Add Tornjak Tests (#220)

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>

.github/tests/tornjak/install.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+helm install \
+  --namespace spire-server \
+  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
+  --values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
+  spire charts/spire --wait
+helm test spire -n spire-server

.github/tests/tornjak/post-install.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT=$(readlink -f "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+k_wait=(kubectl wait --for condition=available --timeout 30s --namespace)
+k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace)
+
+function get_namespace_details {
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### Namespace $1
+
+#### Events
+
+\`\`\`shell
+$(kubectl --request-timeout=30s get events --output wide --namespace "$1")
+\`\`\`
+
+#### Pods
+
+\`\`\`shell
+$(kubectl --request-timeout=30s describe pods --namespace "$1")
+\`\`\`
+
+#### Logs
+
+\`\`\`shell
+$(kubectl get pods -o name -n "$1" | while read -r line; do echo logs for "${line}"; kubectl logs -n "$1" "${line}" --all-containers=true --ignore-errors=true; done)
+\`\`\`
+
+EOF
+}
+
+cat <<EOF >>"$GITHUB_STEP_SUMMARY"
+### spire
+
+| workload                             | Status |
+| ------------------------------------ | ------ |
+| spire-server                         | "$("${k_rollout_status[@]}" spire-server statefulset spire-server)" |
+| spire-controller-manager             | "$("${k_rollout_status[@]}" spire-server statefulset spire-controller-manager)" |
+| spire-spiffe-oidc-discovery-provider | "$("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider)" |
+| spire-spiffe-csi-driver              | "$("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver)" |
+| spire-agent                          | "$("${k_rollout_status[@]}" spire-system daemonset spire-agent)" |
+| tornjak-frontend                     | "$("${k_wait[@]}" spire-server deployments.apps spire-tornjak-frontend)" |
+EOF
+
+kubectl -n spire-server get service spire-tornjak-frontend
+
+if [ $1 -ne 0 ]; then
+  get_namespace_details spire-server
+  get_namespace_details spire-system
+fi

.github/tests/tornjak/pre-install.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+kubectl create namespace spire-system
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace spire-server
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

charts/spire/charts/tornjak-frontend/Chart.yaml

@@ -4,6 +4,10 @@ description: A Helm chart to deploy Tornjak frontend
 type: application
 version: 0.1.0
 appVersion: "v1.0.2"
+home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
+sources:
+  - https://github.com/spiffe/tornjak
+icon: https://raw.githubusercontent.com/spiffe/tornjak/main/logos/logo%2Btornjak.2132x1291.png
 maintainers:
   - name: mrsabath
     email: [email protected]

charts/spire/charts/tornjak-frontend/README.md

@@ -7,6 +7,8 @@
 
 A Helm chart to deploy Tornjak frontend
 
+**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
+
 ## Version support
 
 > **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
@@ -39,6 +41,10 @@ port forwarding. See the chart NOTES output for more details.
 | ---- | ------ | --- |
 | mrsabath | <mrsabath@gmail.com> | <https://mrsabath.github.io> |
 
+## Source Code
+
+* <https://github.com/spiffe/tornjak>
+
 ## Values
 
 | Key | Type | Default | Description |

examples/production/values.yaml

@@ -77,3 +77,18 @@ spiffe-oidc-discovery-provider:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+
+tornjak-frontend:
+  podSecurityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    fsGroupChangePolicy: OnRootMismatch
+  securityContext:
+    allowPrivilegeEscalation: false
+    runAsNonRoot: true
+    readOnlyRootFilesystem: false
+    capabilities:
+      drop: [ALL]
+    seccompProfile:
+      type: RuntimeDefault

examples/tornjak/README.md

@@ -0,0 +1,19 @@
+# Recommended setup to deploy Tornjak
+
+To install Spire with the least privileges possible we deploy spire across 2 namespaces.
+
+```shell
+kubectl create namespace "spire-system"
+kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
+kubectl create namespace "spire-server"
+kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
+
+# deploy SPIRE with Tornjak enabled
+helm upgrade --install --namespace spire-server --values ../production/values.yaml \
+ --values ./values.yaml spire charts/spire
+
+# test the Tornjak deployment
+helm test spire -n spire-server
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.

examples/tornjak/values.yaml

@@ -0,0 +1,10 @@
+spire-server:
+  tornjak:
+    enabled: true
+
+tornjak-frontend:
+  enabled: true
+  service:
+    type: ClusterIP
+    port: 3000
+  apiServerURL: "http://localhost:10000/"