Skip to content

Commit 0f20b0a

Browse files
guilhermoccguilhermocc
authored
Add integration tests for foreign trust domain admin ids update (#3761)
Add integration tests for foreign trust domain admin ids update Signed-off-by: Guilherme Carvalho <[email protected]>
1 parent d8262d0 commit 0f20b0a

18 files changed

+183
-59
lines changed

‎test/integration/setup/adminclient/client.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -224,8 +224,8 @@ func mintJWTSVID(ctx context.Context, c *itclient.Client) error {
224224
return errors.New("missing exp")
225225
case claimsMap["iat"] == 0:
226226
return errors.New("missing iat")
227-
case claimsMap["sub"] != "spiffe://domain.test/new_workload":
228-
return fmt.Errorf("unexpected sub: %q", claimsMap["sub"])
227+
case claimsMap["sub"] != fmt.Sprintf("spiffe://%s/new_workload", c.Td.String()):
228+
return fmt.Errorf("unexpected sub: %q, %s", claimsMap["sub"], fmt.Sprintf("spiffe://%q/new_workload", c.Td))
229229
}
230230

231231
return nil
@@ -397,7 +397,7 @@ func countBundles(ctx context.Context, c *itclient.Client) error {
397397
return validatePermissionError(err)
398398
case err != nil:
399399
return err
400-
case resp.Count != 3:
400+
case resp.Count != 4:
401401
return fmt.Errorf("unexpected bundle count: %d", resp.Count)
402402
}
403403
return nil
@@ -410,7 +410,7 @@ func listFederatedBundles(ctx context.Context, c *itclient.Client) error {
410410
return validatePermissionError(err)
411411
case err != nil:
412412
return err
413-
case len(resp.Bundles) != 2:
413+
case len(resp.Bundles) != 3:
414414
return fmt.Errorf("unexpected bundles size: %d", len(resp.Bundles))
415415
}
416416

@@ -525,7 +525,7 @@ func countEntries(ctx context.Context, c *itclient.Client) error {
525525
return validatePermissionError(err)
526526
case err != nil:
527527
return err
528-
case resp.Count != 3:
528+
case resp.Count < 3:
529529
return fmt.Errorf("unexpected entry count: %d", resp.Count)
530530
}
531531
return nil
@@ -534,6 +534,7 @@ func countEntries(ctx context.Context, c *itclient.Client) error {
534534
func listEntries(ctx context.Context, c *itclient.Client) error {
535535
expectedSpiffeIDs := []*types.SPIFFEID{
536536
{TrustDomain: c.Td.String(), Path: "/admin"},
537+
{TrustDomain: c.Td.String(), Path: "/agent-alias"},
537538
{TrustDomain: c.Td.String(), Path: "/workload"},
538539
{TrustDomain: c.Td.String(), Path: "/bar"},
539540
}
@@ -543,7 +544,7 @@ func listEntries(ctx context.Context, c *itclient.Client) error {
543544
return validatePermissionError(err)
544545
case err != nil:
545546
return err
546-
case len(resp.Entries) != 3:
547+
case len(resp.Entries) < 3:
547548
return fmt.Errorf("unexpected entries size: %d", len(resp.Entries))
548549
}
549550

@@ -558,7 +559,7 @@ func listEntries(ctx context.Context, c *itclient.Client) error {
558559

559560
for _, e := range resp.Entries {
560561
if !containsFunc(e.SpiffeId) {
561-
return fmt.Errorf("unexpected entry: %v", e)
562+
return fmt.Errorf("unexpected entry: %v", e.SpiffeId)
562563
}
563564
}
564565

‎test/integration/suites/admin-endpoints/00-setup

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#!/bin/bash
22

3-
"${ROOTDIR}/setup/x509pop/setup.sh" conf/server conf/agent
4-
5-
"${ROOTDIR}/setup/adminclient/build.sh" "${RUNDIR}/conf/agent/adminclient"
3+
"${ROOTDIR}/setup/x509pop/setup.sh" conf/domain-a/server conf/domain-a/agent
4+
"${ROOTDIR}/setup/x509pop/setup.sh" conf/domain-b/server conf/domain-b/agent
65

6+
"${ROOTDIR}/setup/adminclient/build.sh" "${RUNDIR}/conf/domain-a/agent/adminclient"
7+
"${ROOTDIR}/setup/adminclient/build.sh" "${RUNDIR}/conf/domain-b/agent/adminclient"

‎test/integration/suites/admin-endpoints/01-start-server

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
#!/bin/bash
22

3-
docker-up spire-server
3+
docker-up spire-server-a spire-server-b

‎test/integration/suites/admin-endpoints/02-bootstrap-agent

-5
This file was deleted.

