From 48afbb1f656ba6018582b311fb9b9ff0e6595dcb Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Wed, 4 Sep 2019 16:34:35 +0100 Subject: [PATCH 01/16] Adds duration and wildcard feature tests to conformance tests Signed-off-by: JoshVanL --- .../suite/conformance/certificates/suite.go | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index cf021cf32..4eb51407d 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -188,6 +188,58 @@ func (s *Suite) Define() { err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) }) + + It("should issue a certificate that defines a commonName and sets a duration", func() { + s.checkFeatures(DurationFeature) + + testCertificate := &cmapi.Certificate{ + ObjectMeta: metav1.ObjectMeta{ + Name: "testcert", + Namespace: f.Namespace.Name, + }, + Spec: cmapi.CertificateSpec{ + SecretName: "testcert-tls", + CommonName: s.newDomain(), + IssuerRef: issuerRef, + Duration: &metav1.Duration{ + Duration: time.Hour * 35, + }, + }, + } + By("Creating a Certificate") + err := f.CRClient.Create(ctx, testCertificate) + Expect(err).NotTo(HaveOccurred()) + + By("Waiting for the Certificate to be issued...") + err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) + Expect(err).NotTo(HaveOccurred()) + + f.CertificateDurationValid(testCertificate, time.Hour*35) + }) + + It("should issue a certificate which has a wildcard DNS name defined", func() { + s.checkFeatures(Wildcards) + + testCertificate := &cmapi.Certificate{ + ObjectMeta: metav1.ObjectMeta{ + Name: "testcert", + Namespace: f.Namespace.Name, + }, + Spec: cmapi.CertificateSpec{ + SecretName: "testcert-tls", + CommonName: s.newDomain(), + IssuerRef: issuerRef, + DNSNames: []string{"foo." + s.newDomain()}, + }, + } + By("Creating a Certificate") + err := f.CRClient.Create(ctx, testCertificate) + Expect(err).NotTo(HaveOccurred()) + + By("Waiting for the Certificate to be issued...") + err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) + Expect(err).NotTo(HaveOccurred()) + }) }) } From 3d616b508832e197831c77e8b96024c9e1b34db2 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Wed, 4 Sep 2019 17:04:10 +0100 Subject: [PATCH 02/16] Adds vault issuer to e2e conformance tests Signed-off-by: JoshVanL --- .../conformance/certificates/BUILD.bazel | 1 + .../suite/conformance/certificates/ca/ca.go | 2 +- .../suite/conformance/certificates/suite.go | 4 +- .../certificates/vault/BUILD.bazel | 32 +++++ .../conformance/certificates/vault/vault.go | 116 ++++++++++++++++++ 5 files changed, 152 insertions(+), 3 deletions(-) create mode 100644 test/e2e/suite/conformance/certificates/vault/BUILD.bazel create mode 100644 test/e2e/suite/conformance/certificates/vault/vault.go diff --git a/test/e2e/suite/conformance/certificates/BUILD.bazel b/test/e2e/suite/conformance/certificates/BUILD.bazel index 10066fe49..2caa6b349 100644 --- a/test/e2e/suite/conformance/certificates/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/BUILD.bazel @@ -33,6 +33,7 @@ filegroup( "//test/e2e/suite/conformance/certificates/acme:all-srcs", "//test/e2e/suite/conformance/certificates/ca:all-srcs", "//test/e2e/suite/conformance/certificates/selfsigned:all-srcs", + "//test/e2e/suite/conformance/certificates/vault:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/test/e2e/suite/conformance/certificates/ca/ca.go b/test/e2e/suite/conformance/certificates/ca/ca.go index 049a36a11..a5afdacbe 100644 --- a/test/e2e/suite/conformance/certificates/ca/ca.go +++ b/test/e2e/suite/conformance/certificates/ca/ca.go @@ -36,7 +36,7 @@ var _ = framework.ConformanceDescribe("Certificates", func() { }) func createCAIssuer(f *framework.Framework) cmmeta.ObjectReference { - By("Creating a SelfSigned issuer") + By("Creating a CA issuer") rootCertSecret, err := f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Create(newSigningKeypairSecret("root-cert")) Expect(err).NotTo(HaveOccurred(), "failed to create root signing keypair secret") diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 4eb51407d..938f129a1 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -202,7 +202,7 @@ func (s *Suite) Define() { CommonName: s.newDomain(), IssuerRef: issuerRef, Duration: &metav1.Duration{ - Duration: time.Hour * 35, + Duration: time.Hour * 896, }, }, } @@ -214,7 +214,7 @@ func (s *Suite) Define() { err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) - f.CertificateDurationValid(testCertificate, time.Hour*35) + f.CertificateDurationValid(testCertificate, time.Hour*896) }) It("should issue a certificate which has a wildcard DNS name defined", func() { diff --git a/test/e2e/suite/conformance/certificates/vault/BUILD.bazel b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel new file mode 100644 index 000000000..85b729cf0 --- /dev/null +++ b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel @@ -0,0 +1,32 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["vault.go"], + importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/vault", + visibility = ["//visibility:public"], + deps = [ + "//pkg/apis/certmanager/v1alpha1:go_default_library", + "//test/e2e/framework:go_default_library", + "//test/e2e/framework/addon/tiller:go_default_library", + "//test/e2e/framework/addon/vault:go_default_library", + "//test/e2e/suite/conformance/certificates:go_default_library", + "//vendor/github.com/onsi/ginkgo:go_default_library", + "//vendor/github.com/onsi/gomega:go_default_library", + "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/test/e2e/suite/conformance/certificates/vault/vault.go b/test/e2e/suite/conformance/certificates/vault/vault.go new file mode 100644 index 000000000..0f7991420 --- /dev/null +++ b/test/e2e/suite/conformance/certificates/vault/vault.go @@ -0,0 +1,116 @@ +/* +Copyright 2019 The Jetstack cert-manager contributors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package selfsigned + +import ( + "path" + + . "github.com/onsi/ginkgo" + . "github.com/onsi/gomega" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" + "github.com/jetstack/cert-manager/test/e2e/framework" + "github.com/jetstack/cert-manager/test/e2e/framework/addon/tiller" + vaultaddon "github.com/jetstack/cert-manager/test/e2e/framework/addon/vault" + "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates" +) + +var _ = framework.ConformanceDescribe("Certificates", func() { + (&certificates.Suite{ + Name: "Vault", + CreateIssuerFunc: createVaultIssuer, + }).Define() +}) + +func createVaultIssuer(f *framework.Framework) cmapi.ObjectReference { + By("Creating a Vault issuer") + + var ( + tiller = &tiller.Tiller{ + Name: "tiller-deploy", + Namespace: f.Namespace.Name, + ClusterPermissions: false, + } + vault = &vaultaddon.Vault{ + Tiller: tiller, + Namespace: f.Namespace.Name, + Name: "cm-e2e-create-vault-issuer", + } + ) + + f.RequireAddon(tiller) + f.RequireAddon(vault) + + intermediateMount := "intermediate-ca" + role := "kubernetes-vault" + vaultSecretAppRoleName := "vault-role" + vaultPath := path.Join(intermediateMount, "sign", role) + authPath := "approle" + + By("Configuring the Vault server") + vaultInit := &vaultaddon.VaultInitializer{ + Details: *vault.Details(), + RootMount: "root-ca", + IntermediateMount: intermediateMount, + Role: role, + AuthPath: authPath, + } + err := vaultInit.Init() + Expect(err).NotTo(HaveOccurred()) + err = vaultInit.Setup() + Expect(err).NotTo(HaveOccurred()) + roleID, secretID, err := vaultInit.CreateAppRole() + Expect(err).NotTo(HaveOccurred()) + + _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Create(vaultaddon.NewVaultAppRoleSecret(vaultSecretAppRoleName, secretID)) + Expect(err).NotTo(HaveOccurred()) + + issuer, err := f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(&cmapi.Issuer{ + ObjectMeta: metav1.ObjectMeta{ + Name: "vault-issuer", + }, + Spec: cmapi.IssuerSpec{ + IssuerConfig: cmapi.IssuerConfig{ + Vault: &cmapi.VaultIssuer{ + Server: vault.Details().Host, + Path: vaultPath, + CABundle: vault.Details().VaultCA, + Auth: cmapi.VaultAuth{ + AppRole: cmapi.VaultAppRole{ + Path: authPath, + RoleId: roleID, + SecretRef: cmapi.SecretKeySelector{ + Key: "secretkey", + LocalObjectReference: cmapi.LocalObjectReference{ + Name: vaultSecretAppRoleName, + }, + }, + }, + }, + }, + }, + }, + }) + Expect(err).NotTo(HaveOccurred(), "failed to create vault issuer") + + return cmapi.ObjectReference{ + Group: cmapi.SchemeGroupVersion.Group, + Kind: cmapi.IssuerKind, + Name: issuer.Name, + } +} From eacd83a8bb9d356fdf65abedd1bb5b117046d358 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Wed, 4 Sep 2019 18:31:46 +0100 Subject: [PATCH 03/16] Adds venafi e2e conformance test Signed-off-by: JoshVanL --- test/e2e/suite/conformance/BUILD.bazel | 2 + .../conformance/certificates/BUILD.bazel | 1 + .../conformance/certificates/acme/acme.go | 2 +- .../suite/conformance/certificates/ca/ca.go | 2 +- .../conformance/certificates/vault/vault.go | 2 +- .../certificates/venafi/BUILD.bazel | 30 +++++++++ .../conformance/certificates/venafi/venafi.go | 62 +++++++++++++++++++ test/e2e/suite/conformance/doc.go | 2 + 8 files changed, 100 insertions(+), 3 deletions(-) create mode 100644 test/e2e/suite/conformance/certificates/venafi/BUILD.bazel create mode 100644 test/e2e/suite/conformance/certificates/venafi/venafi.go diff --git a/test/e2e/suite/conformance/BUILD.bazel b/test/e2e/suite/conformance/BUILD.bazel index 97d49e697..2d342f18c 100644 --- a/test/e2e/suite/conformance/BUILD.bazel +++ b/test/e2e/suite/conformance/BUILD.bazel @@ -10,6 +10,8 @@ go_library( "//test/e2e/suite/conformance/certificates/acme:go_default_library", "//test/e2e/suite/conformance/certificates/ca:go_default_library", "//test/e2e/suite/conformance/certificates/selfsigned:go_default_library", + "//test/e2e/suite/conformance/certificates/vault:go_default_library", + "//test/e2e/suite/conformance/certificates/venafi:go_default_library", "//test/e2e/suite/conformance/rbac:go_default_library", ], ) diff --git a/test/e2e/suite/conformance/certificates/BUILD.bazel b/test/e2e/suite/conformance/certificates/BUILD.bazel index 2caa6b349..182b3c3b1 100644 --- a/test/e2e/suite/conformance/certificates/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/BUILD.bazel @@ -34,6 +34,7 @@ filegroup( "//test/e2e/suite/conformance/certificates/ca:all-srcs", "//test/e2e/suite/conformance/certificates/selfsigned:all-srcs", "//test/e2e/suite/conformance/certificates/vault:all-srcs", + "//test/e2e/suite/conformance/certificates/venafi:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/test/e2e/suite/conformance/certificates/acme/acme.go b/test/e2e/suite/conformance/certificates/acme/acme.go index 96e0e4ded..897f83e60 100644 --- a/test/e2e/suite/conformance/certificates/acme/acme.go +++ b/test/e2e/suite/conformance/certificates/acme/acme.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package selfsigned +package acme import ( . "github.com/onsi/ginkgo" diff --git a/test/e2e/suite/conformance/certificates/ca/ca.go b/test/e2e/suite/conformance/certificates/ca/ca.go index a5afdacbe..8287579d0 100644 --- a/test/e2e/suite/conformance/certificates/ca/ca.go +++ b/test/e2e/suite/conformance/certificates/ca/ca.