From a469e07f1acb94f58dd458163bbd66343d9d6327 Mon Sep 17 00:00:00 2001 From: joshvanl Date: Wed, 16 Jun 2021 14:19:11 +0100 Subject: [PATCH] Adds Venafi E2E CertificateSigningRequest conformance suite Signed-off-by: joshvanl --- test/e2e/suite/conformance/BUILD.bazel | 1 + .../certificatesigningrequests/BUILD.bazel | 1 + .../venafi/BUILD.bazel | 36 +++++ .../venafi/cloud.go | 129 ++++++++++++++++++ .../certificatesigningrequests/venafi/tpp.go | 129 ++++++++++++++++++ test/e2e/suite/conformance/import.go | 1 + 6 files changed, 297 insertions(+) create mode 100644 test/e2e/suite/conformance/certificatesigningrequests/venafi/BUILD.bazel create mode 100644 test/e2e/suite/conformance/certificatesigningrequests/venafi/cloud.go create mode 100644 test/e2e/suite/conformance/certificatesigningrequests/venafi/tpp.go diff --git a/test/e2e/suite/conformance/BUILD.bazel b/test/e2e/suite/conformance/BUILD.bazel index c5397ea8a..d86719d37 100644 --- a/test/e2e/suite/conformance/BUILD.bazel +++ b/test/e2e/suite/conformance/BUILD.bazel @@ -17,6 +17,7 @@ go_library( "//test/e2e/suite/conformance/certificatesigningrequests/ca:go_default_library", "//test/e2e/suite/conformance/certificatesigningrequests/selfsigned:go_default_library", "//test/e2e/suite/conformance/certificatesigningrequests/vault:go_default_library", + "//test/e2e/suite/conformance/certificatesigningrequests/venafi:go_default_library", "//test/e2e/suite/conformance/rbac:go_default_library", ], ) diff --git a/test/e2e/suite/conformance/certificatesigningrequests/BUILD.bazel b/test/e2e/suite/conformance/certificatesigningrequests/BUILD.bazel index cee603c87..b5311223f 100644 --- a/test/e2e/suite/conformance/certificatesigningrequests/BUILD.bazel +++ b/test/e2e/suite/conformance/certificatesigningrequests/BUILD.bazel @@ -40,6 +40,7 @@ filegroup( "//test/e2e/suite/conformance/certificatesigningrequests/ca:all-srcs", "//test/e2e/suite/conformance/certificatesigningrequests/selfsigned:all-srcs", "//test/e2e/suite/conformance/certificatesigningrequests/vault:all-srcs", + "//test/e2e/suite/conformance/certificatesigningrequests/venafi:all-srcs", ], tags = ["automanaged"], visibility = ["//visibility:public"], diff --git a/test/e2e/suite/conformance/certificatesigningrequests/venafi/BUILD.bazel b/test/e2e/suite/conformance/certificatesigningrequests/venafi/BUILD.bazel new file mode 100644 index 000000000..caf05731d --- /dev/null +++ b/test/e2e/suite/conformance/certificatesigningrequests/venafi/BUILD.bazel @@ -0,0 +1,36 @@ +load("@io_bazel_rules_go//go:def.bzl", "go_library") + +go_library( + name = "go_default_library", + srcs = [ + "cloud.go", + "tpp.go", + ], + importpath = "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests/venafi", + visibility = ["//visibility:public"], + deps = [ + "//pkg/controller/certificatesigningrequests/util:go_default_library", + "//test/e2e/framework:go_default_library", + "//test/e2e/framework/addon/venafi:go_default_library", + "//test/e2e/framework/helper/featureset:go_default_library", + "//test/e2e/framework/util/errors:go_default_library", + "//test/e2e/suite/conformance/certificatesigningrequests:go_default_library", + "@com_github_onsi_ginkgo//:go_default_library", + "@com_github_onsi_gomega//:go_default_library", + "@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library", + ], +) + +filegroup( + name = "package-srcs", + srcs = glob(["**"]), + tags = ["automanaged"], + visibility = ["//visibility:private"], +) + +filegroup( + name = "all-srcs", + srcs = [":package-srcs"], + tags = ["automanaged"], + visibility = ["//visibility:public"], +) diff --git a/test/e2e/suite/conformance/certificatesigningrequests/venafi/cloud.go b/test/e2e/suite/conformance/certificatesigningrequests/venafi/cloud.go new file mode 100644 index 000000000..89f1c40b2 --- /dev/null +++ b/test/e2e/suite/conformance/certificatesigningrequests/venafi/cloud.go @@ -0,0 +1,129 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package venafi + +import ( + "context" + "fmt" + + . "github.com/onsi/ginkgo" + . "github.com/onsi/gomega" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "github.com/jetstack/cert-manager/pkg/controller/certificatesigningrequests/util" + "github.com/jetstack/cert-manager/test/e2e/framework" + "github.com/jetstack/cert-manager/test/e2e/framework/addon/venafi" + "github.com/jetstack/cert-manager/test/e2e/framework/helper/featureset" + "github.com/jetstack/cert-manager/test/e2e/framework/util/errors" + "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests" +) + +var _ = framework.ConformanceDescribe("CertificateSigningRequests", func() { + // unsupportedFeatures is a list of features that are not supported by the + // Venafi TPP issuer. + var unsupportedFeatures = featureset.NewFeatureSet( + // Venafi TPP doesn't allow setting a duration + featureset.DurationFeature, + // Due to the current configuration of the test environment, it does not + // support signing certificates that pair with an elliptic curve private + // key + featureset.ECDSAFeature, + // Our Venafi TPP doesn't allow setting non DNS SANs + // TODO: investigate options to enable these + featureset.EmailSANsFeature, + featureset.URISANsFeature, + featureset.IPAddressFeature, + // Venafi doesn't allow certs with empty CN & DN + featureset.OnlySAN, + // Venafi doesn't setting key usages. + featureset.KeyUsagesFeature, + ) + + venafiIssuer := new(cloud) + (&certificatesigningrequests.Suite{ + Name: "Venafi Cloud Issuer", + CreateIssuerFunc: venafiIssuer.createIssuer, + DeleteIssuerFunc: venafiIssuer.delete, + UnsupportedFeatures: unsupportedFeatures, + }).Define() + + venafiClusterIssuer := new(cloud) + (&certificatesigningrequests.Suite{ + Name: "Venafi Cloud Cluster Issuer", + CreateIssuerFunc: venafiClusterIssuer.createClusterIssuer, + DeleteIssuerFunc: venafiClusterIssuer.delete, + UnsupportedFeatures: unsupportedFeatures, + }).Define() +}) + +type cloud struct { + *venafi.VenafiCloud +} + +func (c *cloud) delete(f *framework.Framework, signerName string) { + Expect(c.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision cloud venafi") + + ref, _ := util.SignerIssuerRefFromSignerName(signerName) + if ref.Type == "clusterissuers" { + err := f.CertManagerClientSet.CertmanagerV1().ClusterIssuers().Delete(context.TODO(), ref.Name, metav1.DeleteOptions{}) + Expect(err).NotTo(HaveOccurred()) + } +} + +func (c *cloud) createIssuer(f *framework.Framework) string { + By("Creating a Venafi Cloud Issuer") + + c.VenafiCloud = &venafi.VenafiCloud{ + Namespace: f.Namespace.Name, + } + + err := c.Setup(f.Config) + if errors.IsSkip(err) { + framework.Skipf("Skipping test as addon could not be setup: %v", err) + } + Expect(err).NotTo(HaveOccurred(), "failed to provision venafi cloud issuer") + + Expect(c.Provision()).NotTo(HaveOccurred(), "failed to provision tpp venafi") + + issuer := c.Details().BuildIssuer() + issuer, err = f.CertManagerClientSet.CertmanagerV1().Issuers(f.Namespace.Name).Create(context.TODO(), issuer, metav1.CreateOptions{}) + Expect(err).NotTo(HaveOccurred(), "failed to create issuer for venafi") + + return fmt.Sprintf("issuers.cert-manager.io/%s.%s", issuer.Namespace, issuer.Name) +} + +func (c *cloud) createClusterIssuer(f *framework.Framework) string { + By("Creating a Venafi Cloud ClusterIssuer") + + c.VenafiCloud = &venafi.VenafiCloud{ + Namespace: f.Config.Addons.CertManager.ClusterResourceNamespace, + } + + err := c.Setup(f.Config) + if errors.IsSkip(err) { + framework.Skipf("Skipping test as addon could not be setup: %v", err) + } + Expect(err).NotTo(HaveOccurred(), "failed to setup tpp venafi") + + Expect(c.Provision()).NotTo(HaveOccurred(), "failed to provision tpp venafi") + + issuer := c.Details().BuildClusterIssuer() + issuer, err = f.CertManagerClientSet.CertmanagerV1().ClusterIssuers().Create(context.TODO(), issuer, metav1.CreateOptions{}) + Expect(err).NotTo(HaveOccurred(), "failed to create issuer for venafi") + + return fmt.Sprintf("clusterissuers.cert-manager.io/%s", issuer.Name) +} diff --git a/test/e2e/suite/conformance/certificatesigningrequests/venafi/tpp.go b/test/e2e/suite/conformance/certificatesigningrequests/venafi/tpp.go new file mode 100644 index 000000000..4bf1f97af --- /dev/null +++ b/test/e2e/suite/conformance/certificatesigningrequests/venafi/tpp.go @@ -0,0 +1,129 @@ +/* +Copyright 2021 The cert-manager Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package venafi + +import ( + "context" + "fmt" + + . "github.com/onsi/ginkgo" + . "github.com/onsi/gomega" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "github.com/jetstack/cert-manager/pkg/controller/certificatesigningrequests/util" + "github.com/jetstack/cert-manager/test/e2e/framework" + "github.com/jetstack/cert-manager/test/e2e/framework/addon/venafi" + "github.com/jetstack/cert-manager/test/e2e/framework/helper/featureset" + "github.com/jetstack/cert-manager/test/e2e/framework/util/errors" + "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests" +) + +var _ = framework.ConformanceDescribe("CertificateSigningRequests", func() { + // unsupportedFeatures is a list of features that are not supported by the + // Venafi TPP issuer. + var unsupportedFeatures = featureset.NewFeatureSet( + // Venafi TPP doesn't allow setting a duration + featureset.DurationFeature, + // Due to the current configuration of the test environment, it does not + // support signing certificates that pair with an elliptic curve private + // key + featureset.ECDSAFeature, + // Our Venafi TPP doesn't allow setting non DNS SANs + // TODO: investigate options to enable these + featureset.EmailSANsFeature, + featureset.URISANsFeature, + featureset.IPAddressFeature, + // Venafi doesn't allow certs with empty CN & DN + featureset.OnlySAN, + // Venafi doesn't setting key usages. + featureset.KeyUsagesFeature, + ) + + venafiIssuer := new(tpp) + (&certificatesigningrequests.Suite{ + Name: "Venafi TPP Issuer", + CreateIssuerFunc: venafiIssuer.createIssuer, + DeleteIssuerFunc: venafiIssuer.delete, + UnsupportedFeatures: unsupportedFeatures, + }).Define() + + venafiClusterIssuer := new(tpp) + (&certificatesigningrequests.Suite{ + Name: "Venafi TPP Cluster Issuer", + CreateIssuerFunc: venafiClusterIssuer.createClusterIssuer, + DeleteIssuerFunc: venafiClusterIssuer.delete, + UnsupportedFeatures: unsupportedFeatures, + }).Define() +}) + +type tpp struct { + *venafi.VenafiTPP +} + +func (t *tpp) delete(f *framework.Framework, signerName string) { + Expect(t.Deprovision()).NotTo(HaveOccurred(), "failed to deprovision tpp venafi") + ref, _ := util.SignerIssuerRefFromSignerName(signerName) + + if ref.Type == "clusterissuers" { + err := f.CertManagerClientSet.CertmanagerV1().ClusterIssuers().Delete(context.TODO(), ref.Name, metav1.DeleteOptions{}) + Expect(err).NotTo(HaveOccurred()) + } +} + +func (t *tpp) createIssuer(f *framework.Framework) string { + By("Creating a Venafi Issuer") + + t.VenafiTPP = &venafi.VenafiTPP{ + Namespace: f.Namespace.Name, + } + + err := t.Setup(f.Config) + if errors.IsSkip(err) { + framework.Skipf("Skipping test as addon could not be setup: %v", err) + } + Expect(err).NotTo(HaveOccurred(), "failed to setup tpp venafi") + + Expect(t.Provision()).NotTo(HaveOccurred(), "failed to provision tpp venafi") + + issuer := t.Details().BuildIssuer() + issuer, err = f.CertManagerClientSet.CertmanagerV1().Issuers(f.Namespace.Name).Create(context.TODO(), issuer, metav1.CreateOptions{}) + Expect(err).NotTo(HaveOccurred(), "failed to create issuer for venafi") + + return fmt.Sprintf("issuers.cert-manager.io/%s.%s", issuer.Namespace, issuer.Name) +} + +func (t *tpp) createClusterIssuer(f *framework.Framework) string { + By("Creating a Venafi ClusterIssuer") + + t.VenafiTPP = &venafi.VenafiTPP{ + Namespace: f.Config.Addons.CertManager.ClusterResourceNamespace, + } + + err := t.Setup(f.Config) + if errors.IsSkip(err) { + framework.Skipf("Skipping test as addon could not be setup: %v", err) + } + Expect(err).NotTo(HaveOccurred(), "failed to setup tpp venafi") + + Expect(t.Provision()).NotTo(HaveOccurred(), "failed to provision tpp venafi") + + issuer := t.Details().BuildClusterIssuer() + issuer, err = f.CertManagerClientSet.CertmanagerV1().ClusterIssuers().Create(context.TODO(), issuer, metav1.CreateOptions{}) + Expect(err).NotTo(HaveOccurred(), "failed to create issuer for venafi") + + return fmt.Sprintf("clusterissuers.cert-manager.io/%s", issuer.Name) +} diff --git a/test/e2e/suite/conformance/import.go b/test/e2e/suite/conformance/import.go index 61b61b9af..964c572dc 100644 --- a/test/e2e/suite/conformance/import.go +++ b/test/e2e/suite/conformance/import.go @@ -27,5 +27,6 @@ import ( _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests/ca" _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests/selfsigned" _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests/vault" + _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/certificatesigningrequests/venafi" _ "github.com/jetstack/cert-manager/test/e2e/suite/conformance/rbac" )