Skip to content

Commit 0df73f1

Browse files
xekxek
committed
LDAP Adoption tests
IPA is enabled on OSP17 when testing TLS-E adoption. Since it contains an LDAP server, we can use it to run additional LDAP adoption tests. Depends-On: openstack-k8s-operators/install_yamls#1079
1 parent 40e2aff commit 0df73f1

File tree

6 files changed

+270
-1
lines changed

6 files changed

+270
-1
lines changed

‎tests/roles/development_environment/defaults/main.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
# IPA-related variables
3+
ipa_admin_password: "fce95318204114530f31f885c9df588f"
4+
ipa_user_password: "nomoresecrets"
15
prelaunch_test_instance: true
26
prelaunch_test_instance_scripts:
37
- pre_launch.bash

‎tests/roles/development_environment/tasks/main.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,3 +170,35 @@
170170
- name: copy keys from undercloud for tobiko
171171
ansible.builtin.shell: |
172172
mkdir -p ~/ci-framework-data/tests/test_operator; scp -r ${OS_CLOUD_IP}:~/.ssh/id_ecdsa* ~/ci-framework-data/tests/test_operator/
173+
174+
- name: Add IPA domain to Keystone and create IPA users
175+
when: enable_tlse is defined and enable_tlse
176+
block:
177+
- name: SSH into standalone VM and execute IPA commands
178+
ansible.builtin.shell: |
179+
{{ shell_header }}
180+
ssh {{ edpm_node_ip }} "sudo podman exec freeipa-server-container bash -c '\
181+
echo {{ ipa_admin_password }} | kinit admin;\
182+
ipa user-add svc-ldap --first=Openstack --last=LDAP;\
183+
echo {{ ipa_admin_password }} | ipa passwd svc-ldap;\
184+
ipa user-add ipauser1 --first=ipa1 --last=user1;\
185+
echo {{ ipa_user_password }} | ipa passwd ipauser1;\
186+
ipa user-add ipauser2 --first=ipa2 --last=user2;\
187+
echo {{ ipa_user_password }} | ipa passwd ipauser2;\
188+
ipa user-add ipauser3 --first=ipa3 --last=user3;\
189+
echo {{ ipa_user_password }} | ipa passwd ipauser3;\
190+
ipa group-add --desc=\"OpenStack Users\" grp-openstack;\
191+
ipa group-add --desc=\"OpenStack Admin Users\" grp-openstack-admin;\
192+
ipa group-add --desc=\"OpenStack Demo Users\" grp-openstack-demo;\
193+
ipa group-add-member --users=svc-ldap grp-openstack;\
194+
ipa group-add-member --users=ipauser1 grp-openstack;\
195+
ipa group-add-member --users=ipauser1 grp-openstack-admin;\
196+
ipa group-add-member --users=ipauser2 grp-openstack;\
197+
ipa group-add-member --users=ipauser2 grp-openstack-demo;\
198+
ipa group-add-member --users=ipauser3 grp-openstack;\
199+
'"
200+
201+
- name: Add REDHAT domain to Keystone
202+
ansible.builtin.shell: |
203+
{{ shell_header }}
204+
{{ openstack_command }} domain create --description \"Test LDAP Domain\" REDHAT

‎tests/roles/keystone_adoption/defaults/main.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,48 @@ keystone_patch: |
2222
type: LoadBalancer
2323
databaseInstance: openstack
2424
secret: osp-secret
25+
26+
keystone_patch_ldap: |
27+
spec:
28+
keystone:
29+
enabled: true
30+
apiOverride:
31+
route: {}
32+
template:
33+
customServiceConfig: |
34+
[token]
35+
expiration = 360000
36+
[identity]
37+
domain_specific_drivers_enabled = true
38+
extraMounts:
39+
- name: v1
40+
region: r1
41+
extraVol:
42+
- propagation:
43+
- Keystone
44+
extraVolType: Conf
45+
volumes:
46+
- name: keystone-domains
47+
secret:
48+
secretName: keystone-domains
49+
mounts:
50+
- name: keystone-domains
51+
mountPath: "/etc/keystone/domains"
52+
readOnly: true
53+
override:
54+
service:
55+
internal:
56+
metadata:
57+
annotations:
58+
metallb.universe.tf/address-pool: internalapi
59+
metallb.universe.tf/allow-shared-ip: internalapi
60+
metallb.universe.tf/loadBalancerIPs: {{ internalapi_prefix | default('172.17.0') }}.80
61+
spec:
62+
type: LoadBalancer
63+
databaseInstance: openstack
64+
secret: osp-secret
65+
66+
# IPA-related variables
67+
edpm_node_hostname: standalone.localdomain
68+
ipa_admin_password: "fce95318204114530f31f885c9df588f"
69+
ipa_user_password: "nomoresecrets"

