[keymanager] add cloudbuild integration test flow by atulpatildbz · Pull Request #701 · google/go-tpm-tools

atulpatildbz · 2026-03-10T07:35:57Z

This adds the automated integration tests for the keymanager service.

Adds a test workload container image that runs the end-to-end Python client test
Adds a cloudbuild yaml test definition to spin up a VM with the workload
Hooks the test into the main launcher cloudbuild.yaml workflow

atulpatildbz · 2026-03-10T09:08:59Z

/gcbrun

atulpatildbz · 2026-03-11T14:53:25Z

/gcbrun

atulpatildbz · 2026-03-12T04:41:06Z

launcher/image/testworkloads/keymanager/workload.py

+import requests_unixsocket
+
+session = requests_unixsocket.Session()
+# Use the correct socket path for confidential space environment


todo: remove / modify this comment

Done. Updated the comment to reflect the HTTP post request instead of reading from server.log

atulpatildbz · 2026-03-12T04:42:53Z

launcher/image/testworkloads/keymanager/workload.py

+    enc_bytes, ciphertext, plaintext = do_encap(pub_key_b64)
+    shared_secret_bytes = decap_key(handle, enc_bytes)
+    verify_payload(shared_secret_bytes, ciphertext, plaintext)
+    print("\nSuccess! Flow completed.")


todo: add destroy. then enumerate again to check if it is empty

Done. Added a destroy_key step at the end of the test flow, followed by enumerate_keys to assert the handle is no longer present

NilanjanDaw · 2026-03-12T04:39:15Z

launcher/image/testworkloads/keymanager/workload.py

+
+# Check for server.log generated by background WSD server
+def generate_key():
+  print("\n--- Generating Key ---")


Can we move all the log print statements to the serial console. Otherwise they are not captured in the VM logs and it will be hard to debug if anything goes wrong.

Done. Redirected sys.stdout and sys.stderr to /dev/console at the start of the script.

Checking the output after test execution

Seems like the logs are still missing.

I forgot to push the workload image after changes. Trying again

Reverted the /dev/console logic. the SERIAL_OUTPUT was empty in that case.

as per launcher/image/test/scripts/test_keymanager.sh we only echo to serial output in case of failure.

I temporarily removed this condition in 48980de and then reran the cloudbuild test.

the print statements can be found in the cloudbuild job: (sharing url separately)

level=INFO msg="workload task started" Socket /run/container_launcher/kmaserver.sock found after 0 seconds --- Getting Capabilities --- Capabilities: { "supported_algorithms": [ { "algorithm": { "type": "kem", "params": { "kem_id": "DHKEM_X25519_HKDF_SHA256" } } } ] } --- Generating Key --- Generated Key: af9ee813-9e3e-498b-9610-e9da884fb439 --- Enumerating Keys --- Enumerated Keys: [ { "key_handle": { "handle": "af9ee813-9e3e-498b-9610-e9da884fb439" }, "pub_key": { "algorithm": { "type": "kem", "params": { "kem_id": "DHKEM_X25519_HKDF_SHA256" } }, "public_key": "Ktak7twxMHVResTMfmLKQK4UahV04+6V5l/ao4dVbDo=" }, "key_protection_mechanism": "KEY_PROTECTION_VM_EMULATED", "expiration_time": 1773386236 } ] --- Performing HPKE Encapsulation --- Encrypting plaintext payload: 'authentic-secret-32-bytes-value!' --- Decapping Key af9ee813-9e3e-498b-9610-e9da884fb439 --- Decapped shared secret: { "algorithm": "DHKEM_X25519_HKDF_SHA256", "secret": "L5BzbGPw41Nd2NXQmIjBnB8Vlq1dVgBmXI06ebZbwM0=" } --- Verifying Decapped Payload --- Initializing HPKE receiver context from the decapped shared secret... Opening the ciphertext locally using the returned shared secret... Decrypted payload: 'authentic-secret-32-bytes-value!' SUCCESS: The decrypted payload matches the originally sent payload! --- Destroying Key af9ee813-9e3e-498b-9610-e9da884fb439 --- Key destroyed successfully. --- Enumerating Keys --- Enumerated Keys: [] Success! Flow completed. time=2026-03-13T06:17:17.555Z

I'll proceed to revert 48980de now

launcher/image/testworkloads/keymanager/client_test.py

NilanjanDaw · 2026-03-12T04:46:49Z

launcher/image/testworkloads/keymanager/client_test.py

+  if resp.status_code != 200:
+    print(f"Error: {resp.status_code} - {resp.text}")
+  resp.raise_for_status()
+  keys = resp.json()["key_infos"]


Lets tighten this test to check that the key we generated in the generate_key step is also included in the enumerated list.

