Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add tests for custom number of fernet keys #497

Merged
merged 1 commit into from
Nov 28, 2024
+258 −13
Merged

Add tests for custom number of fernet keys #497

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions controllers/keystoneapi_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1195,8 +1195,9 @@ func (r *KeystoneAPIReconciler) generateServiceConfigMaps(
instance.Status.DatabaseHostname,
keystone.DatabaseName,
),
"enableSecureRBAC": instance.Spec.EnableSecureRBAC,
"ProcessNumber": instance.Spec.HttpdCustomization.ProcessNumber,
"ProcessNumber": instance.Spec.HttpdCustomization.ProcessNumber,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not related to this PR, but @Deydra71 we might want to add some functional tests for the ProcessNumber?

"enableSecureRBAC": instance.Spec.EnableSecureRBAC,
"fernetMaxActiveKeys": instance.Spec.FernetMaxActiveKeys,
}

// create httpd vhost template parameters
Expand Down Expand Up @@ -1461,11 +1462,6 @@ func (r *KeystoneAPIReconciler) ensureFernetKeys(
return nil
}

fernetKeys := make(map[string]string, len(secret.Data))
for k, v := range secret.Data {
fernetKeys[k] = string(v[:])
}

secret.Annotations[fernetAnnotation] = now.Format(time.RFC3339)

// use update to apply changes to the secret, since EnsureSecrets
Expand Down
2 changes: 1 addition & 1 deletion templates/keystoneapi/config/keystone.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ enforce_scope = {{ .enableSecureRBAC }}

[fernet_tokens]
key_repository=/etc/keystone/fernet-keys
max_active_keys=2
max_active_keys={{ .fernetMaxActiveKeys }}

{{ if (index . "TransportURL") }}
[oslo_messaging_notifications]
Expand Down
15 changes: 10 additions & 5 deletions tests/functional/base_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,15 +30,20 @@ import (
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
)

func GetDefaultKeystoneAPISpec() map[string]interface{} {
func GetKeystoneAPISpec(fernetMaxKeys int32) map[string]interface{} {
return map[string]interface{}{
"databaseInstance": "openstack",
"replicas": 1,
"secret": SecretName,
"databaseAccount": AccountName,
"databaseInstance": "openstack",
"replicas": 1,
"secret": SecretName,
"databaseAccount": AccountName,
"fernetMaxActiveKeys": fernetMaxKeys,
}
}

func GetDefaultKeystoneAPISpec() map[string]interface{} {
return GetKeystoneAPISpec(5)
}

func GetTLSKeystoneAPISpec() map[string]interface{} {
return map[string]interface{}{
"databaseInstance": "openstack",
Expand Down
244 changes: 244 additions & 0 deletions tests/functional/keystoneapi_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ import (
"fmt"
"os"
"strconv"
"strings"
"time"

. "github.com/onsi/ginkgo/v2" //revive:disable:dot-imports
Expand All @@ -36,6 +37,7 @@ import (
"k8s.io/apimachinery/pkg/types"
"k8s.io/utils/ptr"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
)

var _ = Describe("Keystone controller", func() {
Expand Down Expand Up @@ -1110,6 +1112,248 @@ var _ = Describe("Keystone controller", func() {
})
})

When("When FernetMaxActiveKeys is created with a number lower than 3", func() {
It("should fail", func() {
err := InterceptGomegaFailure(
func() {
CreateKeystoneAPI(keystoneAPIName, GetKeystoneAPISpec(-1))
})
Expect(err).Should(HaveOccurred())
})
})

When("When the fernet keys are created with FernetMaxActiveKeys as 3", func() {
BeforeEach(func() {
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneMessageBusSecret(namespace, "rabbitmq-secret"))
DeferCleanup(th.DeleteInstance, CreateKeystoneAPI(keystoneAPIName, GetKeystoneAPISpec(3)))
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneAPISecret(namespace, SecretName))
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, "memcached", memcachedSpec))
DeferCleanup(
mariadb.DeleteDBService,
mariadb.CreateDBService(
namespace,
GetKeystoneAPI(keystoneAPIName).Spec.DatabaseInstance,
corev1.ServiceSpec{
Ports: []corev1.ServicePort{{Port: 3306}},
},
),
)
mariadb.SimulateMariaDBAccountCompleted(keystoneAccountName)
mariadb.SimulateMariaDBDatabaseCompleted(keystoneDatabaseName)
infra.SimulateTransportURLReady(types.NamespacedName{
Name: fmt.Sprintf("%s-keystone-transport", keystoneAPIName.Name),
Namespace: namespace,
})
infra.SimulateMemcachedReady(types.NamespacedName{
Name: "memcached",
Namespace: namespace,
})
th.SimulateJobSuccess(dbSyncJobName)
th.SimulateJobSuccess(bootstrapJobName)
th.SimulateDeploymentReplicaReady(deploymentName)
})

