diff --git a/.github/kind/conf/kind-config.yaml b/.github/kind/conf/kind-config.yaml index 6c900fe..7c0cd3f 100644 --- a/.github/kind/conf/kind-config.yaml +++ b/.github/kind/conf/kind-config.yaml @@ -15,3 +15,4 @@ kubeadmConfigPatches: # admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml nodes: - role: control-plane + - role: worker diff --git a/.github/scripts/parse-versions.sh b/.github/scripts/parse-versions.sh new file mode 100644 index 0000000..eca9881 --- /dev/null +++ b/.github/scripts/parse-versions.sh @@ -0,0 +1,9 @@ +#!/usr/bin/env bash + +TESTS_PATH="$(dirname "${BASH_SOURCE[0]}")/../tests" + +# Set repo and version env variables +REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${TESTS_PATH}/charts.json") +VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${TESTS_PATH}/charts.json") +eval "$REPOS" +eval "$VERSIONS" diff --git a/.github/tests/charts.sh b/.github/tests/charts.sh deleted file mode 100644 index d83af09..0000000 --- a/.github/tests/charts.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json) -VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json) -eval "$REPOS" -eval "$VERSIONS" diff --git a/.github/tests/upstream-authority-disk/create-cert.sh b/.github/tests/create-cert.sh similarity index 100% rename from .github/tests/upstream-authority-disk/create-cert.sh rename to .github/tests/create-cert.sh diff --git a/.github/tests/production-external-mysql/mysql-values.yaml b/.github/tests/dependencies/mysql.yaml similarity index 59% rename from .github/tests/production-external-mysql/mysql-values.yaml rename to .github/tests/dependencies/mysql.yaml index 62f27e2..bd5e621 100644 --- a/.github/tests/production-external-mysql/mysql-values.yaml +++ b/.github/tests/dependencies/mysql.yaml @@ -5,3 +5,8 @@ primary: drop: [ALL] seccompProfile: type: RuntimeDefault +auth: + database: spire-server + username: spire + password: sp1ff3Test + rootPassword: sp1ff3TestPassword diff --git a/.github/tests/production-external-postgresql/postgresql-values.yaml b/.github/tests/dependencies/postgresql.yaml similarity index 61% rename from .github/tests/production-external-postgresql/postgresql-values.yaml rename to .github/tests/dependencies/postgresql.yaml index ea34425..fb906c1 100644 --- a/.github/tests/production-external-postgresql/postgresql-values.yaml +++ b/.github/tests/dependencies/postgresql.yaml @@ -6,3 +6,8 @@ primary: drop: [ALL] seccompProfile: type: RuntimeDefault +auth: + database: spire-server + username: spire + password: sp1ff3Test + postgresPassword: sp1ff3TestPassword diff --git a/.github/tests/upstream-authority-disk/example-org.key b/.github/tests/example-org.key similarity index 100% rename from .github/tests/upstream-authority-disk/example-org.key rename to .github/tests/example-org.key diff --git a/.github/tests/upstream-authority-disk/example-org.pem b/.github/tests/example-org.pem similarity index 100% rename from .github/tests/upstream-authority-disk/example-org.pem rename to .github/tests/example-org.pem diff --git a/.github/tests/extras/post-install.sh b/.github/tests/extras/post-install.sh deleted file mode 100644 index 1278f29..0000000 --- a/.github/tests/extras/post-install.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status "${scenario}" - -if [[ "$1" -ne 0 ]]; then - get_namespace_details "${scenario}" -fi diff --git a/.github/tests/federation-bundle-endpoint/post-install.sh b/.github/tests/federation-bundle-endpoint/post-install.sh deleted file mode 100644 index 1278f29..0000000 --- a/.github/tests/federation-bundle-endpoint/post-install.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status "${scenario}" - -if [[ "$1" -ne 0 ]]; then - get_namespace_details "${scenario}" -fi diff --git a/.github/tests/namespace-override/post-install.sh b/.github/tests/namespace-override/post-install.sh deleted file mode 100755 index 7fbaf11..0000000 --- a/.github/tests/namespace-override/post-install.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status spire-server spire-system - -if [[ "$1" -ne 0 ]]; then - get_namespace_details spire-server - get_namespace_details spire-systen -fi - diff --git a/.github/tests/namespace-override/pre-install.sh b/.github/tests/namespace-override/pre-install.sh deleted file mode 100755 index 3d778a6..0000000 --- a/.github/tests/namespace-override/pre-install.