home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-09 05:06:38 +10:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4322 from jetstack-bot/cherry-pick-4298-to-release-1.5

Browse Source 
[release-1.5] Improve certificate condition checking and error logging
This commit is contained in:
jetstack-bot
2021-08-07 19:19:46 +01:00
committed by GitHub
parent be988fe2a8 069a47ab97
commit 74879f46a9
15 changed files with 262 additions and 363 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/e2e/framework/helper/BUILD.bazel
+2 -1
View File
@@ -20,6 +20,7 @@ go_library(
"//pkg/apis/certmanager/v1:go_default_library",
"//pkg/apis/meta/v1:go_default_library",
"//pkg/client/clientset/versioned:go_default_library",
"//pkg/client/clientset/versioned/typed/certmanager/v1:go_default_library",
"//pkg/controller/certificatesigningrequests/util:go_default_library",
"//pkg/util:go_default_library",
"//pkg/util/pki:go_default_library",
@@ -28,10 +29,10 @@ go_library(
"//test/e2e/framework/helper/validation/certificates:go_default_library",
"//test/e2e/framework/helper/validation/certificatesigningrequests:go_default_library",
"//test/e2e/framework/log:go_default_library",
"//test/e2e/util:go_default_library",
"@com_github_onsi_ginkgo//:go_default_library",
"@io_k8s_api//certificates/v1:go_default_library",
"@io_k8s_api//core/v1:go_default_library",
"@io_k8s_apimachinery//pkg/api/errors:go_default_library",
"@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
"@io_k8s_apimachinery//pkg/util/wait:go_default_library",
"@io_k8s_client_go//kubernetes:go_default_library",
test/e2e/framework/helper/certificates.go
+116 -66
View File
@@ -23,80 +23,143 @@ import (
"sort"
"time"
errors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/wait"
apiutil "github.com/jetstack/cert-manager/pkg/api/util"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
v1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
clientset "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1"
"github.com/jetstack/cert-manager/test/e2e/framework/log"
e2eutil "github.com/jetstack/cert-manager/test/e2e/util"
)
func (h *Helper) handleResult(ns, name string, cert *cmapi.Certificate, state string, err error) (*cmapi.Certificate, error) {
if err != nil {
log.Logf("Error waiting for Certificate to become %s: %v", state, err)
h.Kubectl(ns).DescribeResource("certificate", name)
h.Kubectl(ns).Describe("order", "challenge")
h.describeCertificateRequestFromCertificate(ns, cert)
// WaitForCertificateToExist waits for the named certificate to exist and returns the certificate
func (h *Helper) WaitForCertificateToExist(namespace string, name string, timeout time.Duration) (*cmapi.Certificate, error) {
client := h.CMClient.CertmanagerV1().Certificates(namespace)
var certificate *v1.Certificate
pollErr := wait.PollImmediate(500*time.Millisecond, timeout, func() (bool, error) {
log.Logf("Waiting for Certificate %v to exist", name)
var err error
certificate, err = client.Get(context.TODO(), name, metav1.GetOptions{})
if errors.IsNotFound(err) {
return false, nil
}
if err != nil {
return false, fmt.Errorf("error getting Certificate %v: %v", name, err)
}
return true, nil
})
return certificate, pollErr
}
func (h *Helper) waitForCertificateCondition(client clientset.CertificateInterface, name string, check func(*v1.Certificate) bool, timeout time.Duration) (*cmapi.Certificate, error) {
var certificate *v1.Certificate
pollErr := wait.PollImmediate(500*time.Millisecond, timeout, func() (bool, error) {
var err error
certificate, err = client.Get(context.TODO(), name, metav1.GetOptions{})
if nil != err {
certificate = nil
return false, fmt.Errorf("error getting Certificate %v: %v", name, err)
}
return check(certificate), nil
})
if pollErr != nil && certificate != nil {
log.Logf("Failed waiting for certificate %v: %v\n", name, pollErr.Error())
if len(certificate.Status.Conditions) > 0 {
log.Logf("Observed certificate conditions:\n")
for _, cond := range certificate.Status.Conditions {
log.Logf("- Last Status: '%s' Reason: '%s', Message: '%s'\n", cond.Status, cond.Reason, cond.Message)
}
}
log.Logf("Certificate description:\n")
h.Kubectl(certificate.Namespace).DescribeResource("certificate", name)
log.Logf("Order and challenge descriptions:\n")
h.Kubectl(certificate.Namespace).Describe("order", "challenge")
log.Logf("CertificateRequest description:\n")
crName, err := apiutil.ComputeName(certificate.Name, certificate.Spec)
if err != nil {
log.Logf("Failed to compute CertificateRequest name from certificate: %s", err)
} else {
h.Kubectl(certificate.Namespace).DescribeResource("certificaterequest", crName)
}
}
return cert, err
return certificate, pollErr
}
// waitForCertificateNotIssuing waits for the certificate resource to leave the Issuing state.
func (h *Helper) waitForCertificateNotIssuing(ns, name string, timeout time.Duration) (*cmapi.Certificate, error) {
result, err := e2eutil.WaitForMissingCertificateCondition(h.CMClient.CertmanagerV1().Certificates(ns), name, cmapi.CertificateCondition{
Type: cmapi.CertificateConditionIssuing,
Status: cmmeta.ConditionTrue,
}, timeout)
return h.handleResult(ns, name, result, "Not Issuing", err)
}
// WaitForCertificateReady waits for the certificate resource to enter a Ready state and to leave the Issuing state.
func (h *Helper) WaitForCertificateReady(ns, name string, timeout time.Duration) (*cmapi.Certificate, error) {
result, err := e2eutil.WaitForCertificateCondition(h.CMClient.CertmanagerV1().Certificates(ns), name, cmapi.CertificateCondition{
Type: cmapi.CertificateConditionReady,
Status: cmmeta.ConditionTrue,
}, timeout)
if err != nil {
return h.handleResult(ns, name, result, "Ready", err)
}
// Making sure that the Certificate is stable (see #4239) by also waiting for the Issuing state to disappear.