‎test/integration/suites/admin-endpoints/02-bootstrap-federation-bundles

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
docker-up spire-server-a spire-server-b
4+
5+
log-debug "bootstrapping bundle from server b to server a..."
6+
docker-compose exec -T spire-server-b \
7+
/opt/spire/bin/spire-server bundle show -format spiffe > conf/domain-a/server/downstream-domain.test.bundle
8+
docker-compose exec -T spire-server-a \
9+
/opt/spire/bin/spire-server bundle set -format spiffe -id spiffe://domain-b.test -path /opt/spire/conf/server/downstream-domain.test.bundle
10+
11+
log-debug "bootstrapping bundle from server a to server b..."
12+
docker-compose exec -T spire-server-a \
13+
/opt/spire/bin/spire-server bundle show -format spiffe > conf/domain-b/server/downstream-domain.test.bundle
14+
docker-compose exec -T spire-server-b \
15+
/opt/spire/bin/spire-server bundle set -format spiffe -id spiffe://domain-a.test -path /opt/spire/conf/server/downstream-domain.test.bundle

‎test/integration/suites/admin-endpoints/03-bootstrap-agent

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
3+
log-debug "bootstrapping agent a..."
4+
docker-compose exec -T spire-server-a \
5+
/opt/spire/bin/spire-server bundle show > conf/domain-a/agent/bootstrap.crt
6+
7+
log-debug "bootstrapping agent b..."
8+
docker-compose exec -T spire-server-b \
9+
/opt/spire/bin/spire-server bundle show > conf/domain-b/agent/bootstrap.crt

‎test/integration/suites/admin-endpoints/03-start-agent

-3
This file was deleted.

‎test/integration/suites/admin-endpoints/04-create-registration-entries

-21
This file was deleted.

‎test/integration/suites/admin-endpoints/04-start-agent

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
docker-up spire-agent-a spire-agent-b

‎test/integration/suites/admin-endpoints/05-create-registration-entries

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
3+
log-debug "creating admin registration entry on server a..."
4+
docker-compose exec -T spire-server-a \
5+
/opt/spire/bin/spire-server entry create \
6+
-parentID "spiffe://domain-a.test/spire/agent/x509pop/$(fingerprint conf/domain-a/agent/agent.crt.pem)" \
7+
-spiffeID "spiffe://domain-a.test/admin" \
8+
-selector "unix:uid:1001" \
9+
-admin \
10+
-ttl 0
11+
check-synced-entry "spire-agent-a" "spiffe://domain-a.test/admin"
12+
13+
log-debug "creating foreign admin registration entry..."
14+
docker-compose exec -T spire-server-b \
15+
/opt/spire/bin/spire-server entry create \
16+
-parentID "spiffe://domain-b.test/spire/agent/x509pop/$(fingerprint conf/domain-b/agent/agent.crt.pem)" \
17+
-spiffeID "spiffe://domain-b.test/admin" \
18+
-selector "unix:uid:1003" \
19+
-federatesWith "spiffe://domain-a.test" \
20+
-ttl 0
21+
check-synced-entry "spire-agent-b" "spiffe://domain-b.test/admin"
22+
23+
log-debug "creating regular registration entry..."
24+
docker-compose exec -T spire-server-a \
25+
/opt/spire/bin/spire-server entry create \
26+
-parentID "spiffe://domain-a.test/spire/agent/x509pop/$(fingerprint conf/domain-a/agent/agent.crt.pem)" \
27+
-spiffeID "spiffe://domain-a.test/workload" \
28+
-selector "unix:uid:1002" \
29+
-ttl 0
30+
check-synced-entry "spire-agent-a" "spiffe://domain-a.test/workload"

‎test/integration/suites/admin-endpoints/05-test-endpoints

-9
This file was deleted.

‎test/integration/suites/admin-endpoints/06-test-endpoints

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
log-debug "test admin workload..."
4+
docker-compose exec -u 1001 -T spire-agent-a \
5+
/opt/spire/conf/agent/adminclient -trustDomain domain-a.test -serverAddr spire-server-a:8081 || fail-now "failed to check admin endpoints"
6+
7+
log-debug "test foreign admin workload..."
8+
docker-compose exec -u 1003 -T spire-agent-b \
9+
/opt/spire/conf/agent/adminclient -trustDomain domain-a.test -serverAddr spire-server-a:8081 || fail-now "failed to check admin foreign td endpoints"
10+
11+
log-debug "test regular workload..."
12+
docker-compose exec -u 1002 -T spire-agent-a \
13+
/opt/spire/conf/agent/adminclient -trustDomain domain-a.test -serverAddr spire-server-a:8081 -expectErrors || fail-now "failed to check admin endpoints"

‎test/integration/suites/admin-endpoints/conf/agent/agent.conf ‎test/integration/suites/admin-endpoints/conf/domain-a/agent/agent.conf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
agent {
22
data_dir = "/opt/spire/data/agent"
33
log_level = "DEBUG"
4-
server_address = "spire-server"
4+
server_address = "spire-server-a"
55
server_port = "8081"
66
trust_bundle_path = "/opt/spire/conf/agent/bootstrap.crt"
7-
trust_domain = "domain.test"
7+
trust_domain = "domain-a.test"
88
}
99

