Skip to content

Commit 377a60d

Browse files
gkechgkech
committed
add e2e test
1 parent 7aeeeb4 commit 377a60d

20 files changed

+577
-0
lines changed

‎e2e-tests/run-pr.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ dynamic-configuration
1010
finalizers
1111
init-deploy
1212
huge-pages
13+
ldap
1314
monitoring
1415
monitoring-pmm3
1516
one-pod

‎e2e-tests/run-release.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ dynamic-configuration
1010
finalizers
1111
init-deploy
1212
huge-pages
13+
ldap
1314
major-upgrade
1415
monitoring
1516
monitoring-pmm3

‎e2e-tests/tests/ldap/00-assert.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 120
4+
---
5+
apiVersion: apiextensions.k8s.io/v1
6+
kind: CustomResourceDefinition
7+
metadata:
8+
name: perconapgclusters.pgv2.percona.com
9+
spec:
10+
group: pgv2.percona.com
11+
names:
12+
kind: PerconaPGCluster
13+
listKind: PerconaPGClusterList
14+
plural: perconapgclusters
15+
singular: perconapgcluster
16+
scope: Namespaced
17+
---
18+
apiVersion: kuttl.dev/v1beta1
19+
kind: TestAssert
20+
metadata:
21+
name: check-operator-deploy-status
22+
timeout: 120
23+
commands:
24+
- script: kubectl assert exist-enhanced deployment percona-postgresql-operator -n ${OPERATOR_NS:-$NAMESPACE} --field-selector status.readyReplicas=1

‎e2e-tests/tests/ldap/00-deploy-operator.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
timeout: 10
4+
commands:
5+
- script: |-
6+
set -o errexit
7+
set -o xtrace
8+
9+
source ../../functions
10+
init_temp_dir # do this only in the first TestStep
11+
12+
deploy_operator
13+
deploy_client

‎e2e-tests/tests/ldap/01-assert.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
# OpenLDAP readiness probe has initialDelaySeconds: 60, so allow extra time.
4+
timeout: 180
5+
---
6+
apiVersion: apps/v1
7+
kind: Deployment
8+
metadata:
9+
name: openldap
10+
status:
11+
availableReplicas: 1
12+
readyReplicas: 1

‎e2e-tests/tests/ldap/01-openldap.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
apply:
4+
- files/openldap.yaml

‎e2e-tests/tests/ldap/02-assert.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 600
4+
---
5+
apiVersion: postgres-operator.crunchydata.com/v1beta1
6+
kind: PostgresCluster
7+
metadata:
8+
name: ldap
9+
status:
10+
instances:
11+
- name: instance1
12+
readyReplicas: 3
13+
replicas: 3
14+
updatedReplicas: 3
15+
---
16+
apiVersion: v1
17+
kind: Service
18+
metadata:
19+
name: ldap-primary
20+

‎e2e-tests/tests/ldap/02-cluster.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
timeout: 10
4+
commands:
5+
- script: |-
6+
set -o errexit
7+
set -o xtrace
8+
9+
source ../../functions
10+
11+
get_cr \
12+
| yq eval '
13+
.spec.users += [{"name":"percona","databases":["percona"]}] |
14+
.spec.authentication.rules = [{"connection":"host","method":"ldap","users":["percona"],"options":{"ldapserver":"openldap","ldapport":389,"ldapprefix":"uid=","ldapsuffix":",ou=perconadba,dc=ldap,dc=local"}}]
15+
' - \
16+
| kubectl -n "${NAMESPACE}" apply -f -

‎e2e-tests/tests/ldap/03-verify-ldap-auth.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
- script: |
6+
set -e
7+
8+
PRIMARY=$(
9+
kubectl get pod --namespace "${NAMESPACE}" \
10+
--output name --selector \
11+
'postgres-operator.crunchydata.com/cluster=ldap,postgres-operator.crunchydata.com/role=primary' \
12+
| head -1
13+
)
14+
15+
HBA=$(kubectl exec --namespace "${NAMESPACE}" "${PRIMARY}" -c database \
16+
-- psql -tAc "SELECT pg_read_file('pg_hba.conf');" 2>&1)
17+
18+
contains() { bash -ceu '[[ "$1" == *"$2"* ]]' - "$@"; }
19+
contains "${HBA}" "ldap" || {
20+
echo >&2 'pg_hba.conf does not contain an ldap rule'
21+
exit 1
22+
}
23+
24+
## verify ldap directories
25+
for i in $(seq 12); do
26+
if kubectl exec --namespace "${NAMESPACE}" deployment/openldap -c ldap-setup \
27+
-- ldapsearch -x -H ldap://localhost:389 \
28+
-D "cn=admin,dc=ldap,dc=local" -w adminpassword \
29+
-b "uid=percona,ou=perconadba,dc=ldap,dc=local" 2>&1 \
30+
| grep -q "uid: percona"; then
31+
echo "LDAP entry for percona found"
32+
break
33+
fi
34+
echo "Attempt ${i}: LDAP entry not yet available, waiting..."
35+
sleep 10
36+
done
37+
38+
# verify LDAP auth
39+
result=""
40+
for i in $(seq 6); do
41+
result=$(kubectl exec --namespace "${NAMESPACE}" "${PRIMARY}" -c database \
42+
-- bash -c 'PGPASSWORD=mysecretpassword PGSSLMODE=disable \
43+
psql -h 127.0.0.1 -U percona -d percona -tAc "SELECT current_user;" 2>&1') && break
44+
echo "Attempt ${i} failed: ${result}"
45+
sleep 10
46+
done
47+
48+
[[ "${result}" == "percona" ]] || {
49+
echo >&2 "Expected current_user='percona', got: ${result}"
50+
exit 1
51+
}
52+
53+
# verify wrong password is rejected
54+
if bad_result=$(kubectl exec --namespace "${NAMESPACE}" "${PRIMARY}" -c database \
55+
-- bash -c 'PGPASSWORD=wrongpassword PGSSLMODE=disable \
56+
psql -h 127.0.0.1 -U percona -d percona -tAc "SELECT current_user;" 2>&1'); then
57+
echo >&2 "Expected authentication failure with wrong password, but login succeeded: ${bad_result}"
58+
exit 1
59+
fi
60+
echo "Wrong password correctly rejected"

‎e2e-tests/tests/ldap/files/cluster.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: pgv2.percona.com/v2
2+
kind: PerconaPGCluster
3+
metadata:
4+
name: ldap
5+
spec:
6+
# postgresVersion, images, backups, etc. are injected by get_cr() from deploy/cr.yaml
7+
users:
8+
- name: percona
9+
databases:
10+
- percona
11+
# LDAP simple-bind: constructs DN as uid={username},ou=perconadba,dc=ldap,dc=local
12+
# and binds with the user's password against the openldap Service (port 389).
13+
authentication:
14+
rules:
15+
- connection: host
16+
method: ldap
17+
users:
18+
- percona
19+
options:
20+
ldapserver: openldap
21+
ldapport: 389
22+
ldapprefix: "uid="
23+
ldapsuffix: ",ou=perconadba,dc=ldap,dc=local"

0 commit comments

Comments
 (0)