// A certificate that has state Ready=True and Issuing not set, is stable and will not change without outside changes.
return h.waitForCertificateNotIssuing(ns, name, timeout)
}
// WaitForCertificateReadyUpdate waits for the certificate resource to enter a
// Ready state and to leave the Issuing state. If the provided cert was in a
// Ready state already, the function waits for a state transition to have happened.
func (h *Helper) WaitForCertificateReadyUpdate(cert *cmapi.Certificate, timeout time.Duration) (*cmapi.Certificate, error) {
result, err := e2eutil.WaitForCertificateConditionWithObservedGeneration(h.CMClient.CertmanagerV1().Certificates(cert.Namespace), cert.Name, cmapi.CertificateCondition{
// WaitForCertificateReadyAndDoneIssuing waits for the certificate resource to be in a Ready=True state and not be in an Issuing state.
// The Ready=True condition will be checked against the provided certificate to make sure that it is up-to-date (condition gen. >= cert gen.).
func (h *Helper) WaitForCertificateReadyAndDoneIssuing(cert *cmapi.Certificate, timeout time.Duration) (*cmapi.Certificate, error) {
ready_true_condition := cmapi.CertificateCondition{
Type: cmapi.CertificateConditionReady,
Status: cmmeta.ConditionTrue,
ObservedGeneration: cert.Generation,
}, timeout)
if err != nil {
return h.handleResult(cert.Namespace, cert.Name, result, "Ready", err)
}
// Making sure that the Certificate is stable (see #4239) by also waiting for the Issuing state to disappear.
// A certificate that has state Ready=True and Issuing not set, is stable and will not change without outside changes.
return h.waitForCertificateNotIssuing(cert.Namespace, cert.Name, timeout)
issuing_true_condition := cmapi.CertificateCondition{
Type: cmapi.CertificateConditionIssuing,
Status: cmmeta.ConditionTrue,
}
return h.waitForCertificateCondition(h.CMClient.CertmanagerV1().Certificates(cert.Namespace), cert.Name, func(certificate *v1.Certificate) bool {
if !apiutil.CertificateHasConditionWithObservedGeneration(certificate, ready_true_condition) {
log.Logf(
"Expected Certificate %v condition %v=%v (generation >= %v) but it has: %v",
certificate.Name,
ready_true_condition.Type,
ready_true_condition.Status,
ready_true_condition.ObservedGeneration,
certificate.Status.Conditions,
)
return false
}
if apiutil.CertificateHasCondition(certificate, issuing_true_condition) {
log.Logf("Expected Certificate %v condition %v to be missing but it has: %v", certificate.Name, issuing_true_condition.Type, certificate.Status.Conditions)
return false
}
return true
}, timeout)
}
// WaitForCertificateReadyUpdate waits for the certificate resource to enter a
// Ready=False state and to leave the Issuing state. If the provided cert was
// in a Ready=False state already, the function waits for a state transition to have happened.
func (h *Helper) WaitForCertificateNotReadyUpdate(cert *cmapi.Certificate, timeout time.Duration) (*cmapi.Certificate, error) {
result, err := e2eutil.WaitForCertificateConditionWithObservedGeneration(h.CMClient.CertmanagerV1().Certificates(cert.Namespace), cert.Name, cmapi.CertificateCondition{
// WaitForCertificateNotReadyAndDoneIssuing waits for the certificate resource to be in a Ready=False state and not be in an Issuing state.
// The Ready=False condition will be checked against the provided certificate to make sure that it is up-to-date (condition gen. >= cert gen.).
func (h *Helper) WaitForCertificateNotReadyAndDoneIssuing(cert *cmapi.Certificate, timeout time.Duration) (*cmapi.Certificate, error) {
ready_false_condition := cmapi.CertificateCondition{
Type: cmapi.CertificateConditionReady,
Status: cmmeta.ConditionFalse,
ObservedGeneration: cert.Generation,
}, timeout)
if err != nil {
return h.handleResult(cert.Namespace, cert.Name, result, "Not Ready", err)
}
// Making sure that the Certificate is stable (see #4239) by also waiting for the Issuing state to disappear.