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package selfsigned +package ca import ( . "github.com/onsi/ginkgo" diff --git a/test/e2e/suite/conformance/certificates/vault/vault.go b/test/e2e/suite/conformance/certificates/vault/vault.go index 0f7991420..24ae74cf5 100644 --- a/test/e2e/suite/conformance/certificates/vault/vault.go +++ b/test/e2e/suite/conformance/certificates/vault/vault.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package selfsigned +package vault import ( "path" diff --git a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel new file mode 100644 index 000000000..1c2a5a768 --- /dev/null +++ b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel @@ -0,0 +1,30 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["venafi.go"], + importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/venafi", + visibility = ["//visibility:public"], + deps = [ + "//pkg/apis/certmanager/v1alpha1:go_default_library", + "//test/e2e/framework:go_default_library", + "//test/e2e/suite/conformance/certificates:go_default_library", + "//test/e2e/suite/issuers/venafi/addon:go_default_library", + "//vendor/github.com/onsi/ginkgo:go_default_library", + "//vendor/github.com/onsi/gomega:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go new file mode 100644 index 000000000..729319c41 --- /dev/null +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -0,0 +1,62 @@ +/* +Copyright 2019 The Jetstack cert-manager contributors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package venafi + +import ( + . "github.com/onsi/ginkgo" + . "github.com/onsi/gomega" + + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" + "github.com/jetstack/cert-manager/test/e2e/framework" + "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates" + vaddon "github.com/jetstack/cert-manager/test/e2e/suite/issuers/venafi/addon" +) + +var _ = framework.ConformanceDescribe("Certificates", func() { + // unsupportedFeatures is a list of features that are not supported by the ACME + // issuer type using HTTP01 + var unsupportedFeatures = certificates.NewFeatureSet( + certificates.IPAddressFeature, + certificates.Wildcards, + ) + + (&certificates.Suite{ + Name: "Venafi", + CreateIssuerFunc: createVenafiIssuer, + UnsupportedFeatures: unsupportedFeatures, + }).Define() +}) + +func createVenafiIssuer(f *framework.Framework) cmapi.ObjectReference { + By("Creating a Venafi issuer") + + tppAddon := &vaddon.VenafiTPP{ + Namespace: f.Namespace.Name, + } + + f.RequireAddon(tppAddon) + + issuer := tppAddon.Details().BuildIssuer() + issuer, err := f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(issuer) + Expect(err).NotTo(HaveOccurred()) + + return cmapi.ObjectReference{ + Group: cmapi.SchemeGroupVersion.Group, + Kind: cmapi.IssuerKind, + Name: issuer.Name, + } +} diff --git a/test/e2e/suite/conformance/doc.go b/test/e2e/suite/conformance/doc.go index ec2af0414..a050d7419 100644 --- a/test/e2e/suite/conformance/doc.go +++ b/test/e2e/suite/conformance/doc.go @@ -20,5 +20,7 @@ import ( _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/acme" _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/ca" _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/selfsigned" + _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/vault" + _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/venafi" _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/rbac" ) From 2c131e94db4d6b695f41d906b0634749c9424675 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Wed, 4 Sep 2019 18:36:07 +0100 Subject: [PATCH 04/16] Removes duration feature from acme and veanfi Signed-off-by: JoshVanL --- test/e2e/suite/conformance/certificates/acme/acme.go | 3 ++- test/e2e/suite/conformance/certificates/featureset.go | 2 +- test/e2e/suite/conformance/certificates/suite.go | 2 +- test/e2e/suite/conformance/certificates/venafi/venafi.go | 2 +- 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/test/e2e/suite/conformance/certificates/acme/acme.go b/test/e2e/suite/conformance/certificates/acme/acme.go index 897f83e60..15522c82c 100644 --- a/test/e2e/suite/conformance/certificates/acme/acme.go +++ b/test/e2e/suite/conformance/certificates/acme/acme.go @@ -35,7 +35,8 @@ var _ = framework.ConformanceDescribe("Certificates", func() { // issuer type using HTTP01 var unsupportedFeatures = certificates.NewFeatureSet( certificates.IPAddressFeature, - certificates.Wildcards, + certificates.WildcardsFeature, + certificates.DurationFeature, ) provisioner := &acmeIssuerProvisioner{setGroupName: false} diff --git a/test/e2e/suite/conformance/certificates/featureset.go b/test/e2e/suite/conformance/certificates/featureset.go index e6449971e..82d24a12e 100644 --- a/test/e2e/suite/conformance/certificates/featureset.go +++ b/test/e2e/suite/conformance/certificates/featureset.go @@ -86,5 +86,5 @@ const ( // Wildcards denotes tests that request certificates for wildcard domains. // Some issuer's disable wildcard certificate issuance, so this feature // allows runs of the suite to exclude those tests that utilise wildcards. - Wildcards Feature = "Wildcards" + WildcardsFeature Feature = "Wildcards" ) diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 938f129a1..2e122de4d 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -218,7 +218,7 @@ func (s *Suite) Define() { }) It("should issue a certificate which has a wildcard DNS name defined", func() { - s.checkFeatures(Wildcards) + s.checkFeatures(WildcardsFeature) testCertificate := &cmapi.Certificate{ ObjectMeta: metav1.ObjectMeta{ diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go index 729319c41..c80d8c457 100644 --- a/test/e2e/suite/conformance/certificates/venafi/venafi.go +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -31,7 +31,7 @@ var _ = framework.ConformanceDescribe("Certificates", func() { // issuer type using HTTP01 var unsupportedFeatures = certificates.NewFeatureSet( certificates.IPAddressFeature, - certificates.Wildcards, + certificates.DurationFeature, ) (&certificates.Suite{ From 91f2b1c05173ef5ec3dadfeef0f40fb945b50c10 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Fri, 6 Sep 2019 10:25:56 +0100 Subject: [PATCH 05/16] Uses create and delete for venafi and vault e2e conformance provisioners Signed-off-by: JoshVanL --- .../conformance/certificates/acme/acme.go | 28 +------- .../conformance/certificates/vault/vault.go | 70 +++++++++++-------- .../certificates/venafi/BUILD.bazel | 1 + .../conformance/certificates/venafi/venafi.go | 31 ++++++-- test/e2e/suite/issuers/venafi/addon/tpp.go | 3 +- 5 files changed, 69 insertions(+), 64 deletions(-) diff --git a/test/e2e/suite/conformance/certificates/acme/acme.go b/test/e2e/suite/conformance/certificates/acme/acme.go index 15522c82c..1c0fb5be2 100644 --- a/test/e2e/suite/conformance/certificates/acme/acme.go +++ b/test/e2e/suite/conformance/certificates/acme/acme.go @@ -39,33 +39,18 @@ var _ = framework.ConformanceDescribe("Certificates", func() { certificates.DurationFeature, ) - provisioner := &acmeIssuerProvisioner{setGroupName: false} + provisioner := new(acmeIssuerProvisioner) (&certificates.Suite{ Name: "ACME HTTP01", CreateIssuerFunc: provisioner.create, DeleteIssuerFunc: provisioner.delete, UnsupportedFeatures: unsupportedFeatures, }).Define() - - // crProvisioner sets the issuerRef.group field on Certificates it creates - crProvisioner := &acmeIssuerProvisioner{setGroupName: true} - (&certificates.Suite{ - Name: "ACME HTTP01 (CertificateRequest)", - CreateIssuerFunc: crProvisioner.create, - DeleteIssuerFunc: crProvisioner.delete, - UnsupportedFeatures: unsupportedFeatures, - }).Define() }) type acmeIssuerProvisioner struct { tiller *tiller.Tiller pebble *pebble.Pebble - // if setGroupName is true, the 'group name' field on the IssuerRef will be - // set the 'cert-manager.io'. - // Setting the group name will cause the new 'certificate requests' based - // implementation to be used, however this is not implemented for ACME yet - // See: https://github.com/jetstack/cert-manager/pull/1943 - setGroupName bool } func (a *acmeIssuerProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { @@ -128,17 +113,8 @@ func (a *acmeIssuerProvisioner) create(f *framework.Framework) cmmeta.ObjectRefe Expect(err).NotTo(HaveOccurred(), "failed to create acme issuer") return cmmeta.ObjectReference{ - Group: emptyOrString(a.setGroupName, cmapi.SchemeGroupVersion.Group), + Group: cmapi.SchemeGroupVersion.Group, Kind: cmapi.IssuerKind, Name: issuer.Name, } } - -// emptyOrString will return the given string 's' if 'set' is true, -// otherwise it will return the empty string. -func emptyOrString(set bool, s string) string { - if set { - return s - } - return "" -} diff --git a/test/e2e/suite/conformance/certificates/vault/vault.go b/test/e2e/suite/conformance/certificates/vault/vault.go index 24ae74cf5..878263be1 100644 --- a/test/e2e/suite/conformance/certificates/vault/vault.go +++ b/test/e2e/suite/conformance/certificates/vault/vault.go @@ -26,35 +26,48 @@ import ( cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" "github.com/jetstack/cert-manager/test/e2e/framework" "github.com/jetstack/cert-manager/test/e2e/framework/addon/tiller" - vaultaddon "github.com/jetstack/cert-manager/test/e2e/framework/addon/vault" + vault "github.com/jetstack/cert-manager/test/e2e/framework/addon/vault" "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates" ) var _ = framework.ConformanceDescribe("Certificates", func() { + provisioner := new(vaultProvisioner) + (&certificates.Suite{ Name: "Vault", - CreateIssuerFunc: createVaultIssuer, + CreateIssuerFunc: provisioner.create, + DeleteIssuerFunc: provisioner.delete, }).Define() }) -func createVaultIssuer(f *framework.Framework) cmapi.ObjectReference { +type vaultProvisioner struct { + tiller *tiller.Tiller + vault *vault.Vault +} + +func (v *vaultProvisioner) delete(f *framework.Framework, ref cmapi.ObjectReference) { + Expect(v.vault.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision vault") + Expect(v.tiller.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tiller") +} + +func (v *vaultProvisioner) create(f *framework.Framework) cmapi.ObjectReference { By("Creating a Vault issuer") - var ( - tiller = &tiller.Tiller{ - Name: "tiller-deploy", - Namespace: f.Namespace.Name, - ClusterPermissions: false, - } - vault = &vaultaddon.Vault{ - Tiller: tiller, - Namespace: f.Namespace.Name, - Name: "cm-e2e-create-vault-issuer", - } - ) + v.tiller = &tiller.Tiller{ + Name: "tiller-deploy", + Namespace: f.Namespace.Name, + ClusterPermissions: false, + } + Expect(v.tiller.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup tiller") + Expect(v.tiller.Provision()).NotTo(HaveOccurred(), "failed to provision tiller") - f.RequireAddon(tiller) - f.RequireAddon(vault) + v.vault = &vault.Vault{ + Tiller: v.tiller, + Namespace: f.Namespace.Name, + Name: "cm-e2e-create-vault-issuer", + } + Expect(v.vault.