-
Notifications
You must be signed in to change notification settings - Fork 239
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #2577 from weyfonk/0.9-strict-tls-mode
[v0.9] Add strict TLS mode
- Loading branch information
Showing
16 changed files
with
346 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| package installation_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| . "github.com/onsi/ginkgo/v2" | ||
| . "github.com/onsi/gomega" | ||
| "github.com/onsi/gomega/matchers" | ||
| "github.com/rancher/fleet/e2e/testenv/kubectl" | ||
| ) | ||
|
|
||
| var ( | ||
| agentMode string | ||
| kd kubectl.Command | ||
| ) | ||
|
|
||
| var _ = Describe("Fleet installation with TLS agent modes", func() { | ||
| BeforeEach(func() { | ||
| kd = env.Kubectl.Context(env.Downstream) | ||
| }) | ||
|
|
||
| JustBeforeEach(func() { | ||
| out, err := ku.Patch( | ||
| "configmap", | ||
| "fleet-controller", | ||
| "-n", | ||
| "cattle-fleet-system", | ||
| "--type=merge", | ||
| "-p", | ||
| fmt.Sprintf( | ||
| `{"data":{"config":"{\"apiServerURL\": \"https://google.com\", \"apiServerCA\": \"\", \"agentTLSMode\": \"%s\"}"}}`, | ||
| agentMode, | ||
| ), | ||
| ) | ||
| Expect(err).ToNot(HaveOccurred(), string(out)) | ||
|
|
||
| }) | ||
|
|
||
| Context("with non-strict agent TLS mode", func() { | ||
| When("fetching fleet-agent-register logs", func() { | ||
| BeforeEach(func() { | ||
| agentMode = "system-store" | ||
| }) | ||
|
|
||
| It("reaches the server without cert issues", func() { | ||
| Eventually(func() bool { | ||
| logs, err := kd.Namespace("cattle-fleet-system").Logs( | ||
| "-l", | ||
| "app=fleet-agent", | ||
| "--tail=-1", | ||
| ) | ||
| if err != nil { | ||
| return false | ||
| } | ||
|
|
||
| regexMatcher := matchers.MatchRegexpMatcher{ | ||
| Regexp: "Failed to register agent.*could not find the requested resource", | ||
| } | ||
| reachesServerWithoutCertIssue, err := regexMatcher.Match(logs) | ||
| if err != nil { | ||
| return false | ||
| } | ||
|
|
||
| return reachesServerWithoutCertIssue | ||
| }).Should(BeTrue()) | ||
| }) | ||
| }) | ||
| }) | ||
|
|
||
| Context("with strict agent TLS mode", func() { | ||
| When("fetching fleet-agent-register logs", func() { | ||
| BeforeEach(func() { | ||
| agentMode = "strict" | ||
| }) | ||
|
|
||
| It("cannot reach the server because the cert is signed by an unknown authority", func() { | ||
| Eventually(func() bool { | ||
| logs, err := kd.Namespace("cattle-fleet-system").Logs( | ||
| "-l", | ||
| "app=fleet-agent", | ||
| "--tail=-1", | ||
| ) | ||
| if err != nil { | ||
| return false | ||
| } | ||
|
|
||
| regexMatcher := matchers.MatchRegexpMatcher{ | ||
| Regexp: "Failed to register agent.*signed by unknown authority", | ||
| } | ||
| reachesServerWithoutCertIssue, err := regexMatcher.Match(logs) | ||
| if err != nil { | ||
| return false | ||
| } | ||
|
|
||
| return reachesServerWithoutCertIssue | ||
| }).Should(BeTrue()) | ||
| }) | ||
| }) | ||
| }) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| // Package installation contains e2e tests deploying Fleet to multiple clusters. The tests use kubectl to apply | ||
| // manifests. Expectations are verified by checking cluster resources. | ||
| package installation_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/rancher/fleet/e2e/testenv" | ||
| "github.com/rancher/fleet/e2e/testenv/kubectl" | ||
|
|
||
| . "github.com/onsi/ginkgo/v2" | ||
| . "github.com/onsi/gomega" | ||
| ) | ||
|
|
||
| func TestE2E(t *testing.T) { | ||
| RegisterFailHandler(Fail) | ||
| RunSpecs(t, "E2E Installation Suite for Multi-Cluster") | ||
| } | ||
|
|
||
| var ( | ||
| env *testenv.Env | ||
| ku kubectl.Command | ||
| config string | ||
| ) | ||
|
|
||
| var _ = BeforeSuite(func() { | ||
| SetDefaultEventuallyTimeout(testenv.Timeout) | ||
| testenv.SetRoot("../..") | ||
|
|
||
| env = testenv.New() | ||
| ku = env.Kubectl.Context(env.Upstream) | ||
|
|
||
| // Save initial state of `fleet-controller` config map | ||
| cfg, err := ku.Get( | ||
| "configmap", | ||
| "fleet-controller", | ||
| "-n", | ||
| "cattle-fleet-system", | ||
| "-o", | ||
| "jsonpath={.data.config}") | ||
| Expect(err).ToNot(HaveOccurred(), cfg) | ||
|
|
||
| cfg = strings.ReplaceAll(cfg, `"`, `\"`) | ||
| config = strings.ReplaceAll(cfg, "\n", "") | ||
| }) | ||
|
|
||
| var _ = AfterSuite(func() { | ||
| // Restore initial state of config map | ||
| out, err := ku.Patch( | ||
| "configmap", | ||
| "fleet-controller", | ||
| "-n", | ||
| "cattle-fleet-system", | ||
| "--type=merge", | ||
| "-p", | ||
| fmt.Sprintf(`{"data":{"config":"%s"}}`, config), | ||
| ) | ||
| Expect(err).ToNot(HaveOccurred(), string(out)) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.