// A certificate that has state Ready=False and Issuing not set, is stable and will not change without outside changes.
return h.waitForCertificateNotIssuing(cert.Namespace, cert.Name, timeout)
issuing_true_condition := cmapi.CertificateCondition{
Type: cmapi.CertificateConditionIssuing,
Status: cmmeta.ConditionTrue,
}
return h.waitForCertificateCondition(h.CMClient.CertmanagerV1().Certificates(cert.Namespace), cert.Name, func(certificate *v1.Certificate) bool {
if !apiutil.CertificateHasConditionWithObservedGeneration(certificate, ready_false_condition) {
log.Logf(
"Expected Certificate %v condition %v=%v (generation >= %v) but it has: %v",
certificate.Name,
ready_false_condition.Type,
ready_false_condition.Status,
ready_false_condition.ObservedGeneration,
certificate.Status.Conditions,
)
return false
}
if apiutil.CertificateHasCondition(certificate, issuing_true_condition) {
log.Logf("Expected Certificate %v condition %v to be missing but it has: %v", certificate.Name, issuing_true_condition.Type, certificate.Status.Conditions)
return false
}
return true
}, timeout)
}
func (h *Helper) deduplicateExtKeyUsages(us []x509.ExtKeyUsage) []x509.ExtKeyUsage {
@@ -184,16 +247,3 @@ func (h *Helper) keyUsagesMatch(aKU x509.KeyUsage, aEKU []x509.ExtKeyUsage,
return true
}
func (h *Helper) describeCertificateRequestFromCertificate(ns string, certificate *cmapi.Certificate) {
if certificate == nil {
return
}
crName, err := apiutil.ComputeName(certificate.Name, certificate.Spec)
if err != nil {
log.Logf("Failed to compute CertificateRequest name from certificate: %s", err)
return
}
h.Kubectl(ns).DescribeResource("certificaterequest", crName)
}
test/e2e/framework/helper/validate.go
+3 -5
View File
@@ -22,20 +22,18 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
"github.com/jetstack/cert-manager/test/e2e/framework/helper/validation"
"github.com/jetstack/cert-manager/test/e2e/framework/helper/validation/certificates"
"github.com/jetstack/cert-manager/test/e2e/framework/helper/validation/certificatesigningrequests"
)
// ValidateCertificate retrieves the issued certificate and runs all validation functions
func (h *Helper) ValidateCertificate(ns, name string, validations ...certificates.ValidationFunc) error {
func (h *Helper) ValidateCertificate(certificate *cmapi.Certificate, validations ...certificates.ValidationFunc) error {
if len(validations) == 0 {
validations = validation.DefaultCertificateSet()
}
certificate, err := h.CMClient.CertmanagerV1().Certificates(ns).Get(context.TODO(), name, metav1.GetOptions{})
if err != nil {
return err
}
secret, err := h.KubeClient.CoreV1().Secrets(certificate.Namespace).Get(context.TODO(), certificate.Spec.SecretName, metav1.GetOptions{})
if err != nil {
return err
test/e2e/suite/conformance/certificates/BUILD.bazel
-2
View File
@@ -24,8 +24,6 @@ go_library(
"@io_k8s_api//networking/v1:go_default_library",
"@io_k8s_api//networking/v1beta1:go_default_library",
"@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
"@io_k8s_apimachinery//pkg/types:go_default_library",
"@io_k8s_client_go//util/retry:go_default_library",
],
)
test/e2e/suite/conformance/certificates/tests.go
+64 -78
View File
@@ -28,8 +28,6 @@ import (
networkingv1 "k8s.io/api/networking/v1"
networkingv1beta1 "k8s.io/api/networking/v1beta1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/client-go/util/retry"
cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
@@ -93,11 +91,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.OnlySAN)
@@ -119,11 +117,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.IssueCAFeature)
@@ -147,11 +145,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.ECDSAFeature, featureset.OnlySAN)
@@ -175,11 +173,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.OnlySAN, featureset.Ed25519FeatureSet)
@@ -204,11 +202,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.CommonNameFeature)
@@ -236,11 +234,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.ECDSAFeature, featureset.CommonNameFeature)
@@ -268,11 +266,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.Ed25519FeatureSet, featureset.CommonNameFeature)
@@ -293,11 +291,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.IPAddressFeature)
@@ -319,11 +317,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.OnlySAN, featureset.IPAddressFeature)
@@ -349,11 +347,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.CommonNameFeature, featureset.IPAddressFeature)
@@ -374,11 +372,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.EmailSANsFeature, featureset.OnlySAN)
@@ -404,11 +402,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.URISANsFeature, featureset.CommonNameFeature)
@@ -433,11 +431,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.CommonNameFeature)
@@ -460,11 +458,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.CommonNameFeature)
@@ -488,11 +486,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
// We set a weird time here as the duration with should never be used as
@@ -520,11 +518,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.WildcardsFeature, featureset.OnlySAN)
@@ -547,11 +545,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.URISANsFeature, featureset.OnlySAN)
@@ -578,7 +576,7 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
@@ -591,7 +589,7 @@ func (s *Suite) Define() {
}
validations = append(validations, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validations...)
err = f.Helper().ValidateCertificate(testCertificate, validations...)
Expect(err).NotTo(HaveOccurred())
}, featureset.KeyUsagesFeature, featureset.OnlySAN)
@@ -612,11 +610,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
By("Deleting existing certificate data in Secret")
@@ -691,16 +689,15 @@ func (s *Suite) Define() {
}
By("Waiting for the Certificate to exist...")
Expect(e2eutil.WaitForCertificateToExist(
f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name), certName, time.Minute,
)).NotTo(HaveOccurred())
cert, err := f.Helper().WaitForCertificateToExist(f.Namespace.Name, certName, time.Minute)
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err := f.Helper().WaitForCertificateReady(f.Namespace.Name, certName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certName, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(cert, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.OnlySAN)
@@ -757,19 +754,18 @@ func (s *Suite) Define() {
}
By("Waiting for the Certificate to exist...")
