Skip to content

Commit c467de4

Browse files
author
Vladislav Supalov
committed
test: add green ldap + opa integration test
Squashed commit of the following: commit 5ba0132 Author: Razvan-Daniel Mihai <[email protected]> Date: Fri Nov 18 17:33:47 2022 +0100 Updates and cleanups. commit 2e7cd7a Author: Razvan-Daniel Mihai <[email protected]> Date: Fri Nov 18 16:58:10 2022 +0100 Remove OPA and update autocheck.py. commit 5f3aa96 Author: Razvan-Daniel Mihai <[email protected]> Date: Fri Nov 18 14:33:06 2022 +0100 Add leftover from previous comit and experiment with autocheck.py commit 71b9c43 Author: Razvan-Daniel Mihai <[email protected]> Date: Fri Nov 18 11:59:11 2022 +0100 Install openldap in the kuttl test namespace. commit 5e0e594 Author: Razvan-Daniel Mihai <[email protected]> Date: Thu Nov 17 17:47:39 2022 +0100 Almost working kuttl test (missing ldap users).
1 parent d50eeb4 commit c467de4

20 files changed

+783
-42
lines changed

‎05-install-druid.yaml

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
---
2+
apiVersion: druid.stackable.tech/v1alpha1
3+
kind: DruidCluster
4+
metadata:
5+
name: derby-druid
6+
spec:
7+
version: 24.0.0-stackable0.2.0
8+
clusterConfig:
9+
authorization:
10+
opa:
11+
configMapName: test-opa
12+
package: druid
13+
deepStorage:
14+
hdfs:
15+
configMapName: druid-hdfs
16+
directory: /druid
17+
metadataStorageDatabase:
18+
dbType: derby
19+
connString: jdbc:derby://localhost:1527/var/druid/metadata.db;create=true
20+
host: localhost
21+
port: 1527
22+
tls: null
23+
zookeeperConfigMapName: druid-znode
24+
brokers:
25+
configOverrides:
26+
runtime.properties:
27+
druid.auth.authenticatorChain: "[\"ldap\"]"
28+
druid.auth.authenticator.ldap.type: basic
29+
druid.auth.authenticator.ldap.enableCacheNotifications: 'true'
30+
druid.auth.authenticator.ldap.credentialsValidator.type: ldap
31+
druid.auth.authenticator.ldap.credentialsValidator.url: ldap://openldap:1389
32+
druid.auth.authenticator.ldap.credentialsValidator.bindUser: uid=admin,ou=Users,dc=example,dc=org
33+
druid.auth.authenticator.ldap.credentialsValidator.bindPassword: admin
34+
druid.auth.authenticator.ldap.initialAdminPassword: admin
35+
druid.auth.authenticator.ldap.initialInternalClientPassword: druidsystem
36+
druid.auth.authenticator.ldap.credentialsValidator.baseDn: ou=Users,dc=example,dc=org
37+
druid.auth.authenticator.ldap.credentialsValidator.userSearch: (&(uid=%s)(objectClass=inetOrgPerson))
38+
druid.auth.authenticator.ldap.credentialsValidator.userAttribute: uid
39+
druid.auth.authenticator.ldap.authorizeQueryContextParams: 'true'
40+
# use the opa authorizer instead of ldap groups
41+
#druid.auth.authenticator.ldap.authorizerName: OpaAuthorizer
42+
43+
# Escalator
44+
druid.escalator.type: basic
45+
druid.escalator.internalClientUsername: druid_system
46+
druid.escalator.internalClientPassword: druidsystem
47+
#druid.escalator.authorizerName: OpaAuthorizer
48+
roleGroups:
49+
default:
50+
replicas: 1
51+
coordinators:
52+
configOverrides:
53+
runtime.properties:
54+
druid.auth.authenticatorChain: "[\"ldap\"]"
55+
druid.auth.authenticator.ldap.type: basic
56+
druid.auth.authenticator.ldap.enableCacheNotifications: 'true'
57+
druid.auth.authenticator.ldap.credentialsValidator.type: ldap
58+
druid.auth.authenticator.ldap.credentialsValidator.url: ldap://openldap:1389
59+
druid.auth.authenticator.ldap.credentialsValidator.bindUser: uid=admin,ou=Users,dc=example,dc=org
60+
druid.auth.authenticator.ldap.credentialsValidator.bindPassword: admin
61+
druid.auth.authenticator.ldap.initialAdminPassword: admin
62+
druid.auth.authenticator.ldap.initialInternalClientPassword: druidsystem
63+
druid.auth.authenticator.ldap.credentialsValidator.baseDn: ou=Users,dc=example,dc=org
64+
druid.auth.authenticator.ldap.credentialsValidator.userSearch: (&(uid=%s)(objectClass=inetOrgPerson))
65+
druid.auth.authenticator.ldap.credentialsValidator.userAttribute: uid
66+
druid.auth.authenticator.ldap.authorizeQueryContextParams: 'true'
67+
# use the opa authorizer instead of ldap groups
68+
#druid.auth.authenticator.ldap.authorizerName: OpaAuthorizer
69+
70+
# Escalator
71+
druid.escalator.type: basic
72+
druid.escalator.internalClientUsername: druid_system
73+
druid.escalator.internalClientPassword: druidsystem
74+
druid.escalator.authorizerName: OpaAuthorizer
