Skip to content

Commit 7c31b28

Browse files
rjeberhardrjeberhard
authored
Merge pull request #849 from oracle/OWLS-70638
OWLS-70638
2 parents f5b1e52 + 8d44683 commit 7c31b28

File tree

14 files changed

+392
-83
lines changed

14 files changed

+392
-83
lines changed

‎integration-tests/src/test/java/oracle/kubernetes/operator/ITOperator.java

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ public class ITOperator extends BaseTest {
3333
private static String op2YamlFile = "operator2.yaml";
3434
private static final String opForDelYamlFile1 = "operator_del1.yaml";
3535
private static final String opForDelYamlFile2 = "operator_del2.yaml";
36+
private static final String opForBackwardCompatibility = "operator_bc.yaml";
3637

3738
// property file used to customize domain properties for domain inputs yaml
3839
private static String domain1YamlFile = "domain1.yaml";
@@ -59,6 +60,8 @@ public class ITOperator extends BaseTest {
5960
private static Operator operatorForDel1;
6061
private static Operator operatorForDel2;
6162

63+
private static Operator operatorForBackwardCompatibility;
64+
6265
private static boolean QUICKTEST;
6366
private static boolean SMOKETEST;
6467
private static boolean JENKINS;
@@ -580,6 +583,28 @@ public void testAutoSitConfigOverrides() throws Exception {
580583
}
581584
logger.info("SUCCESS - testAutoSitConfigOverrides");
582585
}
586+
587+
/**
588+
* Create operator and enable external rest endpoint using the externalOperatorCert and
589+
* externalOperatorKey defined in the helm chart values instead of the tls secret. This test is
590+
* for backward compatibility
591+
*
592+
* @throws Exception
593+
*/
594+
@Test
595+
public void testRESTIdentityBackwardCompatibility() throws Exception {
596+
Assume.assumeFalse(QUICKTEST);
597+
598+
logTestBegin("testRESTIdentityBackwardCompatibility");
599+
logger.info("Checking if operatorForBackwardCompatibility is running, if not creating");
600+
if (operatorForBackwardCompatibility == null) {
601+
operatorForBackwardCompatibility = TestUtils.createOperator(opForBackwardCompatibility, true);
602+
}
603+
logger.info("Operator using legacy REST identity created successfully");
604+
operatorForBackwardCompatibility.destroy();
605+
logger.info("SUCCESS - testRESTIdentityBackwardCompatibility");
606+
}
607+
583608
/**
584609
* Create Operator and create domain with some junk value for t3 channel public address and using
585610
* custom situational config override replace with valid public address using secret Verify the

‎integration-tests/src/test/java/oracle/kubernetes/operator/utils/Operator.java

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,19 @@ public class Operator {
3737
private static int maxIterationsOp = BaseTest.getMaxIterationsPod(); // 50 * 5 = 250 seconds
3838
private static int waitTimeOp = BaseTest.getWaitTimePod();
3939

40+
/**
41+
* Takes operator input properties which needs to be customized and generates a operator input
42+
* yaml file.
43+
*
44+
* @param inputYaml
45+
* @throws Exception
46+
*/
47+
public Operator(String inputYaml, boolean useLegacyRESTIdentity) throws Exception {
48+
initialize(inputYaml);
49+
generateInputYaml(useLegacyRESTIdentity);
50+
callHelmInstall();
51+
}
52+
4053
/**
4154
* Takes operator input properties which needs to be customized and generates a operator input
4255
* yaml file.
@@ -245,19 +258,30 @@ private String getExecFailure(String cmd, ExecResult result) throws Exception {
245258
}
246259

247260
private void generateInputYaml() throws Exception {
261+
generateInputYaml(false);
262+
}
263+
264+
private void generateInputYaml(boolean useLegacyRESTIdentity) throws Exception {
248265
Path parentDir =
249266
Files.createDirectories(Paths.get(userProjectsDir + "/weblogic-operators/" + operatorNS));
250267
generatedInputYamlFile = parentDir + "/weblogic-operator-values.yaml";
251268
TestUtils.createInputFile(operatorMap, generatedInputYamlFile);
252-
253-
// write certificates
254-
ExecCommand.exec(
255-
BaseTest.getProjectRoot()
256-
+ "/kubernetes/samples/scripts/rest/generate-external-rest-identity.sh "
257-
+ "DNS:"
258-
+ TestUtils.getHostName()
259-
+ " >> "
260-
+ generatedInputYamlFile);
269+
StringBuilder sb = new StringBuilder(200);
270+
sb.append(BaseTest.getProjectRoot());
271+
if (useLegacyRESTIdentity) {
272+
sb.append(
273+
"/integration-tests/src/test/resources/scripts/legacy-generate-external-rest-identity.sh ");
274+
} else {
275+
sb.append("/kubernetes/samples/scripts/rest/generate-external-rest-identity.sh ");
276+
sb.append(" -n ");
277+
sb.append(operatorNS);
278+
}
279+
sb.append(" DNS:");
280+
sb.append(TestUtils.getHostName());
281+
sb.append(" >> ");
282+
sb.append(generatedInputYamlFile);
283+
logger.info("Invoking " + sb.toString());
284+
ExecCommand.exec(sb.toString());
261285
}
262286

