Skip to content

Commit 9228428

Browse files
xekxek
committed
LDAP Adoption tests
IPA is enabled on OSP17 when testing TLS-E adoption. Since it contains an LDAP server, we can use it to run additional LDAP adoption tests.
1 parent 3e09afd commit 9228428

File tree

6 files changed

+254
-0
lines changed

6 files changed

+254
-0
lines changed

‎tests/roles/development_environment/defaults/main.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
# IPA-related variables
3+
ipa_admin_password: "fce95318204114530f31f885c9df588f"
4+
ipa_user_password: "nomoresecrets"
15
prelaunch_test_instance: true
26
prelaunch_test_instance_scripts:
37
- pre_launch.bash

‎tests/roles/development_environment/tasks/main.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,3 +170,35 @@
170170
- name: copy keys from undercloud for tobiko
171171
ansible.builtin.shell: |
172172
mkdir -p ~/ci-framework-data/tests/test_operator; scp -r ${OS_CLOUD_IP}:~/.ssh/id_ecdsa* ~/ci-framework-data/tests/test_operator/
173+
174+
- name: Add IPA domain to Keystone and create IPA users
175+
when: enable_tlse is defined and enable_tlse
176+
block:
177+
- name: SSH into standalone VM and execute IPA commands
178+
ansible.builtin.shell: |
179+
{{ shell_header }}
180+
ssh {{ edpm_node_ip }} "sudo podman exec -it freeipa-server-container bash -c '\
181+
echo {{ ipa_admin_password }} | kinit admin;\
182+
ipa user-add svc-ldap --first=Openstack --last=LDAP;\
183+
echo {{ ipa_admin_password }} | ipa passwd svc-ldap;\
184+
ipa user-add ipauser1 --first=ipa1 --last=user1;\
185+
echo {{ ipa_admin_password }} | ipa passwd ipauser1;\
186+
ipa user-add ipauser2 --first=ipa2 --last=user2;\
187+
echo {{ ipa_admin_password }} | ipa passwd ipauser2;\
188+
ipa user-add ipauser3 --first=ipa3 --last=user3;\
189+
echo {{ ipa_admin_password }} | ipa passwd ipauser3;\
190+
ipa group-add --desc='OpenStack Users' grp-openstack;\
191+
ipa group-add --desc='OpenStack Admin Users' grp-openstack-admin;\
192+
ipa group-add --desc='OpenStack Demo Users' grp-openstack-demo;\
193+
ipa group-add-member --users=svc-ldap grp-openstack;\
194+
ipa group-add-member --users=ipauser1 grp-openstack;\
195+
ipa group-add-member --users=ipauser1 grp-openstack-admin;\
196+
ipa group-add-member --users=ipauser2 grp-openstack;\
197+
ipa group-add-member --users=ipauser2 grp-openstack-demo;\
198+
ipa group-add-member --users=ipauser3 grp-openstack;\
199+
'"
200+
201+
- name: Add REDHAT domain to Keystone
202+
ansible.builtin.shell: |
203+
{{ shell_header }}
204+
{{ openstack_command }} domain create --description "Test LDAP Domain" REDHAT

‎tests/roles/keystone_adoption/defaults/main.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,23 @@ keystone_patch: |
1010
customServiceConfig: |
1111
[token]
1212
expiration = 360000
13+
[identity]
14+
domain_specific_drivers_enabled = true
15+
extraMounts:
16+
- name: v1
17+
region: r1
18+
extraVol:
19+
- propagation:
20+
- Keystone
21+
extraVolType: Conf
22+
volumes:
23+
- name: keystone-domains
24+
secret:
25+
secretName: keystone-domains
26+
mounts:
27+
- name: keystone-domains
28+
mountPath: "/etc/keystone/domains"
29+
readOnly: true
1330
override:
1431
service:
1532
internal:
@@ -22,3 +39,7 @@ keystone_patch: |
2239
type: LoadBalancer
2340
databaseInstance: openstack
2441
secret: osp-secret
42+
# IPA-related variables
43+
edpm_node_hostname: standalone.localdomain
44+
ipa_admin_password: "fce95318204114530f31f885c9df588f"
45+
ipa_user_password: "nomoresecrets"

