Skip to content

Commit a7cf406

Browse files
davidhadasdavidhIBM
davidhadas
authored and
davidhIBM
committed
SecureComms: E2e test SecureComms without KBS
Add support for e2e testing SecureComms without KBS Signed-off-by: David Hadas <[email protected]>
1 parent b9679f0 commit a7cf406

File tree

7 files changed

+123
-41
lines changed

7 files changed

+123
-41
lines changed

‎src/cloud-api-adaptor/libvirt/config_libvirt.sh

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,13 @@ echo "CLUSTER_NAME=\"peer-pods\"" >> libvirt.properties
125125
# switch to the appropriate e2e test and add configs to libvirt.properties as needed
126126
case $TEST_E2E_SECURE_COMMS in
127127

128+
"withoutKbs")
129+
echo "processing withoutKbs"
130+
echo "SECURE_COMMS=\"true\"" >> libvirt.properties
131+
echo "SECURE_COMMS_NO_TRUSTEE=\"true\"" >> libvirt.properties
132+
echo "INITDATA=\"\"" >> libvirt.properties
133+
;;
134+
128135
*)
129136
echo "processing none"
130137
echo "SECURE_COMMS=\"false\"" >> libvirt.properties

‎src/cloud-api-adaptor/libvirt/e2e_matrix_libvirt.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"container_runtime": ["containerd", "crio"],
3-
"secure_comms": ["none"],
3+
"secure_comms": ["none", "withoutKbs"],
44
"os": ["ubuntu"],
55
"provider": ["generic"],
66
"arch": ["amd64"]

‎src/cloud-api-adaptor/test/e2e/assessment_helpers.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,21 @@ func VerifyAlternateImage(ctx context.Context, t *testing.T, client klient.Clien
292292
return nil
293293
}
294294

295+
func VerifySecureCommsActivated(ctx context.Context, t *testing.T, client klient.Client, pod *v1.Pod) error {
296+
nodeName, err := GetNodeNameFromPod(ctx, client, pod)
297+
if err != nil {
298+
return fmt.Errorf("VerifySecureCommsConnected: GetNodeNameFromPod failed with %v", err)
299+
}
300+
301+
expectedSuccessMessage := "Using PP SecureComms"
302+
err = VerifyCaaPodLogContains(ctx, t, client, nodeName, expectedSuccessMessage)
303+
if err != nil {
304+
return fmt.Errorf("VerifySecureCommsConnected: failed: %v", err)
305+
}
306+
t.Logf("PodVM was brought up using SecureComms")
307+
return nil
308+
}
309+
295310
func VerifyCaaPodLogContains(ctx context.Context, t *testing.T, client klient.Client, nodeName, expected string) error {
296311
caaPod, err := getCaaPod(ctx, client, t, nodeName)
297312
if err != nil {

‎src/cloud-api-adaptor/test/e2e/assessment_runner.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@ type ExtraPod struct {
4848
testCommands []TestCommand
4949
}
5050

51+
var testCase_secureComms_isActive bool
52+
5153
type TestCase struct {
5254
testing *testing.T
5355
testEnv env.Environment
@@ -420,6 +422,13 @@ func (tc *TestCase) Run() {
420422
t.Errorf("VerifyAlternateImage failed: %v", err)
421423
}
422424
}
425+
426+
if testCase_secureComms_isActive {
427+
err := VerifySecureCommsActivated(ctx, t, client, tc.pod)
428+
if err != nil {
429+
t.Errorf("VerifySecureCommsActivated failed: %v", err)
430+
}
431+
}
423432
}
424433

425434
if tc.extraPods != nil {

‎src/cloud-api-adaptor/test/e2e/main_test.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,12 @@ func TestMain(m *testing.M) {
123123

124124
// Get properties
125125
props := provisioner.GetProperties(ctx, cfg)
126+
if props["SECURE_COMMS"] == "true" {
127+
testCase_secureComms_isActive = true
128+
log.Info("Do setup secureComms is active")
129+
}
130+
testCase_secureComms_isActive = true
131+
log.Info("Do setup test only secureComms")
126132

127133
// Set CONTAINER_RUNTIME env variable if present in the properties
128134
// Default value is containerd.

