Skip to content

Commit 0959e74

Browse files
JasonPowrJasonPowr
committed
add testing
1 parent 37e930e commit 0959e74

21 files changed

+705
-155
lines changed

‎.github/workflows/main.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ jobs:
199199

200200
- name: Add service hosts to /etc/hosts
201201
run: |
202-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local" | sudo tee -a /etc/hosts
202+
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
203203
- name: Install cosign
204204
run: go install github.com/sigstore/cosign/v2/cmd/cosign@v2.2.2
205205

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,6 @@ go.work
3535

3636
# K8s dump from e2e tests
3737
k8s-dump-*.tar.gz
38+
39+
#tsa certificate chain file
40+
ts_chain.pem

‎api/v1alpha1/securesign_types.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ type SecuresignSpec struct {
2929
Rekor RekorSpec `json:"rekor,omitempty"`
3030
Fulcio FulcioSpec `json:"fulcio,omitempty"`
3131
Trillian TrillianSpec `json:"trillian,omitempty"`
32-
//+kubebuilder:default:={keys:{{name: rekor.pub},{name: ctfe.pub},{name: fulcio_v1.crt.pem}}}
32+
//+kubebuilder:default:={keys:{{name: rekor.pub},{name: ctfe.pub},{name: fulcio_v1.crt.pem},{name: tsa_cert_chain.pem}}}
3333
Tuf TufSpec `json:"tuf,omitempty"`
3434
Ctlog CTlogSpec `json:"ctlog,omitempty"`
3535
TimestampAuthority TimestampAuthoritySpec `json:"tsa,omitempty"`

‎api/v1alpha1/tuf_types.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ type TufSpec struct {
1717
//+kubebuilder:validation:Maximum:=65535
1818
Port int32 `json:"port,omitempty"`
1919
// List of TUF targets which will be added to TUF root
20-
//+kubebuilder:default:={{name: rekor.pub},{name: ctfe.pub},{name: fulcio_v1.crt.pem}}
20+
//+kubebuilder:default:={{name: rekor.pub},{name: ctfe.pub},{name: fulcio_v1.crt.pem},{name: tsa_cert_chain.pem}}
2121
//+kubebuilder:validation:MinItems:=1
2222
Keys []TufKey `json:"keys,omitempty"`
2323
}

‎api/v1alpha1/tuf_types_test.go

+3
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,9 @@ func generateTufObject(name string) *Tuf {
206206
{
207207
Name: "fulcio_v1.crt.pem",
208208
},
209+
{
210+
Name: "tsa_cert_chain.pem",
211+
},
209212
},
210213
},
211214
}

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+26-3
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,7 @@ metadata:
134134
"organizationEmail": "jdoe@redhat.com",
135135
"organizationName": "Red Hat"
136136
}
137-
},
138-
"type": "file"
137+
}
139138
}
140139
},
141140
"tuf": {
@@ -151,6 +150,9 @@ metadata:
151150
},
152151
{
153152
"name": "fulcio_v1.crt.pem"
153+
},
154+
{
155+
"name": "tsa_cert_chain.pem"
154156
}
155157
]
156158
}
@@ -172,6 +174,20 @@ metadata:
172174
"spec": {
173175
"externalAccess": {
174176
"enabled": true
177+
},
178+
"signer": {
179+
"certificateChain": {
180+
"intermediateCA": {
181+
"commonName": "tsa.hostname",
182+
"organizationEmail": "jdoe@redhat.com",
183+
"organizationName": "Red Hat"
184+
},
185+
"rootCA": {
186+
"commonName": "tsa.hostname",
187+
"organizationEmail": "jdoe@redhat.com",
188+
"organizationName": "Red Hat"
189+
}
190+
}
175191
}
176192
}
177193
},
@@ -224,14 +240,21 @@ metadata:
224240
"key": "public",
225241
"name": "ctlog-pub-key"
226242
}
243+
},
244+
{
245+
"name": "tsa_cert_chain.pem",
246+
"secretRef": {
247+
"key": "certificateChain",
248+
"name": "tsa-cert-chain"
249+
}
227250
}
228251
]
229252
}
230253
}
231254
]
232255
capabilities: Seamless Upgrades
233256
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
234-
createdAt: "2024-07-08T09:54:48Z"
257+
createdAt: "2024-07-15T15:46:15Z"
235258
features.operators.openshift.io/cnf: "false"
236259
features.operators.openshift.io/cni: "false"
237260
features.operators.openshift.io/csi: "false"