263287
private void runCommandInLoop(String command) throws Exception {

‎integration-tests/src/test/java/oracle/kubernetes/operator/utils/TestUtils.java

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -419,10 +419,11 @@ public static String getExternalOperatorCertificate(String operatorNS, String us
419419
File certFile =
420420
new File(userProjectsDir + "/weblogic-operators/" + operatorNS + "/operator.cert.pem");
421421

422-
StringBuffer opCertCmd = new StringBuffer("kubectl get cm -n ");
422+
StringBuffer opCertCmd = new StringBuffer("kubectl get secret -n ");
423423
opCertCmd
424424
.append(operatorNS)
425-
.append(" weblogic-operator-cm -o jsonpath='{.data.externalOperatorCert}'");
425+
.append(
426+
" weblogic-operator-external-rest-identity -o yaml | grep tls.crt | cut -d':' -f 2");
426427

427428
ExecResult result = ExecCommand.exec(opCertCmd.toString());
428429
if (result.exitValue() != 0) {
@@ -440,7 +441,7 @@ public static String getExternalOperatorCertificate(String operatorNS, String us
440441
.append(" | base64 --decode > ")
441442
.append(certFile.getAbsolutePath());
442443

443-
String decodedOpCert = ExecCommand.exec(opCertDecodeCmd.toString()).stdout().trim();
444+
ExecCommand.exec(opCertDecodeCmd.toString()).stdout().trim();
444445
return certFile.getAbsolutePath();
445446
}
446447

@@ -449,12 +450,11 @@ public static String getExternalOperatorKey(String operatorNS, String userProjec
449450
File keyFile =
450451
new File(userProjectsDir + "/weblogic-operators/" + operatorNS + "/operator.key.pem");
451452

452-
StringBuffer opKeyCmd = new StringBuffer("grep externalOperatorKey: ");
453+
StringBuffer opKeyCmd = new StringBuffer("kubectl get secret -n ");
453454
opKeyCmd
454-
.append(userProjectsDir)
455-
.append("/weblogic-operators/")
456455
.append(operatorNS)
457-
.append("/weblogic-operator-values.yaml | awk '{ print $2 }'");
456+
.append(
457+
" weblogic-operator-external-rest-identity -o yaml | grep tls.key | cut -d':' -f 2");
458458

459459
ExecResult result = ExecCommand.exec(opKeyCmd.toString());
460460
if (result.exitValue() != 0) {
@@ -467,7 +467,7 @@ public static String getExternalOperatorKey(String operatorNS, String userProjec
467467
StringBuffer opKeyDecodeCmd = new StringBuffer("echo ");
468468
opKeyDecodeCmd.append(opKey).append(" | base64 --decode > ").append(keyFile.getAbsolutePath());
469469

470-
String decodedOpKey = ExecCommand.exec(opKeyDecodeCmd.toString()).stdout().trim();
470+
ExecCommand.exec(opKeyDecodeCmd.toString()).stdout().trim();
471471
return keyFile.getAbsolutePath();
472472
}
473473

@@ -480,9 +480,10 @@ public static String getGitBranchName() throws Exception {
480480
return result.stdout().trim();
481481
}
482482

483-
public static Operator createOperator(String opYamlFile) throws Exception {
483+
public static Operator createOperator(String opYamlFile, boolean useLegacyRESTIdentity)
484+
throws Exception {
484485
// create op
485-
Operator operator = new Operator(opYamlFile);
486+
Operator operator = new Operator(opYamlFile, useLegacyRESTIdentity);
486487

487488
logger.info("Check Operator status");
488489
operator.verifyPodCreated();
@@ -492,6 +493,10 @@ public static Operator createOperator(String opYamlFile) throws Exception {
492493
return operator;
493494
}
494495

496+
public static Operator createOperator(String opYamlFile) throws Exception {
497+
return createOperator(opYamlFile, false);
498+
}
499+
495500
public static Domain createDomain(String inputYaml) throws Exception {
496501
logger.info("Creating domain with yaml, waiting for the script to complete execution");
497502
return new Domain(inputYaml);

‎integration-tests/src/test/resources/operator_bc.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Copyright 2019, Oracle Corporation and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
4+
#any property can be provided here from kubernetes/charts/weblogic-operator/values.yaml
5+
releaseName: op3
6+
serviceAccount: weblogic-operator
7+
namespace: weblogic-operator-backward-compatibility
8+
domainNamespaces: [ "domain-backward-compatibility"]
9+
externalRestEnabled: true
10+
externalRestHttpsPort: 32004
11+
javaLoggingLevel: FINE