‎tests/roles/keystone_adoption/tasks/main.yaml‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,52 @@
1616
type: Opaque
1717
EOF
1818
19+
20+
- name: Set IPA BaseDN var
21+
ansible.builtin.set_fact:
22+
ipa_basedn: "dc={{ edpm_node_hostname.split('.')[1:] | join(',dc=') }}"
23+
when: enable_tlse is defined and enable_tlse
24+
25+
- name: Create Keystone domain config secret for LDAP
26+
ansible.builtin.shell: |
27+
{{ shell_header }}
28+
{{ oc_header }}
29+
cat <<EOF | oc apply -n openstack -f -
30+
apiVersion: v1
31+
kind: Secret
32+
metadata:
33+
name: keystone-domains
34+
type: Opaque
35+
stringData:
36+
keystone.{{ ipa_domain | default('REDHAT') }}.conf: |
37+
[identity]
38+
driver = ldap
39+
[ldap]
40+
url = ldap://{{ standalone_ip }}
41+
user = uid=admin,cn=users,cn=accounts,{{ ipa_basedn }}
42+
password = {{ ipa_admin_password | default('nomoresecrets') }}
43+
suffix = {{ ipa_basedn }}
44+
user_tree_dn = cn=users,cn=accounts,{{ ipa_basedn }}
45+
user_objectclass = person
46+
user_id_attribute = uid
47+
user_name_attribute = uid
48+
user_mail_attribute = mail
49+
group_tree_dn = cn=groups,cn=accounts,{{ ipa_basedn }}
50+
group_objectclass = groupOfNames
51+
group_id_attribute = cn
52+
group_name_attribute = cn
53+
group_member_attribute = member
54+
group_desc_attribute = description
55+
EOF
56+
when: enable_tlse is defined and enable_tlse
57+
1958
- name: deploy podified Keystone
2059
ansible.builtin.shell: |
2160
{{ shell_header }}
2261
{{ oc_header }}
23-
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch }}'
62+
oc patch openstackcontrolplane openstack --type=merge --patch '{{ keystone_patch_to_use }}'
63+
vars:
64+
keystone_patch_to_use: "{{ keystone_patch_ldap if (enable_tlse is defined and enable_tlse) else keystone_patch }}"
2465

2566
- name: wait for Keystone to start up
2667
ansible.builtin.shell: |
@@ -106,3 +147,7 @@
106147
${BASH_ALIASES[openstack]} credential show {{ before_adoption_credential.stdout }} -f value -c blob
107148
register: after_adoption_credential
108149
failed_when: after_adoption_credential.stdout != 'test'
150+
151+
- name: Run IPA tests if enable_tlse is true
152+
ansible.builtin.include_tasks: run_ipa_test.yml
153+
when: enable_tlse is defined and enable_tlse

