Skip to content

Commit 49fb33b

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1134 from stuggi/tls_day2
[kuttl] add test to enable tls as day2 in ctlplane-tls-cert-rotation
2 parents 48d49da + d8315c3 commit 49fb33b

File tree

5 files changed

+362
-0
lines changed

5 files changed

+362
-0
lines changed

‎config/samples/tls/tls_ingress/kustomization.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
resources:
2+
- ../../base/openstackcontrolplane
3+
4+
patches:
5+
- target:
6+
kind: OpenStackControlPlane
7+
name: .*
8+
patch: |-
9+
- op: replace
10+
path: /metadata/name
11+
value: openstack
12+
- target:
13+
kind: OpenStackControlPlane
14+
path: patch.yaml

‎config/samples/tls/tls_ingress/patch.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: core.openstack.org/v1beta1
2+
kind: OpenStackControlPlane
3+
metadata:
4+
name: openstack
5+
spec:
6+
tls:
7+
podLevel:
8+
enabled: false

‎tests/kuttl/tests/ctlplane-tls-cert-rotation/00-assert-deploy-openstack.yaml‎

Lines changed: 311 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,311 @@
1+
apiVersion: core.openstack.org/v1beta1
2+
kind: OpenStackControlPlane
3+
metadata:
4+
name: openstack
5+
spec:
6+
secret: osp-secret
7+
keystone:
8+
template:
9+
databaseInstance: openstack
10+
secret: osp-secret
11+
galera:
12+
enabled: true
13+
templates:
14+
openstack:
15+
storageRequest: 500M
16+
secret: osp-secret
17+
replicas: 1
18+
openstack-cell1:
19+
storageRequest: 500M
20+
secret: osp-secret
21+
replicas: 1
22+
rabbitmq:
23+
templates:
24+
rabbitmq:
25+
replicas: 1
26+
rabbitmq-cell1:
27+
replicas: 1
28+
memcached:
29+
templates:
30+
memcached:
31+
replicas: 1
32+
placement:
33+
template:
34+
databaseInstance: openstack
35+
secret: osp-secret
36+
glance:
37+
template:
38+
databaseInstance: openstack
39+
secret: osp-secret
40+
glanceAPIs:
41+
default:
42+
replicas: 1
43+
storage:
44+
storageRequest: 10G
45+
cinder:
46+
template:
47+
databaseInstance: openstack
48+
secret: osp-secret
49+
cinderAPI:
50+
replicas: 1
51+
cinderScheduler:
52+
replicas: 1
53+
cinderBackup:
54+
replicas: 0 # backend needs to be configured
55+
cinderVolumes:
56+
volume1:
57+
replicas: 0 # backend needs to be configured
58+
manila:
59+
template:
60+
manilaAPI:
61+
replicas: 1
62+
manilaScheduler:
63+
replicas: 1
64+
manilaShares:
65+
share1:
66+
replicas: 1
67+
ovn:
68+
template:
69+
ovnDBCluster:
70+
ovndbcluster-nb:
71+
replicas: 1
72+
dbType: NB
73+
storageRequest: 10G
74+
ovndbcluster-sb:
75+
replicas: 1
76+
dbType: SB
77+
storageRequest: 10G
78+
ovnNorthd:
79+
replicas: 1
80+
ovnController:
81+
external-ids:
82+
system-id: "random"
83+
ovn-bridge: "br-int"
84+
ovn-encap-type: "geneve"
85+
neutron:
86+
template:
87+
databaseInstance: openstack
88+
secret: osp-secret
89+
horizon:
90+
template:
91+
replicas: 1
92+
secret: osp-secret
93+
nova:
94+
template:
95+
secret: osp-secret
96+
heat:
97+
enabled: false
98+
template:
99+
databaseInstance: openstack
100+
heatAPI:
101+
replicas: 1
102+
heatEngine:
103+
replicas: 1
104+
secret: osp-secret
105+
octavia:
106+
enabled: false
107+
template:
108+
databaseInstance: openstack
109+
octaviaAPI:
110+
replicas: 1
111+
secret: osp-secret
112+
ironic:
113+
enabled: false
114+
template:
115+
databaseInstance: openstack
116+
ironicAPI:
117+
replicas: 1
118+
ironicConductors:
119+
- replicas: 1
120+
storageRequest: 10G
121+
ironicInspector:
122+
replicas: 1
123+
ironicNeutronAgent:
124+
replicas: 1
125+
secret: osp-secret
126+
telemetry:
127+
enabled: true
128+
template:
129+
autoscaling:
130+
aodh:
131+
secret: osp-secret
132+
serviceUser: aodh
133+
ceilometer:
134+
passwordSelector:
135+
ceilometerService: CeilometerPassword
136+
secret: osp-secret
137+
serviceUser: ceilometer
138+
swift:
139+
enabled: true
140+
template:
141+
swiftRing:
142+
ringReplicas: 1
143+
swiftStorage:
144+
replicas: 1
145+
swiftProxy:
146+
replicas: 1
147+
designate:
148+
enabled: false
149+
template:
150+
databaseInstance: openstack
151+
secret: osp-secret
152+
designateAPI:
153+
replicas: 1
154+
designateCentral:
155+
replicas: 0 # backend needs to be configured
156+
designateWorker:
157+
replicas: 0 # backend needs to be configured
158+
designateProducer:
159+
replicas: 0 # backend needs to be configured
160+
designateBackendbind9:
161+
replicas: 0 # backend needs to be configured
162+
barbican:
163+
enabled: true
164+
template:
165+
databaseInstance: openstack
166+
secret: osp-secret
167+
barbicanAPI:
168+
replicas: 1
169+
barbicanWorker:
170+
replicas: 1
171+
barbicanKeystoneListener:
172+
replicas: 1
173+
tls:
174+
ingress:
175+
ca:
176+
duration: 87600h0m0s
177+
cert:
178+
duration: 43800h0m0s
179+
enabled: true
180+
podLevel:
181+
enabled: false
182+
status:
183+
conditions:
184+
- message: Setup complete
185+
reason: Ready
186+
status: "True"
187+
type: Ready
188+
- message: OpenStackControlPlane Barbican completed
189+
reason: Ready
190+