75+
roleGroups:
76+
default:
77+
replicas: 1
78+
historicals:
79+
configOverrides:
80+
runtime.properties:
81+
druid.auth.authenticatorChain: "[\"ldap\"]"
82+
druid.auth.authenticator.ldap.type: basic
83+
druid.auth.authenticator.ldap.enableCacheNotifications: 'true'
84+
druid.auth.authenticator.ldap.credentialsValidator.type: ldap
85+
druid.auth.authenticator.ldap.credentialsValidator.url: ldap://openldap:1389
86+
druid.auth.authenticator.ldap.credentialsValidator.bindUser: uid=admin,ou=Users,dc=example,dc=org
87+
druid.auth.authenticator.ldap.credentialsValidator.bindPassword: admin
88+
druid.auth.authenticator.ldap.initialAdminPassword: admin
89+
druid.auth.authenticator.ldap.initialInternalClientPassword: druidsystem
90+
druid.auth.authenticator.ldap.credentialsValidator.baseDn: ou=Users,dc=example,dc=org
91+
druid.auth.authenticator.ldap.credentialsValidator.userSearch: (&(uid=%s)(objectClass=inetOrgPerson))
92+
druid.auth.authenticator.ldap.credentialsValidator.userAttribute: uid
93+
druid.auth.authenticator.ldap.authorizeQueryContextParams: 'true'
94+
# use the opa authorizer instead of ldap groups
95+
#druid.auth.authenticator.ldap.authorizerName: OpaAuthorizer
96+
97+
# Escalator
98+
druid.escalator.type: basic
99+
druid.escalator.internalClientUsername: druid_system
100+
druid.escalator.internalClientPassword: druidsystem
101+
druid.escalator.authorizerName: OpaAuthorizer
102+
roleGroups:
103+
default:
104+
replicas: 1
105+
middleManagers:
106+
configOverrides:
107+
runtime.properties:
108+
druid.auth.authenticatorChain: "[\"ldap\"]"
109+
druid.auth.authenticator.ldap.type: basic
110+
druid.auth.authenticator.ldap.enableCacheNotifications: 'true'
111+
druid.auth.authenticator.ldap.credentialsValidator.type: ldap
112+
druid.auth.authenticator.ldap.credentialsValidator.url: ldap://openldap:1389
113+
druid.auth.authenticator.ldap.credentialsValidator.bindUser: uid=admin,ou=Users,dc=example,dc=org
114+
druid.auth.authenticator.ldap.credentialsValidator.bindPassword: admin
115+
druid.auth.authenticator.ldap.initialAdminPassword: admin
116+
druid.auth.authenticator.ldap.initialInternalClientPassword: druidsystem
117+
druid.auth.authenticator.ldap.credentialsValidator.baseDn: ou=Users,dc=example,dc=org
118+
druid.auth.authenticator.ldap.credentialsValidator.userSearch: (&(uid=%s)(objectClass=inetOrgPerson))
119+
druid.auth.authenticator.ldap.credentialsValidator.userAttribute: uid
120+
druid.auth.authenticator.ldap.authorizeQueryContextParams: 'true'
121+
# use the opa authorizer instead of ldap groups
122+
#druid.auth.authenticator.ldap.authorizerName: OpaAuthorizer
123+
124+
# Escalator
125+
druid.escalator.type: basic
126+
druid.escalator.internalClientUsername: druid_system
127+
druid.escalator.internalClientPassword: druidsystem
128+
#druid.escalator.authorizerName: OpaAuthorizer
129+
roleGroups:
130+
default:
131+
replicas: 1
132+
routers:
133+
configOverrides:
134+
runtime.properties:
135+
druid.auth.authenticatorChain: "[\"ldap\"]"
136+
druid.auth.authenticator.ldap.type: basic
137+
druid.auth.authenticator.ldap.enableCacheNotifications: 'true'
138+
druid.auth.authenticator.ldap.credentialsValidator.type: ldap
139+
druid.auth.authenticator.ldap.credentialsValidator.url: ldap://openldap:1389
140+
druid.auth.authenticator.ldap.credentialsValidator.bindUser: uid=admin,ou=Users,dc=example,dc=org
141+
druid.auth.authenticator.ldap.credentialsValidator.bindPassword: admin
142+
druid.auth.authenticator.ldap.initialAdminPassword: admin
143+
druid.auth.authenticator.ldap.initialInternalClientPassword: druidsystem
144+
druid.auth.authenticator.ldap.credentialsValidator.baseDn: ou=Users,dc=example,dc=org
145+
druid.auth.authenticator.ldap.credentialsValidator.userSearch: (&(uid=%s)(objectClass=inetOrgPerson))
146+
druid.auth.authenticator.ldap.credentialsValidator.userAttribute: uid
147+
druid.auth.authenticator.ldap.authorizeQueryContextParams: 'true'
148+
# use the opa authorizer instead of ldap groups
149+
#druid.auth.authenticator.ldap.authorizerName: OpaAuthorizer
150+
151+
# Escalator
152+
druid.escalator.type: basic
153+
druid.escalator.internalClientUsername: druid_system
154+
druid.escalator.internalClientPassword: druidsystem
155+
#druid.escalator.authorizerName: OpaAuthorizer
156+
roleGroups:
157+
default:
158+
replicas: 1