1010
plugins {

‎test/integration/suites/admin-endpoints/conf/domain-a/server/server.conf

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
server {
2+
bind_address = "0.0.0.0"
3+
bind_port = "8081"
4+
trust_domain = "domain-a.test"
5+
data_dir = "/opt/spire/data/server"
6+
log_level = "DEBUG"
7+
ca_ttl = "1h"
8+
default_x509_svid_ttl = "10m"
9+
admin_ids = ["spiffe://domain-b.test/admin"]
10+
federation {
11+
bundle_endpoint {
12+
address = "0..0.0"
13+
port = 8082
14+
}
15+
federates_with "domain-b" {
16+
bundle_endpoint_url = "https://spire-server-b:8082"
17+
bundle_endpoint_profile "https_spiffe" {
18+
endpoint_spiffe_id = "spiffe://domain-b/spire/server"
19+
}
20+
}
21+
}
22+
}
23+
24+
plugins {
25+
DataStore "sql" {
26+
plugin_data {
27+
database_type = "sqlite3"
28+
connection_string = "/opt/spire/data/server/datastore.sqlite3"
29+
}
30+
}
31+
NodeAttestor "x509pop" {
32+
plugin_data {
33+
ca_bundle_path = "/opt/spire/conf/server/agent-cacert.pem"
34+
}
35+
}
36+
KeyManager "memory" {
37+
plugin_data = {}
38+
}
39+
}

‎test/integration/suites/admin-endpoints/conf/domain-b/agent/agent.conf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
agent {
2+
data_dir = "/opt/spire/data/agent"
3+
log_level = "DEBUG"
4+
server_address = "spire-server-b"
5+
server_port = "8081"
6+
trust_bundle_path = "/opt/spire/conf/agent/bootstrap.crt"
7+
trust_domain = "domain-b.test"
8+
}
9+
10+
plugins {
11+
NodeAttestor "x509pop" {
12+
plugin_data {
13+
private_key_path = "/opt/spire/conf/agent/agent.key.pem"
14+
certificate_path = "/opt/spire/conf/agent/agent.crt.pem"
15+
}
16+
}
17+
KeyManager "disk" {
18+
plugin_data {
19+
directory = "/opt/spire/data/agent"
20+
}
21+
}
22+
WorkloadAttestor "unix" {
23+
plugin_data {
24+
}
25+
}
26+
}

‎test/integration/suites/admin-endpoints/conf/server/server.conf ‎test/integration/suites/admin-endpoints/conf/domain-b/server/server.conf

+13-1
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,23 @@
11
server {
22
bind_address = "0.0.0.0"
33
bind_port = "8081"
4-
trust_domain = "domain.test"
4+
trust_domain = "domain-b.test"
55
data_dir = "/opt/spire/data/server"
66
log_level = "DEBUG"
77
ca_ttl = "1h"
88
default_x509_svid_ttl = "10m"
9+
federation {
10+
bundle_endpoint {
11+
address = "0.0.0.0"
12+
port = 8082
13+
}
14+
federates_with "domain-a.test" {
15+
bundle_endpoint_url = "https://spire-server-a:8082"
16+
bundle_endpoint_profile "https_spiffe" {
17+
endpoint_spiffe_id = "spiffe://domain-a.test/spire/server"
18+
}
19+
}
20+
}
921
}
1022

1123
plugins {

‎test/integration/suites/admin-endpoints/docker-compose.yaml

+19-6
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,28 @@
11
version: '3'
22
services:
3-
spire-server:
3+
spire-server-a:
44
image: spire-server-scratch:latest-local
55
hostname: spire-server
66
volumes:
7-
- ./conf/server:/opt/spire/conf/server
7+
- ./conf/domain-a/server:/opt/spire/conf/server
88
command: ["-config", "/opt/spire/conf/server/server.conf"]
9-
spire-agent:
9+
spire-agent-a:
1010
image: spire-agent-scratch:latest-local
1111
hostname: spire-agent
12-
depends_on: ["spire-server"]
12+
depends_on: [ "spire-server-a" ]
1313
volumes:
14-
- ./conf/agent:/opt/spire/conf/agent
15-
command: ["-config", "/opt/spire/conf/agent/agent.conf"]
14+
- ./conf/domain-a/agent:/opt/spire/conf/agent
15+
command: [ "-config", "/opt/spire/conf/agent/agent.conf" ]
16+
spire-server-b:
17+
image: spire-server-scratch:latest-local
18+
hostname: spire-server-foreign-td
19+
volumes:
20+
- ./conf/domain-b/server:/opt/spire/conf/server
21+
command: [ "-config", "/opt/spire/conf/server/server.conf" ]
22+
spire-agent-b:
23+
image: spire-agent-scratch:latest-local
24+
hostname: spire-agent-foreign-td
25+
depends_on: [ "spire-server-b" ]
26+
volumes:
27+
- ./conf/domain-b/agent:/opt/spire/conf/agent
28+
command: [ "-config", "/opt/spire/conf/agent/agent.conf" ]

‎test/integration/test-one.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ if [ ${#steps[@]} -eq 0 ]; then
9999
fail-now "test suite has no steps"
100100
fi
101101
for step in "${steps[@]}"; do
102-
if ! run-step "$step"; then
102+
if ! run-step "$step"; then
103103
fail-now "step $(basename "$step") failed"
104104
fi
105105
done

0 commit comments

Comments
 (0)