‎tests/roles/keystone_adoption/tasks/main.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,49 @@
1616
type: Opaque
1717
EOF
1818
19+
20+
- name: Set IPA BaseDN and hostname vars
21+
ansible.builtin.set_fact:
22+
ipa_hostname: "ipa.{{ edpm_node_hostname.split('.')[1:] }}"
23+
ipa_basedn: "dc={{ edpm_node_hostname.split('.')[1:] | join(',dc=') }}"
24+
25+
- name: Set Keystone config key name
26+
ansible.builtin.set_fact:
27+
keystone_conf_key: "keystone.{{ ipa_domain | default('REDHAT') }}.conf"
28+
29+
- name: Create Keystone domain config secret for LDAP
30+
kubernetes.core.k8s:
31+
32+
state: present
33+
definition:
34+
apiVersion: v1
35+
kind: Secret
36+
metadata:
37+
name: keystone-domains
38+
namespace: openstack
39+
type: Opaque
40+
stringData: "{{ {keystone_conf_key: keystone_ldap_config_content} }}"
41+
vars:
42+
keystone_ldap_config_content: |
43+
[identity]
44+
driver = ldap
45+
[ldap]
46+
url = ldap://{{ ipa_hostname }}
47+
user = uid=admin,cn=users,cn=accounts,{{ ipa_basedn }}
48+
password = {{ ipa_admin_password | default('nomoresecrets') }}
49+
suffix = {{ ipa_basedn }}
50+
user_tree_dn = cn=users,cn=accounts,{{ ipa_basedn }}
51+
user_objectclass = person
52+
user_id_attribute = uid
53+
user_name_attribute = uid
54+
user_mail_attribute = mail
55+
group_tree_dn = cn=groups,cn=accounts,{{ ipa_basedn }}
56+
group_objectclass = groupOfNames
57+
group_id_attribute = cn
58+
group_name_attribute = cn
59+
group_member_attribute = member
60+
group_desc_attribute = description
61+
1962
- name: deploy podified Keystone
2063
ansible.builtin.shell: |
2164
{{ shell_header }}
@@ -106,3 +149,7 @@
106149
${BASH_ALIASES[openstack]} credential show {{ before_adoption_credential.stdout }} -f value -c blob
107150
register: after_adoption_credential
108151
failed_when: after_adoption_credential.stdout != 'test'
152+
153+
- name: Run IPA tests if enable_tlse is true
154+
ansible.builtin.include_tasks: run_ipa_test.yml
155+
when: enable_tlse is defined and enable_tlse