‎src/cloud-api-adaptor/test/provisioner/libvirt/provision_common.go

Lines changed: 73 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -23,17 +23,21 @@ const AlternateVolumeName = "another-podvm-base.qcow2"
2323

2424
// LibvirtProvisioner implements the CloudProvisioner interface for Libvirt.
2525
type LibvirtProvisioner struct {
26-
conn *libvirt.Connect // Libvirt connection
27-
containerRuntime string // Name of the container runtime
28-
network string // Network name
29-
ssh_key_file string // SSH key file used to connect to Libvirt
30-
storage string // Storage pool name
31-
uri string // Libvirt URI
32-
wd string // libvirt's directory path on this repository
33-
volumeName string // Podvm volume name
34-
clusterName string // Cluster name
35-
tunnelType string // Tunnel Type
36-
vxlanPort string // VXLAN port number
26+
conn *libvirt.Connect // Libvirt connection
27+
containerRuntime string // Name of the container runtime
28+
network string // Network name
29+
ssh_key_file string // SSH key file used to connect to Libvirt
30+
storage string // Storage pool name
31+
uri string // Libvirt URI
32+
wd string // libvirt's directory path on this repository
33+
volumeName string // Podvm volume name
34+
clusterName string // Cluster name
35+
tunnelType string // Tunnel Type
36+
vxlanPort string // VXLAN port number
37+
secure_comms string // Activate CAA SECURE_COMMS
38+
secure_comms_no_trustee string // Deactivate Trustee mode in SECURE_COMMS
39+
secure_comms_kbs_addr string // KBS URL
40+
initdata string // InitData
3741
}
3842

3943
// LibvirtInstallOverlay implements the InstallOverlay interface
@@ -95,19 +99,43 @@ func NewLibvirtProvisioner(properties map[string]string) (pv.CloudProvisioner, e
9599
vxlanPort = properties["vxlan_port"]
96100
}
97101

102+
secure_comms := "false"
103+
if properties["SECURE_COMMS"] != "" {
104+
secure_comms = properties["SECURE_COMMS"]
105+
}
106+
107+
secure_comms_kbs_addr := ""
108+
if properties["SECURE_COMMS_KBS_ADDR"] != "" {
109+
secure_comms_kbs_addr = properties["SECURE_COMMS_KBS_ADDR"]
110+
}
111+
112+
secure_comms_no_trustee := "false"
113+
if properties["SECURE_COMMS_NO_TRUSTEE"] != "" {
114+
secure_comms_no_trustee = properties["SECURE_COMMS_NO_TRUSTEE"]
115+
}
116+
117+
initdata := ""
118+
if properties["INITDATA"] != "" {
119+
initdata = properties["INITDATA"]
120+
}
121+
98122
// TODO: Check network and storage are not nil?
99123
return &LibvirtProvisioner{
100-
conn: conn,
101-
containerRuntime: properties["container_runtime"],
102-
network: network,
103-
ssh_key_file: ssh_key_file,
104-
storage: storage,
105-
uri: uri,
106-
wd: wd,
107-
volumeName: vol_name,
108-
clusterName: clusterName,
109-
tunnelType: tunnelType,
110-
vxlanPort: vxlanPort,
124+
conn: conn,
125+
containerRuntime: properties["container_runtime"],
126+
network: network,
127+
ssh_key_file: ssh_key_file,
128+
storage: storage,
129+
uri: uri,
130+
wd: wd,
131+
volumeName: vol_name,
132+
clusterName: clusterName,
133+
tunnelType: tunnelType,
134+
vxlanPort: vxlanPort,
135+
secure_comms: secure_comms,
136+
secure_comms_kbs_addr: secure_comms_kbs_addr,
137+
secure_comms_no_trustee: secure_comms_no_trustee,
138+
initdata: initdata,
111139
}, nil
112140
}
113141

@@ -212,14 +240,18 @@ func (l *LibvirtProvisioner) DeleteVPC(ctx context.Context, cfg *envconf.Config)
212240