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup vault") + Expect(v.vault.Provision()).NotTo(HaveOccurred(), "failed to provision vault") intermediateMount := "intermediate-ca" role := "kubernetes-vault" @@ -63,22 +76,21 @@ func createVaultIssuer(f *framework.Framework) cmapi.ObjectReference { authPath := "approle" By("Configuring the Vault server") - vaultInit := &vaultaddon.VaultInitializer{ - Details: *vault.Details(), + vaultInit := &vault.VaultInitializer{ + Details: *v.vault.Details(), RootMount: "root-ca", IntermediateMount: intermediateMount, Role: role, AuthPath: authPath, } - err := vaultInit.Init() - Expect(err).NotTo(HaveOccurred()) - err = vaultInit.Setup() - Expect(err).NotTo(HaveOccurred()) - roleID, secretID, err := vaultInit.CreateAppRole() - Expect(err).NotTo(HaveOccurred()) + Expect(vaultInit.Init()).NotTo(HaveOccurred(), "failed to init vault") + Expect(vaultInit.Setup()).NotTo(HaveOccurred(), "fauled to setup vault") - _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Create(vaultaddon.NewVaultAppRoleSecret(vaultSecretAppRoleName, secretID)) - Expect(err).NotTo(HaveOccurred()) + roleID, secretID, err := vaultInit.CreateAppRole() + Expect(err).NotTo(HaveOccurred(), "vault to create app role from vault") + + _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Create(vault.NewVaultAppRoleSecret(vaultSecretAppRoleName, secretID)) + Expect(err).NotTo(HaveOccurred(), "vault to store app role secret from vault") issuer, err := f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(&cmapi.Issuer{ ObjectMeta: metav1.ObjectMeta{ @@ -87,9 +99,9 @@ func createVaultIssuer(f *framework.Framework) cmapi.ObjectReference { Spec: cmapi.IssuerSpec{ IssuerConfig: cmapi.IssuerConfig{ Vault: &cmapi.VaultIssuer{ - Server: vault.Details().Host, + Server: v.vault.Details().Host, Path: vaultPath, - CABundle: vault.Details().VaultCA, + CABundle: v.vault.Details().VaultCA, Auth: cmapi.VaultAuth{ AppRole: cmapi.VaultAppRole{ Path: authPath, diff --git a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel index 1c2a5a768..454ab9b20 100644 --- a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel @@ -8,6 +8,7 @@ go_library( deps = [ "//pkg/apis/certmanager/v1alpha1:go_default_library", "//test/e2e/framework:go_default_library", + "//test/e2e/framework/util/errors:go_default_library", "//test/e2e/suite/conformance/certificates:go_default_library", "//test/e2e/suite/issuers/venafi/addon:go_default_library", "//vendor/github.com/onsi/ginkgo:go_default_library", diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go index c80d8c457..d1c744706 100644 --- a/test/e2e/suite/conformance/certificates/venafi/venafi.go +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -22,6 +22,7 @@ import ( cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" "github.com/jetstack/cert-manager/test/e2e/framework" + "github.com/jetstack/cert-manager/test/e2e/framework/util/errors" "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates" vaddon "github.com/jetstack/cert-manager/test/e2e/suite/issuers/venafi/addon" ) @@ -34,25 +35,41 @@ var _ = framework.ConformanceDescribe("Certificates", func() { certificates.DurationFeature, ) + provisioner := new(venafiProvisioner) (&certificates.Suite{ Name: "Venafi", - CreateIssuerFunc: createVenafiIssuer, + CreateIssuerFunc: provisioner.create, + DeleteIssuerFunc: provisioner.delete, UnsupportedFeatures: unsupportedFeatures, }).Define() }) -func createVenafiIssuer(f *framework.Framework) cmapi.ObjectReference { +type venafiProvisioner struct { + tpp *vaddon.VenafiTPP +} + +func (v *venafiProvisioner) delete(f *framework.Framework, ref cmapi.ObjectReference) { + Expect(v.tpp.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tpp venafi") +} + +func (v *venafiProvisioner) create(f *framework.Framework) cmapi.ObjectReference { By("Creating a Venafi issuer") - tppAddon := &vaddon.VenafiTPP{ + v.tpp = &vaddon.VenafiTPP{ Namespace: f.Namespace.Name, } - f.RequireAddon(tppAddon) + err := v.tpp.Setup(f.Config) + if errors.IsSkip(err) { + framework.Skipf("Skipping test as addon could not be setup: %v", err) + } + Expect(err).NotTo(HaveOccurred(), "failed to setup tpp venafi") - issuer := tppAddon.Details().BuildIssuer() - issuer, err := f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(issuer) - Expect(err).NotTo(HaveOccurred()) + Expect(v.tpp.Provision()).NotTo(HaveOccurred(), "failed to provision tpp venafi") + + issuer := v.tpp.Details().BuildIssuer() + issuer, err = f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(issuer) + Expect(err).NotTo(HaveOccurred(), "failed to create issuer for venafi") return cmapi.ObjectReference{ Group: cmapi.SchemeGroupVersion.Group, diff --git a/test/e2e/suite/issuers/venafi/addon/tpp.go b/test/e2e/suite/issuers/venafi/addon/tpp.go index 74ac797aa..27ed74ff3 100644 --- a/test/e2e/suite/issuers/venafi/addon/tpp.go +++ b/test/e2e/suite/issuers/venafi/addon/tpp.go @@ -107,8 +107,7 @@ func (v *VenafiTPP) Details() *TPPDetails { } func (v *VenafiTPP) Deprovision() error { - v.Base.Details().KubeClient.CoreV1().Secrets(v.createdSecret.Namespace).Delete(v.createdSecret.Name, nil) - return nil + return v.Base.Details().KubeClient.CoreV1().Secrets(v.createdSecret.Namespace).Delete(v.createdSecret.Name, nil) } func (v *VenafiTPP) SupportsGlobal() bool { From ced21c287f1b78d19eef5d4480c9c71236bc38e1 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Fri, 6 Sep 2019 13:41:11 +0100 Subject: [PATCH 06/16] Conformance: Ensure if a certificate is deleted then a new certificate is signed with same key Signed-off-by: JoshVanL --- pkg/api/util/BUILD.bazel | 1 + pkg/api/util/names.go | 43 ++++++++++++ pkg/controller/certificates/BUILD.bazel | 37 ++++++----- pkg/controller/certificates/sync.go | 22 +------ pkg/controller/certificates/sync_test.go | 3 +- test/e2e/framework/addon/vault/setup.go | 1 + .../conformance/certificates/BUILD.bazel | 3 + .../suite/conformance/certificates/suite.go | 66 +++++++++++++++++++ .../certificates/vault/BUILD.bazel | 7 +- .../certificates/venafi/BUILD.bazel | 5 +- 10 files changed, 141 insertions(+), 47 deletions(-) create mode 100644 pkg/api/util/names.go diff --git a/pkg/api/util/BUILD.bazel b/pkg/api/util/BUILD.bazel index 3322dd028..7dac105fb 100644 --- a/pkg/api/util/BUILD.bazel +++ b/pkg/api/util/BUILD.bazel @@ -6,6 +6,7 @@ go_library( "conditions.go", "duration.go", "issuers.go", + "names.go", "usages.go", ], importpath = "github.com/jetstack/cert-manager/pkg/api/util", diff --git a/pkg/api/util/names.go b/pkg/api/util/names.go new file mode 100644 index 000000000..456ac5985 --- /dev/null +++ b/pkg/api/util/names.go @@ -0,0 +1,43 @@ +/* +Copyright 2019 The Jetstack cert-manager contributors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package util + +import ( + "encoding/json" + "fmt" + "hash/fnv" + + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" +) + +func ExpectedCertificateRequestName(crt *cmapi.Certificate) (string, error) { + crt = crt.DeepCopy() + specBytes, err := json.Marshal(crt.Spec) + if err != nil { + return "", err + } + + hashF := fnv.New32() + _, err = hashF.Write(specBytes) + if err != nil { + return "", err + } + + // shorten the cert name to 52 chars to ensure the total length of the name + // is less than or equal to 64 characters + return fmt.Sprintf("%.52s-%d", crt.Name, hashF.Sum32()), nil +} diff --git a/pkg/controller/certificates/BUILD.bazel b/pkg/controller/certificates/BUILD.bazel index 2ed9ec86f..74d7f61fa 100644 --- a/pkg/controller/certificates/BUILD.bazel +++ b/pkg/controller/certificates/BUILD.bazel @@ -39,6 +39,25 @@ go_library( ], ) +go_test( + name = "go_default_test", + srcs = ["sync_test.go"], + embed = [":go_default_library"], + deps = [ + "//pkg/api/util:go_default_library", + "//pkg/apis/certmanager/v1alpha2:go_default_library", + "//pkg/apis/meta/v1:go_default_library", + "//pkg/controller/test:go_default_library", + "//pkg/util/pki:go_default_library", + "//test/unit/gen:go_default_library", + "@io_k8s_api//core/v1:go_default_library", + "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", + "@io_k8s_apimachinery//pkg/runtime:go_default_library", + "@io_k8s_client_go//testing:go_default_library", + "@io_k8s_utils//clock/testing:go_default_library", + ], +) + filegroup( name = "package-srcs", srcs = glob(["**"]), @@ -52,21 +71,3 @@ filegroup( tags = ["automanaged"], visibility = ["//visibility:public"], ) - -go_test( - name = "go_default_test", - srcs = ["sync_test.go"], - embed = [":go_default_library"], - deps = [ - "//pkg/apis/certmanager/v1alpha2:go_default_library", - "//pkg/apis/meta/v1:go_default_library", - "//pkg/controller/test:go_default_library", - "//pkg/util/pki:go_default_library", - "//test/unit/gen:go_default_library", - "@io_k8s_api//core/v1:go_default_library", - "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", - "@io_k8s_apimachinery//pkg/runtime:go_default_library", - "@io_k8s_client_go//testing:go_default_library", - "@io_k8s_utils//clock/testing:go_default_library", - ], -) diff --git a/pkg/controller/certificates/sync.go b/pkg/controller/certificates/sync.go index 4c20393b1..1e045bb5e 100644 --- a/pkg/controller/certificates/sync.go +++ b/pkg/controller/certificates/sync.go @@ -21,10 +21,8 @@ import ( "crypto/ecdsa" "crypto/rsa" "crypto/x509" - "encoding/json" "encoding/pem" "fmt" - "hash/fnv" "reflect" "strings" "time" @@ -188,7 +186,7 @@ func (c *certificateRequestManager) processCertificate(ctx context.Context, crt // The certificate request name is a product of the certificate's spec, // which makes it unique and predictable. // First we compute what we expect it to be. - expectedReqName, err := expectedCertificateRequestName(crt) + expectedReqName, err := apiutil.ExpectedCertificateRequestName(crt) if err != nil { return fmt.Errorf("internal error hashing certificate spec: %v", err) } @@ -584,24 +582,6 @@ func (c *certificateRequestManager) certificateRequiresIssuance(ctx context.Cont return needsRenew, []string{"Certificate is expiring soon"}, nil } -func expectedCertificateRequestName(crt *cmapi.Certificate) (string, error) { - crt = crt.DeepCopy() - specBytes, err := json.Marshal(crt.Spec) - if err != nil { - return "", err - } - - hashF := fnv.New32() - _, err = hashF.Write(specBytes) - if err != nil { - return "", err - } - - // shorten the cert name to 52 chars to ensure the total length of the name - // is less than or equal to 64 characters - return fmt.Sprintf("%.52s-%d", crt.Name, hashF.Sum32()), nil -} - type generateCSRFn func(*cmapi.Certificate, []byte) ([]byte, error) func generateCSRImpl(crt *cmapi.Certificate, pk []byte) ([]byte, error) { diff --git a/pkg/controller/certificates/sync_test.go b/pkg/controller/certificates/sync_test.go index 260162413..9f5ecc437 100644 --- a/pkg/controller/certificates/sync_test.go +++ b/pkg/controller/certificates/sync_test.go @@ -31,6 +31,7 @@ import ( coretesting "k8s.io/client-go/testing" fakeclock "k8s.io/utils/clock/testing" + apiutil "github.com/jetstack/cert-manager/pkg/api/util" cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1" testpkg "github.com/jetstack/cert-manager/pkg/controller/test" @@ -81,7 +82,7 @@ func mustCreateCryptoBundle(t *testing.T, crt *cmapi.Certificate) cryptoBundle { } func createCryptoBundle(crt *cmapi.Certificate) (*cryptoBundle, error) { - reqName, err := expectedCertificateRequestName(crt) + reqName, err := apiutil.ExpectedCertificateRequestName(crt) if err != nil { return nil, err } diff --git a/test/e2e/framework/addon/vault/setup.go b/test/e2e/framework/addon/vault/setup.go index 27521aebb..06a5958f4 100644 --- a/test/e2e/framework/addon/vault/setup.go +++ b/test/e2e/framework/addon/vault/setup.go @@ -406,6 +406,7 @@ func (v *VaultInitializer) setupRole() error { params := map[string]string{ "allow_any_name": "true", "max_ttl": "2160h", + "key_type": "all", } url := path.Join("/v1", v.IntermediateMount, "roles", v.Role) diff --git a/test/e2e/suite/conformance/certificates/BUILD.bazel b/test/e2e/suite/conformance/certificates/BUILD.bazel index 182b3c3b1..610418200 100644 --- a/test/e2e/suite/conformance/certificates/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/BUILD.bazel @@ -9,12 +9,15 @@ go_library( importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates", visibility = ["//visibility:public"], deps = [ + "//pkg/api/util:go_default_library", "//pkg/apis/certmanager/v1alpha2:go_default_library", "//pkg/apis/meta/v1:go_default_library", "//pkg/util:go_default_library", + "//pkg/util/pki:go_default_library", "//test/e2e/framework:go_default_library", "@com_github_onsi_ginkgo//:go_default_library", "@com_github_onsi_gomega//:go_default_library", + "@io_k8s_api//core/v1:go_default_library", "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", ], ) diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 2e122de4d..6fc07ce83 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -23,11 +23,14 @@ import ( . "github.com/onsi/ginkgo" . "github.com/onsi/gomega" + corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + apiutil "github.com/jetstack/cert-manager/pkg/api/util" cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1" "github.com/jetstack/cert-manager/pkg/util" + "github.com/jetstack/cert-manager/pkg/util/pki" "github.com/jetstack/cert-manager/test/e2e/framework" ) @@ -240,6 +243,69 @@ func (s *Suite) Define() { err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) }) + + It("should issue another certificate with the same private key if the existing certificate and CertificateRequest are deleted", func() { + testCertificate := &cmapi.Certificate{ + ObjectMeta: metav1.ObjectMeta{ + Name: "testcert", + Namespace: f.Namespace.Name, + }, + Spec: cmapi.CertificateSpec{ + SecretName: "testcert-tls", + CommonName: s.newDomain(), + DNSNames: []string{s.newDomain()}, + IssuerRef: issuerRef, + }, + } + By("Creating a Certificate") + err := f.CRClient.Create(ctx, testCertificate) + Expect(err).NotTo(HaveOccurred()) + + By("Waiting for the Certificate to be issued...") + err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) + Expect(err).NotTo(HaveOccurred()) + + By("Deleting existing certificate in Secret and owned CertificateRequest") + expectedReqName, err := apiutil.ExpectedCertificateRequestName(testCertificate) + Expect(err).NotTo(HaveOccurred(), "failed to generate expected name for created Certificate") + + Expect(f.CertManagerClientSet.CertmanagerV1alpha2(). + CertificateRequests(f.Namespace.Name).Delete(expectedReqName, &metav1.DeleteOptions{})). + NotTo(HaveOccurred(), "failed to delete owned CertificateRequest") + + sec, err := f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name). + Get(testCertificate.Spec.SecretName, metav1.GetOptions{}) + Expect(err).NotTo(HaveOccurred(), "failed to get secret containing signed certificate key pair") + + sec = sec.DeepCopy() + crtPEM1 := sec.Data[corev1.TLSCertKey] + crt1, err := pki.DecodeX509CertificateBytes(crtPEM1) + Expect(err).NotTo(HaveOccurred(), "failed to get decode first signed certificate") + + delete(sec.Data, corev1.TLSCertKey) + + _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Update(sec) + Expect(err).NotTo(HaveOccurred(), "failed to update secret by deleting the signed certificate") + + By("Waiting for the second Certificate to be issued...") + err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) + Expect(err).NotTo(HaveOccurred()) + + sec, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name). + Get(testCertificate.Spec.SecretName, metav1.GetOptions{}) + Expect(err).NotTo(HaveOccurred(), "failed to get 2nd secret containing signed certificate key pair") + crtPEM2 := sec.Data[corev1.TLSCertKey] + crt2, err := pki.DecodeX509CertificateBytes(crtPEM2) + Expect(err).NotTo(HaveOccurred(), "failed to get decode second signed certificate") + + By("Ensuing both certificates signed by same private key") + match, err := pki.PublicKeysEqual(crt1.PublicKey, crt2.PublicKey) + Expect(err).NotTo(HaveOccurred(), "failed to check public keys of both signed certificates") + + if !match { + Fail("Both signed certificates not signed by same private key") + } + }) }) } diff --git a/test/e2e/suite/conformance/certificates/vault/BUILD.bazel b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel index 85b729cf0..e25edb487 100644 --- a/test/e2e/suite/conformance/certificates/vault/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel @@ -6,14 +6,13 @@ go_library( importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/vault", visibility = ["//visibility:public"], deps = [ - "//pkg/apis/certmanager/v1alpha1:go_default_library", "//test/e2e/framework:go_default_library", "//test/e2e/framework/addon/tiller:go_default_library", "//test/e2e/framework/addon/vault:go_default_library", "//test/e2e/suite/conformance/certificates:go_default_library", - "//vendor/github.com/onsi/ginkgo:go_default_library", - "//vendor/github.com/onsi/gomega:go_default_library", - "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", + "@com_github_onsi_ginkgo//:go_default_library", + "@com_github_onsi_gomega//:go_default_library", + "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", ], ) diff --git a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel index 454ab9b20..4a3d730ee 100644 --- a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel @@ -6,13 +6,12 @@ go_library( importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/venafi", visibility = ["//visibility:public"], deps = [ - "//pkg/apis/certmanager/v1alpha1:go_default_library", "//test/e2e/framework:go_default_library", "//test/e2e/framework/util/errors:go_default_library", "//test/e2e/suite/conformance/certificates:go_default_library", "//test/e2e/suite/issuers/venafi/addon:go_default_library", - "//vendor/github.com/onsi/ginkgo:go_default_library", - "//vendor/github.com/onsi/gomega:go_default_library", + "@com_github_onsi_ginkgo//:go_default_library", + "@com_github_onsi_gomega//:go_default_library", ], ) From 0f55a21e32e72c260a72f6600c2ed340c1a496d2 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Mon, 9 Sep 2019 09:13:38 +0100 Subject: [PATCH 07/16] Set vault e2e to key_type=any Signed-off-by: JoshVanL --- test/e2e/framework/addon/vault/setup.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/framework/addon/vault/setup.go b/test/e2e/framework/addon/vault/setup.go index 06a5958f4..a8193b7c3 100644 --- a/test/e2e/framework/addon/vault/setup.go +++ b/test/e2e/framework/addon/vault/setup.go @@ -406,7 +406,7 @@ func (v *VaultInitializer) setupRole() error { params := map[string]string{ "allow_any_name": "true", "max_ttl": "2160h", - "key_type": "all", + "key_type": "any", } url := path.Join("/v1", v.IntermediateMount, "roles", v.Role) From 10777301d8d33f4b2717ca388dd3257cd71aa798 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Wed, 11 Sep 2019 15:04:31 +0100 Subject: [PATCH 08/16] Adds DNS acme conformance tests Signed-off-by: JoshVanL --- .../conformance/certificates/acme/BUILD.bazel | 5 +- .../conformance/certificates/acme/acme.go | 103 ++++++++++++++---- 2 files changed, 86 insertions(+), 22 deletions(-) diff --git a/test/e2e/suite/conformance/certificates/acme/BUILD.bazel b/test/e2e/suite/conformance/certificates/acme/BUILD.bazel index 02577b584..6bda145e7 100644 --- a/test/e2e/suite/conformance/certificates/acme/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/acme/BUILD.bazel @@ -13,6 +13,7 @@ go_library( "//test/e2e/framework/addon/pebble:go_default_library", "//test/e2e/framework/addon/tiller:go_default_library", "//test/e2e/suite/conformance/certificates:go_default_library", + "//test/e2e/suite/issuers/acme/dnsproviders:go_default_library", "@com_github_onsi_ginkgo//:go_default_library", "@com_github_onsi_gomega//:go_default_library", "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", @@ -21,14 +22,14 @@ go_library( filegroup( name = "package-srcs", + visibility = ["//visibility:private"], srcs = glob(["**"]), tags = ["automanaged"], - visibility = ["//visibility:private"], ) filegroup( name = "all-srcs", srcs = [":package-srcs"], - tags = ["automanaged"], visibility = ["//visibility:public"], + tags = ["automanaged"], ) diff --git a/test/e2e/suite/conformance/certificates/acme/acme.go b/test/e2e/suite/conformance/certificates/acme/acme.go index 1c0fb5be2..4805b349c 100644 --- a/test/e2e/suite/conformance/certificates/acme/acme.go +++ b/test/e2e/suite/conformance/certificates/acme/acme.go @@ -28,6 +28,7 @@ import ( "github.com/jetstack/cert-manager/test/e2e/framework/addon/pebble" "github.com/jetstack/cert-manager/test/e2e/framework/addon/tiller" "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates" + "github.com/jetstack/cert-manager/test/e2e/suite/issuers/acme/dnsproviders" ) var _ = framework.ConformanceDescribe("Certificates", func() { @@ -39,51 +40,60 @@ var _ = framework.ConformanceDescribe("Certificates", func() { certificates.DurationFeature, ) - provisioner := new(acmeIssuerProvisioner) + provisionerHTTP01 := new(acmeIssuerProvisioner) (&certificates.Suite{ Name: "ACME HTTP01", - CreateIssuerFunc: provisioner.create, - DeleteIssuerFunc: provisioner.delete, + CreateIssuerFunc: provisionerHTTP01.createHTTP01, + DeleteIssuerFunc: provisionerHTTP01.delete, + UnsupportedFeatures: unsupportedFeatures, + }).Define() + + provisionerDNS01 := new(acmeIssuerProvisioner) + (&certificates.Suite{ + Name: "ACME DNS01", + CreateIssuerFunc: provisionerDNS01.createDNS01, + DeleteIssuerFunc: provisionerDNS01.delete, UnsupportedFeatures: unsupportedFeatures, }).Define() }) type acmeIssuerProvisioner struct { - tiller *tiller.Tiller - pebble *pebble.Pebble + tiller *tiller.Tiller + pebble *pebble.Pebble + cloudflair *dnsproviders.Cloudflare } func (a *acmeIssuerProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { - Expect(a.pebble.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision pebble") + if a.pebble != nil { + Expect(a.pebble.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision pebble") + } + if a.cloudflair != nil { + Expect(a.cloudflair.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision cloudflair") + } Expect(a.tiller.