‎integration-tests/src/test/resources/scripts/legacy-generate-external-rest-identity.sh

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
#!/usr/bin/env bash
2+
# Copyright 2017, 2018, Oracle Corporation and/or its affiliates. All rights reserved.
3+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
4+
#
5+
# When the customer enables the operator's external REST api (by setting
6+
# externalRestEnabled to true when installing the operator helm chart), the customer needs
7+
# to provide the certificate and private key for api's SSL identity too (by setting
8+
# externalOperatorCert and externalOperatorKey to the base64 encoded PEM of the cert and
9+
# key when installing the operator helm chart).
10+
#
11+
# This sample script generates a self-signed certificate and private key that can be used
12+
# for the operator's external REST api when experimenting with the operator. They should
13+
# not be used in a production environment.
14+
#
15+
# The sytax of the script is:
16+
# kubernetes/samples/scripts/generate-external-rest-identity.sh <subject alternative names>
17+
#
18+
# <subject alternative names> lists the subject alternative names to put into the generated
19+
# self-signed certificate for the external WebLogic Operator REST https interface,
20+
# for example:
21+
# DNS:myhost,DNS:localhost,IP:127.0.0.1
22+
#
23+
# The script prints out the base64 encoded pem of the generated certificate and private key
24+
# in the same format that the operator helm chart's values.yaml requires.
25+
#
26+
# Example usage:
27+
# generate-external-rest-identity.sh IP:127.0.0.1 > my_values.yaml
28+
# echo "externalRestEnabled: true" >> my_values.yaml
29+
# ...
30+
# helm install kubernetes/charts/weblogic-operator --name my_operator --namespace my_operator-ns --values my_values.yaml --wait
31+
32+
if [ "$#" != 1 ] ; then
33+
1>&2 echo "Syntax: ${BASH_SOURCE[0]} <subject alternative names>"
34+
exit 1
35+
fi
36+
37+
if [ ! -x "$(command -v keytool)" ]; then
38+
echo "Can't find keytool. Please add it to the path."
39+
exit 1
40+
fi
41+
42+
if [ ! -x "$(command -v openssl)" ]; then
43+
echo "Can't find openssl. Please add it to the path."
44+
exit 1
45+
fi
46+
47+
if [ ! -x "$(command -v base64)" ]; then
48+
echo "Can't find base64. Please add it to the path."
49+
exit 1
50+
fi
51+
52+
TEMP_DIR=`mktemp -d`
53+
if [ $? -ne 0 ]; then
54+
echo "$0: Can't create temp directory."
55+
exit 1
56+
fi
57+
58+
if [ -z $TEMP_DIR ]; then
59+
echo "Can't create temp directory."
60+
exit 1
61+
fi
62+
63+
function cleanup {
64+
rm -r $TEMP_DIR
65+
if [[ $SUCCEEDED != "true" ]]; then
66+
exit 1
67+
fi
68+
}
69+
70+
set -e
71+
72+
trap "cleanup" EXIT
73+
74+
#set -x
75+
76+
SANS=$1
77+
DAYS_VALID="3650"
78+
TEMP_PW="temp_password"
79+
OP_PREFIX="weblogic-operator"
80+
OP_ALIAS="${OP_PREFIX}-alias"
81+
OP_JKS="${TEMP_DIR}/${OP_PREFIX}.jks"
82+
OP_PKCS12="${TEMP_DIR}/${OP_PREFIX}.p12"
83+
OP_CSR="${TEMP_DIR}/${OP_PREFIX}.csr"
84+
OP_CERT_PEM="${TEMP_DIR}/${OP_PREFIX}.cert.pem"
85+
OP_KEY_PEM="${TEMP_DIR}/${OP_PREFIX}.key.pem"
86+
KEYTOOL=/usr/java/jdk1.8.0_141/bin/keytool
87+
88+
# generate a keypair for the operator's REST service, putting it in a keystore
89+
keytool \
90+
-genkey \
91+
-keystore ${OP_JKS} \
92+
-alias ${OP_ALIAS} \
93+
-storepass ${TEMP_PW} \
94+
-keypass ${TEMP_PW} \
95+
-keysize 2048 \
96+
-keyalg RSA \
97+
-validity ${DAYS_VALID} \
98+
-dname "CN=weblogic-operator" \
99+
-ext KU=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgreement \
100+
-ext SAN="${SANS}" \
101+
2> /dev/null
102+
103+
# extract the cert to a pem file
104+
keytool \
105+
-exportcert \
106+
-keystore ${OP_JKS} \
107+
-storepass ${TEMP_PW} \
108+
-alias ${OP_ALIAS} \
109+
-rfc \
110+
> ${OP_CERT_PEM} 2> /dev/null
111+
112+
# convert the keystore to a pkcs12 file
113+
keytool \
114+
-importkeystore \
115+
-srckeystore ${OP_JKS} \
116+
-srcstorepass ${TEMP_PW} \
117+
-destkeystore ${OP_PKCS12} \
118+
-srcstorepass ${TEMP_PW} \
119+
-deststorepass ${TEMP_PW} \
120+
-deststoretype PKCS12 \
121+
2> /dev/null
122+
123+
# extract the private key from the pkcs12 file to a pem file
124+
openssl \
125+
pkcs12 \
126+
-in ${OP_PKCS12} \
127+
-passin pass:${TEMP_PW} \
128+
-nodes \
129+
-nocerts \
130+
-out ${OP_KEY_PEM} \
131+
2> /dev/null
132+
133+
# base64 encode the cert and private key pem
134+
CERT_DATA=`base64 -i ${OP_CERT_PEM} | tr -d '\n'`
135+
KEY_DATA=`base64 -i ${OP_KEY_PEM} | tr -d '\n'`
136+
137+
# print out the cert and pem in the form that can be added to
138+
# the operator helm chart's values.yaml
139+
echo "externalOperatorCert: ${CERT_DATA}"
140+
echo "externalOperatorKey: ${KEY_DATA}"
141+
142+
SUCCEEDED=true

‎kubernetes/charts/weblogic-operator/templates/_operator-cm.tpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
apiVersion: "v1"
77
data:
88
{{- if .externalRestEnabled }}
9-
{{- if (hasKey . "externalCertificateSecret") }}
10-
externalCertificateSecret: {{ .externalCertificateSecret | quote }}
9+
{{- if (hasKey . "externalRestIdentitySecret") }}
10+
externalRestIdentitySecret: {{ .externalRestIdentitySecret | quote }}
1111
{{- else }}
1212
externalOperatorCert: {{ .externalOperatorCert | quote }}
1313
{{- end }}

‎kubernetes/charts/weblogic-operator/templates/_validate-inputs.tpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,15 @@
1212
{{- $ignore := include "utils.verifyEnum" (list $scope "imagePullPolicy" (list "Always" "IfNotPresent" "Never")) -}}
1313
{{- $ignore := include "utils.verifyOptionalDictionaryList" (list $scope "imagePullSecrets") -}}
1414
{{- $ignore := include "utils.verifyEnum" (list $scope "javaLoggingLevel" (list "SEVERE" "WARNING" "INFO" "CONFIG" "FINE" "FINER" "FINEST")) -}}
15-
{{- $ignore := include "utils.mutexString" (list $scope "externalCertificateSecret" (list "externalOperatorKey" "externalOperatorCert")) -}}
1615
{{- if include "utils.verifyBoolean" (list $scope "externalRestEnabled") -}}
1716
{{- if $scope.externalRestEnabled -}}
1817
{{- $ignore := include "utils.verifyInteger" (list $scope "externalRestHttpsPort") -}}
18+
{{- $ignore := include "utils.mutexString" (list $scope "externalRestIdentitySecret" (list "externalOperatorKey" "externalOperatorCert")) -}}
1919
{{- if (or (hasKey $scope "externalOperatorCert") (hasKey $scope "externalOperatorKey")) -}}
2020
{{- $ignore := include "utils.verifyString" (list $scope "externalOperatorCert") -}}
2121
{{- $ignore := include "utils.verifyString" (list $scope "externalOperatorKey") -}}
2222
{{- else }}
23-
{{- $ignore := include "utils.verifyString" (list $scope "externalCertificateSecret") -}}
23+
{{- $ignore := include "utils.verifyString" (list $scope "externalRestIdentitySecret") -}}
2424
{{- end -}}
2525
{{- end -}}
2626
{{- end -}}

‎kubernetes/charts/weblogic-operator/values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,9 @@ externalRestHttpsPort: 31001
5555
# The name of the secret used to store the certificate and private key to use for the external operator REST https interface.
5656
# The secret has to be created in the same namespace of the welbogic operator.
5757
# This parameter is required if 'externalRestEnabled' is true. Otherwise, it is ignored.
58-
# As example, a self-sigend certificate can be created and stored in weblogic-operator-certificate using the
59-
# following sample script kubernetes/samples/scripts/rest/generate-external-rest-identity.sh
60-
#externalCertificateSecret:
58+
# As example, an external rest identity can be created using the following sample script
59+
# kubernetes/samples/scripts/rest/generate-external-rest-identity.sh
60+
#externalRestIdentitySecret:
6161

6262
# remoteDebugNodePortEnabled specifies whether or not the operator will start a Java remote debug server
6363
# on the provided port and suspend execution until a remote debugger has attached.

0 commit comments

Comments
 (0)