‎bundle/manifests/rhtas.redhat.com_rekors.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,9 @@ spec:
150150
x-kubernetes-validations:
151151
- message: Feature cannot be disabled
152152
rule: (self || !oldSelf)
153+
host:
154+
description: Set hostname for your Ingress/Route.
155+
type: string
153156
required:
154157
- enabled
155158
type: object

‎bundle/manifests/rhtas.redhat.com_securesigns.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -533,6 +533,9 @@ spec:
533533
x-kubernetes-validations:
534534
- message: Feature cannot be disabled
535535
rule: (self || !oldSelf)
536+
host:
537+
description: Set hostname for your Ingress/Route.
538+
type: string
536539
required:
537540
- enabled
538541
type: object
@@ -1286,6 +1289,7 @@ spec:
12861289
- name: rekor.pub
12871290
- name: ctfe.pub
12881291
- name: fulcio_v1.crt.pem
1292+
- name: tsa_cert_chain.pem
12891293
description: TufSpec defines the desired state of Tuf
12901294
properties:
12911295
externalAccess:
@@ -1311,6 +1315,7 @@ spec:
13111315
- name: rekor.pub
13121316
- name: ctfe.pub
13131317
- name: fulcio_v1.crt.pem
1318+
- name: tsa_cert_chain.pem
13141319
description: List of TUF targets which will be added to TUF root
13151320
items:
13161321
properties:

‎bundle/manifests/rhtas.redhat.com_tufs.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ spec:
7171
- name: rekor.pub
7272
- name: ctfe.pub
7373
- name: fulcio_v1.crt.pem
74+
- name: tsa_cert_chain.pem
7475
description: List of TUF targets which will be added to TUF root
7576
items:
7677
properties:

‎config/crd/bases/rhtas.redhat.com_securesigns.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1289,6 +1289,7 @@ spec:
12891289
- name: rekor.pub
12901290
- name: ctfe.pub
12911291
- name: fulcio_v1.crt.pem
1292+
- name: tsa_cert_chain.pem
12921293
description: TufSpec defines the desired state of Tuf
12931294
properties:
12941295
externalAccess:
@@ -1314,6 +1315,7 @@ spec:
13141315
- name: rekor.pub
13151316
- name: ctfe.pub
13161317
- name: fulcio_v1.crt.pem
1318+
- name: tsa_cert_chain.pem
13171319
description: List of TUF targets which will be added to TUF root
13181320
items:
13191321
properties:

‎config/crd/bases/rhtas.redhat.com_tufs.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ spec:
7171
- name: rekor.pub
7272
- name: ctfe.pub
7373
- name: fulcio_v1.crt.pem
74+
- name: tsa_cert_chain.pem
7475
description: List of TUF targets which will be added to TUF root
7576
items:
7677
properties:

‎internal/controller/securesign/securesign_controller.go

+2
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package securesign
1818

1919
import (
2020
"context"
21+
2122
v12 "k8s.io/api/core/v1"
2223
"k8s.io/apimachinery/pkg/types"
2324

@@ -164,5 +165,6 @@ func (r *SecuresignReconciler) SetupWithManager(mgr ctrl.Manager) error {
164165
Owns(&rhtasv1alpha1.Tuf{}).
165166
Owns(&rhtasv1alpha1.Trillian{}).
166167
Owns(&rhtasv1alpha1.CTlog{}).
168+
Owns(&rhtasv1alpha1.TimestampAuthority{}).
167169
Complete(r)
168170
}

‎internal/controller/tsa/actions/generate_signer.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,9 @@ func (g generateSigner) Handle(ctx context.Context, instance *v1alpha1.Timestamp
7070
Reason: constants.Pending,
7171
Message: "Resolving keys",
7272
})
73-
return g.FailedWithStatusUpdate(ctx, err, instance)
73+
g.StatusUpdate(ctx, instance)
74+
// swallow error and retry
75+
return g.Requeue()
7476
}
7577

