CM-423: Adds e2e test for istio-csr controller with grpc CreateCertificate call by PillaiManish · Pull Request #226 · openshift/cert-manager-operator

PillaiManish · 2024-12-26T05:06:08Z

The PR adds the e2e test scenarios for the new istio-csr controller.

Apply's the new IstioCSR resource in the istio-system namespace
Create a new job - grpcurl-job which calls the endpoint of the istio-csr
Waits for the response and validates the certificate and the root chain

openshift-ci-robot · 2024-12-26T05:06:11Z

@PillaiManish: This pull request references CM-423 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.19." or "openshift-4.19.", but it targets "cert-manager-1.15" instead.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-12-26T05:06:12Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

swghosh · 2024-12-27T09:55:18Z

/testwith openshift/cert-manager-operator/master/e2e-operator #220

PillaiManish · 2025-01-06T12:18:28Z

/reopen

openshift-ci · 2025-01-06T12:18:38Z

@PillaiManish: Failed to re-open PR: state cannot be changed. There is already an open pull request from PillaiManish:master to openshift:master.

Details

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2025-01-06T12:18:40Z

@PillaiManish: This pull request references CM-423 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.19." or "openshift-4.19.", but it targets "cert-manager-1.15" instead.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bharath-b-rh · 2025-01-07T03:31:40Z

/testwith openshift/cert-manager-operator/master/e2e-operator #220

test/e2e/istio_csr_test.go

swghosh

Please refactor the tests using a fresh Ginkgo suite that can have a label for TechPreview and Feature:IstioCSR or the alike.

Also, per discussions with team earlier we can strip the service mesh functionality for now and only make this test, really test the grpc server exposed by istio-csr with a plain client.

test/library/utils.go

swghosh

overall the test case(s) seem to be in a good shape.

test/e2e/istio-csr_test.go

test/e2e/testdata/istio/proto-cm.yaml

test/e2e/istio-csr_test.go

swghosh · 2025-01-13T14:09:41Z

/testwith openshift/cert-manager-operator/master/e2e-operator #220

test/e2e/istio-csr_test.go

bharath-b-rh · 2025-01-17T08:22:07Z

Please add the description.

