Skip to content

Commit 5073bbb

Browse files
pierDipipierDipi
committed
Add CA rotation tests
Signed-off-by: Pierangelo Di Pilato <[email protected]>
1 parent 1160b45 commit 5073bbb

File tree

10 files changed

+351
-1
lines changed

10 files changed

+351
-1
lines changed

Diff for: ‎test/rekt/apiserversource_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ func TestApiServerSourceDataPlaneTLS(t *testing.T) {
111111

112112
env.ParallelTest(ctx, t, apiserversourcefeatures.SendsEventsWithTLS())
113113
env.ParallelTest(ctx, t, apiserversourcefeatures.SendsEventsWithTLSTrustBundle())
114+
env.ParallelTest(ctx, t, apiserversourcefeatures.SendsEventsWithTLSWithAdditionalTrustBundle())
114115
}
115116

116117
func TestApiServerSourceDataPlane_EventModes(t *testing.T) {

Diff for: ‎test/rekt/features/apiserversource/data_plane.go

+57
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
duckv1 "knative.dev/pkg/apis/duck/v1"
2626
"knative.dev/pkg/network"
2727
"knative.dev/reconciler-test/pkg/environment"
28+
"knative.dev/reconciler-test/pkg/knative"
2829

2930
"knative.dev/eventing/pkg/eventingtls/eventingtlstesting"
3031
"knative.dev/eventing/test/rekt/resources/addressable"
@@ -271,6 +272,62 @@ func SendsEventsWithTLSTrustBundle() *feature.Feature {
271272
return f
272273
}
273274

275+
func SendsEventsWithTLSWithAdditionalTrustBundle() *feature.Feature {
276+
src := feature.MakeRandomK8sName("apiserversource")
277+
sink := feature.MakeRandomK8sName("sink")
278+
trustBundle := feature.MakeRandomK8sName("trust-bundle")
279+
280+
f := feature.NewFeatureNamed("Send events to TLS sink - additional trust bundle")
281+
282+
f.Prerequisite("should not run when Istio is enabled", featureflags.IstioDisabled())
283+
284+
f.Setup("install sink", eventshub.Install(sink, eventshub.StartReceiverTLS))
285+
286+
f.Setup("Add trust bundle to system namespace", func(ctx context.Context, t feature.T) {
287+
288+
configmap.Install(trustBundle, knative.KnativeNamespaceFromContext(ctx),
289+
configmap.WithLabels(map[string]string{"networking.knative.dev/trust-bundle": "true"}),
290+
configmap.WithData("ca.crt", *eventshub.GetCaCerts(ctx)),
291+
)(ctx, t)
292+
})
293+
294+
sacmName := feature.MakeRandomK8sName("apiserversource")
295+
f.Requirement("Create Service Account for ApiServerSource with RBAC for v1.Event resources",
296+
setupAccountAndRoleForPods(sacmName))
297+
298+
cfg := []manifest.CfgFn{
299+
apiserversource.WithServiceAccountName(sacmName),
300+
apiserversource.WithEventMode(v1.ResourceMode),
301+
apiserversource.WithResources(v1.APIVersionKindSelector{
302+
APIVersion: "v1",
303+
Kind: "Event",
304+
}),
305+
}
306+
307+
f.Requirement("install ApiServerSource", func(ctx context.Context, t feature.T) {
308+
cfg = append(cfg, apiserversource.WithSink(&duckv1.Destination{
309+
URI: &apis.URL{
310+
Scheme: "https", // Force using https
311+
Host: network.GetServiceHostname(sink, environment.FromContext(ctx).Namespace()),
312+
},
313+
CACerts: nil, // CA certs are in the new trust-bundle
314+
}))
315+
apiserversource.Install(src, cfg...)(ctx, t)
316+
})
317+
f.Requirement("ApiServerSource goes ready", apiserversource.IsReady(src))
318+
319+
f.Stable("ApiServerSource as event source").
320+
Must("delivers events on sink with ref",
321+
eventassert.OnStore(sink).
322+
Match(eventassert.MatchKind(eventshub.EventReceived)).
323+
MatchEvent(test.HasType("dev.knative.apiserver.resource.update")).
324+
AtLeast(1),
325+
).
326+
Must("Set sinkURI to HTTPS endpoint", source.ExpectHTTPSSink(apiserversource.Gvr(), src))
327+
328+
return f
329+
}
330+
274331
// SendsEventsWithEventTypes tests apiserversource to a ready broker.
275332
func SendsEventsWithEventTypes() *feature.Feature {
276333
source := feature.MakeRandomK8sName("source")

