Change production example to be an integration test (#237)

* Change production example to be an integration test The documentation is a better example then the test now. Separate the two. Signed-off-by: Kevin Fox <[email protected]> * Fix job name reference Signed-off-by: Kevin Fox <[email protected]> * Fix job name reference Signed-off-by: Kevin Fox <[email protected]> * Update postgresql example Signed-off-by: Kevin Fox <[email protected]> * Update mysql example Signed-off-by: Kevin Fox <[email protected]> * Update nested and mysql Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Fix split issue Signed-off-by: Kevin Fox <[email protected]> * Try folding example your values into bash so that its not laying around in an fs for a user to accidently use. Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-03-20 14:12:48 -07:00
parent 72768ecdbc
commit 993ee8582b
16 changed files with 36 additions and 114 deletions
@@ -10,13 +10,11 @@ If manually deploying for testing, you can safely put the password into an envir
 source ../bin/readpw.sh
 ```

-Next, edit values.yaml with your settings. Check it into your git repo if using one.
+Follow the instructions as described at https://artifacthub.io/packages/helm/spiffe/spire, and copy in the settings from
+examples/external-mysql/values.yaml into your values file.

-Then, deploy the chart pointing at your mysql instance like so:
+You can add the password at install runtime like so:

 ```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-mysql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
+helm upgrade --install --namespace spire-mgmt spire spire -f your-values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" --repo https://spiffe.github.io/helm-charts-hardened/
 ```
-
-See the [production example](../production) for production recommendations.
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
@@ -54,6 +54,6 @@ helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO
  --wait

 helm upgrade --install --namespace "spire-server" \
-  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
+  --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
  --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
 helm test --namespace "spire-server" spire
@@ -10,14 +10,12 @@ If manually deploying for testing, you can safely put the password into an envir
 source ../bin/readpw.sh
 ```

-Next, edit values.yaml with your settings. Check it into your git repo if using one.
+Follow the instructions as described at https://artifacthub.io/packages/helm/spiffe/spire, and copy in the settings from
+examples/external-postgresql/values.yaml into your values file.

-Then, deploy the chart pointing at your postgresql instance like so:
+You can add the password at install runtime like so:

 ```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-postgresql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
+helm upgrade --install --namespace spire-mgmt spire spire -f your-values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" --repo https://spiffe.github.io/helm-charts-hardened/

 ```
-
-See the [production example](../production) for production recommendations.
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
@@ -50,10 +50,10 @@ kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restrict

 helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
  --namespace spire-server \
-  --values "${DEPS}/postgresql.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
+  --values "${DEPS}/postgresql.yaml" \
  --wait

 helm upgrade --install --namespace "spire-server" \
-  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
+  --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
  --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
 helm test --namespace "spire-server" spire
@@ -55,7 +55,7 @@ helm upgrade --install --create-namespace spire charts/spire \
  --values "${DEPS}/spire-root-server-values.yaml" \
  --wait

-helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
+helm upgrade --install --create-namespace --namespace spire-server --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
  --wait spire charts/spire
 helm test --namespace spire-server spire