PillaiManish · 2025-01-21T16:56:25Z

/testwith openshift/cert-manager-operator/master/e2e-operator #220

PillaiManish · 2025-01-24T11:14:40Z

/testwith openshift/cert-manager-operator/master/e2e-operator #220

test/e2e/utils_test.go

test/e2e/istio_csr_test.go

swghosh · 2025-02-20T08:03:28Z

test/e2e/istio_csr_test.go

+			By("creating an grpcurl job")
+			job := &batchv1.Job{
+				ObjectMeta: metav1.ObjectMeta{
+					Name: "grpcurl-job",
+				},
+				Spec: batchv1.JobSpec{
+					Completions:  ptr.To(int32(1)),
+					BackoffLimit: ptr.To(back_off_limits),
+					Template: corev1.PodTemplateSpec{
+						ObjectMeta: metav1.ObjectMeta{
+							Name: grpcAppName,
+							Labels: map[string]string{
+								"app": grpcAppName,
+							},
+						},
+						Spec: corev1.PodSpec{
+							ServiceAccountName:           serviceAccountName,
+							AutomountServiceAccountToken: ptr.To(false),
+							RestartPolicy:                corev1.RestartPolicyOnFailure,
+							Containers: []corev1.Container{
+								{
+									Name:  grpcAppName,
+									Image: "registry.redhat.io/rhel9/go-toolset",
+									Command: []string{
+										"/bin/sh",
+										"-c",
+									},
+									Env: []corev1.EnvVar{
+										{
+											Name:  "GOCACHE",
+											Value: "/tmp/go-cache",
+										},
+									},
+									Args: []string{
+										"GOCACHE=/tmp/go-cache && " +
+											"export GOPATH=/tmp/go && " +
+											"go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.9.2 >/dev/null 2>&1 && " +
+											"TOKEN=$(cat /var/run/secrets/istio-ca/token) && " +
+											"/tmp/go/bin/grpcurl " +
+											"-import-path /proto " +
+											"-proto /proto/ca.proto " +
+											"-H \"Authorization: Bearer $TOKEN\" " +
+											fmt.Sprintf("-d '{\"csr\": \"%s\", \"validity_duration\": 3600}' ", csr) +
+											"-cacert /etc/root-secret/ca.crt " +
+											"-key /etc/root-secret/tls.key " +
+											"-cert /etc/root-secret/tls.crt " +
+											fmt.Sprintf("%s istio.v1.auth.IstioCertificateService/CreateCertificate", istioCSRGRPCEndpoint),
+									},
+									VolumeMounts: []corev1.VolumeMount{
+										{Name: "root-secret", MountPath: "/etc/root-secret"},
+										{Name: "proto", MountPath: "/proto"},
+										{Name: "service-token", MountPath: "/var/run/secrets/istio-ca"},
+									},
+								},
+							},
+							Volumes: []corev1.Volume{
+								{
+									Name: "service-token",
+									VolumeSource: corev1.VolumeSource{
+										Projected: &corev1.ProjectedVolumeSource{
+											DefaultMode: ptr.To(int32(420)),
+											Sources: []corev1.VolumeProjection{
+												{
+													ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
+														Audience:          "istio-ca",
+														ExpirationSeconds: ptr.To(int64(3600)),
+														Path:              "token",
+													},
+												},
+											},
+										},
+									},
+								},
+								{
+									Name: "root-secret",
+									VolumeSource: corev1.VolumeSource{
+										Secret: &corev1.SecretVolumeSource{
+											SecretName: "istiod-tls",
+										},
+									},
+								},
+								{
+									Name: "proto",
+									VolumeSource: corev1.VolumeSource{
+										ConfigMap: &corev1.ConfigMapVolumeSource{
+											LocalObjectReference: corev1.LocalObjectReference{
+												Name: "proto-cm",
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			}


prefer a file for this instead, as most of the field values are fixed. replaceStrInFile can help;
however follow-up PR is fine.

Maybe I can do it in a follow-up, if that works?

let's de-clutter it, how about a test/e2e/testdata/istio_csr/grpcurl_job.yaml?

apiVersion: batch/v1 kind: Job metadata: name: grpcurl-istio-csr spec: backoffLimit: 10 completions: 1 template: metadata: labels: app: grpcurl-istio-csr name: grpcurl-istio-csr spec: automountServiceAccountToken: false containers: - args: - | go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.9.2 >/dev/null 2>&1 && \ TOKEN=$(cat /var/run/secrets/istio-ca/token) && \ /tmp/go/bin/grpcurl \ -import-path /proto \ -proto /proto/ca.proto \ -H "Authorization: Bearer $TOKEN" \ -d '{"csr": "{{.CertificateSigningRequest}}", "validity_duration": 3600}' \ -cacert /etc/root-secret/ca.crt \ -key /etc/root-secret/tls.key \ -cert /etc/root-secret/tls.crt \ {{.IstioCSRStatus.IstioCSRGRPCEndpoint}} istio.v1.auth.IstioCertificateService/CreateCertificate command: - /bin/sh - -c env: - name: GOCACHE value: /tmp/go-cache - name: GOPATH value: /tmp/go image: registry.redhat.io/rhel9/go-toolset name: grpcurl volumeMounts: - mountPath: /etc/root-secret name: root-secret - mountPath: /proto name: proto - mountPath: /var/run/secrets/istio-ca name: sa-token restartPolicy: OnFailure serviceAccountName: '{{.IstioCSRStatus.ServiceAccount}}' volumes: - name: sa-token projected: defaultMode: 420 sources: - serviceAccountToken: audience: istio-ca expirationSeconds: 3600 path: token - name: root-secret secret: secretName: istiod-tls - configMap: name: proto-cm name: proto

what I meant basically pushes ahead of #247, so that within test/e2e/config_template.go we can add:

+ // IstioCSRConfig customizes the fields in a job spec + type IstioCSRGRPCurlJobConfig struct { + CertificateSigningRequest string + IstioCSRStatus v1alpha1.IstioCSRStatus + }

to get the above yaml value filled in during test.

