Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 2.3.x]: fix(e2e): Deprecated SSL quarkus configuration #5534

Merged
merged 2 commits into from
May 22, 2024
Merged

[Backport 2.3.x]: fix(e2e): Deprecated SSL quarkus configuration #5534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f093378
fix(e2e): Deprecated SSL quarkus configuration
gansheer May 21, 2024
ab630d5
fix(e2e): Fix flakiness in route tests
gansheer May 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/modules/traits/pages/route.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,17 +141,17 @@ kamel run --dev PlatformHttpServer.java -t route.tls-termination=edge -t route.t
* To add a *passthrough* route using secrets, the TLS is setup in the integration pod, the keys and certificates should be visible in the running integration pod, to achieve this we are using the `--resource` kamel parameter to mount the secret in the integration pod, then we use some camel quarkus parameters to reference these certificate files in the running pod, they start with `-p quarkus.http.ssl.certificate`. This route example trait references a secret named `my-combined-certs` which contains two keys named `tls.key` and `tls.crt`.
+
[source,console]
kamel run --dev PlatformHttpServer.java --resource secret:my-combined-certs@/etc/ssl/my-combined-certs -p quarkus.http.ssl.certificate.file=/etc/ssl/my-combined-certs/tls.crt -p quarkus.http.ssl.certificate.key-file=/etc/ssl/my-combined-certs/tls.key -t route.tls-termination=passthrough -t container.port=8443
kamel run --dev PlatformHttpServer.java --resource secret:my-combined-certs@/etc/ssl/my-combined-certs -p quarkus.http.ssl.certificate.files=/etc/ssl/my-combined-certs/tls.crt -p quarkus.http.ssl.certificate.key-files=/etc/ssl/my-combined-certs/tls.key -t route.tls-termination=passthrough -t container.port=8443

* To add a *reencrypt* route using secrets, the TLS is setup in the integration pod, the keys and certificates should be visible in the running integration pod, to achieve this we are using the `--resource` kamel parameter to mount the secret in the integration pod, then we use some camel quarkus parameters to reference these certificate files in the running pod, they start with `-p quarkus.http.ssl.certificate`. This route example trait references a secret named `my-combined-certs` which contains two keys named `tls.key` and `tls.crt`.
+
[source,console]
kamel run --dev PlatformHttpServer.java --resource secret:my-combined-certs@/etc/ssl/my-combined-certs -p quarkus.http.ssl.certificate.file=/etc/ssl/my-combined-certs/tls.crt -p quarkus.http.ssl.certificate.key-file=/etc/ssl/my-combined-certs/tls.key -t route.tls-termination=reencrypt -t route.tls-destination-ca-certificate-secret=my-combined-certs/tls.crt -t route.tls-certificate-secret=my-combined-certs/tls.crt -t route.tls-key-secret=my-combined-certs/tls.key -t container.port=8443
kamel run --dev PlatformHttpServer.java --resource secret:my-combined-certs@/etc/ssl/my-combined-certs -p quarkus.http.ssl.certificate.files=/etc/ssl/my-combined-certs/tls.crt -p quarkus.http.ssl.certificate.key-files=/etc/ssl/my-combined-certs/tls.key -t route.tls-termination=reencrypt -t route.tls-destination-ca-certificate-secret=my-combined-certs/tls.crt -t route.tls-certificate-secret=my-combined-certs/tls.crt -t route.tls-key-secret=my-combined-certs/tls.key -t container.port=8443

