Enable trusted_execution_cluster tests on OpenShift

test_utils/Cargo.toml

@@ -31,3 +31,4 @@ tokio = { workspace = true, features = ["process"] }
 tower = { version = "0.5.2", features = ["full"] }
 uuid.workspace = true
 which = "8.0"
+fs_extra = "1.3.0"

test_utils/src/lib.rs

@@ -11,6 +11,7 @@ use std::path::Path;
 use std::sync::Once;
 use std::time::Duration;
 use tokio::process::Command;
+use fs_extra::dir;
 
 pub mod timer;
 pub use timer::Poller;
@@ -260,9 +261,11 @@ impl TestContext {
         );
 
         let crd_temp_dir = Path::new(&self.manifests_dir).join("crd");
+        let rbac_dir = workspace_root.join("config/rbac/");
+        let options = dir::CopyOptions::new();
+        dir::copy(rbac_dir, &self.manifests_dir, &options)?;
         let rbac_temp_dir = Path::new(&self.manifests_dir).join("rbac");
-        std::fs::create_dir_all(&crd_temp_dir)?;
-        std::fs::create_dir_all(&rbac_temp_dir)?;
+        std::fs::create_dir_all(&crd_temp_dir)?;   
 
         let crd_temp_dir_str = crd_temp_dir
             .to_str()
@@ -300,29 +303,32 @@ impl TestContext {
                 trusted_cluster_gen_path.display()
             ));
         }
-
+        let repo = std::env::var("REGISTRY")
+            .unwrap_or_else(|_| "localhost:5000".to_string());
+        let tag = std::env::var("TAG")
+            .unwrap_or_else(|_| "latest".to_string());
         let manifest_gen_output = Command::new(&trusted_cluster_gen_path)
             .args([
                 "-namespace",
                 &ns,
                 "-output-dir",
                 &self.manifests_dir,
                 "-image",
-                "localhost:5000/trusted-execution-clusters/trusted-cluster-operator:latest",
+                &format!("{repo}/trusted-execution-clusters/trusted-cluster-operator:{tag}"),
                 "-pcrs-compute-image",
-                "localhost:5000/trusted-execution-clusters/compute-pcrs:latest",
+                &format!("{repo}/trusted-execution-clusters/compute-pcrs:{tag}"),
                 "-trustee-image",
-                "quay.io/trusted-execution-clusters/key-broker-service:20260106",
+                "quay.io/trusted-execution-clusters/key-broker-service:latest",
                 "-register-server-image",
-                "localhost:5000/trusted-execution-clusters/registration-server:latest",
+                &format!("{repo}/trusted-execution-clusters/registration-server:{tag}"),
                 "-attestation-key-register-image",
-                "localhost:5000/trusted-execution-clusters/attestation-key-register:latest",
+                &format!("{repo}/trusted-execution-clusters/attestation-key-register:{tag}"),
                 "-approved-image",
                 "quay.io/fedora/fedora-coreos@sha256:8f11c87187dfe83145001e9571948f9ab466e9f4a8b1e092a4798e5db1030dc3"
             ])
             .output()
             .await?;
-
+        
         if !manifest_gen_output.status.success() {
             let stderr = String::from_utf8_lossy(&manifest_gen_output.stderr);
             return Err(anyhow::anyhow!("Failed to generate manifests: {stderr}"));
@@ -395,25 +401,26 @@ impl TestContext {
         std::fs::write(&le_rb_dst, le_rb_content)?;
 
         test_info!(&self.test_name, "Preparing RBAC kustomization");
-        let kustomization_content = format!(
-            r#"# SPDX-FileCopyrightText: Generated for testing
-# SPDX-License-Identifier: CC0-1.0
-
-namespace: {}
-
-resources:
-  - service_account.yaml
-  - role.yaml
-  - role_binding.yaml
-  - leader_election_role.yaml
-  - leader_election_role_binding.yaml
-"#,
-            ns
-        );
-
+        let platform = std::env::var("PLATFORM")
+            .unwrap_or_else(|_| "kind".to_string());
+        let kustomization_src = workspace_root.join("config/rbac/kustomization.yaml.in");
+        let kustomization_content = std::fs::read_to_string(&kustomization_src)?
+            .replace("namespace: NAMESPACE", &format!("namespace: {}", ns))
+            .replace("resources:", if platform == "openshift" {
+            "resources:\n  - scc.yaml"
+            } else {
+            "resources:"
+            });
         let temp_kustomization_path = rbac_temp_dir.join("kustomization.yaml");
         std::fs::write(&temp_kustomization_path, kustomization_content)?;
 
+        let scc_openshift_rb_src = workspace_root.join("config/openshift/scc.yaml");
+        let scc_openshift_rb_content = std::fs::read_to_string(&scc_openshift_rb_src)?
+            .replace("<NAMESPACE>",  &ns);
+        let scc_openshift_rb_dst = rbac_temp_dir.join("scc.yaml");
+        std::fs::write(&scc_openshift_rb_dst, scc_openshift_rb_content)?;
+
+
         kube_apply!(
             rbac_temp_dir_str,
             &self.test_name,
@@ -436,7 +443,9 @@ resources:
             &self.test_name,
             "Updating CR manifest with publicTrusteeAddr"
         );
-        let trustee_addr = format!("kbs-service.{}.svc.cluster.local:8080", ns);
+        let cluster_url = std::env::var("CLUSTER_URL")
+            .unwrap_or_else(|_| "svc.cluster.local".to_string());
+        let trustee_addr = format!("kbs-service.{}.{}:8080", ns, cluster_url);
         let cr_manifest_path = manifests_path.join("trusted_execution_cluster_cr.yaml");
 
         let cr_content = std::fs::read_to_string(&cr_manifest_path)?;