213241
func (l *LibvirtProvisioner) GetProperties(ctx context.Context, cfg *envconf.Config) map[string]string {
214242
return map[string]string{
215-
"CONTAINER_RUNTIME": l.containerRuntime,
216-
"network": l.network,
217-
"podvm_volume": l.volumeName,
218-
"ssh_key_file": l.ssh_key_file,
219-
"storage": l.storage,
220-
"uri": l.uri,
221-
"tunnel_type": l.tunnelType,
222-
"vxlan_port": l.vxlanPort,
243+
"CONTAINER_RUNTIME": l.containerRuntime,
244+
"network": l.network,
245+
"podvm_volume": l.volumeName,
246+
"ssh_key_file": l.ssh_key_file,
247+
"storage": l.storage,
248+
"uri": l.uri,
249+
"tunnel_type": l.tunnelType,
250+
"vxlan_port": l.vxlanPort,
251+
"SECURE_COMMS": l.secure_comms,
252+
"SECURE_COMMS_KBS_ADDR": l.secure_comms_kbs_addr,
253+
"SECURE_COMMS_NO_TRUSTEE": l.secure_comms_no_trustee,
254+
"INITDATA": l.initdata,
223255
}
224256
}
225257

@@ -326,14 +358,17 @@ func (lio *LibvirtInstallOverlay) Edit(ctx context.Context, cfg *envconf.Config,
326358

327359
// Mapping the internal properties to ConfigMapGenerator properties and their default values.
328360
mapProps := map[string][2]string{
329-
"network": {"default", "LIBVIRT_NET"},
330-
"storage": {"default", "LIBVIRT_POOL"},
331-
"pause_image": {"", "PAUSE_IMAGE"},
332-
"podvm_volume": {"", "LIBVIRT_VOL_NAME"},
333-
"uri": {"qemu+ssh://[email protected]/system?no_verify=1", "LIBVIRT_URI"},
334-
"tunnel_type": {"", "TUNNEL_TYPE"},
335-
"vxlan_port": {"", "VXLAN_PORT"},
336-
"INITDATA": {"", "INITDATA"},
361+
"network": {"default", "LIBVIRT_NET"},
362+
"storage": {"default", "LIBVIRT_POOL"},
363+
"pause_image": {"", "PAUSE_IMAGE"},
364+
"podvm_volume": {"", "LIBVIRT_VOL_NAME"},
365+
"uri": {"qemu+ssh://[email protected]/system?no_verify=1", "LIBVIRT_URI"},
366+
"tunnel_type": {"", "TUNNEL_TYPE"},
367+
"vxlan_port": {"", "VXLAN_PORT"},
368+
"INITDATA": {"", "INITDATA"},
369+
"SECURE_COMMS": {"", "SECURE_COMMS"},
370+
"SECURE_COMMS_NO_TRUSTEE": {"", "SECURE_COMMS_NO_TRUSTEE"},
371+
"SECURE_COMMS_KBS_ADDR": {"", "SECURE_COMMS_KBS_ADDR"},
337372
}
338373

339374
for k, v := range mapProps {

‎src/cloud-api-adaptor/test/provisioner/provision.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"os"
1010
"os/exec"
1111
"path/filepath"
12+
"strings"
1213
"time"
1314

1415
"github.com/BurntSushi/toml"
@@ -220,7 +221,6 @@ func (p *CloudAPIAdaptor) Delete(ctx context.Context, cfg *envconf.Config) error
220221
wait.WithTimeout(time.Minute*1)); err != nil {
221222
return err
222223
}
223-
224224
return nil
225225
}
226226

@@ -295,7 +295,17 @@ func (p *CloudAPIAdaptor) Deploy(ctx context.Context, cfg *envconf.Config, props
295295
}
296296
}
297297

298-
fmt.Printf("Wait for the %s runtimeclass be created\n", p.runtimeClass.GetName())
298+
log.Trace("CAA ConfigMap:\n")
299+
caaConfigMap := exec.Command("kubectl", "get", "cm", "peer-pods-cm", "-n", "confidential-containers-system", "-o", "yaml")
300+
caaConfigMap.Env = append(os.Environ(), fmt.Sprintf("KUBECONFIG="+cfg.KubeconfigFile()))
301+
caaConfigMapOut := new(strings.Builder)
302+
caaConfigMap.Stdout = caaConfigMapOut
303+
if err = caaConfigMap.Run(); err != nil {
304+
return err
305+
}
306+
log.Tracef("%v, CAA ConfigMap: \n%s", caaConfigMap, caaConfigMapOut.String())
307+
308+
log.Infof("Wait for the %s runtimeclass be created\n", p.runtimeClass.GetName())
299309
if err = wait.For(conditions.New(resources).ResourcesFound(&nodev1.RuntimeClassList{Items: []nodev1.RuntimeClass{*p.runtimeClass}}),
300310
wait.WithTimeout(time.Second*60)); err != nil {
301311
return err

0 commit comments

Comments
 (0)