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tiller") } -// create will deploy the required components to run an ACME issuer based test. +// createXXX will deploy the required components to run an ACME issuer based test. // This includes: // - tiller // - pebble // - a properly configured Issuer resource -func (a *acmeIssuerProvisioner) create(f *framework.Framework) cmmeta.ObjectReference { - a.tiller = &tiller.Tiller{ - Name: "tiller-deploy", - ClusterPermissions: false, - Namespace: f.Namespace.Name, - } - Expect(a.tiller.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup tiller") - Expect(a.tiller.Provision()).NotTo(HaveOccurred(), "failed to provision tiller") + +func (a *acmeIssuerProvisioner) createHTTP01(f *framework.Framework) cmmeta.ObjectReference { + a.deployTiller(f, "http01") a.pebble = &pebble.Pebble{ Tiller: a.tiller, - Name: "cm-e2e-create-acme-issuer", + Name: "cm-e2e-create-acme-http01-issuer", Namespace: f.Namespace.Name, } Expect(a.pebble.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup pebble") Expect(a.pebble.Provision()).NotTo(HaveOccurred(), "failed to provision pebble") - By("Creating an ACME issuer") + By("Creating an ACME HTTP01 issuer") issuer := &cmapi.Issuer{ ObjectMeta: metav1.ObjectMeta{ - Name: "acme-issuer", + Name: "acme-issuer-http01", }, Spec: cmapi.IssuerSpec{ IssuerConfig: cmapi.IssuerConfig{ @@ -92,7 +102,7 @@ func (a *acmeIssuerProvisioner) create(f *framework.Framework) cmmeta.ObjectRefe SkipTLSVerify: true, PrivateKey: cmmeta.SecretKeySelector{ LocalObjectReference: cmmeta.LocalObjectReference{ - Name: "acme-private-key", + Name: "acme-private-key-http01", }, }, Solvers: []cmacme.ACMEChallengeSolver{ @@ -109,8 +119,9 @@ func (a *acmeIssuerProvisioner) create(f *framework.Framework) cmmeta.ObjectRefe }, }, } + issuer, err := f.CertManagerClientSet.CertmanagerV1alpha2().Issuers(f.Namespace.Name).Create(issuer) - Expect(err).NotTo(HaveOccurred(), "failed to create acme issuer") + Expect(err).NotTo(HaveOccurred(), "failed to create acme HTTP01 issuer") return cmmeta.ObjectReference{ Group: cmapi.SchemeGroupVersion.Group, @@ -118,3 +129,55 @@ func (a *acmeIssuerProvisioner) create(f *framework.Framework) cmmeta.ObjectRefe Name: issuer.Name, } } + +func (a *acmeIssuerProvisioner) createDNS01(f *framework.Framework) cmmeta.ObjectReference { + a.deployTiller(f, "dns01") + + a.cloudflair = &dnsproviders.Cloudflare{} + Expect(a.cloudflair.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup cloudflair") + Expect(a.cloudflair.Provision()).NotTo(HaveOccurred(), "failed to provision cloudflair") + + By("Creating an ACME DNS01 issuer") + issuer := &cmapi.Issuer{ + ObjectMeta: metav1.ObjectMeta{ + Name: "acme-issuer-dns01", + }, + Spec: cmapi.IssuerSpec{ + IssuerConfig: cmapi.IssuerConfig{ + ACME: &cmacme.ACMEIssuer{ + // Hardcode this to the acme staging endpoint now due to issues with pebble dns resolution + Server: "https://acme-staging-v02.api.letsencrypt.org/directory", + SkipTLSVerify: true, + PrivateKey: cmmeta.SecretKeySelector{ + LocalObjectReference: cmmeta.LocalObjectReference{ + Name: "acme-private-key", + }, + }, + Solvers: []cmacme.ACMEChallengeSolver{ + { + DNS01: &a.cloudflair.Details().ProviderConfig, + }, + }, + }, + }, + }, + } + issuer, err := f.CertManagerClientSet.CertmanagerV1alpha2().Issuers(f.Namespace.Name).Create(issuer) + Expect(err).NotTo(HaveOccurred(), "failed to create acme HTTP01 issuer") + + return cmmeta.ObjectReference{ + Group: cmapi.SchemeGroupVersion.Group, + Kind: cmapi.IssuerKind, + Name: issuer.Name, + } +} + +func (a *acmeIssuerProvisioner) deployTiller(f *framework.Framework, solverType string) { + a.tiller = &tiller.Tiller{ + Name: "tiller-deploy-" + solverType, + ClusterPermissions: false, + Namespace: f.Namespace.Name, + } + Expect(a.tiller.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup tiller") + Expect(a.tiller.Provision()).NotTo(HaveOccurred(), "failed to provision tiller") +} From 05851d4029929bdf9f8c704825b73d0f08db34b4 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Fri, 13 Sep 2019 16:22:28 +0100 Subject: [PATCH 09/16] e2e: update secret key with no data rather than delete key Signed-off-by: JoshVanL --- test/e2e/suite/conformance/certificates/suite.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 6fc07ce83..5ea57e62b 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -282,7 +282,7 @@ func (s *Suite) Define() { crt1, err := pki.DecodeX509CertificateBytes(crtPEM1) Expect(err).NotTo(HaveOccurred(), "failed to get decode first signed certificate") - delete(sec.Data, corev1.TLSCertKey) + sec.Data[corev1.TLSCertKey] = []byte{} _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Update(sec) Expect(err).NotTo(HaveOccurred(), "failed to update secret by deleting the signed certificate") From bcd94fc2f13b569c699a82834c12f3756a2dd24e Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Wed, 18 Sep 2019 16:46:48 +0100 Subject: [PATCH 10/16] e2e: Adds fuz to cert duration check and fix waiting for cert unready Signed-off-by: JoshVanL --- test/e2e/framework/framework.go | 11 ++++++----- test/e2e/suite/conformance/certificates/suite.go | 6 +++++- test/e2e/suite/issuers/ca/certificate.go | 2 +- test/e2e/suite/issuers/selfsigned/certificate.go | 2 +- test/e2e/suite/issuers/vault/certificate/approle.go | 2 +- 5 files changed, 14 insertions(+), 9 deletions(-) diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index d204fd8b9..72f1a98b4 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -22,7 +22,6 @@ import ( . "github.com/onsi/ginkgo" . "github.com/onsi/gomega" - "k8s.io/api/core/v1" api "k8s.io/api/core/v1" apiext "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1" apiextcs "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset" @@ -78,7 +77,7 @@ type Framework struct { CRClient crclient.Client // Namespace in which all test resources should reside - Namespace *v1.Namespace + Namespace *api.Namespace // To make sure that this framework cleans up after itself, no matter what, // we install a Cleanup action before each test and clear it after. If we @@ -232,7 +231,7 @@ func (f *Framework) Helper() *helper.Helper { return f.helper } -func (f *Framework) CertificateDurationValid(c *v1alpha2.Certificate, duration time.Duration) { +func (f *Framework) CertificateDurationValid(c *v1alpha2.Certificate, duration time.Duration, fuzz time.Duration) { By("Verifying TLS certificate exists") secret, err := f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Get(c.Spec.SecretName, metav1.GetOptions{}) Expect(err).NotTo(HaveOccurred()) @@ -243,8 +242,10 @@ func (f *Framework) CertificateDurationValid(c *v1alpha2.Certificate, duration t cert, err := pki.DecodeX509CertificateBytes(certBytes) Expect(err).NotTo(HaveOccurred()) By("Verifying that the duration is valid") - if cert.NotAfter.Sub(cert.NotBefore) != duration { - Failf("Expected duration of %s, got %s [NotBefore: %s, NotAfter: %s]", duration, cert.NotAfter.Sub(cert.NotBefore), cert.NotBefore.Format(time.RFC3339), cert.NotAfter.Format(time.RFC3339)) + certDuration := cert.NotAfter.Sub(cert.NotBefore) + if certDuration > (duration+fuzz) || certDuration < duration { + Failf("Expected duration of %s, got %s (fuzz: %s) [NotBefore: %s, NotAfter: %s]", duration, certDuration, + fuzz, cert.NotBefore.Format(time.RFC3339), cert.NotAfter.Format(time.RFC3339)) } } diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 5ea57e62b..6d6606b14 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -217,7 +217,7 @@ func (s *Suite) Define() { err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) - f.CertificateDurationValid(testCertificate, time.Hour*896) + f.CertificateDurationValid(testCertificate, time.Hour*896, 30*time.Second) }) It("should issue a certificate which has a wildcard DNS name defined", func() { @@ -287,6 +287,10 @@ func (s *Suite) Define() { _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Update(sec) Expect(err).NotTo(HaveOccurred(), "failed to update secret by deleting the signed certificate") + By("Waiting for the Certificate to become un-ready") + _, err = f.Helper().WaitForCertificateNotReady(f.Namespace.Name, "testcert", time.Second*30) + Expect(err).NotTo(HaveOccurred()) + By("Waiting for the second Certificate to be issued...") err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) diff --git a/test/e2e/suite/issuers/ca/certificate.go b/test/e2e/suite/issuers/ca/certificate.go index 1f78108b0..ef57f1af7 100644 --- a/test/e2e/suite/issuers/ca/certificate.go +++ b/test/e2e/suite/issuers/ca/certificate.go @@ -123,7 +123,7 @@ var _ = framework.CertManagerDescribe("CA Certificate", func() { By("Verifying the Certificate is valid") err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Second*30) Expect(err).NotTo(HaveOccurred()) - f.CertificateDurationValid(cert, v.expectedDuration) + f.CertificateDurationValid(cert, v.expectedDuration, 0) }) } }) diff --git a/test/e2e/suite/issuers/selfsigned/certificate.go b/test/e2e/suite/issuers/selfsigned/certificate.go index 9ac884a3c..9c02f504a 100644 --- a/test/e2e/suite/issuers/selfsigned/certificate.go +++ b/test/e2e/suite/issuers/selfsigned/certificate.go @@ -102,7 +102,7 @@ var _ = framework.CertManagerDescribe("Self Signed Certificate", func() { Expect(err).NotTo(HaveOccurred()) err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Second*30) Expect(err).NotTo(HaveOccurred()) - f.CertificateDurationValid(cert, v.expectedDuration) + f.CertificateDurationValid(cert, v.expectedDuration, 0) }) } diff --git a/test/e2e/suite/issuers/vault/certificate/approle.go b/test/e2e/suite/issuers/vault/certificate/approle.go index 8e1bb3078..252ee4abd 100644 --- a/test/e2e/suite/issuers/vault/certificate/approle.go +++ b/test/e2e/suite/issuers/vault/certificate/approle.go @@ -178,7 +178,7 @@ var _ = framework.CertManagerDescribe("Vault Certificate (AppRole)", func() { Expect(err).NotTo(HaveOccurred()) // Vault substract 30 seconds to the NotBefore date. - f.CertificateDurationValid(cert, v.expectedDuration+(30*time.Second)) + f.CertificateDurationValid(cert, v.expectedDuration, time.Second*30) }) } }) From 3c0b90169089cfd7fd0378028519787559f63a2c Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Thu, 19 Sep 2019 11:29:57 +0100 Subject: [PATCH 11/16] Disable EC key conformance test for venafi issuer Signed-off-by: JoshVanL --- .../e2e/suite/conformance/certificates/featureset.go | 12 +++++++++--- test/e2e/suite/conformance/certificates/suite.go | 2 ++ .../suite/conformance/certificates/venafi/venafi.go | 9 ++++++--- 3 files changed, 17 insertions(+), 6 deletions(-) diff --git a/test/e2e/suite/conformance/certificates/featureset.go b/test/e2e/suite/conformance/certificates/featureset.go index 82d24a12e..88fcc8b82 100644 --- a/test/e2e/suite/conformance/certificates/featureset.go +++ b/test/e2e/suite/conformance/certificates/featureset.go @@ -83,8 +83,14 @@ const ( // will never pass tests that validate the duration is as expected. DurationFeature Feature = "Duration" - // Wildcards denotes tests that request certificates for wildcard domains. - // Some issuer's disable wildcard certificate issuance, so this feature - // allows runs of the suite to exclude those tests that utilise wildcards. + // WildcardsFeature denotes tests that request certificates for wildcard + // domains. Some issuer's disable wildcard certificate issuance, so