‎tests/roles/keystone_adoption/tasks/run_ipa_test.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
# Tasks for testing IPA integration with Keystone
3+
- name: Check if IPA is enabled
4+
ansible.builtin.fail:
5+
msg: "IPA is not enabled (enable_tlse is not true). Skipping IPA tests."
6+
when: enable_tlse is not defined or not enable_tlse
7+
8+
- name: Wait for Keystone to be fully operational
9+
ansible.builtin.shell: |
10+
{{ shell_header }}
11+
{{ oc_header }}
12+
oc wait pod --for condition=Ready --selector=service=keystone
13+
register: keystone_wait_result
14+
until: keystone_wait_result is success
15+
retries: 60
16+
delay: 2
17+
18+
- name: Wait for openstackclient pod to be ready
19+
ansible.builtin.shell: |
20+
{{ shell_header }}
21+
{{ oc_header }}
22+
oc wait pod --for condition=Ready --selector=service=openstackclient
23+
register: osc_wait_result
24+
until: osc_wait_result is success
25+
retries: 60
26+
delay: 2
27+
28+
- name: Get Keystone route
29+
ansible.builtin.shell: |
30+
{{ shell_header }}
31+
{{ oc_header }}
32+
oc get route keystone-public -n openstack -o jsonpath='{.spec.host}'
33+
register: keystone_route
34+
35+
- name: Create files directory if it does not exist
36+
ansible.builtin.file:
37+
path: "{{ role_path }}/files"
38+
state: directory
39+
mode: '0755'
40+
41+
- name: Create IPA test user cloudrc file
42+
ansible.builtin.template:
43+
src: ipauser.j2
44+
dest: "{{ role_path }}/files/ipauser"
45+
mode: "0600"
46+
vars:
47+
auth_url: "https://{{ keystone_route.stdout }}/v3"
48+
username: "ipauser1"
49+
password: "{{ ipa_user_password }}"
50+
domain: "REDHAT"
51+
52+
- name: Copy IPA test user cloudrc to openstackclient pod
53+
ansible.builtin.shell: |
54+
{{ shell_header }}
55+
{{ oc_header }}
56+
oc cp {{ role_path }}/files/ipauser openstackclient:/home/cloud-admin/ipauser
57+
58+
- name: Test IPA user authentication
59+
ansible.builtin.shell: |
60+
{{ shell_header }}
61+
{{ oc_header }}
62+
oc exec -t openstackclient -- bash -c "
63+
source /home/cloud-admin/ipauser &&
64+
export OS_IDENTITY_API_VERSION=3 &&
65+
openstack token issue -f value -c id > /dev/null &&
66+
echo 'IPA user authentication successful' ||
67+
echo 'IPA user authentication failed'"
68+
register: ipa_auth_test
69+
failed_when: "'IPA user authentication failed' in ipa_auth_test.stdout"
70+
71+
- name: List IPA users via Keystone
72+
ansible.builtin.shell: |
73+
{{ shell_header }}
74+
{{ oc_header }}
75+
oc exec -t openstackclient -- bash -c "
76+
source /home/cloud-admin/ipauser &&
77+
export OS_IDENTITY_API_VERSION=3 &&
78+
openstack user list --domain REDHAT"
79+
register: ipa_user_list
80+
81+
- name: Verify IPA users are accessible
82+
ansible.builtin.assert:
83+
that:
84+
- "'ipauser1' in ipa_user_list.stdout"
85+
- "'ipauser2' in ipa_user_list.stdout"
86+
- "'ipauser3' in ipa_user_list.stdout"
87+
88+
- name: List IPA groups via Keystone
89+
ansible.builtin.shell: |
90+
{{ shell_header }}
91+
{{ oc_header }}
92+
oc exec -t openstackclient -- bash -c "
93+
source /home/cloud-admin/ipauser &&
94+
export OS_IDENTITY_API_VERSION=3 &&
95+
openstack group list --domain REDHAT"
96+
register: ipa_group_list
97+
98+
- name: Verify IPA groups are accessible
99+
ansible.builtin.assert:
100+
that:
101+
- "'grp-openstack' in ipa_group_list.stdout"
102+
- "'grp-openstack-admin' in ipa_group_list.stdout"
103+
- "'grp-openstack-demo' in ipa_group_list.stdout"
104+
105+
- name: Check ipauser1 in grp-openstack-admin
106+
ansible.builtin.shell: |
107+
{{ shell_header }}
108+
{{ oc_header }}
109+
oc exec -t openstackclient -- bash -c "
110+
source /home/cloud-admin/ipauser &&
111+
export OS_IDENTITY_API_VERSION=3 &&
112+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack-admin ipauser1"
113+
register: user1_group_result
114+
failed_when: "'ipauser1 in group grp-openstack-admin' not in user1_group_result.stdout"
115+
116+
- name: Check ipauser2 in grp-openstack-demo
117+
ansible.builtin.shell: |
118+
{{ shell_header }}
119+
{{ oc_header }}
120+
oc exec -t openstackclient -- bash -c "
121+
source /home/cloud-admin/ipauser &&
122+
export OS_IDENTITY_API_VERSION=3 &&
123+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack-demo ipauser2"
124+
register: user2_group_result
125+
failed_when: "'ipauser2 in group grp-openstack-demo' not in user2_group_result.stdout"
126+
127+
- name: Check ipauser3 in grp-openstack
128+
ansible.builtin.shell: |
129+
{{ shell_header }}
130+
{{ oc_header }}
131+
oc exec -t openstackclient -- bash -c "
132+
source /home/cloud-admin/ipauser &&
133+
export OS_IDENTITY_API_VERSION=3 &&
134+
openstack group contains user --group-domain REDHAT --user-domain REDHAT grp-openstack ipauser3"
135+
register: user3_group_result
136+
failed_when: "'ipauser3 in group grp-openstack' not in user3_group_result.stdout"

‎tests/roles/keystone_adoption/templates/ipauser.j2‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
unset OS_CLOUD
3+
export OS_IDENTITY_API_VERSION=3
4+
export OS_AUTH_URL="{{ auth_url }}"
5+
export OS_USER_DOMAIN_NAME="{{ domain }}"
6+
export OS_USERNAME="{{ username }}"
7+
export OS_PASSWORD="{{ password }}"

0 commit comments

Comments
 (0)