Diff for: ‎test/rekt/features/channel/eventing_tls_feature.go

+87
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,15 @@ import (
3131
"knative.dev/reconciler-test/pkg/eventshub"
3232
"knative.dev/reconciler-test/pkg/eventshub/assert"
3333
"knative.dev/reconciler-test/pkg/feature"
34+
"knative.dev/reconciler-test/pkg/knative"
3435
"knative.dev/reconciler-test/pkg/resources/service"
3536
"knative.dev/reconciler-test/resources/certificate"
3637

3738
"knative.dev/eventing/pkg/eventingtls/eventingtlstesting"
3839
"knative.dev/eventing/test/rekt/features/featureflags"
3940
"knative.dev/eventing/test/rekt/resources/addressable"
4041
"knative.dev/eventing/test/rekt/resources/channel_impl"
42+
"knative.dev/eventing/test/rekt/resources/configmap"
4143
"knative.dev/eventing/test/rekt/resources/subscription"
4244
)
4345

@@ -243,3 +245,88 @@ func SubscriptionTLSTrustBundle() *feature.Feature {
243245

244246
return f
245247
}
248+
249+
func SubscriptionTLSWithAdditionalTrustBundle() *feature.Feature {
250+
251+
channelName := feature.MakeRandomK8sName("channel")
252+
subscriptionName := feature.MakeRandomK8sName("sub")
253+
sink := feature.MakeRandomK8sName("sink")
254+
source := feature.MakeRandomK8sName("source")
255+
dlsName := feature.MakeRandomK8sName("dls")
256+
dlsSubscriptionName := feature.MakeRandomK8sName("dls-sub")
257+
trustBundle := feature.MakeRandomK8sName("trust-bundle")
258+
259+
f := feature.NewFeature()
260+
261+
f.Prerequisite("transport encryption is strict", featureflags.TransportEncryptionStrict())
262+
f.Prerequisite("should not run when Istio is enabled", featureflags.IstioDisabled())
263+
264+
f.Setup("Add trust bundle to system namespace", func(ctx context.Context, t feature.T) {
265+
266+
configmap.Install(trustBundle, knative.KnativeNamespaceFromContext(ctx),
267+
configmap.WithLabels(map[string]string{"networking.knative.dev/trust-bundle": "true"}),
268+
configmap.WithData("ca.crt", *eventshub.GetCaCerts(ctx)),
269+
)(ctx, t)
270+
})
271+
272+
f.Setup("install sink", eventshub.Install(sink, eventshub.StartReceiverTLS))
273+
f.Setup("install sink", eventshub.Install(dlsName, eventshub.StartReceiverTLS))
274+
f.Setup("install channel", channel_impl.Install(channelName))
275+
f.Setup("channel is ready", channel_impl.IsReady(channelName))
276+
277+
f.Setup("install subscription", func(ctx context.Context, t feature.T) {
278+
d := &duckv1.Destination{
279+
URI: &apis.URL{
280+
Scheme: "https", // Force using https
281+
Host: network.GetServiceHostname(sink, environment.FromContext(ctx).Namespace()),
282+
},
283+
CACerts: nil, // CA certs are in the new trust-bundle
284+
}
285+
subscription.Install(subscriptionName,
286+
subscription.WithChannel(channel_impl.AsRef(channelName)),
287+
subscription.WithSubscriberFromDestination(d))(ctx, t)
288+
})
289+
f.Setup("subscription is ready", subscription.IsReady(subscriptionName))
290+
f.Setup("install dead letter subscription", func(ctx context.Context, t feature.T) {
291+
d := &duckv1.Destination{
292+
URI: &apis.URL{
293+
Scheme: "https", // Force using https
294+
Host: network.GetServiceHostname(dlsName, environment.FromContext(ctx).Namespace()),
295+
},
296+
CACerts: nil, // CA certs are in the trust-bundle
297+
}
298+
299+
subscription.Install(dlsSubscriptionName,
300+
subscription.WithChannel(channel_impl.AsRef(channelName)),
301+
subscription.WithDeadLetterSinkFromDestination(d),
302+
subscription.WithSubscriber(nil, "http://127.0.0.1:2468", ""))(ctx, t)
303+
})
304+
f.Setup("subscription dead letter is ready", subscription.IsReady(dlsSubscriptionName))
305+
f.Setup("Channel has HTTPS address", channel_impl.ValidateAddress(channelName, addressable.AssertHTTPSAddress))
306+
307+
event := cetest.FullEvent()
308+
event.SetID(uuid.New().String())
309+
310+
f.Requirement("install source", eventshub.Install(source,
311+
eventshub.StartSenderToResourceTLS(channel_impl.GVR(), channelName, nil),
312+
eventshub.InputEvent(event),
313+
// Send multiple events so that we take into account that the certificate rotation might
314+
// be detected by the server after some time.
315+
eventshub.SendMultipleEvents(100, 3*time.Second),
316+
))
317+
318+
f.Assert("Event sent", assert.OnStore(source).
319+
MatchSentEvent(cetest.HasId(event.ID())).
320+
AtLeast(1),
321+
)
322+
f.Assert("Event received in sink", assert.OnStore(sink).
323+
MatchReceivedEvent(cetest.HasId(event.ID())).
324+
AtLeast(1),
325+
)
326+
f.Assert("Event received in dead letter sink", assert.OnStore(dlsName).
327+
MatchReceivedEvent(cetest.HasId(event.ID())).
328+
AtLeast(1),
329+
)
330+
331+
return f
332+
}

