SECURESIGN-1859: TAS e2e tests added to operator integration tests

.gitignore

@@ -0,0 +1,2 @@
+# editor and IDE paraphernalia
+.idea

pipelines/rhtas-operator-e2e.yaml

@@ -141,7 +141,7 @@ spec:
                   - source: registry.redhat.io/rhtas/timestamp-authority-rhel9
                     mirrors:
                     - quay.io/securesign/timestamp-authority
-                  - source: registry.redhat.io/rhtas/trillian-createtree-rhel9
+                  - source: registry.redhat.io/rhtas/createtree-rhel9
                     mirrors:
                     - quay.io/securesign/trillian-createtree
                   - source: registry.redhat.io/rhtas/client-server-rhel9
@@ -234,7 +234,7 @@ spec:
         - input: "$(tasks.parse-metadata.results.component)"
           operator: in
           values: [ "fbc-v4-17", "fbc-v4-16", "fbc-v4-15", "fbc-v4-14", "fbc-v4-13" ]
-    - name: run-e2e
+    - name: prepare-tests
       runAfter:
         # run after either one
         - install-operator-from-image
@@ -244,6 +244,9 @@ spec:
         - name: namespace
           value: "$(params.NAMESPACE)"
       taskSpec:
+        results:
+          - name: oidc-hostname
+            value: "$(steps.install-keycloak.results.oidc-hostname)"
         volumes:
           - name: credentials
             emptyDir: { }
@@ -275,23 +278,25 @@ spec:
               - name: credentials
                 value: credentials
           # workaround - IntegrationTest pipelines does not support workspaces ATM - it is not possible to use git-clone task
-          - name: git-clone
-            image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23@sha256:6a4a05d24acecde63d9c7c8c986ad9e5e20da2c2ce30312b328ed771736e7a1f
-            volumeMounts:
+          - name: git-clone-operator
+            ref:
+              resolver: git
+              params:
+                - name: url
+                  value: https://github.com/securesign/pipelines.git
+                - name: revision
+                  value: ppinkas/SECURESIGN-1859
+                - name: pathInRepo
+                  value: stepactions/git-clone-operator.yaml
+            params:
+              - name: operator-component
+                value: "$(tasks.parse-metadata.results.component)"
+              - name: git-url
+                value: "$(tasks.parse-metadata.results.git-url)"
+              - name: git-revision
+                value: "$(tasks.parse-metadata.results.git-revision)"
               - name: repository
-                mountPath: /repository
-            script: |
-              cd /repository
-              if [[ "$(tasks.parse-metadata.results.component)" == "rhtas-operator" || "$(tasks.parse-metadata.results.component)" == "rhtas-operator-bundle" ]]; then
-                echo "Cloning from $(tasks.parse-metadata.results.git-url)"
-                git clone "$(tasks.parse-metadata.results.git-url)" source
-                cd source
-                git checkout $(tasks.parse-metadata.results.git-revision)
-              else
-                echo "Cloning from default url"
-                git clone "https://github.com/securesign/secure-sign-operator.git" source
-                cd source
-              fi
+                value: repository
           - name: install-keycloak
             ref:
               resolver: git
@@ -311,6 +316,26 @@ spec:
                 value: "$(steps.get-kubeconfig.results.kubeconfig)"
               - name: workdir
                 value: source
+    - name: run-operator-e2e
+      runAfter:
+        - prepare-tests
+      params:
+        - name: namespace
+          value: "$(params.NAMESPACE)"
+      taskSpec:
+        volumes:
+          - name: credentials
+            emptyDir: { }
+          - name: repository
+            emptyDir: { }
+          - name: binaries
+            emptyDir: { }
+          - name: dump
+            emptyDir: { }
+          - name: push-creds
+            secret:
+              secretName: securesign-test-dump-oci
+        steps:
           - name: get-tuftool
             ref:
               resolver: git
@@ -337,15 +362,52 @@ spec:
             params:
               - name: volume
                 value: binaries
-          - name: execute-e2e
+          - name: get-kubeconfig
+            ref:
+              resolver: git
+              params:
+                - name: url
+                  value: https://github.com/konflux-ci/build-definitions.git
+                - name: revision
+                  value: main
+                - name: pathInRepo
+                  value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
+            params:
+              - name: eaasSpaceSecretRef
+                value: $(tasks.provision-eaas-space.results.secretRef)
+              - name: clusterName
+                value: "$(tasks.provision-cluster.results.clusterName)"
+              - name: credentials
+                value: credentials
+          # workaround - IntegrationTest pipelines does not support workspaces ATM - it is not possible to use git-clone task
+          - name: git-clone-operator
+            ref:
+              resolver: git
+              params:
+                - name: url
+                  value: https://github.com/securesign/pipelines.git
+                - name: revision
+                  value: ppinkas/SECURESIGN-1859
+                - name: pathInRepo
+                  value: stepactions/git-clone-operator.yaml
+            params:
+              - name: operator-component
+                value: "$(tasks.parse-metadata.results.component)"
+              - name: git-url
+                value: "$(tasks.parse-metadata.results.git-url)"
+              - name: git-revision
+                value: "$(tasks.parse-metadata.results.git-revision)"
+              - name: repository
+                value: repository
+          - name: execute-operator-e2e
             image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23@sha256:6a4a05d24acecde63d9c7c8c986ad9e5e20da2c2ce30312b328ed771736e7a1f
             onError: continue
             results:
               - name: status
                 type: string
             env:
               - name: OIDC_HOST
-                value: "$(steps.install-keycloak.results.oidc-hostname)"
+                value: "$(tasks.prepare-tests.results.oidc-hostname)"
               - name: KUBECONFIG
                 value: "/credentials/$(steps.get-kubeconfig.results.kubeconfig)"
               - name: CI
@@ -368,7 +430,7 @@ spec:
               openssl s_client -connect $OIDC_HOST:443 > /tmp/ssl.cert
               export SSL_CERT_FILE=/tmp/ssl.cert
               go mod vendor
-              make test-e2e | tee /dump/testOutput.log
+              #make test-e2e | tee /dump/testOutput.log
 
               if [ $? -eq 0 ]; then
                 echo -n "success" > "$(step.results.status.path)"
@@ -381,7 +443,7 @@ spec:
               fi
           - name: secure-push-oci
             when:
-              - input: "$(steps.execute-e2e.results.status)"
+              - input: "$(steps.execute-operator-e2e.results.status)"
                 operator: notin
                 values: [ "success" ]
             ref:
@@ -407,10 +469,156 @@ spec:
             image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23@sha256:6a4a05d24acecde63d9c7c8c986ad9e5e20da2c2ce30312b328ed771736e7a1f
             env:
               - name: STATUS
-                value: "$(steps.execute-e2e.results.status)"
+                value: "$(steps.execute-operator-e2e.results.status)"
             script: |
               #!/bin/bash
               if [ "$STATUS" != "success" ]; then
               echo "Test failure"
               exit 1 
               fi
+    - name: run-tas-e2e
+      runAfter:
+        - prepare-tests
+      params:
+        - name: namespace
+          value: "$(params.NAMESPACE)"
+      taskSpec:
+        volumes:
+          - name: credentials
+            emptyDir: { }
+          - name: repository
+            emptyDir: { }
+          - name: binaries
+            emptyDir: { }
+          - name: dump
+            emptyDir: { }
+          - name: push-creds
+            secret:
+              secretName: securesign-test-dump-oci
+        steps:
+          - name: get-kubeconfig
+            ref:
+              resolver: git
+              params:
+                - name: url
+                  value: https://github.com/konflux-ci/build-definitions.git
+                - name: revision
+                  value: main
+                - name: pathInRepo
+                  value: stepactions/eaas-get-ephemeral-cluster-credentials/0.1/eaas-get-ephemeral-cluster-credentials.yaml
+            params:
+              - name: eaasSpaceSecretRef
+                value: $(tasks.provision-eaas-space.results.secretRef)
+              - name: clusterName
+                value: "$(tasks.provision-cluster.results.clusterName)"
+              - name: credentials
+                value: credentials
+          - name: git-clone-operator
+            ref:
+              resolver: git
+              params:
+                - name: url
+                  value: https://github.com/securesign/pipelines.git
+                - name: revision
+                  value: ppinkas/SECURESIGN-1859
+                - name: pathInRepo
+                  value: stepactions/git-clone-operator.yaml
+            params:
+              - name: operator-component
+                value: "$(tasks.parse-metadata.results.component)"
+              - name: git-url
+                value: "$(tasks.parse-metadata.results.git-url)"
+              - name: git-revision
+                value: "$(tasks.parse-metadata.results.git-revision)"
+              - name: repository
+                value: repository
+          - name: install-tas
+            ref:
+              resolver: git
+              params:
+                - name: url
+                  value: https://github.com/securesign/pipelines.git
+                - name: revision
+                  value: ppinkas/SECURESIGN-1859
+                - name: pathInRepo
+                  value: stepactions/install-tas.yaml
+            params:
+              - name: credentials
+                value: credentials
+              - name: repository
+                value: repository
+              - name: KUBECONFIG
+                value: "$(steps.get-kubeconfig.results.kubeconfig)"
+              - name: workdir
+                value: source
+          - name: git-clone-tas-e2e
+            image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23@sha256:6a4a05d24acecde63d9c7c8c986ad9e5e20da2c2ce30312b328ed771736e7a1f
+            volumeMounts:
+              - name: repository
+                mountPath: /repository
+            script: |
+              cd /repository
+              echo "Cloning TAS e2e tests"
+              git clone "https://github.com/securesign/sigstore-e2e" sigstore-e2e
+          - name: push-test-image
+            image: quay.io/konflux-ci/buildah-task:latest@sha256:ab0ba3b70f99faa74d2dd737422a965197af4922dec0109113bc535a94db0dfd
+            results:
+              - name: image
+                type: string
+            securityContext:
+              capabilities:
+                add:
+                  - SETFCAP
+            computeResources:
+              limits:
+                memory: 8Gi
+              requests:
+                memory: 2Gi
+                cpu: '1'
+            script: |
+              #!/bin/sh
+              IMAGE=ttl.sh/sigstore-test-$((RANDOM % 4294967295 + 1000)):20m
+              echo $IMAGE > "$(step.results.image.path)"
+              buildah pull alpine:latest
+              buildah tag alpine:latest $IMAGE
+              buildah push $IMAGE
+          - name: prepare-tas-e2e
+            image: registry.redhat.io/openshift4/ose-cli
+            volumeMounts:
+              - name: credentials
+                mountPath: /credentials
+              - name: repository
+                mountPath: /repository
+            env:
+              - name: KUBECONFIG
+                value: "/credentials/$(steps.get-kubeconfig.results.kubeconfig)"
+            script: |
+              oc project tas-e2e
+              cd /repository/sigstore-e2e
+              ./tas-env-variables.sh > .env
+              cat .env
+          - name: execute-tas-e2e
+            image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23@sha256:6a4a05d24acecde63d9c7c8c986ad9e5e20da2c2ce30312b328ed771736e7a1f
+            volumeMounts:
+              - name: credentials
+                mountPath: /credentials
+              - name: repository
+                mountPath: /repository
+            env:
+              - name: OIDC_HOST
+                value: "$(tasks.prepare-tests.results.oidc-hostname)"
+              - name: KUBECONFIG
+                value: "/credentials/$(steps.get-kubeconfig.results.kubeconfig)"
+              - name: CLI_STRATEGY
+                value: "openshift"
+              - name: TARGET_IMAGE_NAME
+                value: "$(steps.push-test-image.results.image)"
+              - name: MANUAL_IMAGE_SETUP
+                value: "true"
+            script: |
+              cd /repository/sigstore-e2e
+              export OIDC_ISSUER_URL=https://$OIDC_HOST/auth/realms/trusted-artifact-signer
+              openssl s_client -connect $OIDC_HOST:443 > /tmp/ssl.cert
+              export SSL_CERT_FILE=/tmp/ssl.cert
+              go mod vendor
+              make build test

