Skip to content

Commit 616e8bc

Browse files
moritzschmitz-ovivamaxlambrecht
moritzschmitz-oviva
and
maxlambrecht
authored
Add functional test for java-spiffe-helper (#207)
Add functional test for java-spiffe-helper Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Only run on pull_request Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * No need for selector, there is only one pod Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Implement suggested changes Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Use tee for logs Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * A few changes according to comments Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Extend workflow to support multiple semver ranges for SPIRE helm charts Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Extend workflow to support multiple semver ranges for SPIRE helm charts Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * USe SemVer range instead of fixed version Signed-off-by: Moritz Schmitz von Hülst <[email protected]> --------- Signed-off-by: Moritz Schmitz von Hülst <[email protected]> Co-authored-by: Max Lambrecht <[email protected]>
1 parent c5629c5 commit 616e8bc

File tree

3 files changed

+152
-0
lines changed

3 files changed

+152
-0
lines changed

‎.github/ci-k8s-configs/java-spiffe-helper.yaml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: java-spiffe-helper
6+
data:
7+
java-spiffe-helper.properties: |
8+
keyStorePath=/tmp/keystore.p12
9+
keyStorePass=password
10+
keyPass=password
11+
trustStorePath=/tmp/truststore.p12
12+
trustStorePass=password
13+
keyStoreType=pkcs12
14+
keyAlias=spiffe
15+
spiffeSocketPath=unix:/run/spire/agent-sockets/spire-agent.sock
16+
---
17+
apiVersion: v1
18+
kind: Pod
19+
metadata:
20+
name: java-spiffe-helper
21+
labels:
22+
app: java-spiffe-helper
23+
spec:
24+
containers:
25+
- name: java-spiffe-helper
26+
image: java-spiffe-helper:test
27+
imagePullPolicy: IfNotPresent
28+
readinessProbe:
29+
initialDelaySeconds: 15
30+
exec:
31+
command:
32+
- ls
33+
- /tmp/truststore.p12
34+
volumeMounts:
35+
- name: properties
36+
mountPath: /app/java-spiffe-helper.properties
37+
subPath: java-spiffe-helper.properties
38+
- name: spire-sockets
39+
mountPath: /run/spire/agent-sockets
40+
readOnly: true
41+
restartPolicy: Never
42+
volumes:
43+
- name: properties
44+
configMap:
45+
name: java-spiffe-helper
46+
- name: spire-sockets
47+
hostPath:
48+
path: /run/spire/agent-sockets
49+
type: DirectoryOrCreate

‎.github/ci-k8s-configs/spire-values.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
spire-server:
2+
ca_subject:
3+
common_name: common_name
4+
controllerManager:
5+
identities:
6+
clusterSPIFFEIDs:
7+
default:
8+
enabled: false
9+
java-spiffe-helper:
10+
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
11+
namespaceSelector:
12+
matchLabels:
13+
kubernetes.io/metadata.name: default
14+
podSelector:
15+
matchLabels:
16+
app: java-spiffe-helper
17+
dnsNameTemplates:
18+
- dnsNameTemplate

‎.github/workflows/java-spiffe-helper-ci.yaml

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Java SPIFFE Helper CI
2+
3+
on:
4+
- pull_request
5+
6+
jobs:
7+
test:
8+
name: Test with SPIRE helm chart in version ${{ matrix.spire-chart-version.spire }}
9+
runs-on: ubuntu-latest
10+
11+
strategy:
12+
matrix:
13+
spire-chart-version:
14+
- spire: '0.17.x'
15+
crds: '0.3.x'
16+
17+
env:
18+
HELM_REPOSITORY: https://spiffe.github.io/helm-charts-hardened/
19+
KEYSTORE_COMMON_NAME: keystore-${{ github.sha }}
20+
TRUSTSTORE_COMMON_NAME: truststore-${{ github.sha }}
21+
22+
steps:
23+
- name: Checkout repository
24+
uses: actions/checkout@v4
25+
- name: Setup QEMU
26+
uses: docker/setup-qemu-action@v3
27+
- name: Setup buildx
28+
uses: docker/setup-buildx-action@v3
29+
- name: Setup Java
30+
uses: actions/setup-java@v4
31+
with:
32+
distribution: 'temurin'
33+
java-version: '17'
34+
- name: Build container
35+
uses: docker/build-push-action@v5
36+
with:
37+
context: .
38+
tags: java-spiffe-helper:test
39+
load: true
40+
cache-from: type=gha
41+
cache-to: type=gha,mode=max
42+
- name: Create local kubernetes cluster
43+
uses: helm/kind-action@v1
44+
with:
45+
cluster_name: kind
46+
- name: Load container image onto kubernetes node
47+
run: kind load docker-image java-spiffe-helper:test --name kind
48+
- name: Install SPIRE CRDs in version ${{ matrix.spire-chart-version.crds }}
49+
run: |
50+
helm upgrade --install -n spire-server spire-crds spire-crds \
51+
--repo ${{ env.HELM_REPOSITORY }} \
52+
--version ${{ matrix.spire-chart-version.crds }} \
53+
--create-namespace
54+
- name: Install SPIRE server in version ${{ matrix.spire-chart-version.spire }} and set to-be-verified values for common name
55+
run: |
56+
helm upgrade --install -n spire-server spire spire \
57+
--repo ${{ env.HELM_REPOSITORY }} \
58+
--version ${{ matrix.spire-chart-version.spire }} \
59+
--values .github/ci-k8s-configs/spire-values.yaml \
60+
--set spire-server.ca_subject.common_name="$TRUSTSTORE_COMMON_NAME" \
61+
--set spire-server.controllerManager.identities.clusterSPIFFEIDs.java-spiffe-helper.dnsNameTemplates[0]="$KEYSTORE_COMMON_NAME"
62+
- name: Deploy java-spiffe-helper pod to local cluster
63+
run: kubectl apply -f .github/ci-k8s-configs/java-spiffe-helper.yaml
64+
- name: Wait for java-spiffe-helper pod to become ready
65+
run: kubectl wait pod/java-spiffe-helper --for condition=Ready --timeout=90s
66+
- name: Output logs of java-spiffe-helper pod
67+
if: ${{ failure() }}
68+
run: kubectl logs pod/java-spiffe-helper
69+
- name: Describe java-spiffe-helper pod
70+
if: ${{ failure() }}
71+
run: kubectl describe pod/java-spiffe-helper
72+
- name: Copy keystore from java-spiffe-helper pod
73+
run: kubectl cp java-spiffe-helper:/tmp/keystore.p12 keystore.p12
74+
- name: Copy truststore from java-spiffe-helper pod
75+
run: kubectl cp java-spiffe-helper:/tmp/truststore.p12 truststore.p12
76+
- name: Verify keystore contains configured common name
77+
run: keytool -v -list -keystore keystore.p12 -storepass password | grep "CN=${{ env.KEYSTORE_COMMON_NAME }}"
78+
- name: Output keystore contents
79+
if: ${{ failure() }}
80+
run: keytool -v -list -keystore keystore.p12 -storepass password
81+
- name: Verify truststore contains configured common name
82+
run: keytool -v -list -keystore truststore.p12 -storepass password | grep "CN=${{ env.TRUSTSTORE_COMMON_NAME }}"
83+
- name: Output truststore contents
84+
if: ${{ failure() }}
85+
run: keytool -v -list -keystore truststore.p12 -storepass password

0 commit comments

Comments
 (0)