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env bash - -kubectl create namespace "spire-system" -kubectl create namespace "spire-server" diff --git a/.github/tests/no-spire-controller-manager/post-install.sh b/.github/tests/no-spire-controller-manager/post-install.sh deleted file mode 100644 index 1278f29..0000000 --- a/.github/tests/no-spire-controller-manager/post-install.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status "${scenario}" - -if [[ "$1" -ne 0 ]]; then - get_namespace_details "${scenario}" -fi diff --git a/.github/tests/post-install.sh b/.github/tests/post-install.sh new file mode 100755 index 0000000..1981868 --- /dev/null +++ b/.github/tests/post-install.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/common.sh" + +print_helm_releases diff --git a/.github/tests/pre-install.sh b/.github/tests/pre-install.sh new file mode 100755 index 0000000..bed4f1d --- /dev/null +++ b/.github/tests/pre-install.sh @@ -0,0 +1,49 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +DEPS="${SCRIPTPATH}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../scripts/parse-versions.sh" + +helm_install=(helm upgrade --install --create-namespace) + +# namespace override +kubectl create namespace spire-system || true +kubectl create namespace spire-server || true + +# nginx ingress +"${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \ + --namespace ingress-nginx \ + --set controller.extraArgs.enable-ssl-passthrough= +kubectl wait --namespace ingress-nginx --for=condition=ready --timeout 60s pod --selector=app.kubernetes.io/component=controller + +# prometheus +"${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \ + --namespace prometheus \ + --version "${VERSION_KUBE_PROMETHEUS_STACK}" \ + --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \ + --wait + +# cert-manager +"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ + --namespace cert-manager \ + --set installCRDs=true \ + --wait + +# external database + +# mysql +"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --namespace mysql \ + --values "${DEPS}/mysql.yaml" \ + --wait + +# postgres +"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \ + --namespace postgresql \ + --values "${DEPS}/postgresql.yaml" \ + --wait diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh deleted file mode 100755 index c2b5cfe..0000000 --- a/.github/tests/production-example/install.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/usr/bin/env bash - -set -xe - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" - -helm install \ - --namespace spire-server \ - --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \ - spire charts/spire --wait - -helm test spire --namespace spire-server diff --git a/.github/tests/production-example/post-install.sh b/.github/tests/production-example/post-install.sh deleted file mode 100755 index 29335e6..0000000 --- a/.github/tests/production-example/post-install.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status spire-server spire-system - -if [[ "$1" -ne 0 ]]; then - get_namespace_details spire-server - get_namespace_details spire-system -fi diff --git a/.github/tests/production-example/pre-install.sh b/.github/tests/production-example/pre-install.sh deleted file mode 100755 index b33d1ed..0000000 --- a/.github/tests/production-example/pre-install.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -kubectl create namespace spire-system -kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged -kubectl create namespace spire-server -kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted diff --git a/.github/tests/production-external-mysql/install.sh b/.github/tests/production-external-mysql/install.sh deleted file mode 100755 index 7bb5d63..0000000 --- a/.github/tests/production-external-mysql/install.