It("creates 3 keys", func() {
secret := th.GetSecret(types.NamespacedName{Namespace: keystoneAPIName.Namespace, Name: "keystone"})
Expect(secret).ToNot(BeNil())

Eventually(func(g Gomega) {
numberFernetKeys := 0
for k := range secret.Data {
if strings.HasPrefix(k, "FernetKeys") {
numberFernetKeys++
}
}

g.Expect(numberFernetKeys).Should(BeNumerically("==", 3))
for i := 0; i < 3; i++ {
g.Expect(secret.Data["FernetKeys"+strconv.Itoa(i)]).NotTo(BeNil())
}
}, timeout, interval).Should(Succeed())
})
})

When("When the fernet keys are created with FernetMaxActiveKeys as 100", func() {
BeforeEach(func() {
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneMessageBusSecret(namespace, "rabbitmq-secret"))
DeferCleanup(th.DeleteInstance, CreateKeystoneAPI(keystoneAPIName, GetKeystoneAPISpec(100)))
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneAPISecret(namespace, SecretName))
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, "memcached", memcachedSpec))
DeferCleanup(
mariadb.DeleteDBService,
mariadb.CreateDBService(
namespace,
GetKeystoneAPI(keystoneAPIName).Spec.DatabaseInstance,
corev1.ServiceSpec{
Ports: []corev1.ServicePort{{Port: 3306}},
},
),
)
mariadb.SimulateMariaDBAccountCompleted(keystoneAccountName)
mariadb.SimulateMariaDBDatabaseCompleted(keystoneDatabaseName)
infra.SimulateTransportURLReady(types.NamespacedName{
Name: fmt.Sprintf("%s-keystone-transport", keystoneAPIName.Name),
Namespace: namespace,
})
infra.SimulateMemcachedReady(types.NamespacedName{
Name: "memcached",
Namespace: namespace,
})
th.SimulateJobSuccess(dbSyncJobName)
th.SimulateJobSuccess(bootstrapJobName)
th.SimulateDeploymentReplicaReady(deploymentName)
})

It("creates 100 keys", func() {
secret := th.GetSecret(types.NamespacedName{Namespace: keystoneAPIName.Namespace, Name: "keystone"})
Expect(secret).ToNot(BeNil())

Eventually(func(g Gomega) {
numberFernetKeys := 0
for k := range secret.Data {
if strings.HasPrefix(k, "FernetKeys") {
numberFernetKeys++
}
}

g.Expect(numberFernetKeys).Should(BeNumerically("==", 100))
for i := 0; i < 100; i++ {
g.Expect(secret.Data["FernetKeys"+strconv.Itoa(i)]).NotTo(BeNil())
}
}, timeout, interval).Should(Succeed())
})
})

When("When the fernet keys are updated from 5 to 4", func() {
BeforeEach(func() {
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneMessageBusSecret(namespace, "rabbitmq-secret"))
DeferCleanup(th.DeleteInstance, CreateKeystoneAPI(keystoneAPIName, GetDefaultKeystoneAPISpec()))
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneAPISecret(namespace, SecretName))
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, "memcached", memcachedSpec))
DeferCleanup(
mariadb.DeleteDBService,
mariadb.CreateDBService(
namespace,
GetKeystoneAPI(keystoneAPIName).Spec.DatabaseInstance,
corev1.ServiceSpec{
Ports: []corev1.ServicePort{{Port: 3306}},
},
),
)
mariadb.SimulateMariaDBAccountCompleted(keystoneAccountName)
mariadb.SimulateMariaDBDatabaseCompleted(keystoneDatabaseName)
infra.SimulateTransportURLReady(types.NamespacedName{
Name: fmt.Sprintf("%s-keystone-transport", keystoneAPIName.Name),
Namespace: namespace,
})
infra.SimulateMemcachedReady(types.NamespacedName{
Name: "memcached",
Namespace: namespace,
})
th.SimulateJobSuccess(dbSyncJobName)
th.SimulateJobSuccess(bootstrapJobName)
th.SimulateDeploymentReplicaReady(deploymentName)
})