this + // feature allows runs of the suite to exclude those tests that utilise + // wildcards. WildcardsFeature Feature = "Wildcards" + + // ECDSAFeature denotes whether the target issuer is able to sign + // certificates with an elliptic curve private key. This is useful for some + // issuers that have trouble being configured to support this feature. + ECDSAFeautre Feature = "ECDSA" ) diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 6d6606b14..e9d04480f 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -146,6 +146,8 @@ func (s *Suite) Define() { }) It("should issue an ECDSA, defaulted certificate for a single commonName and distinct dnsName", func() { + s.checkFeatures(ECDSAFeautre) + testCertificate := &cmapi.Certificate{ ObjectMeta: metav1.ObjectMeta{ Name: "testcert", diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go index d1c744706..b81d6a385 100644 --- a/test/e2e/suite/conformance/certificates/venafi/venafi.go +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -28,11 +28,14 @@ import ( ) var _ = framework.ConformanceDescribe("Certificates", func() { - // unsupportedFeatures is a list of features that are not supported by the ACME - // issuer type using HTTP01 + // unsupportedFeatures is a list of features that are not supported by the + // Venafi issuer. var unsupportedFeatures = certificates.NewFeatureSet( - certificates.IPAddressFeature, certificates.DurationFeature, + // Due to the current configuration of the test environment, it does not + // support signing certificates that pair with an elliptic curve private + // key. + certificates.ECDSAFeautre, ) provisioner := new(venafiProvisioner) From cd53c9e00429fa430a0b272a868504d6090a774c Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Thu, 19 Sep 2019 13:38:40 +0100 Subject: [PATCH 12/16] Wait for secret to contain cert for deletion e2e test Signed-off-by: JoshVanL --- test/e2e/framework/helper/BUILD.bazel | 1 + test/e2e/framework/helper/secret.go | 57 +++++++++++++++++++ .../suite/conformance/certificates/suite.go | 13 +---- 3 files changed, 61 insertions(+), 10 deletions(-) create mode 100644 test/e2e/framework/helper/secret.go diff --git a/test/e2e/framework/helper/BUILD.bazel b/test/e2e/framework/helper/BUILD.bazel index 88e79b55e..4c073016b 100644 --- a/test/e2e/framework/helper/BUILD.bazel +++ b/test/e2e/framework/helper/BUILD.bazel @@ -8,6 +8,7 @@ go_library( "helper.go", "kubectl.go", "pod_start.go", + "secret.go", ], importpath = "github.com/jetstack/cert-manager/test/e2e/framework/helper", tags = ["manual"], diff --git a/test/e2e/framework/helper/secret.go b/test/e2e/framework/helper/secret.go new file mode 100644 index 000000000..e6a9f33d6 --- /dev/null +++ b/test/e2e/framework/helper/secret.go @@ -0,0 +1,57 @@ +/* +Copyright 2019 The Jetstack cert-manager contributors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package helper + +import ( + "fmt" + "time" + + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/wait" + + "github.com/jetstack/cert-manager/test/e2e/framework/log" +) + +// WaitForCertificateReady waits for the certificate resource to enter a Ready +// state. +func (h *Helper) WaitForSecretCertificate(ns, name string, timeout time.Duration) (*corev1.Secret, error) { + var secret *corev1.Secret + err := wait.PollImmediate(time.Second, timeout, + func() (bool, error) { + var err error + log.Logf("Waiting for Secret %s:%s to contain a certificate", ns, name) + secret, err = h.KubeClient.CoreV1().Secrets(ns).Get(name, metav1.GetOptions{}) + if err != nil { + return false, fmt.Errorf("error getting secret %s: %s", name, err) + } + + if len(secret.Data[corev1.TLSCertKey]) > 0 { + return true, nil + } + + log.Logf("Expected Secret to contain Certificate but got no data %s:%s: %v", secret.Data) + return false, nil + }, + ) + + if err != nil { + return nil, err + } + + return secret, nil +} diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index e9d04480f..36e42e5a6 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -289,17 +289,10 @@ func (s *Suite) Define() { _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Update(sec) Expect(err).NotTo(HaveOccurred(), "failed to update secret by deleting the signed certificate") - By("Waiting for the Certificate to become un-ready") - _, err = f.Helper().WaitForCertificateNotReady(f.Namespace.Name, "testcert", time.Second*30) - Expect(err).NotTo(HaveOccurred()) + By("Waiting for the Certificate to re-issue a certificate") + sec, err = f.Helper().WaitForSecretCertificate(f.Namespace.Name, sec.Name, time.Minute*5) + Expect(err).NotTo(HaveOccurred(), "failed to wait for secret to have a valid 2nd certificate") - By("Waiting for the second Certificate to be issued...") - err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) - Expect(err).NotTo(HaveOccurred()) - - sec, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name). - Get(testCertificate.Spec.SecretName, metav1.GetOptions{}) - Expect(err).NotTo(HaveOccurred(), "failed to get 2nd secret containing signed certificate key pair") crtPEM2 := sec.Data[corev1.TLSCertKey] crt2, err := pki.DecodeX509CertificateBytes(crtPEM2) Expect(err).NotTo(HaveOccurred(), "failed to get decode second signed certificate") From 030d28ed5b156258d7da1a35bf600126f3a37dc6 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Mon, 23 Sep 2019 15:16:03 +0100 Subject: [PATCH 13/16] Update apis in e2e conformance tests Signed-off-by: JoshVanL --- .../certificates/vault/BUILD.bazel | 31 ------------------- .../conformance/certificates/vault/vault.go | 15 ++++----- .../certificates/venafi/BUILD.bazel | 30 ------------------ .../conformance/certificates/venafi/venafi.go | 11 ++++--- 4 files changed, 14 insertions(+), 73 deletions(-) delete mode 100644 test/e2e/suite/conformance/certificates/vault/BUILD.bazel delete mode 100644 test/e2e/suite/conformance/certificates/venafi/BUILD.bazel diff --git a/test/e2e/suite/conformance/certificates/vault/BUILD.bazel b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel deleted file mode 100644 index e25edb487..000000000 --- a/test/e2e/suite/conformance/certificates/vault/BUILD.bazel +++ /dev/null @@ -1,31 +0,0 @@ -load("@io_bazel_rules_go//go:def.bzl", "go_library") - -go_library( - name = "go_default_library", - srcs = ["vault.go"], - importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/vault", - visibility = ["//visibility:public"], - deps = [ - "//test/e2e/framework:go_default_library", - "//test/e2e/framework/addon/tiller:go_default_library", - "//test/e2e/framework/addon/vault:go_default_library", - "//test/e2e/suite/conformance/certificates:go_default_library", - "@com_github_onsi_ginkgo//:go_default_library", - "@com_github_onsi_gomega//:go_default_library", - "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", - ], -) - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) diff --git a/test/e2e/suite/conformance/certificates/vault/vault.go b/test/e2e/suite/conformance/certificates/vault/vault.go index 878263be1..65262f832 100644 --- a/test/e2e/suite/conformance/certificates/vault/vault.go +++ b/test/e2e/suite/conformance/certificates/vault/vault.go @@ -23,7 +23,8 @@ import ( . "github.com/onsi/gomega" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" + cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1" "github.com/jetstack/cert-manager/test/e2e/framework" "github.com/jetstack/cert-manager/test/e2e/framework/addon/tiller" vault "github.com/jetstack/cert-manager/test/e2e/framework/addon/vault" @@ -45,12 +46,12 @@ type vaultProvisioner struct { vault *vault.Vault } -func (v *vaultProvisioner) delete(f *framework.Framework, ref cmapi.ObjectReference) { +func (v *vaultProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { Expect(v.vault.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision vault") Expect(v.tiller.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tiller") } -func (v *vaultProvisioner) create(f *framework.Framework) cmapi.ObjectReference { +func (v *vaultProvisioner) create(f *framework.Framework) cmmeta.ObjectReference { By("Creating a Vault issuer") v.tiller = &tiller.Tiller{ @@ -92,7 +93,7 @@ func (v *vaultProvisioner) create(f *framework.Framework) cmapi.ObjectReference _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Create(vault.NewVaultAppRoleSecret(vaultSecretAppRoleName, secretID)) Expect(err).NotTo(HaveOccurred(), "vault to store app role secret from vault") - issuer, err := f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(&cmapi.Issuer{ + issuer, err := f.CertManagerClientSet.CertmanagerV1alpha2().Issuers(f.Namespace.Name).Create(&cmapi.Issuer{ ObjectMeta: metav1.ObjectMeta{ Name: "vault-issuer", }, @@ -106,9 +107,9 @@ func (v *vaultProvisioner) create(f *framework.Framework) cmapi.ObjectReference AppRole: cmapi.VaultAppRole{ Path: authPath, RoleId: roleID, - SecretRef: cmapi.SecretKeySelector{ + SecretRef: cmmeta.SecretKeySelector{ Key: "secretkey", - LocalObjectReference: cmapi.LocalObjectReference{ + LocalObjectReference: cmmeta.LocalObjectReference{ Name: vaultSecretAppRoleName, }, }, @@ -120,7 +121,7 @@ func (v *vaultProvisioner) create(f *framework.Framework) cmapi.ObjectReference }) Expect(err).NotTo(HaveOccurred(), "failed to create vault issuer") - return cmapi.ObjectReference{ + return cmmeta.ObjectReference{ Group: cmapi.SchemeGroupVersion.Group, Kind: cmapi.IssuerKind, Name: issuer.Name, diff --git a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel deleted file mode 100644 index 4a3d730ee..000000000 --- a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel +++ /dev/null @@ -1,30 +0,0 @@ -load("@io_bazel_rules_go//go:def.bzl", "go_library") - -go_library( - name = "go_default_library", - srcs = ["venafi.go"], - importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/venafi", - visibility = ["//visibility:public"], - deps = [ - "//test/e2e/framework:go_default_library", - "//test/e2e/framework/util/errors:go_default_library", - "//test/e2e/suite/conformance/certificates:go_default_library", - "//test/e2e/suite/issuers/venafi/addon:go_default_library", - "@com_github_onsi_ginkgo//:go_default_library", - "@com_github_onsi_gomega//:go_default_library", - ], -) - -filegroup( - name = "package-srcs", - srcs = glob(["**"]), - tags = ["automanaged"], - visibility = ["//visibility:private"], -) - -filegroup( - name = "all-srcs", - srcs = [":package-srcs"], - tags = ["automanaged"], - visibility = ["//visibility:public"], -) diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go index b81d6a385..151a9243b 100644 --- a/test/e2e/suite/conformance/certificates/venafi/venafi.go +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -20,7 +20,8 @@ import ( . "github.com/onsi/ginkgo" . "github.com/onsi/gomega" - cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha1" + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" + cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1" "github.com/jetstack/cert-manager/test/e2e/framework" "github.com/jetstack/cert-manager/test/e2e/framework/util/errors" "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates" @@ -51,11 +52,11 @@ type venafiProvisioner struct { tpp *vaddon.VenafiTPP } -func (v *venafiProvisioner) delete(f *framework.Framework, ref cmapi.ObjectReference) { +func (v *venafiProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { Expect(v.tpp.