-
_, err := oc.AdminConfigClient().ConfigV1alpha1().ImagePolicies(namespace).Create(context.TODO(), &policy, metav1.CreateOptions{})
263+
func createImagePolicy(oc *exutil.CLI, policy configv1.ImagePolicy, namespace string) {
264+
_, err := oc.AdminConfigClient().ConfigV1().ImagePolicies(namespace).Create(context.TODO(), &policy, metav1.CreateOptions{})
245265
o.Expect(err).NotTo(o.HaveOccurred())
246266
}
247267

248268
func deleteImagePolicy(oc *exutil.CLI, policyName string, namespace string) error {
249-
if err := oc.AdminConfigClient().ConfigV1alpha1().ImagePolicies(namespace).Delete(context.TODO(), policyName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
269+
if err := oc.AdminConfigClient().ConfigV1().ImagePolicies(namespace).Delete(context.TODO(), policyName, metav1.DeleteOptions{}); err != nil && !errors.IsNotFound(err) {
250270
return fmt.Errorf("failed to delete image policy %s in namespace %s: %v", policyName, namespace, err)
251271
}
252272
waitForPoolComplete(oc)
253273
return nil
254274
}
255275

256-
func generateClusterImagePolicies() map[string]configv1alpha1.ClusterImagePolicy {
257-
testClusterImagePolicies := map[string]configv1alpha1.ClusterImagePolicy{
276+
func generateClusterImagePolicies() map[string]configv1.ClusterImagePolicy {
277+
testClusterImagePolicies := map[string]configv1.ClusterImagePolicy{
258278
invalidPublicKeyClusterImagePolicyName: {
279+
TypeMeta: metav1.TypeMeta{
280+
Kind: "ClusterImagePolicy",
281+
APIVersion: configv1.SchemeGroupVersion.String(),
282+
},
259283
ObjectMeta: metav1.ObjectMeta{Name: invalidPublicKeyClusterImagePolicyName},
260-
Spec: configv1alpha1.ClusterImagePolicySpec{
261-
Scopes: []configv1alpha1.ImageScope{testSignedPolicyScope},
262-
Policy: configv1alpha1.Policy{
263-
RootOfTrust: configv1alpha1.PolicyRootOfTrust{
264-
PolicyType: configv1alpha1.PublicKeyRootOfTrust,
265-
PublicKey: &configv1alpha1.PublicKey{
266-
KeyData: []byte(`LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFVW9GVW9ZQVJlS1hHeTU5eGU1U1FPazJhSjhvKwoyL1l6NVk4R2NOM3pGRTZWaUl2a0duSGhNbEFoWGFYL2JvME05UjYyczAvNnErK1Q3dXdORnVPZzhBPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCgo=`),
284+
Spec: configv1.ClusterImagePolicySpec{
285+
Scopes: []configv1.ImageScope{testSignedPolicyScope},
286+
Policy: configv1.Policy{
287+
RootOfTrust: configv1.PolicyRootOfTrust{
288+
PolicyType: configv1.PublicKeyRootOfTrust,
289+
PublicKey: &configv1.PublicKey{
290+
KeyData: []byte(`-----BEGIN PUBLIC KEY-----
291+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUoFUoYAReKXGy59xe5SQOk2aJ8o+
292+
2/Yz5Y8GcN3zFE6ViIvkGnHhMlAhXaX/bo0M9R62s0/6q++T7uwNFuOg8A==
293+
-----END PUBLIC KEY-----`),
267294
},
268295
},
269-
SignedIdentity: configv1alpha1.PolicyIdentity{
270-
MatchPolicy: configv1alpha1.IdentityMatchPolicyMatchRepoDigestOrExact,
296+
SignedIdentity: &configv1.PolicyIdentity{
297+
MatchPolicy: configv1.IdentityMatchPolicyMatchRepoDigestOrExact,
271298
},
272299
},
273300
},
274301
},
275302
publiKeyRekorClusterImagePolicyName: {
303+
TypeMeta: metav1.TypeMeta{
304+
Kind: "ClusterImagePolicy",
305+
APIVersion: configv1.SchemeGroupVersion.String(),
306+
},
276307
ObjectMeta: metav1.ObjectMeta{Name: publiKeyRekorClusterImagePolicyName},
277-
Spec: configv1alpha1.ClusterImagePolicySpec{
278-
Scopes: []configv1alpha1.ImageScope{testSignedPolicyScope},
279-
Policy: configv1alpha1.Policy{
280-
RootOfTrust: configv1alpha1.PolicyRootOfTrust{
281-
PolicyType: configv1alpha1.PublicKeyRootOfTrust,
282-
PublicKey: &configv1alpha1.PublicKey{
308+
Spec: configv1.ClusterImagePolicySpec{
309+
Scopes: []configv1.ImageScope{testSignedPolicyScope},
310+
Policy: configv1.Policy{
311+
RootOfTrust: configv1.PolicyRootOfTrust{
312+
PolicyType: configv1.PublicKeyRootOfTrust,
313+
PublicKey: &configv1.PublicKey{
283314
KeyData: []byte(`-----BEGIN PUBLIC KEY-----
284315
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5
285316
60l1/qUU0fRATNSCVORCog5PDFo5z0ZLeblWgwbn4c8xpvuo9jQFwpeOsg==
286317
-----END PUBLIC KEY-----`),
287318
},
288319
},
289-
SignedIdentity: configv1alpha1.PolicyIdentity{
290-
MatchPolicy: configv1alpha1.IdentityMatchPolicyMatchRepository,
320+
SignedIdentity: &configv1.PolicyIdentity{
321+
MatchPolicy: configv1.IdentityMatchPolicyMatchRepository,
291322
},
292323
},
293324
},
@@ -296,41 +327,52 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5
296327
return testClusterImagePolicies
297328
}
298329