* To add a *reencrypt* route using a specific certificate from a secret for the route and https://docs.openshift.com/container-platform/4.8/security/certificates/service-serving-certificate.html#add-service-certificate_service-serving-certificate[OpenShift service serving certificates] for the integration endpoint. This way the OpenShift service serving certificates is set up only in the integration pod. The keys and certificates should be visible in the running integration pod, to achieve this we are using the `--resource` kamel parameter to mount the secret in the integration pod, then we use some camel quarkus parameters to reference these certificate files in the running pod, they start with `-p quarkus.http.ssl.certificate`. This route example trait references a secret named `my-combined-certs` which contains two keys named `tls.key` and `tls.crt`.
+
[source,console]
kamel run --dev PlatformHttpServer.java --resource secret:cert-from-openshift@/etc/ssl/cert-from-openshift -p quarkus.http.ssl.certificate.file=/etc/ssl/cert-from-openshift/tls.crt -p quarkus.http.ssl.certificate.key-file=/etc/ssl/cert-from-openshift/tls.key -t route.tls-termination=reencrypt -t route.tls-certificate-secret=my-combined-certs/tls.crt -t route.tls-key-secret=my-combined-certs/tls.key -t container.port=8443
kamel run --dev PlatformHttpServer.java --resource secret:cert-from-openshift@/etc/ssl/cert-from-openshift -p quarkus.http.ssl.certificate.files=/etc/ssl/cert-from-openshift/tls.crt -p quarkus.http.ssl.certificate.key-files=/etc/ssl/cert-from-openshift/tls.key -t route.tls-termination=reencrypt -t route.tls-certificate-secret=my-combined-certs/tls.crt -t route.tls-key-secret=my-combined-certs/tls.key -t container.port=8443
+
Then you should annotate the integration service to inject the OpenShift service serving certificates
+
Expand Down
35 changes: 20 additions & 15 deletions e2e/common/traits/route_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,14 +105,15 @@ func TestRunRoutes(t *testing.T) {
t.Run("Route unsecure http works", func(t *testing.T) {
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java").Execute()).To(Succeed())
g.Eventually(IntegrationPodPhase(t, ctx, ns, integrationName), TestTimeoutLong).Should(Equal(corev1.PodRunning))
route := Route(t, ctx, ns, integrationName)
g.Eventually(route, TestTimeoutMedium).ShouldNot(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).ShouldNot(BeNil())
// must wait a little time after route is created, before doing an http request,
// otherwise the route is unavailable and the http request will fail
time.Sleep(waitBeforeHttpRequest)
route := Route(t, ctx, ns, integrationName)
url := fmt.Sprintf("http://%s/hello?name=Simple", route().Spec.Host)
g.Eventually(httpRequest(url, false), TestTimeoutShort).Should(Equal("Hello Simple"))
g.Expect(Kamel(t, ctx, "delete", "--all", "-n", ns).Execute()).Should(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).Should(BeNil())
})

// =============================
Expand All @@ -121,14 +122,15 @@ func TestRunRoutes(t *testing.T) {
t.Run("Route Edge https works", func(t *testing.T) {
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "-t", "route.tls-termination=edge").Execute()).To(Succeed())
g.Eventually(IntegrationPodPhase(t, ctx, ns, integrationName), TestTimeoutLong).Should(Equal(corev1.PodRunning))
route := Route(t, ctx, ns, integrationName)
g.Eventually(route, TestTimeoutMedium).ShouldNot(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).ShouldNot(BeNil())
// must wait a little time after route is created, before an http request,
// otherwise the route is unavailable and the http request will fail
time.Sleep(waitBeforeHttpRequest)
route := Route(t, ctx, ns, integrationName)
url := fmt.Sprintf("https://%s/hello?name=TLS_Edge", route().Spec.Host)
g.Eventually(httpRequest(url, true), TestTimeoutShort).Should(Equal("Hello TLS_Edge"))
g.Expect(Kamel(t, ctx, "delete", "--all", "-n", ns).Execute()).Should(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).Should(BeNil())
})

// =============================
Expand All @@ -137,60 +139,63 @@ func TestRunRoutes(t *testing.T) {
t.Run("Route Edge (custom certificate) https works", func(t *testing.T) {
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "-t", "route.tls-termination=edge", "-t", "route.tls-certificate-secret="+refCert, "-t", "route.tls-key-secret="+refKey).Execute()).To(Succeed())
g.Eventually(IntegrationPodPhase(t, ctx, ns, integrationName), TestTimeoutLong).Should(Equal(corev1.PodRunning))
route := Route(t, ctx, ns, integrationName)
g.Eventually(route, TestTimeoutMedium).ShouldNot(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).ShouldNot(BeNil())
// must wait a little time after route is created, before an http request,
// otherwise the route is unavailable and the http request will fail
time.Sleep(waitBeforeHttpRequest)
route := Route(t, ctx, ns, integrationName)
code := "TLS_EdgeCustomCertificate"
url := fmt.Sprintf("https://%s/hello?name=%s", route().Spec.Host, code)
g.Eventually(httpRequest(url, true), TestTimeoutShort).Should(Equal("Hello " + code))
g.Expect(Kamel(t, ctx, "delete", "--all", "-n", ns).Execute()).Should(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).Should(BeNil())
})