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tpp venafi") } -func (v *venafiProvisioner) create(f *framework.Framework) cmapi.ObjectReference { +func (v *venafiProvisioner) create(f *framework.Framework) cmmeta.ObjectReference { By("Creating a Venafi issuer") v.tpp = &vaddon.VenafiTPP{ @@ -71,10 +72,10 @@ func (v *venafiProvisioner) create(f *framework.Framework) cmapi.ObjectReference Expect(v.tpp.Provision()).NotTo(HaveOccurred(), "failed to provision tpp venafi") issuer := v.tpp.Details().BuildIssuer() - issuer, err = f.CertManagerClientSet.CertmanagerV1alpha1().Issuers(f.Namespace.Name).Create(issuer) + issuer, err = f.CertManagerClientSet.CertmanagerV1alpha2().Issuers(f.Namespace.Name).Create(issuer) Expect(err).NotTo(HaveOccurred(), "failed to create issuer for venafi") - return cmapi.ObjectReference{ + return cmmeta.ObjectReference{ Group: cmapi.SchemeGroupVersion.Group, Kind: cmapi.IssuerKind, Name: issuer.Name, From f1f30edf1a04f9f321b742b1869845898798b9fb Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Mon, 23 Sep 2019 16:04:17 +0100 Subject: [PATCH 14/16] Adds namespace to cloudflair provisioner Signed-off-by: JoshVanL --- test/e2e/suite/conformance/certificates/acme/acme.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/e2e/suite/conformance/certificates/acme/acme.go b/test/e2e/suite/conformance/certificates/acme/acme.go index 4805b349c..476b5a253 100644 --- a/test/e2e/suite/conformance/certificates/acme/acme.go +++ b/test/e2e/suite/conformance/certificates/acme/acme.go @@ -133,7 +133,9 @@ func (a *acmeIssuerProvisioner) createHTTP01(f *framework.Framework) cmmeta.Obje func (a *acmeIssuerProvisioner) createDNS01(f *framework.Framework) cmmeta.ObjectReference { a.deployTiller(f, "dns01") - a.cloudflair = &dnsproviders.Cloudflare{} + a.cloudflair = &dnsproviders.Cloudflare{ + Namespace: f.Namespace.Name, + } Expect(a.cloudflair.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup cloudflair") Expect(a.cloudflair.Provision()).NotTo(HaveOccurred(), "failed to provision cloudflair") From a96f93e0c9bc9b38fa1804f557707dbe9f3b3418 Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Mon, 23 Sep 2019 16:58:26 +0100 Subject: [PATCH 15/16] Disable reusing private keys for venafi e2e conformance Signed-off-by: JoshVanL --- test/e2e/suite/conformance/certificates/featureset.go | 5 +++++ test/e2e/suite/conformance/certificates/suite.go | 2 ++ test/e2e/suite/conformance/certificates/venafi/venafi.go | 3 ++- 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/test/e2e/suite/conformance/certificates/featureset.go b/test/e2e/suite/conformance/certificates/featureset.go index 88fcc8b82..8c41daf9f 100644 --- a/test/e2e/suite/conformance/certificates/featureset.go +++ b/test/e2e/suite/conformance/certificates/featureset.go @@ -93,4 +93,9 @@ const ( // certificates with an elliptic curve private key. This is useful for some // issuers that have trouble being configured to support this feature. ECDSAFeautre Feature = "ECDSA" + + // ReusePrivateKey denotes whether the target issuer is able to sign multiple + // certificates for the same private key. This is useful for some issuers + // that have trouble being configured to support this feature. + ReusePrivateKeyFeature Feature = "ReusePrivateKey" ) diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 36e42e5a6..5d457eb79 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -247,6 +247,8 @@ func (s *Suite) Define() { }) It("should issue another certificate with the same private key if the existing certificate and CertificateRequest are deleted", func() { + s.checkFeatures(ReusePrivateKeyFeature) + testCertificate := &cmapi.Certificate{ ObjectMeta: metav1.ObjectMeta{ Name: "testcert", diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go index 151a9243b..3b60783c9 100644 --- a/test/e2e/suite/conformance/certificates/venafi/venafi.go +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -35,8 +35,9 @@ var _ = framework.ConformanceDescribe("Certificates", func() { certificates.DurationFeature, // Due to the current configuration of the test environment, it does not // support signing certificates that pair with an elliptic curve private - // key. + // key or using the same private key multiple times. certificates.ECDSAFeautre, + certificates.ReusePrivateKeyFeature, ) provisioner := new(venafiProvisioner) From 869370e226038330451674f4b7e967907a2ec99e Mon Sep 17 00:00:00 2001 From: JoshVanL Date: Thu, 26 Sep 2019 15:46:03 +0100 Subject: [PATCH 16/16] Cleans up code and naming Signed-off-by: JoshVanL --- pkg/api/util/names.go | 2 +- pkg/controller/certificates/sync.go | 2 +- pkg/controller/certificates/sync_test.go | 2 +- test/e2e/framework/helper/secret.go | 9 ++--- .../conformance/certificates/acme/BUILD.bazel | 4 +-- .../conformance/certificates/acme/acme.go | 31 ++++++++++------- .../conformance/certificates/featureset.go | 2 +- .../suite/conformance/certificates/suite.go | 23 ++++++++----- .../certificates/vault/BUILD.bazel | 33 +++++++++++++++++++ .../vault/{vault.go => vault_approle.go} | 18 +++++----- .../certificates/venafi/BUILD.bazel | 32 ++++++++++++++++++ .../conformance/certificates/venafi/venafi.go | 2 +- 12 files changed, 119 insertions(+), 41 deletions(-) create mode 100644 test/e2e/suite/conformance/certificates/vault/BUILD.bazel rename test/e2e/suite/conformance/certificates/vault/{vault.go => vault_approle.go} (89%) create mode 100644 test/e2e/suite/conformance/certificates/venafi/BUILD.bazel diff --git a/pkg/api/util/names.go b/pkg/api/util/names.go index 456ac5985..65de19ea0 100644 --- a/pkg/api/util/names.go +++ b/pkg/api/util/names.go @@ -24,7 +24,7 @@ import ( cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1alpha2" ) -func ExpectedCertificateRequestName(crt *cmapi.Certificate) (string, error) { +func ComputeCertificateRequestName(crt *cmapi.Certificate) (string, error) { crt = crt.DeepCopy() specBytes, err := json.Marshal(crt.Spec) if err != nil { diff --git a/pkg/controller/certificates/sync.go b/pkg/controller/certificates/sync.go index 1e045bb5e..55de11a06 100644 --- a/pkg/controller/certificates/sync.go +++ b/pkg/controller/certificates/sync.go @@ -186,7 +186,7 @@ func (c *certificateRequestManager) processCertificate(ctx context.Context, crt // The certificate request name is a product of the certificate's spec, // which makes it unique and predictable. // First we compute what we expect it to be. - expectedReqName, err := apiutil.ExpectedCertificateRequestName(crt) + expectedReqName, err := apiutil.ComputeCertificateRequestName(crt) if err != nil { return fmt.Errorf("internal error hashing certificate spec: %v", err) } diff --git a/pkg/controller/certificates/sync_test.go b/pkg/controller/certificates/sync_test.go index 9f5ecc437..24f9cb66e 100644 --- a/pkg/controller/certificates/sync_test.go +++ b/pkg/controller/certificates/sync_test.go @@ -82,7 +82,7 @@ func mustCreateCryptoBundle(t *testing.T, crt *cmapi.Certificate) cryptoBundle { } func createCryptoBundle(crt *cmapi.Certificate) (*cryptoBundle, error) { - reqName, err := apiutil.ExpectedCertificateRequestName(crt) + reqName, err := apiutil.ComputeCertificateRequestName(crt) if err != nil { return nil, err } diff --git a/test/e2e/framework/helper/secret.go b/test/e2e/framework/helper/secret.go index e6a9f33d6..aac4e89ec 100644 --- a/test/e2e/framework/helper/secret.go +++ b/test/e2e/framework/helper/secret.go @@ -27,9 +27,9 @@ import ( "github.com/jetstack/cert-manager/test/e2e/framework/log" ) -// WaitForCertificateReady waits for the certificate resource to enter a Ready -// state. -func (h *Helper) WaitForSecretCertificate(ns, name string, timeout time.Duration) (*corev1.Secret, error) { +// WaitForSecretCertificateData waits for the certificate data to be ready +// inside a Secret created by cert-manager. +func (h *Helper) WaitForSecretCertificateData(ns, name string, timeout time.Duration) (*corev1.Secret, error) { var secret *corev1.Secret err := wait.PollImmediate(time.Second, timeout, func() (bool, error) { @@ -44,7 +44,8 @@ func (h *Helper) WaitForSecretCertificate(ns, name string, timeout time.Duration return true, nil } - log.Logf("Expected Secret to contain Certificate but got no data %s:%s: %v", secret.Data) + log.Logf("Secret still does not contain certificate data %s/%s: %v", + secret.Namespace, secret.Name, secret.Data) return false, nil }, ) diff --git a/test/e2e/suite/conformance/certificates/acme/BUILD.bazel b/test/e2e/suite/conformance/certificates/acme/BUILD.bazel index 6bda145e7..b5d48227d 100644 --- a/test/e2e/suite/conformance/certificates/acme/BUILD.bazel +++ b/test/e2e/suite/conformance/certificates/acme/BUILD.bazel @@ -22,14 +22,14 @@ go_library( filegroup( name = "package-srcs", - visibility = ["//visibility:private"], srcs = glob(["**"]), tags = ["automanaged"], + visibility = ["//visibility:private"], ) filegroup( name = "all-srcs", srcs = [":package-srcs"], - visibility = ["//visibility:public"], tags = ["automanaged"], + visibility = ["//visibility:public"], ) diff --git a/test/e2e/suite/conformance/certificates/acme/acme.go b/test/e2e/suite/conformance/certificates/acme/acme.go index 476b5a253..b4d3f19ca 100644 --- a/test/e2e/suite/conformance/certificates/acme/acme.go +++ b/test/e2e/suite/conformance/certificates/acme/acme.go @@ -32,11 +32,18 @@ import ( ) var _ = framework.ConformanceDescribe("Certificates", func() { - // unsupportedFeatures is a list of features that are not supported by the ACME + // unsupportedHTTP01Features is a list of features that are not supported by the ACME // issuer type using HTTP01 - var unsupportedFeatures = certificates.NewFeatureSet( + var unsupportedHTTP01Features = certificates.NewFeatureSet( certificates.IPAddressFeature, + certificates.DurationFeature, certificates.WildcardsFeature, + ) + + // unsupportedDNS01Features is a list of features that are not supported by the ACME + // issuer type using DNS01 + var unsupportedDNS01Features = certificates.NewFeatureSet( + certificates.IPAddressFeature, certificates.DurationFeature, ) @@ -45,7 +52,7 @@ var _ = framework.ConformanceDescribe("Certificates", func() { Name: "ACME HTTP01", CreateIssuerFunc: provisionerHTTP01.createHTTP01, DeleteIssuerFunc: provisionerHTTP01.delete, - UnsupportedFeatures: unsupportedFeatures, + UnsupportedFeatures: unsupportedHTTP01Features, }).Define() provisionerDNS01 := new(acmeIssuerProvisioner) @@ -53,22 +60,22 @@ var _ = framework.ConformanceDescribe("Certificates", func() { Name: "ACME DNS01", CreateIssuerFunc: provisionerDNS01.createDNS01, DeleteIssuerFunc: provisionerDNS01.delete, - UnsupportedFeatures: unsupportedFeatures, + UnsupportedFeatures: unsupportedDNS01Features, }).Define() }) type acmeIssuerProvisioner struct { tiller *tiller.Tiller pebble *pebble.Pebble - cloudflair *dnsproviders.Cloudflare + cloudflare *dnsproviders.Cloudflare } func (a *acmeIssuerProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { if a.pebble != nil { Expect(a.pebble.