Expect(e2eutil.WaitForCertificateToExist(
f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name), certName, time.Minute,
)).NotTo(HaveOccurred())
cert, err := f.Helper().WaitForCertificateToExist(f.Namespace.Name, certName, time.Minute)
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err := f.Helper().WaitForCertificateReady(f.Namespace.Name, certName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
// Verify that the ingres-shim has translated all the supplied
// annotations into equivalent Certificate field values
By("Validating the created Certificate")
err = f.Helper().ValidateCertificate(
f.Namespace.Name, certName,
cert,
func(certificate *cmapi.Certificate, _ *corev1.Secret) error {
Expect(certificate.Spec.DNSNames).To(ConsistOf(domain))
Expect(certificate.Spec.CommonName).To(Equal(domain))
@@ -783,7 +779,7 @@ func (s *Suite) Define() {
// Verify that the issuer has preserved all the Certificate values
// in the signed certificate
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certName, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(cert, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
})
@@ -815,16 +811,16 @@ func (s *Suite) Define() {
certName := gw.Spec.Listeners[0].TLS.CertificateRef.Name
By("Waiting for the Certificate to exist...")
Expect(e2eutil.WaitForCertificateToExist(
f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name), certName, time.Minute,
)).NotTo(HaveOccurred())
cert, err := f.Helper().WaitForCertificateToExist(f.Namespace.Name, certName, time.Minute)
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
// Verify that the ingres-shim has translated all the supplied
// annotations into equivalent Certificate field values
By("Validating the created Certificate")
cert, err := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name).Get(context.TODO(), certName, metav1.GetOptions{})
Expect(err).NotTo(HaveOccurred())
Expect(cert.Spec.DNSNames).To(ConsistOf(domain))
Expect(cert.Spec.CommonName).To(Equal(domain))
Expect(cert.Spec.Duration.Duration).To(Equal(duration))
@@ -853,11 +849,11 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Sanity-check the issued Certificate")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validations...)
err = f.Helper().ValidateCertificate(testCertificate, validations...)
Expect(err).NotTo(HaveOccurred())
}, featureset.OnlySAN, featureset.LongDomainFeatureSet)
@@ -880,37 +876,27 @@ func (s *Suite) Define() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be ready")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Sanity-check the issued Certificate")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validations...)
Expect(err).NotTo(HaveOccurred())
By("Getting the latest version of the Certificate")
cert, err := f.Helper().CMClient.CertmanagerV1().Certificates(f.Namespace.Name).Get(context.TODO(), "testcert", metav1.GetOptions{})
err = f.Helper().ValidateCertificate(testCertificate, validations...)
Expect(err).NotTo(HaveOccurred())
By("Updating the Certificate after having added an additional dnsName")
testCertificate = testCertificate.DeepCopy() // DeepCopy before updating
newDNSName := e2eutil.RandomSubdomain(s.DomainSuffix)
err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
err := f.CRClient.Get(context.Background(), types.NamespacedName{Namespace: f.Namespace.Name, Name: "testcert"}, cert)
if err != nil {
return err
}
testCertificate.Spec.DNSNames = append(testCertificate.Spec.DNSNames, newDNSName)
cert.Spec.DNSNames = append(cert.Spec.DNSNames, newDNSName)
return f.CRClient.Update(context.TODO(), cert)
})
err = f.CRClient.Update(context.TODO(), testCertificate)
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate Ready condition to be updated")
_, err = f.Helper().WaitForCertificateReadyUpdate(cert, time.Minute*5)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Sanity-check the issued Certificate")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validations...)
err = f.Helper().ValidateCertificate(testCertificate, validations...)
Expect(err).NotTo(HaveOccurred())
}, featureset.OnlySAN)
@@ -933,11 +919,11 @@ func (s *Suite) Define() {
// use a longer timeout for this, as it requires performing 2 dns validations in serial
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, "testcert", time.Minute*10)
testCertificate, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(testCertificate, time.Minute*10)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, "testcert", validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
err = f.Helper().ValidateCertificate(testCertificate, validation.CertificateSetForUnsupportedFeatureSet(s.UnsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
}, featureset.WildcardsFeature, featureset.OnlySAN)
})
test/e2e/suite/issuers/acme/certificate/http01.go
+21 -20
View File
@@ -48,8 +48,6 @@ import (
"github.com/jetstack/cert-manager/test/unit/gen"
)
const foreverTestTimeout = time.Second * 60
var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
f := framework.NewDefaultFramework("create-acme-certificate-http01")
@@ -148,7 +146,7 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
)
cert.Namespace = f.Namespace.Name
_, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Making sure the Order failed with a 400 since google.com is invalid")
@@ -174,7 +172,7 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be not ready")
_, err = f.Helper().WaitForCertificateNotReadyUpdate(cert, 30*time.Second)
cert, err = f.Helper().WaitForCertificateNotReadyAndDoneIssuing(cert, 30*time.Second)
Expect(err).NotTo(HaveOccurred())
err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
@@ -196,15 +194,15 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to have the Ready=True condition")
_, err = f.Helper().WaitForCertificateReadyUpdate(cert, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Sanity checking the issued Certificate")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validations...)
err = f.Helper().ValidateCertificate(cert, validations...)
