From 7533499b4fc70d4f6338e3122ce0cc5086209b00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Filip=20=C4=8C=C3=A1p?= Date: Thu, 12 Oct 2023 16:33:48 +0200 Subject: [PATCH] Make mgc test_smoke use TLSPolicy --- .../openshift/objects/gateway_api/gateway.py | 17 +++++++- testsuite/openshift/objects/tlspolicy.py | 31 +++++++++++++++ testsuite/tests/mgc/conftest.py | 39 ++++++++++++++++--- testsuite/tests/mgc/test_basic.py | 6 ++- 4 files changed, 86 insertions(+), 7 deletions(-) create mode 100644 testsuite/openshift/objects/tlspolicy.py diff --git a/testsuite/openshift/objects/gateway_api/gateway.py b/testsuite/openshift/objects/gateway_api/gateway.py index e8e5f432..d2d8d419 100644 --- a/testsuite/openshift/objects/gateway_api/gateway.py +++ b/testsuite/openshift/objects/gateway_api/gateway.py @@ -93,7 +93,22 @@ def create_instance( if placement is not None: labels["cluster.open-cluster-management.io/placement"] = placement - return super(MGCGateway, cls).create_instance(openshift, name, gateway_class, hostname, labels) + instance = super(MGCGateway, cls).create_instance(openshift, name, gateway_class, hostname, labels) + instance.model["spec"]["listeners"] = [ + { + "name": "api", + "port": 443, + "protocol": "HTTPS", + "hostname": hostname, + "allowedRoutes": {"namespaces": {"from": "All"}}, + "tls": { + "mode": "Terminate", + "certificateRefs": [{"name": f"{name}-tls", "kind": "Secret"}], + }, + } + ] + + return instance def get_spoke_gateway(self, spokes: dict[str, OpenShiftClient]) -> "MGCGateway": """ diff --git a/testsuite/openshift/objects/tlspolicy.py b/testsuite/openshift/objects/tlspolicy.py new file mode 100644 index 00000000..a419590f --- /dev/null +++ b/testsuite/openshift/objects/tlspolicy.py @@ -0,0 +1,31 @@ +"""Module for TLSPolicy related classes""" +from testsuite.openshift.client import OpenShiftClient +from testsuite.openshift.objects import OpenShiftObject +from testsuite.openshift.objects.gateway_api import Referencable + + +class TLSPolicy(OpenShiftObject): + """TLSPolicy object""" + + @classmethod + def create_instance( + cls, + openshift: OpenShiftClient, + name: str, + parent: Referencable, + issuer: Referencable, + labels: dict[str, str] = None, + ): + """Creates new instance of TLSPolicy""" + + model = { + "apiVersion": "kuadrant.io/v1alpha1", + "kind": "TLSPolicy", + "metadata": {"name": name, "labels": labels}, + "spec": { + "targetRef": parent.reference, + "issuerRef": issuer.reference, + }, + } + + return cls(model, context=openshift.context) diff --git a/testsuite/tests/mgc/conftest.py b/testsuite/tests/mgc/conftest.py index 2c6a0fcf..bfc9044a 100644 --- a/testsuite/tests/mgc/conftest.py +++ b/testsuite/tests/mgc/conftest.py @@ -5,10 +5,12 @@ from testsuite.openshift.httpbin import Httpbin from testsuite.openshift.objects.dnspolicy import DNSPolicy +from testsuite.openshift.objects.gateway_api import CustomReference from testsuite.openshift.objects.gateway_api.gateway import MGCGateway, GatewayProxy from testsuite.openshift.objects.gateway_api.route import HTTPRoute from testsuite.openshift.objects.proxy import Proxy from testsuite.openshift.objects.route import Route +from testsuite.openshift.objects.tlspolicy import TLSPolicy @pytest.fixture(scope="module") @@ -41,7 +43,8 @@ def upstream_gateway(request, openshift, blame, hostname, module_label): ) request.addfinalizer(upstream_gateway.delete) upstream_gateway.commit() - upstream_gateway.wait_for_ready() + # we cannot wait here because of referencing not yet existent tls secret which would be provided later by tlspolicy + # upstream_gateway.wait_for_ready() return upstream_gateway @@ -61,6 +64,16 @@ def initial_host(hostname): return f"route.{hostname}" +@pytest.fixture(scope="session") +def self_signed_cluster_issuer(): + """Reference to cluster self-signed certificate issuer""" + return CustomReference( + group="cert-manager.io", + kind="ClusterIssuer", + name="selfsigned-cluster-issuer", + ) + + @pytest.fixture(scope="module") def route(request, proxy, blame, gateway, initial_host, backend) -> Route: """Exposed Route object""" @@ -77,9 +90,12 @@ def route(request, proxy, blame, gateway, initial_host, backend) -> Route: return route +# pylint: disable=unused-argument @pytest.fixture(scope="module") -def gateway(upstream_gateway, spokes): +def gateway(upstream_gateway, spokes, hub_policies_commit): """Downstream gateway, e.g. gateway on a spoke cluster""" + # wait for upstream gateway here to be able to get spoke gateways + upstream_gateway.wait_for_ready() gw = upstream_gateway.get_spoke_gateway(spokes) gw.wait_for_ready() return gw @@ -108,10 +124,23 @@ def dns_policy(blame, upstream_gateway, module_label): return policy -@pytest.fixture(scope="module", autouse=True) -def commit(request, dns_policy): +@pytest.fixture(scope="module") +def tls_policy(blame, upstream_gateway, module_label, self_signed_cluster_issuer): + """TLSPolicy fixture""" + policy = TLSPolicy.create_instance( + upstream_gateway.openshift, + blame("tls"), + parent=upstream_gateway, + issuer=self_signed_cluster_issuer, + labels={"app": module_label}, + ) + return policy + + +@pytest.fixture(scope="module") +def hub_policies_commit(request, upstream_gateway, dns_policy, tls_policy): """Commits all important stuff before tests""" - for component in [dns_policy]: + for component in [dns_policy, tls_policy]: if component is not None: request.addfinalizer(component.delete) component.commit() diff --git a/testsuite/tests/mgc/test_basic.py b/testsuite/tests/mgc/test_basic.py index 235d9a50..a338b55a 100644 --- a/testsuite/tests/mgc/test_basic.py +++ b/testsuite/tests/mgc/test_basic.py @@ -17,6 +17,8 @@ import pytest +from testsuite.httpx import HttpxBackoffClient + pytestmark = [pytest.mark.mgc] @@ -30,7 +32,9 @@ def test_smoke(route): Tests whether the backend, exposed using the HTTPRoute and Gateway, was exposed correctly, having a tls secured endpoint with a hostname managed by MGC """ - backend_client = route.client(verify=False) # self-signed certificate; TBD + backend_client = HttpxBackoffClient( + base_url=f"https://{route.hostnames[0]}", verify=False + ) # self-signed certificate sleep(30) # wait for DNS record to propagate correctly; TBD