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision pebble") } - if a.cloudflair != nil { - Expect(a.cloudflair.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision cloudflair") + if a.cloudflare != nil { + Expect(a.cloudflare.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision cloudflare") } Expect(a.tiller.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tiller") } @@ -133,11 +140,11 @@ func (a *acmeIssuerProvisioner) createHTTP01(f *framework.Framework) cmmeta.Obje func (a *acmeIssuerProvisioner) createDNS01(f *framework.Framework) cmmeta.ObjectReference { a.deployTiller(f, "dns01") - a.cloudflair = &dnsproviders.Cloudflare{ + a.cloudflare = &dnsproviders.Cloudflare{ Namespace: f.Namespace.Name, } - Expect(a.cloudflair.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup cloudflair") - Expect(a.cloudflair.Provision()).NotTo(HaveOccurred(), "failed to provision cloudflair") + Expect(a.cloudflare.Setup(f.Config)).NotTo(HaveOccurred(), "failed to setup cloudflare") + Expect(a.cloudflare.Provision()).NotTo(HaveOccurred(), "failed to provision cloudflare") By("Creating an ACME DNS01 issuer") issuer := &cmapi.Issuer{ @@ -157,7 +164,7 @@ func (a *acmeIssuerProvisioner) createDNS01(f *framework.Framework) cmmeta.Objec }, Solvers: []cmacme.ACMEChallengeSolver{ { - DNS01: &a.cloudflair.Details().ProviderConfig, + DNS01: &a.cloudflare.Details().ProviderConfig, }, }, }, @@ -165,7 +172,7 @@ func (a *acmeIssuerProvisioner) createDNS01(f *framework.Framework) cmmeta.Objec }, } issuer, err := f.CertManagerClientSet.CertmanagerV1alpha2().Issuers(f.Namespace.Name).Create(issuer) - Expect(err).NotTo(HaveOccurred(), "failed to create acme HTTP01 issuer") + Expect(err).NotTo(HaveOccurred(), "failed to create acme DNS01 issuer") return cmmeta.ObjectReference{ Group: cmapi.SchemeGroupVersion.Group, diff --git a/test/e2e/suite/conformance/certificates/featureset.go b/test/e2e/suite/conformance/certificates/featureset.go index 8c41daf9f..0731f24a3 100644 --- a/test/e2e/suite/conformance/certificates/featureset.go +++ b/test/e2e/suite/conformance/certificates/featureset.go @@ -92,7 +92,7 @@ const ( // ECDSAFeature denotes whether the target issuer is able to sign // certificates with an elliptic curve private key. This is useful for some // issuers that have trouble being configured to support this feature. - ECDSAFeautre Feature = "ECDSA" + ECDSAFeature Feature = "ECDSA" // ReusePrivateKey denotes whether the target issuer is able to sign multiple // certificates for the same private key. This is useful for some issuers diff --git a/test/e2e/suite/conformance/certificates/suite.go b/test/e2e/suite/conformance/certificates/suite.go index 5d457eb79..e1d0b6799 100644 --- a/test/e2e/suite/conformance/certificates/suite.go +++ b/test/e2e/suite/conformance/certificates/suite.go @@ -146,7 +146,7 @@ func (s *Suite) Define() { }) It("should issue an ECDSA, defaulted certificate for a single commonName and distinct dnsName", func() { - s.checkFeatures(ECDSAFeautre) + s.checkFeatures(ECDSAFeature) testCertificate := &cmapi.Certificate{ ObjectMeta: metav1.ObjectMeta{ @@ -219,6 +219,11 @@ func (s *Suite) Define() { err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) + // We set a weird time here as the duration with should never be used as + // a default by an issuer. This lets us test issuers are using our given + // duration. + // We set a 30 second buffer time here since Vault issues certificates + // with an extra 30 seconds on its duration. f.CertificateDurationValid(testCertificate, time.Hour*896, 30*time.Second) }) @@ -269,8 +274,8 @@ func (s *Suite) Define() { err = f.Helper().WaitCertificateIssuedValid(f.Namespace.Name, "testcert", time.Minute*5) Expect(err).NotTo(HaveOccurred()) - By("Deleting existing certificate in Secret and owned CertificateRequest") - expectedReqName, err := apiutil.ExpectedCertificateRequestName(testCertificate) + By("Deleting existing certificate data in Secret and owned CertificateRequest") + expectedReqName, err := apiutil.ComputeCertificateRequestName(testCertificate) Expect(err).NotTo(HaveOccurred(), "failed to generate expected name for created Certificate") Expect(f.CertManagerClientSet.CertmanagerV1alpha2(). @@ -279,27 +284,27 @@ func (s *Suite) Define() { sec, err := f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name). Get(testCertificate.Spec.SecretName, metav1.GetOptions{}) - Expect(err).NotTo(HaveOccurred(), "failed to get secret containing signed certificate key pair") + Expect(err).NotTo(HaveOccurred(), "failed to get secret containing signed certificate key pair data") sec = sec.DeepCopy() crtPEM1 := sec.Data[corev1.TLSCertKey] crt1, err := pki.DecodeX509CertificateBytes(crtPEM1) - Expect(err).NotTo(HaveOccurred(), "failed to get decode first signed certificate") + Expect(err).NotTo(HaveOccurred(), "failed to get decode first signed certificate data") sec.Data[corev1.TLSCertKey] = []byte{} _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace.Name).Update(sec) - Expect(err).NotTo(HaveOccurred(), "failed to update secret by deleting the signed certificate") + Expect(err).NotTo(HaveOccurred(), "failed to update secret by deleting the signed certificate data") By("Waiting for the Certificate to re-issue a certificate") - sec, err = f.Helper().WaitForSecretCertificate(f.Namespace.Name, sec.Name, time.Minute*5) + sec, err = f.Helper().WaitForSecretCertificateData(f.Namespace.Name, sec.Name, time.Minute*5) Expect(err).NotTo(HaveOccurred(), "failed to wait for secret to have a valid 2nd certificate") crtPEM2 := sec.Data[corev1.TLSCertKey] crt2, err := pki.DecodeX509CertificateBytes(crtPEM2) - Expect(err).NotTo(HaveOccurred(), "failed to get decode second signed certificate") + Expect(err).NotTo(HaveOccurred(), "failed to get decode second signed certificate data") - By("Ensuing both certificates signed by same private key") + By("Ensuing both certificates are signed by same private key") match, err := pki.PublicKeysEqual(crt1.PublicKey, crt2.PublicKey) Expect(err).NotTo(HaveOccurred(), "failed to check public keys of both signed certificates") diff --git a/test/e2e/suite/conformance/certificates/vault/BUILD.bazel b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel new file mode 100644 index 000000000..67ecaf17f --- /dev/null +++ b/test/e2e/suite/conformance/certificates/vault/BUILD.bazel @@ -0,0 +1,33 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["vault_approle.go"], + importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/vault", + visibility = ["//visibility:public"], + deps = [ + "//pkg/apis/certmanager/v1alpha2:go_default_library", + "//pkg/apis/meta/v1:go_default_library", + "//test/e2e/framework:go_default_library", + "//test/e2e/framework/addon/tiller:go_default_library", + "//test/e2e/framework/addon/vault:go_default_library", + "//test/e2e/suite/conformance/certificates:go_default_library", + "@com_github_onsi_ginkgo//:go_default_library", + "@com_github_onsi_gomega//:go_default_library", + "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/test/e2e/suite/conformance/certificates/vault/vault.go b/test/e2e/suite/conformance/certificates/vault/vault_approle.go similarity index 89% rename from test/e2e/suite/conformance/certificates/vault/vault.go rename to test/e2e/suite/conformance/certificates/vault/vault_approle.go index 65262f832..bdc3ee1b6 100644 --- a/test/e2e/suite/conformance/certificates/vault/vault.go +++ b/test/e2e/suite/conformance/certificates/vault/vault_approle.go @@ -32,27 +32,27 @@ import ( ) var _ = framework.ConformanceDescribe("Certificates", func() { - provisioner := new(vaultProvisioner) + provisioner := new(vaultAppRoleProvisioner) (&certificates.Suite{ - Name: "Vault", + Name: "VaultAppRole", CreateIssuerFunc: provisioner.create, DeleteIssuerFunc: provisioner.delete, }).Define() }) -type vaultProvisioner struct { +type vaultAppRoleProvisioner struct { tiller *tiller.Tiller vault *vault.Vault } -func (v *vaultProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { +func (v *vaultAppRoleProvisioner) delete(f *framework.Framework, ref cmmeta.ObjectReference) { Expect(v.vault.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision vault") Expect(v.tiller.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tiller") } -func (v *vaultProvisioner) create(f *framework.Framework) cmmeta.ObjectReference { - By("Creating a Vault issuer") +func (v *vaultAppRoleProvisioner) create(f *framework.Framework) cmmeta.ObjectReference { + By("Creating a VaultAppRole issuer") v.tiller = &tiller.Tiller{ Name: "tiller-deploy", @@ -76,13 +76,13 @@ func (v *vaultProvisioner) create(f *framework.Framework) cmmeta.ObjectReference vaultPath := path.Join(intermediateMount, "sign", role) authPath := "approle" - By("Configuring the Vault server") + By("Configuring the VaultAppRole server") vaultInit := &vault.VaultInitializer{ Details: *v.vault.Details(), RootMount: "root-ca", IntermediateMount: intermediateMount, Role: role, - AuthPath: authPath, + AppRoleAuthPath: authPath, } Expect(vaultInit.Init()).NotTo(HaveOccurred(), "failed to init vault") Expect(vaultInit.Setup()).NotTo(HaveOccurred(), "fauled to setup vault") @@ -104,7 +104,7 @@ func (v *vaultProvisioner) create(f *framework.Framework) cmmeta.ObjectReference Path: vaultPath, CABundle: v.vault.Details().VaultCA, Auth: cmapi.VaultAuth{ - AppRole: cmapi.VaultAppRole{ + AppRole: &cmapi.VaultAppRole{ Path: authPath, RoleId: roleID, SecretRef: cmmeta.SecretKeySelector{ diff --git a/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel new file mode 100644 index 000000000..8a9c737c4 --- /dev/null +++ b/test/e2e/suite/conformance/certificates/venafi/BUILD.bazel @@ -0,0 +1,32 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = ["venafi.go"], + importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificates/venafi", + visibility = ["//visibility:public"], + deps = [ + "//pkg/apis/certmanager/v1alpha2:go_default_library", + "//pkg/apis/meta/v1:go_default_library", + "//test/e2e/framework:go_default_library", + "//test/e2e/framework/util/errors:go_default_library", + "//test/e2e/suite/conformance/certificates:go_default_library", + "//test/e2e/suite/issuers/venafi/addon:go_default_library", + "@com_github_onsi_ginkgo//:go_default_library", + "@com_github_onsi_gomega//:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/test/e2e/suite/conformance/certificates/venafi/venafi.go b/test/e2e/suite/conformance/certificates/venafi/venafi.go index 3b60783c9..380b9f340 100644 --- a/test/e2e/suite/conformance/certificates/venafi/venafi.go +++ b/test/e2e/suite/conformance/certificates/venafi/venafi.go @@ -36,7 +36,7 @@ var _ = framework.ConformanceDescribe("Certificates", func() { // Due to the current configuration of the test environment, it does not // support signing certificates that pair with an elliptic curve private // key or using the same private key multiple times. - certificates.ECDSAFeautre, + certificates.ECDSAFeature, certificates.ReusePrivateKeyFeature, )