Expect(err).NotTo(HaveOccurred())
By("Checking that the secret contains this dns name")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, func(cert *v1.Certificate, secret *corev1.Secret) error {
err = f.Helper().ValidateCertificate(cert, func(cert *v1.Certificate, secret *corev1.Secret) error {
dnsnames, err := findDNSNames(secret)
if err != nil {
return err
@@ -258,17 +256,16 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
Fail("Neither " + networkingv1.SchemeGroupVersion.String() + " nor " + networkingv1beta1.SchemeGroupVersion.String() + " were discovered in the API server")
}
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Waiting for Certificate to exist")
err := util.WaitForCertificateToExist(certClient, certificateSecretName, foreverTestTimeout)
cert, err := f.Helper().WaitForCertificateToExist(f.Namespace.Name, certificateSecretName, time.Second*60)
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validations...)
err = f.Helper().ValidateCertificate(cert, validations...)
Expect(err).NotTo(HaveOccurred())
})
@@ -298,15 +295,15 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
const secretname = "dummy-tls-secret"
selfcert := util.NewCertManagerBasicCertificate("dummy-tls", secretname, "selfsign", v1.IssuerKind, nil, nil, acmeIngressDomain)
_, err = certClient.Create(context.TODO(), selfcert, metav1.CreateOptions{})
selfcert, err = certClient.Create(context.TODO(), selfcert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, dummycert, time.Minute*5)
selfcert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(selfcert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, dummycert, validations...)
err = f.Helper().ValidateCertificate(selfcert, validations...)
Expect(err).NotTo(HaveOccurred())
// create an ingress that points at nothing, but has the TLS redirect annotation set
@@ -411,15 +408,15 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
"testing.cert-manager.io/fixed-ingress": "true",
}
_, err = certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
cert, err = certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validations...)
err = f.Helper().ValidateCertificate(cert, validations...)
Expect(err).NotTo(HaveOccurred())
})
@@ -433,7 +430,7 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
gen.SetCertificateDNSNames(acmeIngressDomain),
)
cert.Namespace = f.Namespace.Name
_, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("killing the solver pod")
@@ -464,16 +461,20 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
err = podClient.Delete(context.TODO(), pod.Name, metav1.DeleteOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for Certificate to exist")
cert, err = f.Helper().WaitForCertificateToExist(f.Namespace.Name, certificateName, time.Second*60)
Expect(err).NotTo(HaveOccurred())
// The pod should get remade and the certificate should be made valid.
// Killing the pod could potentially make the validation invalid if pebble
// were to ask us for the challenge after the pod was killed, but because
// we kill it so early, we should always be in the self-check phase
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validations...)
err = f.Helper().ValidateCertificate(cert, validations...)
Expect(err).NotTo(HaveOccurred())
})
})
test/e2e/suite/issuers/acme/certificate/notafter.go
+3 -3
View File
@@ -139,15 +139,15 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01 + Not After)", f
)
cert.Namespace = f.Namespace.Name
_, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validations...)
err = f.Helper().ValidateCertificate(cert, validations...)
Expect(err).NotTo(HaveOccurred())
sec, err := f.Helper().WaitForSecretCertificateData(f.Namespace.Name, certificateSecretName, time.Minute*5)
test/e2e/suite/issuers/ca/certificate.go
+22 -22
View File
@@ -73,54 +73,54 @@ var _ = framework.CertManagerDescribe("CA Certificate", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Creating a Certificate")
_, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil), metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Verifying the Certificate is valid")
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
It("should be able to obtain an ECDSA key from a RSA backed issuer", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
crt := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
crt.Spec.PrivateKey.Algorithm = v1.ECDSAKeyAlgorithm
crt.Spec.PrivateKey.Size = 521
cert := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
cert.Spec.PrivateKey.Algorithm = v1.ECDSAKeyAlgorithm
cert.Spec.PrivateKey.Size = 521
By("Creating a Certificate")
_, err := certClient.Create(context.TODO(), crt, metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
It("should be able to obtain an Ed25519 key from a RSA backed issuer", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
crt := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
crt.Spec.PrivateKey.Algorithm = v1.Ed25519KeyAlgorithm
cert := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
cert.Spec.PrivateKey.Algorithm = v1.Ed25519KeyAlgorithm
By("Creating a Certificate")
_, err := certClient.Create(context.TODO(), crt, metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
@@ -152,11 +152,11 @@ var _ = framework.CertManagerDescribe("CA Certificate", func() {
cert, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, v.inputDuration, v.inputRenewBefore), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
f.CertificateDurationValid(cert, v.expectedDuration, 0)
@@ -175,14 +175,14 @@ var _ = framework.CertManagerDescribe("CA Certificate", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Creating a Certificate")
_, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil), metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
})
@@ -198,14 +198,14 @@ var _ = framework.CertManagerDescribe("CA Certificate", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Creating a Certificate with Usages")
_, err := certClient.Create(context.TODO(), gen.Certificate(certificateName, gen.SetCertificateNamespace(f.Namespace.Name), gen.SetCertificateCommonName("test.domain.com"), gen.SetCertificateSecretName(certificateSecretName), gen.SetCertificateIssuer(cmmeta.ObjectReference{Name: issuerName, Kind: v1.IssuerKind}), gen.SetCertificateKeyUsages(v1.UsageServerAuth, v1.UsageClientAuth)), metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), gen.Certificate(certificateName, gen.SetCertificateNamespace(f.Namespace.Name), gen.SetCertificateCommonName("test.domain.com"), gen.SetCertificateSecretName(certificateSecretName), gen.SetCertificateIssuer(cmmeta.ObjectReference{Name: issuerName, Kind: v1.IssuerKind}), gen.SetCertificateKeyUsages(v1.UsageServerAuth, v1.UsageClientAuth)), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
})
test/e2e/suite/issuers/selfsigned/certificate.go
+10 -10
View File
@@ -58,14 +58,14 @@ var _ = framework.CertManagerDescribe("Self Signed Certificate", func() {
})
Expect(err).NotTo(HaveOccurred())
By("Creating a Certificate")
_, err = certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil), metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
@@ -113,11 +113,11 @@ var _ = framework.CertManagerDescribe("Self Signed Certificate", func() {
cert, err := certClient.Create(context.TODO(), util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerDurationName, v1.IssuerKind, v.inputDuration, v.inputRenewBefore), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
f.CertificateDurationValid(cert, v.expectedDuration, 0)
@@ -135,19 +135,19 @@ var _ = framework.CertManagerDescribe("Self Signed Certificate", func() {
_, err := f.CertManagerClientSet.CertmanagerV1().Issuers(f.Namespace.Name).Create(context.TODO(), issuer, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
crt := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
crt.Spec.PrivateKey.Encoding = v1.PKCS8
cert := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuerName, v1.IssuerKind, nil, nil)
cert.Spec.PrivateKey.Encoding = v1.PKCS8
By("Creating a Certificate")
_, err = certClient.Create(context.TODO(), crt, metav1.CreateOptions{})
cert, err = certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
})
test/e2e/suite/issuers/vault/certificate/approle.go
+5 -5
View File
@@ -176,15 +176,15 @@ func runVaultAppRoleTests(issuerKind string, testWithRoot bool, unsupportedFeatu
Expect(err).NotTo(HaveOccurred())
By("Creating a Certificate")
_, err = certClient.Create(context.TODO(), util.NewCertManagerVaultCertificate(certificateName, certificateSecretName, vaultIssuerName, issuerKind, nil, nil), metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), util.NewCertManagerVaultCertificate(certificateName, certificateSecretName, vaultIssuerName, issuerKind, nil, nil), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validation.CertificateSetForUnsupportedFeatureSet(unsupportedFeatures)...)
err = f.Helper().ValidateCertificate(cert, validation.CertificateSetForUnsupportedFeatureSet(unsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
})
@@ -275,11 +275,11 @@ func runVaultAppRoleTests(issuerKind string, testWithRoot bool, unsupportedFeatu
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validation.CertificateSetForUnsupportedFeatureSet(unsupportedFeatures)...)
err = f.Helper().ValidateCertificate(cert, validation.CertificateSetForUnsupportedFeatureSet(unsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
// Vault subtract 30 seconds to the NotBefore date.
test/e2e/suite/issuers/vault/certificate/approle_custom_mount.go
+3 -3
View File
@@ -174,15 +174,15 @@ func runVaultCustomAppRoleTests(issuerKind string, testWithRoot bool, unsupporte
Expect(err).NotTo(HaveOccurred())
By("Creating a Certificate")
_, err = certClient.Create(context.TODO(), util.NewCertManagerVaultCertificate(certificateName, certificateSecretName, vaultIssuerName, issuerKind, nil, nil), metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), util.NewCertManagerVaultCertificate(certificateName, certificateSecretName, vaultIssuerName, issuerKind, nil, nil), metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName, validation.CertificateSetForUnsupportedFeatureSet(unsupportedFeatures)...)
err = f.Helper().ValidateCertificate(cert, validation.CertificateSetForUnsupportedFeatureSet(unsupportedFeatures)...)
Expect(err).NotTo(HaveOccurred())
})
}
test/e2e/suite/issuers/venafi/tpp/certificate.go
+5 -5
View File
@@ -75,19 +75,19 @@ var _ = TPPDescribe("[Feature:Issuers:Venafi:TPP] Certificate with a properly co
It("should obtain a signed certificate for a single domain", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
crt := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuer.Name, cmapi.IssuerKind, nil, nil)
crt.Spec.CommonName = cmutil.RandStringRunes(10) + ".venafi-e2e.example"
cert := util.NewCertManagerBasicCertificate(certificateName, certificateSecretName, issuer.Name, cmapi.IssuerKind, nil, nil)
cert.Spec.CommonName = cmutil.RandStringRunes(10) + ".venafi-e2e.example"
By("Creating a Certificate")
_, err := certClient.Create(context.TODO(), crt, metav1.CreateOptions{})
cert, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be issued...")