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash - -set -xe - -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") - -DB=spire -DBUSER=spire -DBPW=$(uuidgen) -DBROOTPW=$(uuidgen) - -# Generate random settings to make sure things come up with random settings. -cat < /tmp/$$-db-values.yaml -auth: - database: ${DB} - username: ${DBUSER} - password: ${DBPW} - rootPassword: ${DBROOTPW} -EOF - -cat < /tmp/$$-spire-values.yaml -spire-server: - dataStore: - sql: - databaseType: mysql - databaseName: ${DB} - username: ${DBUSER} - password: ${DBPW} - host: mysql - port: 3306 -EOF - -helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ - --values "${SCRIPTPATH}/mysql-values.yaml" \ - --values /tmp/$$-db-values.yaml --wait - -helm install \ - --namespace "spire-server" \ - --values /tmp/$$-spire-values.yaml \ - --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \ - spire charts/spire --wait - -helm test spire --namespace "spire-server" diff --git a/.github/tests/production-external-mysql/post-install.sh b/.github/tests/production-external-mysql/post-install.sh deleted file mode 100755 index 29335e6..0000000 --- a/.github/tests/production-external-mysql/post-install.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status spire-server spire-system - -if [[ "$1" -ne 0 ]]; then - get_namespace_details spire-server - get_namespace_details spire-system -fi diff --git a/.github/tests/production-external-mysql/pre-install.sh b/.github/tests/production-external-mysql/pre-install.sh deleted file mode 100755 index b33d1ed..0000000 --- a/.github/tests/production-external-mysql/pre-install.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -kubectl create namespace spire-system -kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged -kubectl create namespace spire-server -kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted diff --git a/.github/tests/production-external-postgresql/install.sh b/.github/tests/production-external-postgresql/install.sh deleted file mode 100755 index 38b56c4..0000000 --- a/.github/tests/production-external-postgresql/install.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/env bash - -set -xe - -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") - -DB=$(uuidgen) -DBUSER=$(uuidgen) -DBPW=$(uuidgen) -DBPGPW=$(uuidgen) - -# Generate random settings to make sure things come up with random settings. -cat > /tmp/$$-db-values.yaml < /tmp/$$-spire-values.yaml <> $GITHUB_OUTPUT - - outputs: - tests: ${{ steps.set-matrix.outputs.tests }} - test: runs-on: ubuntu-22.04 - needs: - - build-matrix strategy: matrix: @@ -53,8 +33,6 @@ jobs: - v1.27.2 - v1.26.4 - v1.25.9 - values: - - ${{ fromJson(needs.build-matrix.outputs.tests) }} steps: - run: 'echo "Skipping tests"' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 98ff85b..f573bc9 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -12,6 +12,7 @@ on: - '.github/tests/**/*.sh' - '.github/tests/**/*.json' - 'examples/**/*.yaml' + - 'examples/**/*.sh' - 'tests/**/*' - 'helm-docs.sh' @@ -22,6 +23,7 @@ concurrency: env: HELM_VERSION: v3.12.0 PYTHON_VERSION: 3.11.3 + KIND_VERSION: v0.19.0 CHART_TESTING_VERSION: v3.8.0 jobs: @@ -114,35 +116,11 @@ jobs: - name: Run chart-testing (lint) run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }} - outputs: - changed: ${{ steps.list-changed.outputs.changed }} - - build-matrix: - name: Build matrix - runs-on: ubuntu-22.04 - - needs: [lint-chart] - - steps: - - name: Checkout - uses: actions/checkout@v3.5.3 - - - id: set-matrix - name: Collect all tests - run: | - tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")" - tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')" - echo "tests=$tests_json" >> $GITHUB_OUTPUT - - outputs: - tests: ${{ steps.set-matrix.outputs.tests }} - test: runs-on: ubuntu-22.04 needs: - lint-chart - - build-matrix strategy: fail-fast: false @@ -155,8 +133,6 @@ jobs: - v1.27.2 - v1.26.4 - v1.25.9 - values: - - ${{ fromJson(needs.build-matrix.outputs.tests) }} steps: - name: Checkout @@ -183,39 +159,83 @@ jobs: uses: helm/kind-action@v1.8.0 # Only build a kind cluster if there are chart changes to test. with: - version: v0.19.0 + version: ${{ env.KIND_VERSION }} node_image: kindest/node:${{ matrix.k8s }} config: .github/kind/conf/kind-config.yaml verbosity: 1 + - name: Setup Test dependencies + run: ./pre-install.sh + working-directory: .github/tests + - name: Run chart-testing (install) run: | - post-install() { - [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1 - exit $1 - } + ct install --config ct.yaml \ + --target-branch ${{ github.base_ref }} - trap 'post-install $? $LINENO' EXIT + - name: Test summary + if: always() + run: ./post-install.sh + working-directory: .github/tests - export scenario="$(basename "${TEST_DIR}")" - export EXTRA_HELM_ARGS="" + build-matrix: + name: Build matrix + runs-on: ubuntu-22.04 - source .github/tests/charts.sh + steps: + - name: Checkout + uses: actions/checkout@v3.5.2 - [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}" - [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh" - [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env" + - id: set-matrix + name: Collect all examples + run: | + examples="$(find examples -maxdepth 2 -type f -name run-tests.sh | xargs -I % dirname %)" + examples_json="$(echo "$examples" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')" + echo "${examples_json}" + echo "examples=$examples_json" >>"$GITHUB_OUTPUT" - if [ -x "${TEST_DIR}/install.sh" ]; then - "${TEST_DIR}/install.sh" - else - ct install --debug \ - --charts "charts/spire" \ - --namespace "${scenario}" \ - --target-branch ${{ github.base_ref }} \ - --exclude-deprecated \ - --skip-clean-up \ - ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }} - fi - env: - TEST_DIR: .github/tests/${{ matrix.values }} + outputs: + examples: ${{ steps.set-matrix.outputs.examples }} + + example-test: + runs-on: ubuntu-22.04 + + needs: + - lint-chart + - build-matrix + + strategy: + fail-fast: false + matrix: + k8s: + - v1.27.2 + - v1.26.4 + - v1.25.9 + example: + - ${{ fromJson(needs.build-matrix.outputs.examples) }} + + steps: + - name: Checkout + uses: actions/checkout@v3.5.2 + + - name: Set up Helm + uses: azure/setup-helm@v3.5 + with: + version: ${{ env.HELM_VERSION }} + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: ${{ env.PYTHON_VERSION }} + + - name: Create kind cluster + uses: helm/kind-action@v1.7.0 + # Only build a kind cluster if there are chart changes to test. + with: + version: ${{ env.KIND_VERSION }} + node_image: kindest/node:v1.26.4 + config: .github/kind/conf/kind-config.yaml + verbosity: 1 + + - name: Install and test example + run: ${{ matrix.example }}/run-tests.sh diff --git a/Makefile b/Makefile index 6b550d5..c3ad2d6 100644 --- a/Makefile +++ b/Makefile @@ -2,8 +2,7 @@ TARGET_BRANCH ?= main .PHONY: help help: ## Display this help. - @$(MAKE) help - @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) + @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) ##@ Linting: @@ -16,10 +15,10 @@ lint-release: ## Lint the charts using chart-testing for release @echo Linting charts… @ct lint --config ct.yaml --target-branch $(TARGET_BRANCH) -##@ Testing: +##@ Testing: (ensure to run on dedicated test cluster) -.PHONY: clean-lingering-resources -clean-lingering-resources: +.PHONY: clean-test-leftovers +clean-test-leftovers: ## Cleans up any lingering resources in case tests fail massively @echo Cleanup potential leftovers… @-kubectl delete csidrivers.storage.k8s.io csi.spiffe.io \ &>/dev/null || true @@ -31,7 +30,36 @@ clean-lingering-resources: &>/dev/null || true .PHONY: test -test: ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster) +test: install-test-deps test-charts test-examples ## Run all chart tests and example tests + +.PHONY: install-test-deps +install-test-deps: ## Install test dependency resources + @echo Installing test dependencies… + @.github/tests/pre-install.sh + +.PHONY: test-charts +test-charts: ## Run tests on charts using Helm chart-testing @echo Running tests… - @ct install --debug \ - --charts charts/spire + @ct install --config ct.yaml + +.PHONY: cleanup-test-deps +cleanup-test-deps: ## Cleans up all test dependencies resources + @echo Uninstalling test dependencies… + @helm uninstall -n cert-manager cert-manager 2>/dev/null || true + @kubectl delete ns cert-manager 2>/dev/null || true + @helm uninstall -n prometheus kube-prometheus-stack 2>/dev/null || true + @kubectl delete ns prometheus 2>/dev/null || true + @helm uninstall -n mysql mysql 2>/dev/null|| true + @kubectl delete ns mysql 2>/dev/null || true + @helm uninstall -n postgresql postgresql 2>/dev/null || true + @kubectl delete ns postgresql 2>/dev/null || true + @helm uninstall -n ingress-nginx ingress-nginx 2>/dev/null || true + @kubectl delete ns ingress-nginx 2>/dev/null || true + +test-example-%: + @echo Running tests for $* example… + @examples/$*/run-tests.sh + @echo + +.PHONY: test-examples +test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run `helm install` and `helm test` for all the examples containing `run-tests.sh` diff --git a/charts/spire/.helmignore b/charts/spire/.helmignore index 0e8a0eb..5bdaa3e 100644 --- a/charts/spire/.helmignore +++ b/charts/spire/.helmignore @@ -21,3 +21,4 @@ .idea/ *.tmproj .vscode/ +ci/ diff --git a/charts/spire/Chart.lock b/charts/spire/Chart.lock new file mode 100644 index 0000000..88436fe --- /dev/null +++ b/charts/spire/Chart.lock @@ -0,0 +1,18 @@ +dependencies: +- name: spire-server + repository: file://./charts/spire-server + version: 0.1.0 +- name: spire-agent + repository: file://./charts/spire-agent + version: 0.1.0 +- name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 +- name: spiffe-oidc-discovery-provider + repository: file://./charts/spiffe-oidc-discovery-provider + version: 0.1.0 +- name: tornjak-frontend + repository: file://./charts/tornjak-frontend + version: 0.1.0 +digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7 +generated: "2023-07-19T19:13:59.722106+02:00" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 7bad95f..393cafe 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -33,7 +33,7 @@ spec: - name: curl-ingress image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] - args: ['-s', '-f', 'http://{{ index .Values.config.additionalDomains 0 }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }} diff --git a/charts/spire/ci/external-mysql-values.yaml b/charts/spire/ci/external-mysql-values.yaml new file mode 100644 index 0000000..adc5c25 --- /dev/null +++ b/charts/spire/ci/external-mysql-values.yaml @@ -0,0 +1,11 @@ +spire-server: + dataStore: + sql: + databaseType: mysql + databaseName: spire-server + username: spire + password: sp1ff3Test + host: mysql.mysql + port: 3306 + options: + - parseTime: true diff --git a/charts/spire/ci/external-postgres-values.yaml b/charts/spire/ci/external-postgres-values.yaml new file mode 100644 index 0000000..f8a7068 --- /dev/null +++ b/charts/spire/ci/external-postgres-values.yaml @@ -0,0 +1,11 @@ +spire-server: + dataStore: + sql: + databaseType: postgres + databaseName: spire-server + username: spire + password: sp1ff3Test + host: postgresql.postgresql + port: 5432 + options: + - sslmode: disable diff --git a/.github/tests/extras/values.yaml b/charts/spire/ci/extras-values.yaml similarity index 100% rename from .github/tests/extras/values.yaml rename to charts/spire/ci/extras-values.yaml diff --git a/.github/tests/federation-bundle-endpoint/values.yaml b/charts/spire/ci/federation-bundle-endpoint-values.yaml similarity index 100% rename from .github/tests/federation-bundle-endpoint/values.yaml rename to charts/spire/ci/federation-bundle-endpoint-values.yaml diff --git a/.github/tests/namespace-override/values.yaml b/charts/spire/ci/namespace-override-values-skip.yaml similarity index 100% rename from .github/tests/namespace-override/values.yaml rename to charts/spire/ci/namespace-override-values-skip.yaml diff --git a/.github/tests/no-spire-controller-manager/values.yaml b/charts/spire/ci/no-spire-controller-manager-values.yaml similarity index 100% rename from .github/tests/no-spire-controller-manager/values.yaml rename to charts/spire/ci/no-spire-controller-manager-values.yaml diff --git a/.github/tests/spire-oidc-insecure/values.yaml b/charts/spire/ci/oidc-values.yaml similarity index 64% rename from .github/tests/spire-oidc-insecure/values.yaml rename to charts/spire/ci/oidc-values.yaml index d521e69..8164ef2 100644 --- a/.github/tests/spire-oidc-insecure/values.yaml +++ b/charts/spire/ci/oidc-values.yaml @@ -8,14 +8,14 @@ spire-server: nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/force-ssl-redirect: "true" hosts: - - host: ingress-nginx-controller.spire-oidc-insecure + - host: ingress-nginx-controller.ingress-nginx paths: - path: / pathType: Prefix spire-agent: server: - address: ingress-nginx-controller.spire-oidc-insecure + address: ingress-nginx-controller.ingress-nginx port: 443 spiffe-oidc-discovery-provider: @@ -26,7 +26,8 @@ spiffe-oidc-discovery-provider: config: additionalDomains: - - ingress-nginx-controller + - ingress-nginx-controller.ingress-nginx + - ingress-nginx-controller.ingress-nginx.svc.cluster.local acme: tosAccepted: false @@ -35,7 +36,7 @@ spiffe-oidc-discovery-provider: enabled: true className: nginx hosts: - - host: ingress-nginx-controller - paths: - - path: / - pathType: Prefix + - host: ingress-nginx-controller.ingress-nginx.svc.cluster.local + paths: + - path: / + pathType: Prefix diff --git a/.github/tests/prometheus/values.yaml b/charts/spire/ci/prometheus-values.yaml similarity index 100% rename from .github/tests/prometheus/values.yaml rename to charts/spire/ci/prometheus-values.yaml diff --git a/charts/spire/ci/tornjak-values.yaml b/charts/spire/ci/tornjak-values.yaml new file mode 100644 index 0000000..5991a5d --- /dev/null +++ b/charts/spire/ci/tornjak-values.yaml @@ -0,0 +1,6 @@ +spire-server: + tornjak: + enabled: true + +tornjak-frontend: + enabled: true diff --git a/.github/tests/upstream-authority-cert-manager/values.yaml b/charts/spire/ci/upstream-authority-cert-manager-values.yaml similarity index 100% rename from .github/tests/upstream-authority-cert-manager/values.yaml rename to charts/spire/ci/upstream-authority-cert-manager-values.yaml diff --git a/.github/tests/upstream-authority-disk/values.yaml b/charts/spire/ci/upstream-authority-disk-values.yaml similarity index 100% rename from .github/tests/upstream-authority-disk/values.yaml rename to charts/spire/ci/upstream-authority-disk-values.yaml diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh new file mode 100755 index 0000000..b6b5ee5 --- /dev/null +++ b/examples/external-mysql/run-tests.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-system + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + + helm uninstall --namespace mysql mysql 2>/dev/null || true + kubectl delete ns mysql 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --namespace mysql \ + --values "${DEPS}/mysql.yaml" \ + --wait + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \ + --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi diff --git a/examples/external-mysql/values.yaml b/examples/external-mysql/values.yaml index c0a8fff..129ee27 100644 --- a/examples/external-mysql/values.yaml +++ b/examples/external-mysql/values.yaml @@ -2,7 +2,8 @@ spire-server: dataStore: sql: databaseType: mysql - databaseName: spire - host: mysql + databaseName: spire-server + host: mysql.mysql port: 3306 username: spire + # password: CHANGE_ME diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh new file mode 100755 index 0000000..1ffe1f6 --- /dev/null +++ b/examples/external-postgresql/run-tests.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-system + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + + helm uninstall --namespace postgresql postgresql 2>/dev/null || true + kubectl delete ns postgresql 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \ + --namespace postgresql \ + --values "${DEPS}/postgresql.yaml" \ + --wait + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \ + --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi diff --git a/examples/external-postgresql/values.yaml b/examples/external-postgresql/values.yaml index 5f1fcfa..8972e87 100644 --- a/examples/external-postgresql/values.yaml +++ b/examples/external-postgresql/values.yaml @@ -2,9 +2,10 @@ spire-server: dataStore: sql: databaseType: postgres - databaseName: spire - host: postgresql + databaseName: spire-server + host: postgresql.postgresql port: 5432 username: spire + # password: CHANGE_ME options: - sslmode: disable diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh new file mode 100755 index 0000000..f64f6c2 --- /dev/null +++ b/examples/production/run-tests.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" + +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-server + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +kubectl create namespace spire-system 2>/dev/null || true +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace "${ns}" 2>/dev/null || true +kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi diff --git a/examples/tornjak/run-tests.sh b/examples/tornjak/run-tests.sh new file mode 100755 index 0000000..e4449cd --- /dev/null +++ b/examples/tornjak/run-tests.sh @@ -0,0 +1,30 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" + +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-system + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi