Richer mocking of keystore in nodeup tests

nodeup/pkg/model/kube_apiserver_test.go

@@ -22,7 +22,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/flagbuilder"
 	"k8s.io/kops/pkg/pki"
@@ -43,7 +42,9 @@ func Test_KubeAPIServer_Builder(t *testing.T) {
 		t.Fatalf("error loading model %q: %v", basedir, err)
 		return
 	}
-	nodeUpModelContext.KeyStore = &fakeKeyStore{T: t}
+	keystore := &fakeCAStore{}
+	keystore.T = t
+	nodeUpModelContext.KeyStore = keystore
 
 	builder := KubeAPIServerBuilder{NodeupModelContext: nodeUpModelContext}
 
@@ -70,53 +71,63 @@ type fakeKeyStore struct {
 	T *testing.T
 }
 
+var _ fi.Keystore = &fakeKeyStore{}
+
 func (k fakeKeyStore) FindKeypair(name string) (*pki.Certificate, *pki.PrivateKey, bool, error) {
-	panic("implement me")
+	panic("fakeKeyStore does not implement FindKeypair")
 }
 
 func (k fakeKeyStore) CreateKeypair(signer string, name string, template *x509.Certificate, privateKey *pki.PrivateKey) (*pki.Certificate, error) {
-	panic("implement me")
+	panic("fakeKeyStore does not implement CreateKeypair")
 }
 
 func (k fakeKeyStore) StoreKeypair(id string, cert *pki.Certificate, privateKey *pki.PrivateKey) error {
-	panic("implement me")
+	panic("fakeKeyStore does not implement StoreKeypair")
 }
 
 func (k fakeKeyStore) MirrorTo(basedir vfs.Path) error {
-	panic("implement me")
+	panic("fakeKeyStore does not implement MirrorTo")
 }
 
-func (k fakeKeyStore) FindCertificatePool(name string) (*fi.CertificatePool, error) {
-	panic("implement me")
+type fakeCAStore struct {
+	fakeKeyStore
+
+	privateKeys map[string]*pki.PrivateKey
+	certs       map[string]*pki.Certificate
+}
+
+var _ fi.CAStore = &fakeCAStore{}
+
+func (k fakeCAStore) FindCertificatePool(name string) (*fi.CertificatePool, error) {
+	panic("fakeCAStore does not implement FindCertificatePool")
 }
 
-func (k fakeKeyStore) FindCertificateKeyset(name string) (*kops.Keyset, error) {
-	panic("implement me")
+func (k fakeCAStore) FindCertificateKeyset(name string) (*kops.Keyset, error) {
+	panic("fakeCAStore does not implement FindCertificateKeyset")
 }
 
-func (k fakeKeyStore) FindPrivateKey(name string) (*pki.PrivateKey, error) {
-	panic("implement me")
+func (k fakeCAStore) FindPrivateKey(name string) (*pki.PrivateKey, error) {
+	return k.privateKeys[name], nil
 }
 
-func (k fakeKeyStore) FindPrivateKeyset(name string) (*kops.Keyset, error) {
-	panic("implement me")
+func (k fakeCAStore) FindPrivateKeyset(name string) (*kops.Keyset, error) {
+	panic("fakeCAStore does not implement FindPrivateKeyset")
 }
 
-func (k fakeKeyStore) FindCert(name string) (*pki.Certificate, error) {
-	assert.Equal(k.T, "apiserver-aggregator-ca", name)
-	return &pki.Certificate{}, nil
+func (k fakeCAStore) FindCert(name string) (*pki.Certificate, error) {
+	return k.certs[name], nil
 }
 
-func (k fakeKeyStore) ListKeysets() ([]*kops.Keyset, error) {
-	panic("implement me")
+func (k fakeCAStore) ListKeysets() ([]*kops.Keyset, error) {
+	panic("fakeCAStore does not implement ListKeysets")
 }
 
-func (k fakeKeyStore) AddCert(name string, cert *pki.Certificate) error {
-	panic("implement me")
+func (k fakeCAStore) AddCert(name string, cert *pki.Certificate) error {
+	panic("fakeCAStore does not implement AddCert")
 }
 
-func (k fakeKeyStore) DeleteKeysetItem(item *kops.Keyset, id string) error {
-	panic("implement me")
+func (k fakeCAStore) DeleteKeysetItem(item *kops.Keyset, id string) error {
+	panic("fakeCAStore does not implement DeleteKeysetItem")
 }
 
 func Test_KubeAPIServer_BuildFlags(t *testing.T) {

nodeup/pkg/model/kubelet_test.go

@@ -21,10 +21,12 @@ import (
 	"path/filepath"
 	"testing"
 