_, err = f.Helper().WaitForCertificateReady(f.Namespace.Name, certificateName, time.Minute*5)
cert, err = f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Validating the issued Certificate...")
err = f.Helper().ValidateCertificate(f.Namespace.Name, certificateName)
err = f.Helper().ValidateCertificate(cert)
Expect(err).NotTo(HaveOccurred())
})
})
test/e2e/suite/serving/cainjector.go
+8 -11
View File
@@ -80,7 +80,7 @@ var _ = framework.CertManagerDescribe("CA Injector", func() {
}
Expect(f.CRClient.Delete(context.Background(), toCleanup)).To(Succeed())
})
generalSetup := func(injectable client.Object) (runtime.Object, certmanager.Certificate, corev1.Secret) {
generalSetup := func(injectable client.Object) (runtime.Object, *certmanager.Certificate) {
By("creating a " + subj + " pointing to a cert")
Expect(f.CRClient.Create(context.Background(), injectable)).To(Succeed())
toCleanup = injectable
@@ -91,7 +91,7 @@ var _ = framework.CertManagerDescribe("CA Injector", func() {
cert.Namespace = f.Namespace.Name
Expect(f.CRClient.Create(context.Background(), cert)).To(Succeed())
_, err := f.Helper().WaitForCertificateReady(f.Namespace.Name, "serving-certs", time.Second*30)
cert, err := f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Second*30)
Expect(err).NotTo(HaveOccurred(), "failed to wait for Certificate to become Ready")
By("grabbing the corresponding secret")
@@ -113,8 +113,7 @@ var _ = framework.CertManagerDescribe("CA Injector", func() {
return test.getCAs(newInjectable), nil
}, "10s", "2s").Should(Equal(expectedCAs))
return injectable, *cert, secret
return injectable, cert
}
It("should inject the CA data into all CA fields", func() {
@@ -150,21 +149,19 @@ var _ = framework.CertManagerDescribe("CA Injector", func() {
if test.disabled != "" {
Skip(test.disabled)
}
injectable, cert, _ := generalSetup(test.makeInjectable("changed"))
By("grabbing the latest copy of the cert")
Expect(f.CRClient.Get(context.Background(), types.NamespacedName{Name: cert.Name, Namespace: cert.Namespace}, &cert)).To(Succeed())
injectable, cert := generalSetup(test.makeInjectable("changed"))
By("changing the name of the corresponding secret in the cert")
secretName := types.NamespacedName{Name: cert.Spec.SecretName, Namespace: f.Namespace.Name}
cert = cert.DeepCopy() // DeepCopy before updating
cert.Spec.DNSNames = append(cert.Spec.DNSNames, "something.com")
Expect(f.CRClient.Update(context.Background(), &cert)).To(Succeed())
Expect(f.CRClient.Update(context.Background(), cert)).To(Succeed())
_, err := f.Helper().WaitForCertificateReadyUpdate(&cert, time.Second*30)
cert, err := f.Helper().WaitForCertificateReadyAndDoneIssuing(cert, time.Second*30)
Expect(err).NotTo(HaveOccurred(), "failed to wait for Certificate to become updated")
By("grabbing the new secret")
var secret corev1.Secret
secretName := types.NamespacedName{Name: cert.Spec.SecretName, Namespace: f.Namespace.Name}
Expect(f.CRClient.Get(context.Background(), secretName, &secret)).To(Succeed())
By("verifying that the hooks have the new data")
test/e2e/util/BUILD.bazel
-3
View File
@@ -12,12 +12,10 @@ go_library(
"//pkg/api/util:go_default_library",
"//pkg/apis/certmanager/v1:go_default_library",
"//pkg/apis/meta/v1:go_default_library",
"//pkg/client/clientset/versioned/scheme:go_default_library",
"//pkg/client/clientset/versioned/typed/certmanager/v1:go_default_library",
"//pkg/util:go_default_library",
"//pkg/util/pki:go_default_library",
"//test/e2e/framework/log:go_default_library",
"@io_k8s_api//core/v1:go_default_library",
"@io_k8s_api//networking/v1:go_default_library",
"@io_k8s_api//networking/v1beta1:go_default_library",
"@io_k8s_apiextensions_apiserver//pkg/client/clientset/clientset/typed/apiextensions/v1:go_default_library",
@@ -26,7 +24,6 @@ go_library(
"@io_k8s_apimachinery//pkg/util/intstr:go_default_library",
"@io_k8s_apimachinery//pkg/util/wait:go_default_library",
"@io_k8s_client_go//discovery:go_default_library",
"@io_k8s_client_go//kubernetes:go_default_library",
"@io_k8s_sigs_gateway_api//apis/v1alpha1:go_default_library",
],
)
test/e2e/util/util.go
-129
View File
@@ -29,7 +29,6 @@ import (
"net/url"
"time"
corev1 "k8s.io/api/core/v1"
networkingv1 "k8s.io/api/networking/v1"
networkingv1beta1 "k8s.io/api/networking/v1beta1"
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
@@ -38,14 +37,12 @@ import (
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/client-go/discovery"
"k8s.io/client-go/kubernetes"
"sigs.k8s.io/gateway-api/apis/v1alpha1"
gwapiv1alpha1 "sigs.k8s.io/gateway-api/apis/v1alpha1"
apiutil "github.com/jetstack/cert-manager/pkg/api/util"
v1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
intscheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
clientset "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/typed/certmanager/v1"
"github.com/jetstack/cert-manager/pkg/util"
"github.com/jetstack/cert-manager/pkg/util/pki"
@@ -146,132 +143,6 @@ func wrapErrorWithClusterIssuerStatusCondition(client clientset.ClusterIssuerInt
return pollErr
}
// WaitForCertificateCondition waits for the status of the named Certificate to contain
// a condition whose type and status matches the supplied one.