‎tests/roles/keystone_adoption/tasks/run_ipa_test.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
---
2+
# Tasks for testing IPA integration with Keystone
3+
- name: Check if IPA is enabled
4+
ansible.builtin.fail:
5+
msg: "IPA is not enabled (enable_tlse is not true). Skipping IPA tests."
6+
when: enable_tlse is not defined or not enable_tlse
7+
8+
- name: Wait for Keystone to be fully operational
9+
ansible.builtin.shell: |
10+
{{ shell_header }}
11+
{{ oc_header }}
12+
oc wait pod --for condition=Ready --selector=service=keystone
13+
register: keystone_wait_result
14+
until: keystone_wait_result is success
15+
retries: 60
16+
delay: 2
17+
when: enable_tlse
18+
19+
- name: Wait for openstackclient pod to be ready
20+
ansible.builtin.shell: |
21+
{{ shell_header }}
22+
{{ oc_header }}
23+
oc wait pod --for condition=Ready --selector=service=openstackclient
24+
register: osc_wait_result
25+
until: osc_wait_result is success
26+
retries: 60
27+
delay: 2
28+
when: enable_tlse
29+
30+
- name: Get Keystone route
31+
ansible.builtin.shell: |
32+
{{ shell_header }}
33+
{{ oc_header }}
34+
oc get route keystone-public -n openstack -o jsonpath='{.spec.host}'
35+
register: keystone_route
36+
when: enable_tlse
37+
38+
- name: Create IPA test user cloudrc file
39+
ansible.builtin.template:
40+
src: ipauser.j2
41+
dest: "{{ ansible_user_dir }}/ipauser"
42+
mode: "0600"
43+
vars:
44+
auth_url: "https://{{ keystone_route.stdout }}/v3"
45+
username: "ipauser1"
46+
password: "{{ ipa_user_password }}"
47+
domain: "REDHAT"
48+
when: enable_tlse
49+
50+
- name: Copy IPA test user cloudrc to openstackclient pod
51+
ansible.builtin.shell: |
52+
{{ shell_header }}
53+
{{ oc_header }}
54+
oc cp {{ ansible_user_dir }}/ipauser openstackclient:/home/cloud-admin/ipauser
55+
when: enable_tlse
56+
57+
- name: Test IPA user authentication
58+
ansible.builtin.shell: |
59+
{{ shell_header }}
60+
{{ oc_header }}
61+
oc exec -t openstackclient -- bash -c "
62+
source /home/cloud-admin/ipauser &&
63+
export OS_IDENTITY_API_VERSION=3 &&
64+
openstack token issue -f value -c id > /dev/null &&
65+
echo 'IPA user authentication successful' ||
66+
echo 'IPA user authentication failed'"
67+
register: ipa_auth_test
68+
failed_when: "'IPA user authentication failed' in ipa_auth_test.stdout"
69+
when: enable_tlse
70+
71+
- name: List IPA users via Keystone
72+
ansible.builtin.shell: |
73+
{{ shell_header }}
74+
{{ oc_header }}
75+
oc exec -t openstackclient -- bash -c "
76+
source /home/cloud-admin/ipauser &&
77+
export OS_IDENTITY_API_VERSION=3 &&
78+
openstack user list --domain REDHAT"
79+
register: ipa_user_list
80+
when: enable_tlse
81+
82+
- name: Verify IPA users are accessible
83+
ansible.builtin.assert:
84+
that:
85+
- "'ipauser1' in ipa_user_list.stdout"
86+
- "'ipauser2' in ipa_user_list.stdout"
87+
- "'ipauser3' in ipa_user_list.stdout"
88+
when: enable_tlse
89+
90+
- name: List IPA groups via Keystone
91+
ansible.builtin.shell: |
92+
{{ shell_header }}
93+
{{ oc_header }}
94+
oc exec -t openstackclient -- bash -c "
95+
source /home/cloud-admin/ipauser &&
96+
export OS_IDENTITY_API_VERSION=3 &&
97+
openstack group list --domain REDHAT"
98+
register: ipa_group_list
99+
when: enable_tlse
100+
101+
- name: Verify IPA groups are accessible
102+
ansible.builtin.assert:
103+
that:
104+
- "'grp-openstack' in ipa_group_list.stdout"
105+
- "'grp-openstack-admin' in ipa_group_list.stdout"
106+
- "'grp-openstack-demo' in ipa_group_list.stdout"
107+
when: enable_tlse
108+
109+
- name: Verify group memberships
110+
block:
111+
- name: Check ipauser1 in grp-openstack-admin
112+
ansible.builtin.shell: |
113+
{{ shell_header }}
114+
{{ oc_header }}
115+
oc exec -t openstackclient -- bash -c "
116+
source /home/cloud-admin/ipauser &&
117+
export OS_IDENTITY_API_VERSION=3 &&
118+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack-admin ipauser1"
119+
register: user1_group_result
120+
failed_when: "'ipauser1 in group grp-openstack-admin' not in user1_group_result.stdout"
121+
122+
- name: Check ipauser2 in grp-openstack-demo
123+
ansible.builtin.shell: |
124+
{{ shell_header }}
125+
{{ oc_header }}
126+
oc exec -t openstackclient -- bash -c "
127+
source /home/cloud-admin/ipauser &&
128+
export OS_IDENTITY_API_VERSION=3 &&
129+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack-demo ipauser2"
130+
register: user2_group_result
131+
failed_when: "'ipauser2 in group grp-openstack-demo' not in user2_group_result.stdout"
132+
133+
- name: Check ipauser3 in grp-openstack
134+
ansible.builtin.shell: |
135+
{{ shell_header }}
136+
{{ oc_header }}
137+
oc exec -t openstackclient -- bash -c "
138+
source /home/cloud-admin/ipauser &&
139+
export OS_IDENTITY_API_VERSION=3 &&
140+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack ipauser3"
141+
register: user3_group_result
142+
failed_when: "'ipauser3 in group grp-openstack' not in user3_group_result.stdout"
143+
when: enable_tlse

‎tests/roles/keystone_adoption/templates/ipauser.j2‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
unset OS_CLOUD
3+
export OS_IDENTITY_API_VERSION=3
4+
export OS_AUTH_URL="{{ auth_url }}"
5+
export OS_USER_DOMAIN_NAME="{{ domain }}"
6+
export OS_USERNAME="{{ username }}"
7+
export OS_PASSWORD="{{ password }}"

0 commit comments

Comments
 (0)