‎tests/templates/kuttl/ldap-authentication/00-assert.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 300
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: druid-zk-server-default
10+
status:
11+
readyReplicas: 1
12+
replicas: 1
13+
---
14+
apiVersion: v1
15+
kind: ConfigMap
16+
metadata:
17+
name: hdfs-znode

‎tests/templates/kuttl/ldap-authentication/00-install-zk.yaml.j2

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: zookeeper.stackable.tech/v1alpha1
3+
kind: ZookeeperCluster
4+
metadata:
5+
name: druid-zk
6+
spec:
7+
version: {{ test_scenario['values']['zookeeper-latest'] }}
8+
servers:
9+
roleGroups:
10+
default:
11+
replicas: 1
12+
---
13+
apiVersion: zookeeper.stackable.tech/v1alpha1
14+
kind: ZookeeperZnode
15+
metadata:
16+
name: druid-znode
17+
spec:
18+
clusterRef:
19+
name: druid-zk
20+
---
21+
apiVersion: zookeeper.stackable.tech/v1alpha1
22+
kind: ZookeeperZnode
23+
metadata:
24+
name: hdfs-znode
25+
spec:
26+
clusterRef:
27+
name: druid-zk

‎tests/templates/kuttl/ldap-authentication/02-assert.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: druid-hdfs-namenode-default
10+
status:
11+
readyReplicas: 2
12+
replicas: 2
13+
---
14+
apiVersion: apps/v1
15+
kind: StatefulSet
16+
metadata:
17+
name: druid-hdfs-journalnode-default
18+
status:
19+
readyReplicas: 1
20+
replicas: 1
21+
---
22+
apiVersion: apps/v1
23+
kind: StatefulSet
24+
metadata:
25+
name: druid-hdfs-datanode-default
26+
status:
27+
readyReplicas: 1
28+
replicas: 1

‎tests/templates/kuttl/ldap-authentication/02-install-hdfs.yaml.j2

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
metadata:
5+
name: druid-hdfs
6+
timeout: 600
7+
---
8+
apiVersion: hdfs.stackable.tech/v1alpha1
9+
kind: HdfsCluster
10+
metadata:
11+
name: druid-hdfs
12+
spec:
13+
version: {{ test_scenario['values']['hadoop'] }}
14+
zookeeperConfigMapName: hdfs-znode
15+
dfsReplication: 1
16+
nameNodes:
17+
roleGroups:
18+
default:
19+
replicas: 2
20+
dataNodes:
21+
roleGroups:
22+
default:
23+
replicas: 1
24+
journalNodes:
25+
roleGroups:
26+
default:
27+
replicas: 1

