hurl: Split read/write token expected variables

Also update GHA for it.

Author: relrod

.github/workflows/ci-reusable.yml

@@ -69,12 +69,22 @@ jobs:
             tag: 1.10.0
           VALUES
           helm repo add checkmk-chart https://checkmk.github.io/checkmk_kube_agent
-          helm upgrade --install --create-namespace -n checkmk-monitoring myrelease checkmk-chart/checkmk -f values.yaml
+          helm upgrade \
+            --install \
+            --create-namespace \
+            -n checkmk-monitoring \
+            myrelease checkmk-chart/checkmk \
+            -f values.yaml
       - name: Install hurl
         uses: gacts/install-hurl@4e426ea8f8626b6f9e87f473751d8a0572370ba3
       - name: Run hurl tests
         run: |
-          TKN=$(kubectl get secret myrelease-checkmk-checkmk -n checkmk-monitoring -o=jsonpath='{.data.token}' | base64 --decode)
+          READ_TKN=$(kubectl get secret myrelease-checkmk-checkmk \
+            -n checkmk-monitoring \
+            -o=jsonpath='{.data.token}' \
+            | base64 --decode)
+          WRITE_TKN=$(kc exec -it daemonsets/myrelease-checkmk-node-collector-machine-sections \
+            -- cat /var/run/secrets/kubernetes.io/serviceaccount/token)
           sleep 15  # TODO: do a loop or something instead
           ./target/release/cmk-rustik-cache-server \
             --log-level=warning \
@@ -83,4 +93,8 @@ jobs:
             --reader-whitelist=checkmk-monitoring:myrelease-checkmk-checkmk \
             --writer-whitelist=checkmk-monitoring:myrelease-checkmk-node-collector-container-metrics,checkmk-monitoring:myrelease-checkmk-node-collector-machine-sections &
           sleep 2
-          hurl --test metrics-cache/tests/hurl/ --variables-file metrics-cache/tests/hurl/vars --variable token=$TKN
+          hurl \
+            --test metrics-cache/tests/hurl/ \
+            --variables-file metrics-cache/tests/hurl/vars \
+            --variable read_token=$READ_TKN \
+            --variable write_token=$WRITE_TKN

metrics-cache/tests/hurl/machine_sections.hurl

@@ -8,7 +8,13 @@ HTTP 401
 #header "Content-Type" == "application/json"
 
 POST {{baseurl}}/update_machine_sections
-Authorization: Bearer {{token}}
+Authorization: Bearer {{read_token}}
+Content-Type: application/json
+file,fixtures/machine_sections_from_python.json;
+HTTP 401
+
+POST {{baseurl}}/update_machine_sections
+Authorization: Bearer {{write_token}}
 Content-Type: application/json
 file,fixtures/machine_sections_from_python.json;
 HTTP 200

metrics-cache/tests/hurl/root.hurl

@@ -9,5 +9,9 @@ HTTP 401
 
 # The root endpoint should allow properly authorized requests.
 GET {{baseurl}}/
-Authorization: Bearer {{token}}
+Authorization: Bearer {{read_token}}
+HTTP 200
+
+GET {{baseurl}}/
+Authorization: Bearer {{write_token}}
 HTTP 200