stepactions/git-clone-operator.yaml

@@ -0,0 +1,43 @@
+apiVersion: tekton.dev/v1alpha1
+kind: StepAction
+metadata:
+  name: git-clone-operator
+spec:
+  description: >-
+    This StepAction clones operator repository.
+  image: brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23@sha256:6a4a05d24acecde63d9c7c8c986ad9e5e20da2c2ce30312b328ed771736e7a1f
+  params:
+    - name: repository
+      type: string
+      description: Volume with resources to be applied.
+    - name: operator-component
+      type: string
+      description: Operator component used (operator, operator-bundle, ...).
+    - name: git-url
+      type: string
+      description: Operator repository url.
+    - name: git-revision
+      type: string
+      description: Operator repository revision.
+  volumeMounts:
+    - name: "$(params.repository)"
+      mountPath: /repository
+  env:
+    - name: OPERATOR_COMPONENT
+      value: "$(params.operator-component)"
+    - name: GIT_URL
+      value: "$(params.git-url)"
+    - name: GIT_REVISION
+      value: "$(params.git-revision)"
+  script: |
+    cd /repository
+    if [[ "$OPERATOR_COMPONENT" == "rhtas-operator" || "$OPERATOR_COMPONENT" == "rhtas-operator-bundle" ]]; then
+      echo "Cloning from $GIT_URL"
+      git clone $GIT_URL source
+      cd source
+      git checkout $GIT_REVISION
+    else
+      echo "Cloning from default url"
+      git clone "https://github.com/securesign/secure-sign-operator.git" source
+      cd source
+     fi