Done. The test now explicitly looks for the generated key handle in the enumerate_keys response.

launcher/image/testworkloads/keymanager/client_test.py

launcher/image/testworkloads/keymanager/workload.py

This adds the automated integration tests for the keymanager service. - Adds a test workload container image that runs the end-to-end Python client test - Adds a cloudbuild yaml test definition to spin up a Keymanager VM with the workload - Hooks the test into the main launcher cloudbuild.yaml workflow Fix fetchExperiments for Vanguard images and update KeymanagerTests The confidential_space_experiments binary is intentionally omitted from Vg images (which use vgpreload.sh and vgentrypoint.sh). Because of this, the fetchExperiments function fails and experiment variables default to false, breaking tests like the new Keymanager E2E tests. This commit updates launcher/spec/launch_spec.go to gracefully fallback to reading the static /usr/share/oem/confidential_space/vgexperiment.json file when the experiments binary is absent or fails. It also updates launcher/cloudbuild.yaml so the KeymanagerTests step runs against the vg debug image (DebugVgImageBuild), rather than the standard debug image, as EnableKeyManager is specifically an injected vg feature. Fix fetchExperiments linter warning (indent-error-flow)

Addresses PR feedback for the keymanager client test workload: 1. Console Logging: Redirects sys.stdout and sys.stderr to /dev/console at the start of the script so that standard output appears in the VM serial console logs immediately. 2. JSON Schema Validation: Replaces the custom nested dictionary validation logic with the standard `jsonschema` Python library. Adds comprehensive JSON schemas for each API response (KEY_HANDLE_SCHEMA, ALGORITHM_SCHEMA, PUB_KEY_SCHEMA, KEY_INFO_SCHEMA, GET_CAPABILITIES_SCHEMA, DECAPS_RESPONSE_SCHEMA, ENUMERATE_KEYS_SCHEMA) and enforces strict payload structures. 3. Added `jsonschema` to the workload Dockerfile dependencies. 4. Destroy Key Flow: Adds a `destroy_key` function to test the v1/keys:destroy API. 5. End-to-End Test Updates: Enhances the main execution flow to destroy the generated key at the end, and then re-enumerates the keys to assert that the destroyed key handle no longer exists in the key manager.

atulpatildbz · 2026-03-12T17:48:53Z

/gcbrun

# Conflicts: # launcher/image/testworkloads/keymanager/Dockerfile

atulpatildbz · 2026-03-13T03:34:48Z

/gcbrun

This reverts commit 48980de.

atulpatildbz · 2026-03-13T08:28:55Z

@meetrajvala i've separated keyclaims and keymanager workload. can you approve this restructuring looks okay?

@jkl73 can you take a look at yaml changes in this PR and approve if it looks okay?

meetrajvala · 2026-03-16T05:39:58Z

launcher/image/testworkloads/keymanager/Dockerfile

@@ -1,13 +1,18 @@
-# From current directory:
-# gcloud builds submit --tag us-west1-docker.pkg.dev/confidential-space-images-dev/cs-integ-test-images/kms-workload:latest --project confidential-space-images-dev


As we do not follow any convention, It would be helpful to have the workload image reference here in comment so that test workload images can be easily mapped to their artifact registry refs.

good point. added gcloud build submit comment.

also added registry reference comment in launcher/image/test/test_keymanager_cloudbuild.yaml

As we do not follow any convention, it is helpful to have the workload image reference in comments so that test workload images can be easily mapped to their artifact registry refs. This addresses a review comment on PR google#701.

atulpatildbz force-pushed the cloudbuild-test branch 2 times, most recently from 27ece38 to 4d5baf9 Compare March 12, 2026 03:03

atulpatildbz requested a review from NilanjanDaw March 12, 2026 03:54

atulpatildbz commented Mar 12, 2026

View reviewed changes

NilanjanDaw mentioned this pull request Mar 12, 2026

Implement TEE server interface to get key endorsement #700

Merged

NilanjanDaw reviewed Mar 12, 2026

View reviewed changes

atulpatildbz force-pushed the cloudbuild-test branch from 4d5baf9 to d1efc92 Compare March 12, 2026 15:48

atulpatildbz added 3 commits March 13, 2026 02:54

Merge remote-tracking branch 'origin/main' into cloudbuild-test

497b91d

# Conflicts: # launcher/image/testworkloads/keymanager/Dockerfile

Rename client_test.py to workload.py and add missing socket variables

a8b5926

fix: json schema minor fixes

97168b7

atulpatildbz added 3 commits March 13, 2026 04:50

remove redirect logic for serial console VM

665c025

temporary: always echo serial output

48980de

Revert "temporary: always echo serial output"

2a05180

This reverts commit 48980de.

atulpatildbz requested review from NilanjanDaw and meetrajvala March 13, 2026 08:25

atulpatildbz requested a review from jkl73 March 13, 2026 08:29

NilanjanDaw approved these changes Mar 14, 2026

View reviewed changes

meetrajvala reviewed Mar 16, 2026

View reviewed changes

meetrajvala approved these changes Mar 16, 2026

View reviewed changes

[keymanager] Add workload image references in comments

d71e341

As we do not follow any convention, it is helpful to have the workload image reference in comments so that test workload images can be easily mapped to their artifact registry refs. This addresses a review comment on PR google#701.

atulpatildbz merged commit 64f2a3f into google:main Mar 16, 2026
12 checks passed

		@@ -1,13 +1,18 @@
		# From current directory:
		# gcloud builds submit --tag us-west1-docker.pkg.dev/confidential-space-images-dev/cs-integ-test-images/kms-workload:latest --project confidential-space-images-dev

Conversation

atulpatildbz commented Mar 10, 2026

Uh oh!

atulpatildbz commented Mar 10, 2026

Uh oh!

atulpatildbz commented Mar 11, 2026

Uh oh!

atulpatildbz Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

atulpatildbz commented Mar 12, 2026

Uh oh!

atulpatildbz commented Mar 13, 2026

Uh oh!

atulpatildbz commented Mar 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

atulpatildbz Mar 12, 2026 •

edited

Loading