7678
secretLabels := map[string]string{

‎test/e2e/byodb_test.go

+27
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,25 @@ var _ = Describe("Securesign install with byodb", Ordered, func() {
8989
Name: "my-db",
9090
},
9191
}},
92+
TimestampAuthority: v1alpha1.TimestampAuthoritySpec{
93+
ExternalAccess: v1alpha1.ExternalAccess{
94+
Enabled: true,
95+
},
96+
Signer: v1alpha1.TimestampAuthoritySigner{
97+
CertificateChain: v1alpha1.CertificateChain{
98+
RootCA: v1alpha1.TsaCertificateAuthority{
99+
OrganizationName: "MyOrg",
100+
OrganizationEmail: "my@email.org",
101+
CommonName: "tsa.hostname",
102+
},
103+
IntermediateCA: v1alpha1.TsaCertificateAuthority{
104+
OrganizationName: "MyOrg",
105+
OrganizationEmail: "my@email.org",
106+
CommonName: "tsa.hostname",
107+
},
108+
},
109+
},
110+
},
92111
},
93112
}
94113
})
@@ -110,6 +129,7 @@ var _ = Describe("Securesign install with byodb", Ordered, func() {
110129
tas.VerifyRekor(ctx, cli, namespace.Name, securesign.Name)
111130
tas.VerifyCTLog(ctx, cli, namespace.Name, securesign.Name)
112131
tas.VerifyTuf(ctx, cli, namespace.Name, securesign.Name)
132+
tas.VerifyTSA(ctx, cli, namespace.Name, securesign.Name)
113133
})
114134

115135
It("No other DB is created", func() {
@@ -128,6 +148,11 @@ var _ = Describe("Securesign install with byodb", Ordered, func() {
128148
tuf := tas.GetTuf(ctx, cli, namespace.Name, securesign.Name)()
129149
Expect(tuf).ToNot(BeNil())
130150

151+
tsa := tas.GetTSA(ctx, cli, namespace.Name, securesign.Name)()
152+
Expect(tsa).ToNot(BeNil())
153+
err := tas.GetTSACertificateChain(ctx, cli, tsa.Namespace, tsa.Name, tsa.Status.Url)
154+
Expect(err).To(BeNil())
155+
131156
oidcToken, err := support.OidcToken(ctx)
132157
Expect(err).ToNot(HaveOccurred())
133158
Expect(oidcToken).ToNot(BeEmpty())
@@ -141,6 +166,7 @@ var _ = Describe("Securesign install with byodb", Ordered, func() {
141166
"cosign", "sign", "-y",
142167
"--fulcio-url="+fulcio.Status.Url,
143168
"--rekor-url="+rekor.Status.Url,
169+
"--timestamp-server-url="+tsa.Status.Url+"/api/v1/timestamp",
144170
"--oidc-issuer="+support.OidcIssuerUrl(),
145171
"--oidc-client-id="+support.OidcClientID(),
146172
"--identity-token="+oidcToken,
@@ -150,6 +176,7 @@ var _ = Describe("Securesign install with byodb", Ordered, func() {
150176
Expect(clients.Execute(
151177
"cosign", "verify",
152178
"--rekor-url="+rekor.Status.Url,
179+
"--timestamp-certificate-chain=ts_chain.pem",
153180
"--certificate-identity-regexp", ".*@redhat",
154181
"--certificate-oidc-issuer-regexp", ".*keycloak.*",
155182
targetImageName,

‎test/e2e/common_install_test.go

+60
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,25 @@ var _ = Describe("Securesign install with certificate generation", Ordered, func
8989
Trillian: v1alpha1.TrillianSpec{Db: v1alpha1.TrillianDB{
9090
Create: utils.Pointer(true),
9191
}},
92+
TimestampAuthority: v1alpha1.TimestampAuthoritySpec{
93+
ExternalAccess: v1alpha1.ExternalAccess{
94+
Enabled: true,
95+
},
96+
Signer: v1alpha1.TimestampAuthoritySigner{
97+
CertificateChain: v1alpha1.CertificateChain{
98+
RootCA: v1alpha1.TsaCertificateAuthority{
99+
OrganizationName: "MyOrg",
100+
OrganizationEmail: "my@email.org",
101+
CommonName: "tsa.hostname",
102+
},
103+
IntermediateCA: v1alpha1.TsaCertificateAuthority{
104+
OrganizationName: "MyOrg",
105+
OrganizationEmail: "my@email.org",
106+
CommonName: "tsa.hostname",
107+
},
108+
},
109+
},
110+
},
92111
},
93112
}
94113
})
@@ -138,6 +157,23 @@ var _ = Describe("Securesign install with certificate generation", Ordered, func
138157
)))
139158
})
140159