As discussed, we'll do this on a follow-up PR after #247 lands.

swghosh

few nits, otherwise LGTM.

test/e2e/istio_csr_test.go

test/e2e/testdata/istio/istio-ca-issuer.yaml

test/e2e/testdata/istio/istio-csr.yaml

swghosh · 2025-02-25T07:11:13Z

/retitle CM-423: Adds e2e test for istio-csr controller with grpc CreateCertificate call

bharath-b-rh · 2025-02-25T07:53:53Z

/lgtm

lunarwhite

LGTM, only minor nits

test/e2e/istio_csr_test.go

- applys IstioCSR resource - deploys grpcurl job - which calls the grpc endpoint of istio-csr - checks the response and validates the certificate

lunarwhite · 2025-02-25T10:22:02Z

/label qe-approved
/lgtm

openshift-ci-robot · 2025-02-25T10:22:11Z

@PillaiManish: This pull request references CM-423 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target either version "4.19." or "openshift-4.19.", but it targets "cert-manager-1.15" instead.

Details

In response to this:

The PR adds the e2e test scenarios for the new istio-csr controller.

Apply's the new IstioCSR resource in the istio-system namespace

Create a new job - grpcurl-job which calls the endpoint of the istio-csr

Waits for the response and validates the certificate and the root chain

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-02-25T10:22:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bharath-b-rh, lunarwhite, PillaiManish, swghosh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [swghosh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

swghosh · 2025-02-25T13:20:03Z

/cherry-pick cert-manager-1.15

openshift-cherrypick-robot · 2025-02-25T13:20:06Z

@swghosh: once the present PR merges, I will cherry-pick it on top of cert-manager-1.15 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick cert-manager-1.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2025-02-25T14:50:01Z

@PillaiManish: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-cherrypick-robot · 2025-02-25T14:55:16Z

@swghosh: #226 failed to apply on top of branch "cert-manager-1.15":

Applying: adds e2e test case for istio-csr:#423
Using index info to reconstruct a base tree...
M	test/e2e/cert_manager_deployment_test.go
M	test/e2e/certificates_test.go
M	test/e2e/utils_test.go
M	test/library/utils.go
Falling back to patching base and 3-way merge...
Auto-merging test/library/utils.go
CONFLICT (content): Merge conflict in test/library/utils.go
Auto-merging test/e2e/utils_test.go
Auto-merging test/e2e/certificates_test.go
CONFLICT (content): Merge conflict in test/e2e/certificates_test.go
Auto-merging test/e2e/cert_manager_deployment_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 adds e2e test case for istio-csr:#423

Details

In response to this:

/cherry-pick cert-manager-1.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 26, 2024

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 26, 2024

PillaiManish closed this Jan 6, 2025

PillaiManish force-pushed the master branch from 632252b to a6b6450 Compare January 6, 2025 08:56

PillaiManish reopened this Jan 6, 2025

PillaiManish marked this pull request as ready for review January 6, 2025 12:41

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 6, 2025

openshift-ci bot requested review from TrilokGeer and swghosh January 6, 2025 12:42

TrilokGeer reviewed Jan 7, 2025

View reviewed changes

test/e2e/istio_csr_test.go Outdated Show resolved Hide resolved

test/e2e/istio_csr_test.go Outdated Show resolved Hide resolved

swghosh suggested changes Jan 7, 2025

View reviewed changes

test/library/utils.go Outdated Show resolved Hide resolved

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 11, 2025

PillaiManish force-pushed the master branch from 0a238ff to 341738b Compare January 13, 2025 08:43