Diff for: ‎test/rekt/features/pingsource/features.go

+44
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,15 @@ import (
2727
"knative.dev/reconciler-test/pkg/environment"
2828
"knative.dev/reconciler-test/pkg/eventshub"
2929
"knative.dev/reconciler-test/pkg/feature"
30+
"knative.dev/reconciler-test/pkg/knative"
3031
"knative.dev/reconciler-test/pkg/manifest"
3132
"knative.dev/reconciler-test/pkg/resources/service"
3233

3334
sourcesv1 "knative.dev/eventing/pkg/apis/sources/v1"
3435
"knative.dev/eventing/pkg/eventingtls/eventingtlstesting"
3536
"knative.dev/eventing/test/rekt/resources/addressable"
3637
"knative.dev/eventing/test/rekt/resources/broker"
38+
"knative.dev/eventing/test/rekt/resources/configmap"
3739
"knative.dev/eventing/test/rekt/resources/eventtype"
3840
"knative.dev/eventing/test/rekt/resources/trigger"
3941

@@ -132,6 +134,48 @@ func SendsEventsTLSTrustBundle() *feature.Feature {
132134
return f
133135
}
134136

137+
func SendsEventsTLSWithAdditionalTrustBundle() *feature.Feature {
138+
src := feature.MakeRandomK8sName("pingsource")
139+
sink := feature.MakeRandomK8sName("sink")
140+
trustBundle := feature.MakeRandomK8sName("trust-bundle")
141+
142+
f := feature.NewFeature()
143+
144+
f.Prerequisite("should not run when Istio is enabled", featureflags.IstioDisabled())
145+
146+
f.Setup("install sink", eventshub.Install(sink, eventshub.StartReceiverTLS))
147+
148+
f.Setup("Add trust bundle to system namespace", func(ctx context.Context, t feature.T) {
149+
150+
configmap.Install(trustBundle, knative.KnativeNamespaceFromContext(ctx),
151+
configmap.WithLabels(map[string]string{"networking.knative.dev/trust-bundle": "true"}),
152+
configmap.WithData("ca.crt", *eventshub.GetCaCerts(ctx)),
153+
)(ctx, t)
154+
})
155+
156+
f.Requirement("install pingsource", func(ctx context.Context, t feature.T) {
157+
d := &duckv1.Destination{
158+
URI: &apis.URL{
159+
Scheme: "https", // Force using https
160+
Host: network.GetServiceHostname(sink, environment.FromContext(ctx).Namespace()),
161+
},
162+
CACerts: nil, // CA certs are in the trust-bundle
163+
}
164+
165+
pingsource.Install(src, pingsource.WithSink(d))(ctx, t)
166+
})
167+
f.Requirement("pingsource goes ready", pingsource.IsReady(src))
168+
169+
f.Stable("pingsource as event source").
170+
Must("delivers events", assert.OnStore(sink).
171+
Match(eventassert.MatchKind(eventshub.EventReceived)).
172+
MatchEvent(test.HasType("dev.knative.sources.ping")).
173+
AtLeast(1)).
174+
Must("Set sinkURI to HTTPS endpoint", source.ExpectHTTPSSink(pingsource.Gvr(), src))
175+
176+
return f
177+
}
178+
135179
func SendsEventsWithSinkURI() *feature.Feature {
136180
source := feature.MakeRandomK8sName("pingsource")
137181
sink := feature.MakeRandomK8sName("sink")

Diff for: ‎test/rekt/features/trigger/feature.go

+77
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"knative.dev/reconciler-test/pkg/environment"
2828
"knative.dev/reconciler-test/pkg/eventshub"
2929
"knative.dev/reconciler-test/pkg/feature"
30+
"knative.dev/reconciler-test/pkg/knative"
3031
"knative.dev/reconciler-test/pkg/manifest"
3132
"knative.dev/reconciler-test/pkg/resources/service"
3233

@@ -36,6 +37,7 @@ import (
3637
"knative.dev/eventing/pkg/eventingtls/eventingtlstesting"
3738
"knative.dev/eventing/test/rekt/features/featureflags"
3839
"knative.dev/eventing/test/rekt/resources/broker"
40+
"knative.dev/eventing/test/rekt/resources/configmap"
3941
"knative.dev/eventing/test/rekt/resources/pingsource"
4042
"knative.dev/eventing/test/rekt/resources/trigger"
4143
)
@@ -235,3 +237,78 @@ func TriggerWithTLSSubscriberTrustBundle() *feature.Feature {
235237