‎tests/templates/kuttl/ldap-authentication/03-assert-openldap.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 300
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: openldap
10+
status:
11+
readyReplicas: 1
12+
replicas: 1

‎tests/templates/kuttl/ldap-authentication/03-install-openldap.yaml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: StatefulSet
4+
metadata:
5+
name: openldap
6+
labels:
7+
app.kubernetes.io/name: openldap
8+
spec:
9+
selector:
10+
matchLabels:
11+
app.kubernetes.io/name: openldap
12+
serviceName: openldap
13+
replicas: 1
14+
template:
15+
metadata:
16+
labels:
17+
app.kubernetes.io/name: openldap
18+
spec:
19+
containers:
20+
- name: openldap
21+
image: docker.io/bitnami/openldap:2.5
22+
env:
23+
- name: LDAP_ADMIN_USERNAME
24+
value: admin
25+
- name: LDAP_ADMIN_PASSWORD
26+
value: admin
27+
- name: LDAP_ENABLE_TLS
28+
value: "yes"
29+
- name: LDAP_TLS_CERT_FILE
30+
value: /tls/tls.crt
31+
- name: LDAP_TLS_KEY_FILE
32+
value: /tls/tls.key
33+
- name: LDAP_TLS_CA_FILE
34+
value: /tls/ca.crt
35+
ports:
36+
- name: ldap
37+
containerPort: 1389
38+
- name: tls-ldap
39+
containerPort: 1636
40+
volumeMounts:
41+
- name: tls
42+
mountPath: /tls
43+
startupProbe:
44+
tcpSocket:
45+
port: 1389
46+
readinessProbe:
47+
tcpSocket:
48+
port: 1389
49+
volumes:
50+
- name: tls
51+
csi:
52+
driver: secrets.stackable.tech
53+
volumeAttributes:
54+
secrets.stackable.tech/class: openldap-tls
55+
secrets.stackable.tech/scope: pod
56+
---
57+
apiVersion: v1
58+
kind: Service
59+
metadata:
60+
name: openldap
61+
labels:
62+
app.kubernetes.io/name: openldap
63+
spec:
64+
type: ClusterIP
65+
ports:
66+
- name: ldap
67+
port: 1389
68+
targetPort: ldap
69+
- name: tls-ldap
70+
port: 1636
71+
targetPort: tls-ldap
72+
selector:
73+
app.kubernetes.io/name: openldap

‎tests/templates/kuttl/ldap-authentication/03-openldap-secret-class.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
metadata:
5+
name: openldap
6+
commands:
7+
# SecretClass requires an explicit namespace to work
8+
- script: |
9+
kubectl apply -n $NAMESPACE -f - <<EOF
10+
---
11+
apiVersion: secrets.stackable.tech/v1alpha1
12+
kind: SecretClass
13+
metadata:
14+
name: openldap-tls
15+
spec:
16+
backend:
17+
autoTls:
18+
ca:
19+
autoGenerate: true
20+
secret:
21+
name: openldap-tls-ca
22+
namespace: $NAMESPACE
23+
EOF

‎tests/templates/kuttl/ldap-authentication/04-assert-ldap-user.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
commands:
5+
- script: kubectl exec -n $NAMESPACE openldap-0 -- ldapsearch -H ldap://localhost:1389 -D uid=admin,ou=Users,dc=example,dc=org -w admin -b ou=Users,dc=example,dc=org > /dev/null
6+
- script: kubectl exec -n $NAMESPACE openldap-0 -- bash -c LDAPTLS_CACERT=/tls/ca.crt ldapsearch -Z -H ldaps://localhost:1636 -D uid=admin,ou=Users,dc=example,dc=org -w admin -b ou=Users,dc=example,dc=org > /dev/null

‎tests/templates/kuttl/ldap-authentication/04-ldap-user.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
metadata:
5+
name: create-ldap-user
6+
commands:
7+
- script: kubectl cp -n $NAMESPACE ./create_ldap_user.sh openldap-0:/tmp
8+
- script: kubectl exec -n $NAMESPACE openldap-0 -- sh /tmp/create_ldap_user.sh

0 commit comments

Comments
 (0)