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 13, 2025

swghosh suggested changes Jan 13, 2025

View reviewed changes

swghosh reviewed Jan 15, 2025

View reviewed changes

test/e2e/istio-csr_test.go Outdated Show resolved Hide resolved

test/e2e/istio-csr_test.go Outdated Show resolved Hide resolved

bharath-b-rh reviewed Jan 17, 2025

View reviewed changes

test/e2e/istio-csr_test.go Outdated Show resolved Hide resolved

bharath-b-rh reviewed Jan 17, 2025

View reviewed changes

test/e2e/istio-csr_test.go Outdated Show resolved Hide resolved

bharath-b-rh reviewed Jan 17, 2025

View reviewed changes

test/e2e/istio-csr_test.go Outdated Show resolved Hide resolved

PillaiManish force-pushed the master branch from a712e39 to b4d920f Compare February 14, 2025 11:15

swghosh reviewed Feb 14, 2025

View reviewed changes

test/e2e/utils_test.go Outdated Show resolved Hide resolved

PillaiManish force-pushed the master branch from b4d920f to c6001e7 Compare February 17, 2025 09:57

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 17, 2025

PillaiManish force-pushed the master branch from c6001e7 to 1a7857e Compare February 17, 2025 11:10

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 17, 2025

swghosh reviewed Feb 20, 2025

View reviewed changes

PillaiManish force-pushed the master branch from 1a7857e to 11e5ad9 Compare February 25, 2025 05:42

swghosh approved these changes Feb 25, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 25, 2025

PillaiManish force-pushed the master branch from 11e5ad9 to 43a7a06 Compare February 25, 2025 06:40

openshift-ci bot changed the title ~~CM-423: added test case for istio-csr~~ CM-423: Adds e2e test for istio-csr controller with grpc CreateCertificate call Feb 25, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 25, 2025

lunarwhite reviewed Feb 25, 2025

View reviewed changes

test/e2e/istio_csr_test.go Outdated Show resolved Hide resolved

test/e2e/istio_csr_test.go Outdated Show resolved Hide resolved

test/e2e/istio_csr_test.go Show resolved Hide resolved

adds e2e test case for istio-csr:#423

efa7e23

- applys IstioCSR resource - deploys grpcurl job - which calls the grpc endpoint of istio-csr - checks the response and validates the certificate

PillaiManish force-pushed the master branch from 43a7a06 to efa7e23 Compare February 25, 2025 09:42

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 25, 2025

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Feb 25, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 25, 2025

openshift-merge-bot bot merged commit 91e24b4 into openshift:master Feb 25, 2025
9 checks passed

PillaiManish mentioned this pull request Mar 4, 2025

[cert-manager-1.15] CM-423: Adds e2e test for istio-csr controller with grpc CreateCertificate call #250

Merged

Conversation

PillaiManish commented Dec 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Dec 26, 2024 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Dec 26, 2024

Uh oh!

swghosh commented Dec 27, 2024

Uh oh!

PillaiManish commented Jan 6, 2025

Uh oh!

openshift-ci bot commented Jan 6, 2025

Uh oh!

openshift-ci-robot commented Jan 6, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bharath-b-rh commented Jan 7, 2025

Uh oh!

Uh oh!

Uh oh!

swghosh left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

swghosh left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

swghosh commented Jan 13, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bharath-b-rh commented Jan 17, 2025

Uh oh!

PillaiManish commented Jan 21, 2025

Uh oh!

PillaiManish commented Jan 24, 2025

Uh oh!

Uh oh!

Uh oh!

swghosh Feb 20, 2025

Choose a reason for hiding this comment

Uh oh!

PillaiManish Feb 25, 2025

Choose a reason for hiding this comment

Uh oh!

swghosh Feb 25, 2025

Choose a reason for hiding this comment

Uh oh!

swghosh Feb 25, 2025

Choose a reason for hiding this comment

Uh oh!

swghosh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

swghosh commented Feb 25, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bharath-b-rh commented Feb 25, 2025

PillaiManish commented Dec 26, 2024 •

edited

Loading

openshift-ci-robot commented Dec 26, 2024 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Jan 6, 2025 •

edited by openshift-ci bot

Loading

swghosh left a comment •

edited

Loading

swghosh left a comment •

edited

Loading

swghosh commented Feb 25, 2025 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Feb 25, 2025 •

edited by openshift-ci bot

Loading