status: "True"
191+
type: OpenStackControlPlaneBarbicanReady
192+
- message: OpenStackControlPlane CAs completed
193+
reason: Ready
194+
status: "True"
195+
type: OpenStackControlPlaneCAReadyCondition
196+
- message: OpenStackControlPlane Cinder completed
197+
reason: Ready
198+
status: "True"
199+
type: OpenStackControlPlaneCinderReady
200+
- message: OpenStackControlPlane Client completed
201+
reason: Ready
202+
status: "True"
203+
type: OpenStackControlPlaneClientReady
204+
- message: OpenStackControlPlane barbican service exposed
205+
reason: Ready
206+
status: "True"
207+
type: OpenStackControlPlaneExposeBarbicanReady
208+
- message: OpenStackControlPlane cinder service exposed
209+
reason: Ready
210+
status: "True"
211+
type: OpenStackControlPlaneExposeCinderReady
212+
- message: OpenStackControlPlane glance service exposed
213+
reason: Ready
214+
status: "True"
215+
type: OpenStackControlPlaneExposeGlanceReady
216+
- message: OpenStackControlPlane keystone service exposed
217+
reason: Ready
218+
status: "True"
219+
type: OpenStackControlPlaneExposeKeystoneAPIReady
220+
- message: OpenStackControlPlane neutron service exposed
221+
reason: Ready
222+
status: "True"
223+
type: OpenStackControlPlaneExposeNeutronReady
224+
- message: OpenStackControlPlane nova service exposed
225+
reason: Ready
226+
status: "True"
227+
type: OpenStackControlPlaneExposeNovaReady
228+
- message: OpenStackControlPlane placement service exposed
229+
reason: Ready
230+
status: "True"
231+
type: OpenStackControlPlaneExposePlacementAPIReady
232+
- message: OpenStackControlPlane swift service exposed
233+
reason: Ready
234+
status: "True"
235+
type: OpenStackControlPlaneExposeSwiftReady
236+
- message: OpenStackControlPlane Glance completed
237+
reason: Ready
238+
status: "True"
239+
type: OpenStackControlPlaneGlanceReady
240+
- message: OpenStackControlPlane InstanceHa CM is available
241+
reason: Ready
242+
status: "True"
243+
type: OpenStackControlPlaneInstanceHaCMReadyCondition
244+
- message: OpenStackControlPlane KeystoneAPI completed
245+
reason: Ready
246+
status: "True"
247+
type: OpenStackControlPlaneKeystoneAPIReady
248+
- message: OpenStackControlPlane MariaDB completed
249+
reason: Ready
250+
status: "True"
251+
type: OpenStackControlPlaneMariaDBReady
252+
- message: OpenStackControlPlane Memcached completed
253+
reason: Ready
254+
status: "True"
255+
type: OpenStackControlPlaneMemcachedReady
256+
- message: OpenStackControlPlane Neutron completed
257+
reason: Ready
258+
status: "True"
259+
type: OpenStackControlPlaneNeutronReady
260+
- message: OpenStackControlPlane Nova completed
261+
reason: Ready
262+
status: "True"
263+
type: OpenStackControlPlaneNovaReady
264+
- message: OpenStackControlPlane OVN completed
265+
reason: Ready
266+
status: "True"
267+
type: OpenStackControlPlaneOVNReady
268+
- message: OpenStackControlPlane PlacementAPI completed
269+
reason: Ready
270+
status: "True"
271+
type: OpenStackControlPlanePlacementAPIReady
272+
- message: OpenStackControlPlane RabbitMQ completed
273+
reason: Ready
274+
status: "True"
275+
type: OpenStackControlPlaneRabbitMQReady
276+
- message: OpenStackControlPlane Swift completed
277+
reason: Ready
278+
status: "True"
279+
type: OpenStackControlPlaneSwiftReady
280+
- message: OpenStackControlPlane Telemetry completed
281+
reason: Ready
282+
status: "True"
283+
type: OpenStackControlPlaneTelemetryReady
284+
- message: OpenStackControlPlane Test Operator CM is available
285+
reason: Ready
286+
status: "True"
287+
type: OpenStackControlPlaneTestCMReadyCondition
288+
---
289+
apiVersion: kuttl.dev/v1beta1
290+
kind: TestAssert
291+
timeout: 500
292+
commands:
293+
- script: |
294+
echo "Waiting for OpenStack control plane to be ready..."
295+
oc wait openstackcontrolplane -n $NAMESPACE --for=condition=Ready --timeout=400s -l core.openstack.org/openstackcontrolplane
296+
- script: |
297+
echo "Fail if internal https endpoints are registered"
298+
oc exec -i openstackclient -n $NAMESPACE -- bash -c "openstack endpoint list --interface internal -f value -c URL" | grep 'https:' && exit 1
299+
exit 0
300+
- script: |
301+
echo "check ovn sb internalDbAddress use tcp"
302+
oc get -n $NAMESPACE OVNDBCluster ovndbcluster-sb -o jsonpath={.status.internalDbAddress} | grep -q tcp
303+
- script: |
304+
echo "check ovn sb DB connection use tcp"
305+
oc exec -i statefulset/ovsdbserver-sb -n $NAMESPACE -- bash -c "ovn-sbctl --no-leader-only get-connection | grep -q ptcp"
306+
- script: |
307+
echo "check nova transport_url use tcp"
308+
oc exec -i statefulset/nova-cell1-conductor -n $NAMESPACE -- bash -c "grep transport_url /etc/nova/nova.conf.d/01-nova.conf | grep -q 'ssl=0'"
309+
- script: |
310+
echo "check neutron ovn_sb_connection url tcp address"
311+
oc exec -i deployment/neutron -n $NAMESPACE -- bash -c "grep ovn_sb_connection /etc/neutron/neutron.conf.d/01-neutron.conf | grep -q tcp"