It("removes the additional key", func() {
secret := th.GetSecret(types.NamespacedName{Namespace: keystoneAPIName.Namespace, Name: "keystone"})
Expect(secret).ToNot(BeNil())

keystone := GetKeystoneAPI(keystoneAPIName)

_, err := controllerutil.CreateOrPatch(
th.Ctx, th.K8sClient, keystone, func() error {
keystone.Spec.FernetMaxActiveKeys = ptr.To(int32(4))
return nil
})
Expect(err).ToNot(HaveOccurred())

Eventually(func(g Gomega) {
secret = th.GetSecret(types.NamespacedName{Namespace: keystoneAPIName.Namespace, Name: "keystone"})
numberFernetKeys := 0
for k := range secret.Data {
if strings.HasPrefix(k, "FernetKeys") {
numberFernetKeys++
}
}

g.Expect(numberFernetKeys).Should(BeNumerically("==", 4))
for i := 0; i < 4; i++ {
g.Expect(secret.Data["FernetKeys"+strconv.Itoa(i)]).NotTo(BeNil())
}
}, timeout, interval).Should(Succeed())
})
})

When("When the fernet keys are updated from 5 to 6", func() {
BeforeEach(func() {
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneMessageBusSecret(namespace, "rabbitmq-secret"))
DeferCleanup(th.DeleteInstance, CreateKeystoneAPI(keystoneAPIName, GetDefaultKeystoneAPISpec()))
DeferCleanup(
k8sClient.Delete, ctx, CreateKeystoneAPISecret(namespace, SecretName))
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, "memcached", memcachedSpec))
DeferCleanup(
mariadb.DeleteDBService,
mariadb.CreateDBService(
namespace,
GetKeystoneAPI(keystoneAPIName).Spec.DatabaseInstance,
corev1.ServiceSpec{
Ports: []corev1.ServicePort{{Port: 3306}},
},
),
)
mariadb.SimulateMariaDBAccountCompleted(keystoneAccountName)
mariadb.SimulateMariaDBDatabaseCompleted(keystoneDatabaseName)
infra.SimulateTransportURLReady(types.NamespacedName{
Name: fmt.Sprintf("%s-keystone-transport", keystoneAPIName.Name),
Namespace: namespace,
})
infra.SimulateMemcachedReady(types.NamespacedName{
Name: "memcached",
Namespace: namespace,
})
th.SimulateJobSuccess(dbSyncJobName)
th.SimulateJobSuccess(bootstrapJobName)
th.SimulateDeploymentReplicaReady(deploymentName)
})

It("creates an additional key", func() {
secret := th.GetSecret(types.NamespacedName{Namespace: keystoneAPIName.Namespace, Name: "keystone"})
Expect(secret).ToNot(BeNil())

keystone := GetKeystoneAPI(keystoneAPIName)

_, err := controllerutil.CreateOrPatch(
th.Ctx, th.K8sClient, keystone, func() error {
keystone.Spec.FernetMaxActiveKeys = ptr.To(int32(6))
return nil
})
Expect(err).ToNot(HaveOccurred())

Eventually(func(g Gomega) {
secret = th.GetSecret(types.NamespacedName{Namespace: keystoneAPIName.Namespace, Name: "keystone"})
numberFernetKeys := 0
for k := range secret.Data {
if strings.HasPrefix(k, "FernetKeys") {
numberFernetKeys++
}
}

g.Expect(numberFernetKeys).Should(BeNumerically("==", 6))
for i := 0; i < 6; i++ {
g.Expect(secret.Data["FernetKeys"+strconv.Itoa(i)]).NotTo(BeNil())
}
}, timeout, interval).Should(Succeed())
})
})

// Set rotated at to past date, triggering rotation
When("When the fernet token rotate", func() {
BeforeEach(func() {
Expand Down