Bottom turtle ha registry tests (#929)

* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2026-09-04 12:50:34 -07:00
parent bb4c73febf
commit 2a8c1b63c4
23 changed files with 1082 additions and 28 deletions
@@ -30,6 +30,39 @@ nodes:
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
+      # One spire-ha-agent on the host is shared by all three virtual nodes, with a
+      # spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
+      # package installed spire-ha-agent@main listens, so kubelet's configuration in
+      # the node is the same one a real bare metal node would use.
+      - hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-2/public
+        containerPath: /var/run/spire/agent/sockets/main/public
+      - hostPath: ./.github/kind/conf/credential-providers
+        containerPath: /credential-plugins
+      - hostPath: ./.github/kind/conf/credential-provider-config.yaml
+        containerPath: /etc/kubernetes/credential-provider-config.yaml
+    kubeadmConfigPatches:
+      - |
+        apiVersion: kubeadm.k8s.io/v1beta3
+        kind: JoinConfiguration
+        nodeRegistration:
+          kubeletExtraArgs:
+            image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
+            image-credential-provider-bin-dir: /credential-plugins
+    kubeadmConfigPatchesJSON6902:
+      - group: kubeadm.k8s.io
+        version: v1beta4
+        kind: JoinConfiguration
+        patch: |
+          - op: add
+            path: /nodeRegistration/kubeletExtraArgs/-
+            value:
+              name: image-credential-provider-config
+              value: /etc/kubernetes/credential-provider-config.yaml
+          - op: add
+            path: /nodeRegistration/kubeletExtraArgs/-
+            value:
+              name: image-credential-provider-bin-dir
+              value: /credential-plugins
  - role: worker
    extraMounts:
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
@@ -40,6 +73,39 @@ nodes:
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
+      # One spire-ha-agent on the host is shared by all three virtual nodes, with a
+      # spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
+      # package installed spire-ha-agent@main listens, so kubelet's configuration in
+      # the node is the same one a real bare metal node would use.
+      - hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-3/public
+        containerPath: /var/run/spire/agent/sockets/main/public
+      - hostPath: ./.github/kind/conf/credential-providers
+        containerPath: /credential-plugins
+      - hostPath: ./.github/kind/conf/credential-provider-config.yaml
+        containerPath: /etc/kubernetes/credential-provider-config.yaml
+    kubeadmConfigPatches:
+      - |
+        apiVersion: kubeadm.k8s.io/v1beta3
+        kind: JoinConfiguration
+        nodeRegistration:
+          kubeletExtraArgs:
+            image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
+            image-credential-provider-bin-dir: /credential-plugins
+    kubeadmConfigPatchesJSON6902:
+      - group: kubeadm.k8s.io
+        version: v1beta4
+        kind: JoinConfiguration
+        patch: |
+          - op: add
+            path: /nodeRegistration/kubeletExtraArgs/-
+            value:
+              name: image-credential-provider-config
+              value: /etc/kubernetes/credential-provider-config.yaml
+          - op: add
+            path: /nodeRegistration/kubeletExtraArgs/-
+            value:
+              name: image-credential-provider-bin-dir
+              value: /credential-plugins
  - role: worker
    extraMounts:
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
@@ -50,3 +116,36 @@ nodes:
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
      - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public
        containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
+      # One spire-ha-agent on the host is shared by all three virtual nodes, with a
+      # spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
+      # package installed spire-ha-agent@main listens, so kubelet's configuration in
+      # the node is the same one a real bare metal node would use.
+      - hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-4/public
+        containerPath: /var/run/spire/agent/sockets/main/public
+      - hostPath: ./.github/kind/conf/credential-providers
+        containerPath: /credential-plugins
+      - hostPath: ./.github/kind/conf/credential-provider-config.yaml
+        containerPath: /etc/kubernetes/credential-provider-config.yaml
+    kubeadmConfigPatches:
+      - |
+        apiVersion: kubeadm.k8s.io/v1beta3
+        kind: JoinConfiguration
+        nodeRegistration:
+          kubeletExtraArgs:
+            image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
+            image-credential-provider-bin-dir: /credential-plugins
+    kubeadmConfigPatchesJSON6902:
+      - group: kubeadm.k8s.io
+        version: v1beta4
+        kind: JoinConfiguration
+        patch: |
+          - op: add
+            path: /nodeRegistration/kubeletExtraArgs/-
+            value:
+              name: image-credential-provider-config
+              value: /etc/kubernetes/credential-provider-config.yaml
+          - op: add
+            path: /nodeRegistration/kubeletExtraArgs/-
+            value:
+              name: image-credential-provider-bin-dir
+              value: /credential-plugins