‎tests/kuttl/tests/ctlplane-tls-cert-rotation/00-deploy-openstack-tls-ingress-only.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: |
5+
oc kustomize ../../../../config/samples/tls/tls_ingress | oc apply -n $NAMESPACE -f -

‎tests/kuttl/tests/ctlplane-tls-cert-rotation/02-assert-endpoint-proto.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 500
5+
commands:
6+
- script: |
7+
echo "Waiting for OpenStack control plane to be ready..."
8+
oc wait openstackcontrolplane -n $NAMESPACE --for=condition=Ready --timeout=400s -l core.openstack.org/openstackcontrolplane
9+
- script: |
10+
echo "Fail if internal http endpoints are registered"
11+
oc exec -i openstackclient -n $NAMESPACE -- bash -c "openstack endpoint list --interface internal -f value -c URL" | grep 'http:' && exit 1
12+
exit 0
13+
- script: |
14+
echo "check ovn sb internalDbAddress use ssl"
15+
oc get -n $NAMESPACE OVNDBCluster ovndbcluster-sb -o jsonpath={.status.internalDbAddress} | grep -q ssl
16+
- script: |
17+
echo "check ovn sb DB connection use ssl"
18+
oc exec -i statefulset/ovsdbserver-sb -n $NAMESPACE -- bash -c "ovn-sbctl --no-leader-only get-connection | grep -q pssl"
19+
- script: |
20+
echo "check nova transport_url use ssl"
21+
oc exec -i statefulset/nova-cell1-conductor -n $NAMESPACE -- bash -c "grep transport_url /etc/nova/nova.conf.d/01-nova.conf | grep -q 'ssl=1'"
22+
- script: |
23+
echo "check neutron ovn_sb_connection url ssl"
24+
oc exec -i deployment/neutron -n $NAMESPACE -- bash -c "grep ovn_sb_connection /etc/neutron/neutron.conf.d/01-neutron.conf| grep -q ssl"

0 commit comments

Comments
 (0)