236238
return f
237239
}
240+
241+
func TriggerWithTLSSubscriberWithAdditionalCATrustBundles() *feature.Feature {
242+
f := feature.NewFeatureNamed("Trigger with TLS subscriber and additional trust bundle")
243+
244+
f.Prerequisite("should not run when Istio is enabled", featureflags.IstioDisabled())
245+
246+
brokerName := feature.MakeRandomK8sName("broker")
247+
sourceName := feature.MakeRandomK8sName("source")
248+
sinkName := feature.MakeRandomK8sName("sink")
249+
triggerName := feature.MakeRandomK8sName("trigger")
250+
dlsName := feature.MakeRandomK8sName("dls")
251+
dlsTriggerName := feature.MakeRandomK8sName("dls-trigger")
252+
trustBundle := feature.MakeRandomK8sName("trust-bundle")
253+
254+
eventToSend := test.FullEvent()
255+
256+
// Install Broker
257+
f.Setup("Install Broker", broker.Install(brokerName, broker.WithEnvConfig()...))
258+
f.Setup("Broker is ready", broker.IsReady(brokerName))
259+
f.Setup("Broker is addressable", broker.IsAddressable(brokerName))
260+
261+
// Install Sink
262+
f.Setup("Install Sink", eventshub.Install(sinkName, eventshub.StartReceiverTLS))
263+
f.Setup("Install dead letter sink service", eventshub.Install(dlsName, eventshub.StartReceiverTLS))
264+
265+
f.Setup("Add trust bundle to system namespace", func(ctx context.Context, t feature.T) {
266+
267+
configmap.Install(trustBundle, knative.KnativeNamespaceFromContext(ctx),
268+
configmap.WithLabels(map[string]string{"networking.knative.dev/trust-bundle": "true"}),
269+
configmap.WithData("ca.crt", *eventshub.GetCaCerts(ctx)),
270+
)(ctx, t)
271+
})
272+
273+
// Install Trigger
274+
f.Setup("Install trigger", func(ctx context.Context, t feature.T) {
275+
subscriber := &duckv1.Destination{
276+
URI: &apis.URL{
277+
Scheme: "https", // Force using https
278+
Host: network.GetServiceHostname(sinkName, environment.FromContext(ctx).Namespace()),
279+
},
280+
CACerts: nil, // CA certs are in the new trust-bundle
281+
}
282+
283+
trigger.Install(triggerName, brokerName,
284+
trigger.WithSubscriberFromDestination(subscriber))(ctx, t)
285+
})
286+
f.Setup("Wait for Trigger to become ready", trigger.IsReady(triggerName))
287+
288+
f.Setup("Install failing trigger", func(ctx context.Context, t feature.T) {
289+
dls := service.AsDestinationRef(dlsName)
290+
291+
linear := eventingv1.BackoffPolicyLinear
292+
trigger.Install(dlsTriggerName, brokerName,
293+
trigger.WithRetry(10, &linear, pointer.String("PT1S")),
294+
trigger.WithDeadLetterSinkFromDestination(dls),
295+
trigger.WithSubscriber(nil, "http://127.0.0.1:2468"))(ctx, t)
296+
})
297+
f.Setup("Wait for failing Trigger to become ready", trigger.IsReady(dlsTriggerName))
298+
299+
// Install Source
300+
f.Requirement("Install Source", eventshub.Install(
301+
sourceName,
302+
eventshub.StartSenderToResource(broker.GVR(), brokerName),
303+
eventshub.InputEvent(eventToSend),
304+
))
305+
306+
f.Assert("Trigger delivers events to TLS subscriber", assert.OnStore(sinkName).
307+
MatchReceivedEvent(test.HasId(eventToSend.ID())).
308+
AtLeast(1))
309+
f.Assert("Trigger delivers events to TLS dead letter sink", assert.OnStore(dlsName).
310+
MatchReceivedEvent(test.HasId(eventToSend.ID())).
311+
AtLeast(1))
312+
313+
return f
314+
}

Diff for: ‎test/rekt/pingsource_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ func TestPingSourceTLS(t *testing.T) {
6161

6262
env.ParallelTest(ctx, t, pingsource.SendsEventsTLS())
6363
env.ParallelTest(ctx, t, pingsource.SendsEventsTLSTrustBundle())
64+
env.ParallelTest(ctx, t, pingsource.SendsEventsTLSWithAdditionalTrustBundle())
6465
}
6566

6667
func TestPingSourceWithSinkURI(t *testing.T) {

Diff for: ‎test/rekt/resources/configmap/config-features.yaml

+14-1
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,28 @@ kind: ConfigMap
33
metadata:
44
name: {{ .name }}
55
namespace: {{ .namespace }}
6+
{{ if .labels }}
7+
labels:
8+
{{ range $key, $value := .labels }}
9+
{{ $key }}: "{{ $value }}"
10+
{{ end }}
11+
{{ else }}
612
labels:
713
knative.dev/config-propagation: original
814
knative.dev/config-category: eventing
15+
{{ end }}
916
data:
17+
{{ if .data }}
18+
{{ range $key, $value := .data }}
19+
{{ $key }}: |-
20+
{{ $value }}
21+
{{ end }}
22+
{{ else }}
1023
_example: |
1124
my-enabled-flag: "enabled"
1225
my-disabled-flag: "disabled"
1326
my-allowed-flag: "allowed"
1427
apiserversources.nodeselector.testkey: testvalue
1528
apiserversources.nodeselector.testkey1: testvalue1
1629
apiserversources.nodeselector.testkey2: testvalue2
17-
30+
{{ end }}

0 commit comments

Comments
 (0)