160+
It("operator should generate TSA secret", func() {
161+
Eventually(func() *v1.Secret {
162+
tsa := tas.GetTSA(ctx, cli, namespace.Name, securesign.Name)()
163+
scr := &v1.Secret{}
164+
Expect(cli.Get(ctx, types.NamespacedName{Namespace: namespace.Name, Name: tsa.Status.Signer.FileSigner.PrivateKeyRef.Name}, scr)).To(Succeed())
165+
return scr
166+
}).Should(
167+
WithTransform(func(secret *v1.Secret) map[string][]byte { return secret.Data },
168+
And(
169+
&matchers.HaveKeyMatcher{Key: "rootPrivateKey"},
170+
&matchers.HaveKeyMatcher{Key: "rootPrivateKeyPassword"},
171+
&matchers.HaveKeyMatcher{Key: "interPrivateKey"},
172+
&matchers.HaveKeyMatcher{Key: "interPrivateKeyPassword"},
173+
&matchers.HaveKeyMatcher{Key: "certificateChain"},
174+
)))
175+
})
176+
141177
It("fulcio is running with mounted certs", func() {
142178
server := tas.GetFulcioServerPod(ctx, cli, namespace.Name)()
143179
Expect(server).NotTo(BeNil())
@@ -175,12 +211,29 @@ var _ = Describe("Securesign install with certificate generation", Ordered, func
175211

176212
})
177213

214+
It("tsa is running with mounted certs", func() {
215+
tas.VerifyTSA(ctx, cli, namespace.Name, securesign.Name)
216+
server := tas.GetTSAServerPod(ctx, cli, namespace.Name)()
217+
Expect(server).NotTo(BeNil())
218+
Expect(server.Spec.Volumes).To(
219+
ContainElement(
220+
WithTransform(func(volume v1.Volume) string {
221+
if volume.VolumeSource.Secret != nil {
222+
return volume.VolumeSource.Secret.SecretName
223+
}
224+
return ""
225+
}, Equal(tas.GetTSA(ctx, cli, namespace.Name, securesign.Name)().Status.Signer.FileSigner.PrivateKeyRef.Name))),
226+
)
227+
228+
})
229+
178230
It("All other components are running", func() {
179231
tas.VerifySecuresign(ctx, cli, namespace.Name, securesign.Name)
180232
tas.VerifyTrillian(ctx, cli, namespace.Name, securesign.Name, true)
181233
tas.VerifyCTLog(ctx, cli, namespace.Name, securesign.Name)
182234
tas.VerifyTuf(ctx, cli, namespace.Name, securesign.Name)
183235
tas.VerifyRekorSearchUI(ctx, cli, namespace.Name, securesign.Name)
236+
tas.VerifyTSA(ctx, cli, namespace.Name, securesign.Name)
184237
})
185238

186239
It("Verify Rekor Search UI is accessible", func() {
@@ -211,6 +264,11 @@ var _ = Describe("Securesign install with certificate generation", Ordered, func
211264
tuf := tas.GetTuf(ctx, cli, namespace.Name, securesign.Name)()
212265
Expect(tuf).ToNot(BeNil())
213266

267+
tsa := tas.GetTSA(ctx, cli, namespace.Name, securesign.Name)()
268+
Expect(tsa).ToNot(BeNil())
269+
err := tas.GetTSACertificateChain(ctx, cli, tsa.Namespace, tsa.Name, tsa.Status.Url)
270+
Expect(err).To(BeNil())
271+
214272
oidcToken, err := support.OidcToken(ctx)
215273
Expect(err).ToNot(HaveOccurred())
216274
Expect(oidcToken).ToNot(BeEmpty())
@@ -224,6 +282,7 @@ var _ = Describe("Securesign install with certificate generation", Ordered, func
224282
"cosign", "sign", "-y",
225283
"--fulcio-url="+fulcio.Status.Url,
226284
"--rekor-url="+rekor.Status.Url,
285+
"--timestamp-server-url="+tsa.Status.Url+"/api/v1/timestamp",
227286
"--oidc-issuer="+support.OidcIssuerUrl(),
228287
"--oidc-client-id="+support.OidcClientID(),
229288
"--identity-token="+oidcToken,
@@ -233,6 +292,7 @@ var _ = Describe("Securesign install with certificate generation", Ordered, func
233292
Expect(clients.Execute(
234293
"cosign", "verify",
235294
"--rekor-url="+rekor.Status.Url,
295+
"--timestamp-certificate-chain=ts_chain.pem",
236296
"--certificate-identity-regexp", ".*@redhat",
237297
"--certificate-oidc-issuer-regexp", ".*keycloak.*",
238298
targetImageName,

0 commit comments

Comments
 (0)