func WaitForCertificateCondition(client clientset.CertificateInterface, name string, condition v1.CertificateCondition, timeout time.Duration) (*v1.Certificate, error) {
var certificate *v1.Certificate = nil
pollErr := wait.PollImmediate(500*time.Millisecond, timeout,
func() (bool, error) {
log.Logf("Waiting for Certificate %v condition %v=%v", name, condition.Type, condition.Status)
certificate, err := client.Get(context.TODO(), name, metav1.GetOptions{})
if nil != err {
return false, fmt.Errorf("error getting Certificate %v: %v", name, err)
}
if !apiutil.CertificateHasCondition(certificate, condition) {
log.Logf("Expected Certificate %v condition %v=%v but it has: %v", name, condition.Type, condition.Status, certificate.Status.Conditions)
return false, nil
}
return true, nil
},
)
return certificate, wrapErrorWithCertificateStatusCondition(client, pollErr, name, condition.Type)
}
// WaitForMissingCertificateCondition waits for the status of the named Certificate to NOT contain
// a condition whose type and status matches the supplied one.
func WaitForMissingCertificateCondition(client clientset.CertificateInterface, name string, condition v1.CertificateCondition, timeout time.Duration) (*v1.Certificate, error) {
var certificate *v1.Certificate = nil
pollErr := wait.PollImmediate(500*time.Millisecond, timeout,
func() (bool, error) {
log.Logf("Waiting for Certificate %v condition %v=%v to be missing", name, condition.Type, condition.Status)
certificate, err := client.Get(context.TODO(), name, metav1.GetOptions{})
if nil != err {
return false, fmt.Errorf("error getting Certificate %v: %v", name, err)
}
if apiutil.CertificateHasCondition(certificate, condition) {
log.Logf("Expected Certificate %v condition %v=%v to be missing but it has: %v", name, condition.Type, condition.Status, certificate.Status.Conditions)
return false, nil
}
return true, nil
},
)
return certificate, wrapErrorWithCertificateStatusCondition(client, pollErr, name, condition.Type)
}
// WaitForCertificateConditionWithObservedGeneration waits for the status of the named Certificate to contain
// a condition whose type and status matches the supplied one.
func WaitForCertificateConditionWithObservedGeneration(client clientset.CertificateInterface, name string, condition v1.CertificateCondition, timeout time.Duration) (*v1.Certificate, error) {
var certificate *v1.Certificate = nil
pollErr := wait.PollImmediate(500*time.Millisecond, timeout,
func() (bool, error) {
log.Logf("Waiting for Certificate %v condition %v=%v", name, condition.Type, condition.Status)
certificate, err := client.Get(context.TODO(), name, metav1.GetOptions{})
if nil != err {
return false, fmt.Errorf("error getting Certificate %v: %v", name, err)
}
if !apiutil.CertificateHasConditionWithObservedGeneration(certificate, condition) {
log.Logf("Expected Certificate %v condition %v=%v (generation >= %v) but it has: %v", name, condition.Type, condition.Status, condition.ObservedGeneration, certificate.Status.Conditions)
return false, nil
}
return true, nil
},
)
return certificate, wrapErrorWithCertificateStatusCondition(client, pollErr, name, condition.Type)
}
// WaitForCertificateEvent waits for an event on the named Certificate to contain
// an event reason matches the supplied one.
func WaitForCertificateEvent(client kubernetes.Interface, cert *v1.Certificate, reason string, timeout time.Duration) error {
return wait.PollImmediate(500*time.Millisecond, timeout,
func() (bool, error) {
log.Logf("Waiting for Certificate event %v reason %#v", cert.Name, reason)
evts, err := client.CoreV1().Events(cert.Namespace).Search(intscheme.Scheme, cert)
if err != nil {
return false, fmt.Errorf("error getting Certificate %v: %v", cert.Name, err)
}
return hasEvent(evts, reason), nil
},
)
}
func hasEvent(events *corev1.EventList, reason string) bool {
for _, evt := range events.Items {
if evt.Reason == reason {
return true
}
}
return false
}
// try to retrieve last condition to help diagnose tests.
func wrapErrorWithCertificateStatusCondition(client clientset.CertificateInterface, pollErr error, name string, conditionType v1.CertificateConditionType) error {
if pollErr == nil {
return nil
}
certificate, err := client.Get(context.TODO(), name, metav1.GetOptions{})
if err != nil {
return pollErr
}
for _, cond := range certificate.Status.Conditions {
if cond.Type == conditionType {
return fmt.Errorf("%s: Last Status: '%s' Reason: '%s', Message: '%s'", pollErr.Error(), cond.Status, cond.Reason, cond.Message)
}
}
return pollErr
}
// WaitForCertificateToExist waits for the named certificate to exist
func WaitForCertificateToExist(client clientset.CertificateInterface, name string, timeout time.Duration) error {
return wait.PollImmediate(500*time.Millisecond, timeout,
func() (bool, error) {
log.Logf("Waiting for Certificate %v to exist", name)
_, err := client.Get(context.TODO(), name, metav1.GetOptions{})
if errors.IsNotFound(err) {
return false, nil
}
if err != nil {
return false, fmt.Errorf("error getting Certificate %v: %v", name, err)
}
return true, nil
},
)
}
// WaitForCRDToNotExist waits for the CRD with the given name to no
// longer exist.
func WaitForCRDToNotExist(client apiextensionsv1.CustomResourceDefinitionInterface, name string) error {