+	"k8s.io/klog"
 	"k8s.io/kops/nodeup/pkg/distros"
 	"k8s.io/kops/pkg/apis/kops"
 	"k8s.io/kops/pkg/assets"
 	"k8s.io/kops/pkg/client/simple/vfsclientset"
+	"k8s.io/kops/pkg/pki"
 	"k8s.io/kops/pkg/testutils"
 	"k8s.io/kops/upup/pkg/fi"
 	"k8s.io/kops/upup/pkg/fi/cloudup"
@@ -232,6 +234,29 @@ func mockedPopulateClusterSpec(c *kops.Cluster) (*kops.Cluster, error) {
 	return cloudup.PopulateClusterSpec(clientset, c, assetBuilder)
 }
 
+// Fixed cert and key, borrowed from the create_kubecfg_test.go test
+// Wouldn't actually work in a real environment, but good enough for (today's) tests
+
+const dummy_crt = "-----BEGIN CERTIFICATE-----\nMIIC2DCCAcCgAwIBAgIRALJXAkVj964tq67wMSI8oJQwDQYJKoZIhvcNAQELBQAw\nFTETMBEGA1UEAxMKa3ViZXJuZXRlczAeFw0xNzEyMjcyMzUyNDBaFw0yNzEyMjcy\nMzUyNDBaMBUxEzARBgNVBAMTCmt1YmVybmV0ZXMwggEiMA0GCSqGSIb3DQEBAQUA\nA4IBDwAwggEKAoIBAQDgnCkSmtnmfxEgS3qNPaUCH5QOBGDH/inHbWCODLBCK9gd\nXEcBl7FVv8T2kFr1DYb0HVDtMI7tixRVFDLgkwNlW34xwWdZXB7GeoFgU1xWOQSY\nOACC8JgYTQ/139HBEvgq4sej67p+/s/SNcw34Kk7HIuFhlk1rRk5kMexKIlJBKP1\nYYUYetsJ/QpUOkqJ5HW4GoetE76YtHnORfYvnybviSMrh2wGGaN6r/s4ChOaIbZC\nAn8/YiPKGIDaZGpj6GXnmXARRX/TIdgSQkLwt0aTDBnPZ4XvtpI8aaL8DYJIqAzA\nNPH2b4/uNylat5jDo0b0G54agMi97+2AUrC9UUXpAgMBAAGjIzAhMA4GA1UdDwEB\n/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBVGR2r\nhzXzRMU5wriPQAJScszNORvoBpXfZoZ09FIupudFxBVU3d4hV9StKnQgPSGA5XQO\nHE97+BxJDuA/rB5oBUsMBjc7y1cde/T6hmi3rLoEYBSnSudCOXJE4G9/0f8byAJe\nrN8+No1r2VgZvZh6p74TEkXv/l3HBPWM7IdUV0HO9JDhSgOVF1fyQKJxRuLJR8jt\nO6mPH2UX0vMwVa4jvwtkddqk2OAdYQvH9rbDjjbzaiW0KnmdueRo92KHAN7BsDZy\nVpXHpqo1Kzg7D3fpaXCf5si7lqqrdJVXH4JC72zxsPehqgi8eIuqOBkiDWmRxAxh\n8yGeRx9AbknHh4Ia\n-----END CERTIFICATE-----\n"
+const dummy_key = "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA4JwpEprZ5n8RIEt6jT2lAh+UDgRgx/4px21gjgywQivYHVxH\nAZexVb/E9pBa9Q2G9B1Q7TCO7YsUVRQy4JMDZVt+McFnWVwexnqBYFNcVjkEmDgA\ngvCYGE0P9d/RwRL4KuLHo+u6fv7P0jXMN+CpOxyLhYZZNa0ZOZDHsSiJSQSj9WGF\nGHrbCf0KVDpKieR1uBqHrRO+mLR5zkX2L58m74kjK4dsBhmjeq/7OAoTmiG2QgJ/\nP2IjyhiA2mRqY+hl55lwEUV/0yHYEkJC8LdGkwwZz2eF77aSPGmi/A2CSKgMwDTx\n9m+P7jcpWreYw6NG9BueGoDIve/tgFKwvVFF6QIDAQABAoIBAA0ktjaTfyrAxsTI\nBezb7Zr5NBW55dvuII299cd6MJo+rI/TRYhvUv48kY8IFXp/hyUjzgeDLunxmIf9\n/Zgsoic9Ol44/g45mMduhcGYPzAAeCdcJ5OB9rR9VfDCXyjYLlN8H8iU0734tTqM\n0V13tQ9zdSqkGPZOIcq/kR/pylbOZaQMe97BTlsAnOMSMKDgnftY4122Lq3GYy+t\nvpr+bKVaQZwvkLoSU3rECCaKaghgwCyX7jft9aEkhdJv+KlwbsGY6WErvxOaLWHd\ncuMQjGapY1Fa/4UD00mvrA260NyKfzrp6+P46RrVMwEYRJMIQ8YBAk6N6Hh7dc0G\n8Z6i1m0CgYEA9HeCJR0TSwbIQ1bDXUrzpftHuidG5BnSBtax/ND9qIPhR/FBW5nj\n22nwLc48KkyirlfIULd0ae4qVXJn7wfYcuX/cJMLDmSVtlM5Dzmi/91xRiFgIzx1\nAsbBzaFjISP2HpSgL+e9FtSXaaqeZVrflitVhYKUpI/AKV31qGHf04sCgYEA6zTV\n99Sb49Wdlns5IgsfnXl6ToRttB18lfEKcVfjAM4frnkk06JpFAZeR+9GGKUXZHqs\nz2qcplw4d/moCC6p3rYPBMLXsrGNEUFZqBlgz72QA6BBq3X0Cg1Bc2ZbK5VIzwkg\nST2SSux6ccROfgULmN5ZiLOtdUKNEZpFF3i3qtsCgYADT/s7dYFlatobz3kmMnXK\nsfTu2MllHdRys0YGHu7Q8biDuQkhrJwhxPW0KS83g4JQym+0aEfzh36bWcl+u6R7\nKhKj+9oSf9pndgk345gJz35RbPJYh+EuAHNvzdgCAvK6x1jETWeKf6btj5pF1U1i\nQ4QNIw/QiwIXjWZeubTGsQKBgQCbduLu2rLnlyyAaJZM8DlHZyH2gAXbBZpxqU8T\nt9mtkJDUS/KRiEoYGFV9CqS0aXrayVMsDfXY6B/S/UuZjO5u7LtklDzqOf1aKG3Q\ndGXPKibknqqJYH+bnUNjuYYNerETV57lijMGHuSYCf8vwLn3oxBfERRX61M/DU8Z\nworz/QKBgQDCTJI2+jdXg26XuYUmM4XXfnocfzAXhXBULt1nENcogNf1fcptAVtu\nBAiz4/HipQKqoWVUYmxfgbbLRKKLK0s0lOWKbYdVjhEm/m2ZU8wtXTagNwkIGoyq\nY/C1Lox4f1ROJnCjc/hfcOjcxX5M8A8peecHWlVtUPKTJgxQ7oMKcw==\n-----END RSA PRIVATE KEY-----\n"
+
+
+func mustParsePrivateKey(s string) *pki.PrivateKey {
+	k, err := pki.ParsePEMPrivateKey([]byte(s))
+	if err != nil {
+		klog.Fatalf("error parsing private key %v", err)
+	}
+	return k
+}
+
+func mustParseCertificate(s string) *pki.Certificate {
+	k, err := pki.ParsePEMCertificate([]byte(s))
+	if err != nil {
+		klog.Fatalf("error parsing certificate %v", err)
+	}
+	return k
+}
+
 func RunGoldenTest(t *testing.T, basedir string, key string, builder func(*NodeupModelContext, *fi.ModelBuilderContext) error) {
 	h := testutils.NewIntegrationTestHarness(t)
 	defer h.Close()
@@ -247,7 +272,26 @@ func RunGoldenTest(t *testing.T, basedir string, key string, builder func(*Nodeu
 		t.Fatalf("error loading model %q: %v", basedir, err)
 		return
 	}
-	nodeupModelContext.KeyStore = &fakeKeyStore{T: t}
+
+	keystore := &fakeCAStore{}
+	keystore.T = t
+	keystore.privateKeys = map[string]*pki.PrivateKey{
+		"ca": mustParsePrivateKey(dummy_key),
+		"apiserver-aggregator-ca": mustParsePrivateKey(dummy_key),
+		"kube-controller-manager": mustParsePrivateKey(dummy_key),
+		"kube-proxy": mustParsePrivateKey(dummy_key),
+		"kube-scheduler": mustParsePrivateKey(dummy_key),
+	}
+	keystore.certs = map[string]*pki.Certificate{
+		"ca": mustParseCertificate(dummy_crt),
+		"apiserver-aggregator-ca": mustParseCertificate(dummy_crt),
+		"kube-controller-manager": mustParseCertificate(dummy_crt),
+		"kube-proxy": mustParseCertificate(dummy_crt),
+		"kube-scheduler": mustParseCertificate(dummy_crt),
+	}
+
+
+	nodeupModelContext.KeyStore = keystore
 
 	// Populate the cluster
 	{