// =============================
// TLS Route Passthrough
// =============================
t.Run("Route passthrough https works", func(t *testing.T) {
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "--resource", "secret:"+secretName+"@/etc/ssl/"+secretName, "-p", "quarkus.http.ssl.certificate.file=/etc/ssl/"+secretName+"/tls.crt", "-p", "quarkus.http.ssl.certificate.key-file=/etc/ssl/"+secretName+"/tls.key", "-t", "route.tls-termination=passthrough", "-t", "container.port=8443").Execute()).To(Succeed())
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "--resource", "secret:"+secretName+"@/etc/ssl/"+secretName, "-p", "quarkus.http.ssl.certificate.files=/etc/ssl/"+secretName+"/tls.crt", "-p", "quarkus.http.ssl.certificate.key-files=/etc/ssl/"+secretName+"/tls.key", "-t", "route.tls-termination=passthrough", "-t", "container.port=8443").Execute()).To(Succeed())
g.Eventually(IntegrationPodPhase(t, ctx, ns, integrationName), TestTimeoutLong).Should(Equal(corev1.PodRunning))
route := Route(t, ctx, ns, integrationName)
g.Eventually(route, TestTimeoutMedium).ShouldNot(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).ShouldNot(BeNil())
// must wait a little time after route is created, before an http request,
// otherwise the route is unavailable and the http request will fail
time.Sleep(waitBeforeHttpRequest)
route := Route(t, ctx, ns, integrationName)
code := "TLS_Passthrough"
url := fmt.Sprintf("https://%s/hello?name=%s", route().Spec.Host, code)
g.Eventually(httpRequest(url, true), TestTimeoutShort).Should(Equal("Hello " + code))
g.Expect(Kamel(t, ctx, "delete", "--all", "-n", ns).Execute()).Should(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).Should(BeNil())
})

// =============================
// TLS Route Reencrypt
// =============================
t.Run("Route Reencrypt https works", func(t *testing.T) {
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "--resource", "secret:"+secretName+"@/etc/ssl/"+secretName, "-p", "quarkus.http.ssl.certificate.file=/etc/ssl/"+secretName+"/tls.crt", "-p", "quarkus.http.ssl.certificate.key-file=/etc/ssl/"+secretName+"/tls.key", "-t", "route.tls-termination=reencrypt", "-t", "route.tls-destination-ca-certificate-secret="+refCert, "-t", "route.tls-certificate-secret="+refCert, "-t", "route.tls-key-secret="+refKey, "-t", "container.port=8443").Execute()).To(Succeed())
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "--resource", "secret:"+secretName+"@/etc/ssl/"+secretName, "-p", "quarkus.http.ssl.certificate.files=/etc/ssl/"+secretName+"/tls.crt", "-p", "quarkus.http.ssl.certificate.key-files=/etc/ssl/"+secretName+"/tls.key", "-t", "route.tls-termination=reencrypt", "-t", "route.tls-destination-ca-certificate-secret="+refCert, "-t", "route.tls-certificate-secret="+refCert, "-t", "route.tls-key-secret="+refKey, "-t", "container.port=8443").Execute()).To(Succeed())
g.Eventually(IntegrationPodPhase(t, ctx, ns, integrationName), TestTimeoutLong).Should(Equal(corev1.PodRunning))

route := Route(t, ctx, ns, integrationName)
g.Eventually(route, TestTimeoutMedium).ShouldNot(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).ShouldNot(BeNil())
// must wait a little time after route is created, before an http request,
// otherwise the route is unavailable and the http request will fail
route := Route(t, ctx, ns, integrationName)
time.Sleep(waitBeforeHttpRequest)
code := "TLS_Reencrypt"
url := fmt.Sprintf("https://%s/hello?name=%s", route().Spec.Host, code)
g.Eventually(httpRequest(url, true), TestTimeoutShort).Should(Equal("Hello " + code))
g.Expect(Kamel(t, ctx, "delete", "--all", "-n", ns).Execute()).Should(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).Should(BeNil())
})

t.Run("Route annotations added", func(t *testing.T) {
g.Expect(Kamel(t, ctx, "delete", "--all", "-n", ns).Execute()).Should(BeNil())
g.Expect(KamelRunWithID(t, ctx, operatorID, ns, "files/PlatformHttpServer.java", "-t", "route.annotations.'haproxy.router.openshift.io/balance'=roundrobin").Execute()).To(Succeed())
g.Eventually(IntegrationPodPhase(t, ctx, ns, integrationName), TestTimeoutLong).Should(Equal(corev1.PodRunning))
route := RouteFull(t, ctx, ns, integrationName)()
g.Eventually(route, TestTimeoutMedium).ShouldNot(BeNil())
g.Eventually(Route(t, ctx, ns, integrationName), TestTimeoutMedium).ShouldNot(BeNil())
// must wait a little time after route is created, before an http request,
// otherwise the route is unavailable and the http request will fail
time.Sleep(waitBeforeHttpRequest)
route := RouteFull(t, ctx, ns, integrationName)()
var annotations = route.ObjectMeta.Annotations
g.Expect(annotations["haproxy.router.openshift.io/balance"]).To(Equal("roundrobin"))

Expand Down