|
| 1 | +#!/bin/bash |
| 2 | +# setup-kmip.sh — Deploy PyKMIP mock server for KMIP SSE testing. |
| 3 | +# Idempotent |
| 4 | +# |
| 5 | +# Deploys PyKMIP infra (certs, pod, service). The Zenko CR is patched |
| 6 | +# by the CTST Before hook when @ServerSideEncryptionKmip tests start. |
| 7 | + |
| 8 | +set -euo pipefail |
| 9 | + |
| 10 | +ZENKO_NAME="${ZENKO_NAME:-end2end}" |
| 11 | +NAMESPACE="${NAMESPACE:-default}" |
| 12 | + |
| 13 | +# 1. Certs + secrets |
| 14 | + |
| 15 | +if kubectl get secret "${ZENKO_NAME}-kmip-certs" -n "${NAMESPACE}" &>/dev/null; then |
| 16 | + echo "KMIP secrets already exist, skipping cert generation" |
| 17 | +else |
| 18 | + echo "Generating KMIP TLS certificates..." |
| 19 | + D=$(mktemp -d) |
| 20 | + trap 'rm -rf "$D"' EXIT |
| 21 | + |
| 22 | + openssl genrsa -out "$D/ca.key" 4096 2>/dev/null |
| 23 | + openssl req -new -x509 -key "$D/ca.key" -out "$D/ca.pem" \ |
| 24 | + -days 3650 -subj "/CN=KMIP-CA" 2>/dev/null |
| 25 | + |
| 26 | + openssl genrsa -out "$D/server.key" 4096 2>/dev/null |
| 27 | + openssl req -new -key "$D/server.key" -out "$D/server.csr" \ |
| 28 | + -subj "/CN=pykmip" 2>/dev/null |
| 29 | + openssl x509 -req -in "$D/server.csr" -CA "$D/ca.pem" -CAkey "$D/ca.key" \ |
| 30 | + -CAcreateserial -out "$D/server.crt" -days 3650 \ |
| 31 | + -extfile <(printf "subjectAltName=DNS:pykmip,DNS:pykmip.%s.svc.cluster.local" "$NAMESPACE") \ |
| 32 | + 2>/dev/null |
| 33 | + |
| 34 | + openssl genrsa -out "$D/client.key" 4096 2>/dev/null |
| 35 | + openssl req -new -key "$D/client.key" -out "$D/client.csr" \ |
| 36 | + -subj "/CN=cloudserver-client" 2>/dev/null |
| 37 | + openssl x509 -req -in "$D/client.csr" -CA "$D/ca.pem" -CAkey "$D/ca.key" \ |
| 38 | + -CAcreateserial -out "$D/client.crt" -days 3650 \ |
| 39 | + -extfile <(printf "extendedKeyUsage=clientAuth") 2>/dev/null |
| 40 | + |
| 41 | + kubectl create secret generic "${ZENKO_NAME}-kmip-certs" \ |
| 42 | + --from-file=ca.pem="$D/ca.pem" --from-file=cert.pem="$D/client.crt" \ |
| 43 | + --from-file=key.pem="$D/client.key" \ |
| 44 | + --dry-run=client -o yaml | kubectl apply -f - |
| 45 | + |
| 46 | + kubectl create secret generic pykmip-server-certs \ |
| 47 | + --from-file=ca.crt="$D/ca.pem" --from-file=server.crt="$D/server.crt" \ |
| 48 | + --from-file=server.key="$D/server.key" \ |
| 49 | + --dry-run=client -o yaml | kubectl apply -f - |
| 50 | +fi |
| 51 | + |
| 52 | +# 2. PyKMIP startup script |
| 53 | + |
| 54 | +kubectl create configmap pykmip-server-script --dry-run=client -o yaml \ |
| 55 | + --from-literal=run_pykmip.py=' |
| 56 | +import logging; from kmip.services.server import KmipServer |
| 57 | +logging.basicConfig(level=logging.INFO) |
| 58 | +server = KmipServer(hostname="0.0.0.0", port=5696, |
| 59 | + certificate_path="/certs/server.crt", key_path="/certs/server.key", |
| 60 | + ca_path="/certs/ca.crt", auth_suite="TLS1.2", config_path=None, |
| 61 | + enable_tls_client_auth=True, database_path="/tmp/pykmip.db") |
| 62 | +with server: server.serve() |
| 63 | +' | kubectl apply -f - |
| 64 | + |
| 65 | +# 3. Deploy PyKMIP pod + service (inline YAML) |
| 66 | + |
| 67 | +if ! kubectl get deployment pykmip -n "${NAMESPACE}" &>/dev/null; then |
| 68 | + kubectl apply -n "${NAMESPACE}" -f - <<'YAML' |
| 69 | +apiVersion: v1 |
| 70 | +kind: Service |
| 71 | +metadata: |
| 72 | + name: pykmip |
| 73 | +spec: |
| 74 | + selector: { name: pykmip } |
| 75 | + ports: [{ name: kmip, port: 5696, targetPort: 5696 }] |
| 76 | +--- |
| 77 | +apiVersion: apps/v1 |
| 78 | +kind: Deployment |
| 79 | +metadata: |
| 80 | + name: pykmip |
| 81 | + labels: { name: pykmip } |
| 82 | +spec: |
| 83 | + replicas: 1 |
| 84 | + selector: |
| 85 | + matchLabels: { name: pykmip } |
| 86 | + template: |
| 87 | + metadata: |
| 88 | + labels: { name: pykmip } |
| 89 | + spec: |
| 90 | + initContainers: |
| 91 | + - name: install |
| 92 | + image: docker.io/library/python:3.10-slim |
| 93 | + command: [pip, install, --target=/pykmip-libs, pykmip==0.10.0, -q] |
| 94 | + volumeMounts: [{ name: pykmip-libs, mountPath: /pykmip-libs }] |
| 95 | + containers: |
| 96 | + - name: pykmip |
| 97 | + image: docker.io/library/python:3.10-slim |
| 98 | + command: [python3, /scripts/run_pykmip.py] |
| 99 | + env: [{ name: PYTHONPATH, value: /pykmip-libs }] |
| 100 | + ports: [{ containerPort: 5696 }] |
| 101 | + readinessProbe: |
| 102 | + tcpSocket: { port: 5696 } |
| 103 | + initialDelaySeconds: 5 |
| 104 | + periodSeconds: 3 |
| 105 | + volumeMounts: |
| 106 | + - { name: certs, mountPath: /certs, readOnly: true } |
| 107 | + - { name: scripts, mountPath: /scripts, readOnly: true } |
| 108 | + - { name: pykmip-libs, mountPath: /pykmip-libs } |
| 109 | + volumes: |
| 110 | + - { name: certs, secret: { secretName: pykmip-server-certs } } |
| 111 | + - { name: scripts, configMap: { name: pykmip-server-script } } |
| 112 | + - { name: pykmip-libs, emptyDir: {} } |
| 113 | +YAML |
| 114 | + echo "Waiting for PyKMIP..." |
| 115 | + kubectl wait --for=condition=Available deployment/pykmip -n "${NAMESPACE}" --timeout=5m |
| 116 | +else |
| 117 | + echo "PyKMIP already deployed" |
| 118 | +fi |
| 119 | + |
| 120 | +echo "PyKMIP infra ready" |
0 commit comments