299-
func generateImagePolicies() map[string]configv1alpha1.ImagePolicy {
300-
testImagePolicies := map[string]configv1alpha1.ImagePolicy{
330+
func generateImagePolicies() map[string]configv1.ImagePolicy {
331+
testImagePolicies := map[string]configv1.ImagePolicy{
301332
invalidPublicKeyImagePolicyName: {
333+
TypeMeta: metav1.TypeMeta{
334+
Kind: "ImagePolicy",
335+
APIVersion: configv1.SchemeGroupVersion.String(),
336+
},
302337
ObjectMeta: metav1.ObjectMeta{Name: invalidPublicKeyImagePolicyName},
303-
Spec: configv1alpha1.ImagePolicySpec{
304-
Scopes: []configv1alpha1.ImageScope{testSignedPolicyScope},
305-
Policy: configv1alpha1.Policy{
306-
RootOfTrust: configv1alpha1.PolicyRootOfTrust{
307-
PolicyType: configv1alpha1.PublicKeyRootOfTrust,
308-
PublicKey: &configv1alpha1.PublicKey{
309-
KeyData: []byte(`LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFVW9GVW9ZQVJlS1hHeTU5eGU1U1FPazJhSjhvKwoyL1l6NVk4R2NOM3pGRTZWaUl2a0duSGhNbEFoWGFYL2JvME05UjYyczAvNnErK1Q3dXdORnVPZzhBPT0KLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tCgo=`),
338+
Spec: configv1.ImagePolicySpec{
339+
Scopes: []configv1.ImageScope{testSignedPolicyScope},
340+
Policy: configv1.Policy{
341+
RootOfTrust: configv1.PolicyRootOfTrust{
342+
PolicyType: configv1.PublicKeyRootOfTrust,
343+
PublicKey: &configv1.PublicKey{
344+
KeyData: []byte(`-----BEGIN PUBLIC KEY-----
345+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUoFUoYAReKXGy59xe5SQOk2aJ8o+
346+
2/Yz5Y8GcN3zFE6ViIvkGnHhMlAhXaX/bo0M9R62s0/6q++T7uwNFuOg8A==
347+
-----END PUBLIC KEY-----`),
310348
},
311349
},
312-
SignedIdentity: configv1alpha1.PolicyIdentity{
313-
MatchPolicy: configv1alpha1.IdentityMatchPolicyMatchRepoDigestOrExact,
350+
SignedIdentity: &configv1.PolicyIdentity{
351+
MatchPolicy: configv1.IdentityMatchPolicyMatchRepoDigestOrExact,
314352
},
315353
},
316354
},
317355
},
318356
publiKeyRekorImagePolicyName: {
357+
TypeMeta: metav1.TypeMeta{
358+
Kind: "ImagePolicy",
359+
APIVersion: configv1.SchemeGroupVersion.String(),
360+
},
319361
ObjectMeta: metav1.ObjectMeta{Name: publiKeyRekorImagePolicyName},
320-
Spec: configv1alpha1.ImagePolicySpec{
321-
Scopes: []configv1alpha1.ImageScope{testSignedPolicyScope},
322-
Policy: configv1alpha1.Policy{
323-
RootOfTrust: configv1alpha1.PolicyRootOfTrust{
324-
PolicyType: configv1alpha1.PublicKeyRootOfTrust,
325-
PublicKey: &configv1alpha1.PublicKey{
362+
Spec: configv1.ImagePolicySpec{
363+
Scopes: []configv1.ImageScope{testSignedPolicyScope},
364+
Policy: configv1.Policy{
365+
RootOfTrust: configv1.PolicyRootOfTrust{
366+
PolicyType: configv1.PublicKeyRootOfTrust,
367+
PublicKey: &configv1.PublicKey{
326368
KeyData: []byte(`-----BEGIN PUBLIC KEY-----
327369
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKvZH0CXTk8XQkETuxkzkl3Bi4ms5
328370
60l1/qUU0fRATNSCVORCog5PDFo5z0ZLeblWgwbn4c8xpvuo9jQFwpeOsg==
329371
-----END PUBLIC KEY-----`),
330372
},
331373
},
332-
SignedIdentity: configv1alpha1.PolicyIdentity{
333-
MatchPolicy: configv1alpha1.IdentityMatchPolicyMatchRepository,
374+
SignedIdentity: &configv1.PolicyIdentity{
375+
MatchPolicy: configv1.IdentityMatchPolicyMatchRepository,
334376
},
335377
},
336378
},

0 commit comments

Comments
 (0)