Bottom turtle ha registry tests (#929)

* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2026-09-04 12:50:34 -07:00
parent bb4c73febf
commit 2a8c1b63c4
23 changed files with 1082 additions and 28 deletions
@@ -0,0 +1,121 @@
+# Pushes an image into zot using an identity minted by the spire-identity-exchange.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zot-push
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: image-push
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app: image-push
+    spec:
+      serviceAccountName: zot-push
+      restartPolicy: Never
+      initContainers:
+      - name: static-busybox
+        # Replaced by run-tests.sh with the image from the spiffe-oidc-discovery-provider chart
+        image: IMAGE_BUSYBOX
+        command: ["sh", "-c", "cp /bin/busybox /data/busybox && chmod +x /data/busybox"]
+        volumeMounts:
+        - name: data-volume
+          mountPath: /data
+      - name: fetch-svid
+        # Replaced by run-tests.sh with the image from the spire-agent chart
+        image: IMAGE_SPIRE_AGENT
+        command:
+        - /data/busybox
+        - sh
+        - -xec
+        - |
+          SOCK=/spire-agent/spire-agent.sock
+          i=0
+          while [ "$i" -lt 30 ]; do
+            if /opt/spire/bin/spire-agent api fetch x509 -socketPath "$SOCK" -write /data -timeout 5s &&
+               /opt/spire/bin/spire-agent api fetch jwt -audience spire-identity-exchange -socketPath "$SOCK" -timeout 5s > /data/jwt.txt; then
+              break
+            fi
+            i=$((i+1))
+            /data/busybox sleep 2
+          done
+          if [ ! -s /data/jwt.txt ]; then
+            echo "no SVID for this pod after ${i} attempts"
+            exit 1
+          fi
+          /data/busybox grep -A1 'token(' /data/jwt.txt | /data/busybox tail -1 | /data/busybox tr -d '[:space:]' > /data/svid.jwt
+          test -s /data/svid.jwt
+        volumeMounts:
+        - name: data-volume
+          mountPath: /data
+        - name: spire-api
+          mountPath: /spire-agent
+          readOnly: true
+      - name: exchange
+        # Replaced by run-tests.sh with the toolkit image from the spiffe-oidc-discovery-provider chart
+        image: IMAGE_TOOLKIT
+        command:
+        - sh
+        - -xec
+        - |
+          # crane talks to both docker.io and zot, so it needs the public roots and the
+          # SPIRE bundle in one file.
+          cat /etc/ssl/certs/ca-certificates.crt /data/bundle.0.pem > /data/ca-bundle.pem
+
+          PSAT="$(cat /var/run/secrets/tokens/token)"
+          SVID="$(cat /data/svid.jwt)"
+          TOKEN="$(curl -k -sS --fail-with-body --max-time 60 --connect-timeout 10 -X POST \
+            -H "Authorization: Bearer k8s_psat=${PSAT}:spiffe=${SVID}" \
+            -H "Content-Type: application/json" \
+            -d '{"audiences": ["zot"]}' \
+            "https://spire-identity-exchange-rest.production.other/api/v1/svid/image_pull/jwt" \
+            | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')"
+          test -n "${TOKEN}"
+
+          AUTH="$(printf 'zot:%s' "${TOKEN}" | base64 | tr -d '\n')"
+          printf '{"auths":{"zot.production.other":{"auth":"%s"}}}' "${AUTH}" > /docker-config/config.json
+        volumeMounts:
+        - name: data-volume
+          mountPath: /data
+        - name: docker-config
+          mountPath: /docker-config
+        - name: psat
+          mountPath: /var/run/secrets/tokens
+          readOnly: true
+      containers:
+      - name: push
+        image: gcr.io/go-containerregistry/crane:v0.21.9
+        env:
+        - name: DOCKER_CONFIG
+          value: /docker-config
+        - name: SSL_CERT_FILE
+          value: /data/ca-bundle.pem
+        args:
+        - copy
+        - docker.io/library/busybox:latest
+        - zot.production.other/test/busybox:latest
+        volumeMounts:
+        - name: data-volume
+          mountPath: /data
+        - name: docker-config
+          mountPath: /docker-config
+      volumes:
+      - name: data-volume
+        emptyDir: {}
+      - name: docker-config
+        emptyDir: {}
+      - name: spire-api
+        csi:
+          driver: csi.spiffe.io
+          readOnly: true
+      - name: psat
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: spire-identity-exchange
+              expirationSeconds: 3600