create opa test basics

labrenbe · labrenbe · commit c2152505b33d · 2025-01-14T09:58:14.000+01:00
diff --git a/tests/templates/kuttl/oidc/10-install-postgresql.yaml b/tests/templates/kuttl/oidc/10-install-postgresql.yaml
@@ -6,7 +6,7 @@ commands:
       helm install superset-postgresql
       --namespace $NAMESPACE
       --version 12.5.6
-      -f helm-bitnami-postgresql-values.yaml
+      -f 10_helm-bitnami-postgresql-values.yaml
       --repo https://charts.bitnami.com/bitnami postgresql
       --wait
     timeout: 600
diff --git a/tests/templates/kuttl/oidc/10_helm-bitnami-postgresql-values.yaml.j2 b/tests/templates/kuttl/oidc/10_helm-bitnami-postgresql-values.yaml.j2
diff --git a/tests/templates/kuttl/oidc/30-keycloak.yaml b/tests/templates/kuttl/oidc/30-keycloak.yaml
@@ -12,7 +12,7 @@ commands:
       PASSWORD=T8mn72D9 \
       CLIENT_ID=superset1 \
       CLIENT_SECRET=R1bxHUD569vHeQdw \
-      envsubst < install-keycloak.yaml | kubectl apply -n $NAMESPACE -f -
+      envsubst < 30_install-keycloak.yaml | kubectl apply -n $NAMESPACE -f -
 
       INSTANCE_NAME=keycloak2 \
       REALM=test2 \
@@ -23,4 +23,4 @@ commands:
       PASSWORD=NvfpU518 \
       CLIENT_ID=superset2 \
       CLIENT_SECRET=scWzh0D4v0GN8NrN \
-      envsubst < install-keycloak.yaml | kubectl apply -n $NAMESPACE -f -
+      envsubst < 30_install-keycloak.yaml | kubectl apply -n $NAMESPACE -f -
diff --git a/tests/templates/kuttl/oidc/30_install-keycloak.yaml.j2 b/tests/templates/kuttl/oidc/30_install-keycloak.yaml.j2
diff --git a/tests/templates/kuttl/oidc/40_install-superset.yaml.j2 b/tests/templates/kuttl/oidc/40_install-superset.yaml.j2
diff --git a/tests/templates/kuttl/opa-authorization/10-assert.yaml b/tests/templates/kuttl/opa-authorization/10-assert.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: test-superset-postgresql
+timeout: 480
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: superset-postgresql
+status:
+  readyReplicas: 1
+  replicas: 1
diff --git a/tests/templates/kuttl/opa-authorization/10-install-postgresql.yaml b/tests/templates/kuttl/opa-authorization/10-install-postgresql.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: >-
+      helm install superset-postgresql
+      --namespace $NAMESPACE
+      --version 12.5.6
+      -f helm-bitnami-postgresql-values.yaml
+      --repo https://charts.bitnami.com/bitnami postgresql
+      --wait
+    timeout: 600
diff --git a/tests/templates/kuttl/opa-authorization/20-assert.yaml b/tests/templates/kuttl/opa-authorization/20-assert.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: test-keycloak
+timeout: 480
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak1
+status:
+  readyReplicas: 1
+  replicas: 1
diff --git a/tests/templates/kuttl/opa-authorization/20-install-keycloak.yaml b/tests/templates/kuttl/opa-authorization/20-install-keycloak.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      INSTANCE_NAME=keycloak1 \
+      REALM=test1 \
+      USERNAME=jane.doe \
+      FIRST_NAME=Jane \
+      LAST_NAME=Doe \
+      EMAIL=jane.doe@stackable.tech \
+      PASSWORD=T8mn72D9 \
+      CLIENT_ID=superset1 \
+      CLIENT_SECRET=R1bxHUD569vHeQdw \
+      envsubst < install-keycloak.yaml | kubectl apply -n $NAMESPACE -f -
diff --git a/tests/templates/kuttl/opa-authorization/30-assert.yaml b/tests/templates/kuttl/opa-authorization/30-assert.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 300
+commands:
+  - script: kubectl -n $NAMESPACE rollout status daemonset opa-server-default --timeout 300s
diff --git a/tests/templates/kuttl/opa-authorization/30-install-opa.yaml.j2 b/tests/templates/kuttl/opa-authorization/30-install-opa.yaml.j2
@@ -0,0 +1,43 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      kubectl apply -n $NAMESPACE -f - <<EOF
+      ---
+      apiVersion: opa.stackable.tech/v1alpha1
+      kind: OpaCluster
+      metadata:
+        name: opa
+      spec:
+        image:
+          productVersion: "{{ test_scenario['values']['opa'] }}"
+          pullPolicy: IfNotPresent
+        clusterConfig:
+          userInfo:
+            backend:
+              keycloak:
+                hostname: keycloak.$NAMESPACE.svc.cluster.local
+                port: 8443
+                tls:
+                  verification:
+                    server:
+                      caCert:
+                        secretClass: keycloak-tls-$NAMESPACE
+                clientCredentialsSecret: user-info-fetcher-client-credentials
+                adminRealm: my-dataspace
+                userRealm: my-dataspace
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+          vectorAggregatorConfigMapName: vector-aggregator-discovery
+{% endif %}
+        servers:
+          config:
+            logging:
+              enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
+              containers:
+                opa:
+                  loggers:
+                    decision:
+                      level: INFO
+          roleGroups:
+            default: {}
diff --git a/tests/templates/kuttl/opa-authorization/31-assert.yaml b/tests/templates/kuttl/opa-authorization/31-assert.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 300
+commands:
+  - script: kubectl -n $NAMESPACE rollout status daemonset opa-server-default --timeout 300s
diff --git a/tests/templates/kuttl/opa-authorization/31-opa-rego.yaml b/tests/templates/kuttl/opa-authorization/31-opa-rego.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test
+  labels:
+    opa.stackable.tech/bundle: "true"
+data:
+  roles.rego: |
+    package superset
+
+    import rego.v1  
+
+    default user_roles := []
+
+    user_roles := roles if {
+        some user in users
+        roles := user.roles
+        user.username == input.username
+    }
+
+    users := [
+        {"username": "admin", "roles": ["Admin", "Test"]},
+        {"username": "testuser", "roles": ["El_Testos", "Custom2"]}
+    ]
diff --git a/tests/templates/kuttl/opa-authorization/40-assert.yaml b/tests/templates/kuttl/opa-authorization/40-assert.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: install-superset
+timeout: 300
+commands:
+  - script: kubectl -n $NAMESPACE wait --for=condition=available=true supersetclusters.superset.stackable.tech/superset --timeout 301s
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: superset-node-default
+status:
+  readyReplicas: 1
+  replicas: 1
diff --git a/tests/templates/kuttl/opa-authorization/40-install-superset.yaml b/tests/templates/kuttl/opa-authorization/40-install-superset.yaml
@@ -0,0 +1,8 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 300
+commands:
+  - script: >
+      envsubst '$NAMESPACE' < install-superset.yaml |
+      kubectl apply -n $NAMESPACE -f -
diff --git a/tests/templates/kuttl/opa-authorization/40_install-superset.yaml.j2 b/tests/templates/kuttl/opa-authorization/40_install-superset.yaml.j2
@@ -0,0 +1,40 @@
+# $NAMESPACE will be replaced with the namespace of the test case.
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: superset-credentials
+type: Opaque
+stringData:
+  adminUser.username: admin
+  adminUser.firstname: Superset
+  adminUser.lastname: Admin
+  adminUser.email: admin@superset.com
+  adminUser.password: admin
+  connections.secretKey: aQC11KVUJ3yTVcy2
+  connections.sqlalchemyDatabaseUri: postgresql://superset:superset@superset-postgresql/superset
+---
+apiVersion: superset.stackable.tech/v1alpha1
+kind: SupersetCluster
+metadata:
+  name: superset
+spec:
+  image:
+    productVersion: "{{ test_scenario['values']['superset'] }}"
+    pullPolicy: IfNotPresent
+  clusterConfig:
+    authorization:
+      opa:
+        configMapName: simple-opa
+        package: superset
+    credentialsSecret: superset-credentials
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+    vectorAggregatorConfigMapName: vector-aggregator-discovery
+{% endif %}
+  nodes:
+    config:
+      logging:
+        enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
+    roleGroups:
+      default:
+        replicas: 1
diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml
@@ -40,6 +40,9 @@ tests:
     dimensions:
       - superset
       - openshift
+  - name: opa
+      - superset
+      - openshift
   - name: resources
     dimensions:
       - superset-latest