@@ -1,66 +0,0 @@
-# Recommended production setup
-
-To install Spire with the least privileges possible we deploy spire across 2 namespaces.
-
-```shell
-kubectl create namespace "spire-system"
-kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace "spire-server"
-kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
-```
-
-Update the `example-your-values.yaml` file with your values, then:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire \
-  -f examples/production/values.yaml -f examples/production/example-your-values.yaml --render-subchart-notes
-```
-
-If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
-cluster, add the following to the end of the helm upgrade example:
-
-```shell
-f examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
-```
-
-If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
-
-```shell
-f examples/production/values-expose-spire-server-ingress-nginx.yaml
-```
-
-For example:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
-```
-
-If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
-you have two options as described here:
-[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
-
-If you chose profile https_web, use:
-
-```shell
-f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
-```
-
-For example:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
-```
-
-If you chose profile https_spiffe, use:
-
-```shell
-f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
-```
-
-For example:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
-```
-
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
@@ -1,22 +0,0 @@
-global:
-  spire:
-    clusterName: production
-    trustDomain: production.other
-
-spire-server:
-  ca_subject:
-    country: US
-    organization: Production
-    common_name: production.other
-
-#  ingress:
-#    host: spire-server
-#  federation:
-#     ingress:
-#       host: spire-server-federation
-#       tlsSecret: tls-cert
-
-# spiffe-oidc-discovery-provider:
-#   ingress:
-#     host: oidc-discovery
-#     tlsSecret: tls-cert
@@ -1,145 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-UPGRADE_VERSION=$(git ls-remote --tags origin -l 'spire-0.*' | awk -F. '{print $2}' | sort -n | tail -n 1 | sed 's/^/v0./; s/$/.0/')
-UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-TESTDIR="${SCRIPTPATH}/../../.github/tests"
-DEPS="${TESTDIR}/dependencies"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
-# shellcheck source=/dev/null
-source "${TESTDIR}/common.sh"
-
-helm_install=(helm upgrade --install --create-namespace)
-ns=spire-server
-
-UPGRADE_ARGS=""
-CLEANUP=1
-
-for i in "$@"; do
-  case $i in
-    -u)
-      if [[ -z "$UPGRADE_VERSION" ]]; then
-        echo "Failed to detect previous version."
-        exit 1
-      fi
-      UPGRADE_ARGS="--repo $UPGRADE_REPO --version $UPGRADE_VERSION"
-      shift # past argument=value
-      ;;
-    -c)
-      CLEANUP=0
-      shift # past argument=value
-      ;;
-  esac
-done
-
-teardown() {
-  print_helm_releases
-  print_spire_workload_status spire-server spire-system
-
-  if [[ "$1" -ne 0 ]]; then
-    get_namespace_details spire-server spire-system
-  fi
-
-  if [ "${CLEANUP}" -eq 1 ]; then
-    helm uninstall --namespace "${ns}" spire 2>/dev/null || true
-    kubectl delete ns "${ns}" 2>/dev/null || true
-    kubectl delete ns spire-system 2>/dev/null || true
-    helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true
-    kubectl delete ns cert-manager 2>/dev/null || true
-    helm uninstall --namespace ingress-nginx 2>/dev/null || true
-    kubectl delete ns ingress-nginx 2>/dev/null || true
-  fi
-}
-
-trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
-
-if [[ -n "$UPGRADE_ARGS" ]]; then
-  pushd "${SCRIPTPATH}"
-  git clone https://github.com/spiffe/helm-charts-hardened "${UPGRADE_VERSION}"
-  pushd "${UPGRADE_VERSION}"
-  git checkout "${UPGRADE_VERSION/v/spire-}"
-  helm install --create-namespace -n spire-system spire-crds charts/spire-crds
-  ./examples/production/run-tests.sh -c
-  popd
-  popd
-  # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
-  helm upgrade -n spire-system spire-crds charts/spire-crds --wait
-else
-
-  kubectl create namespace spire-system 2>/dev/null || true
-  kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
-  kubectl create namespace "${ns}" 2>/dev/null || true
-  kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
-
-  "${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
-    --namespace cert-manager \
-    --create-namespace \
-    --set installCRDs=true \
-    --wait
-
-  kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
-
-  "${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
-    --namespace ingress-nginx \
-    --create-namespace \
-    --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
-    --set controller.ingressClassResource.default=true \
-    --wait
-
-  ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
-  echo "$ip" oidc-discovery.production.other
-
-  cat > /tmp/dummydns <<EOF
-spiffe-oidc-discovery-provider:
-  tests:
-    hostAliases:
-      - ip: "$ip"
-        hostnames:
-          - "oidc-discovery.production.other"
-spire-agent:
-  hostAliases:
-    - ip: "$ip"
-      hostnames:
-        - "spire-server.production.other"
-spire-server:
-  tests:
-    hostAliases:
-      - ip: "$ip"
-        hostnames:
-          - "spire-server-federation.production.other"
-EOF
-
-fi
-
-install_and_test() {
-  # Can't pass an array to a function. We completely control the string so its safe.
-  # shellcheck disable=SC2086
-  "${helm_install[@]}" spire "$1" \
-    --namespace "${ns}" \
-    --values "${SCRIPTPATH}/values.yaml" \
-    --values "${SCRIPTPATH}/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
-    --values "${SCRIPTPATH}/values-expose-spire-server-ingress-nginx.yaml" \
-    --values "${SCRIPTPATH}/values-expose-federation-https-web-ingress-nginx.yaml" \
-    --values /tmp/dummydns \
-    --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
-    --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
-    --set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
-    --values "${SCRIPTPATH}/example-your-values.yaml" \
-    $2 \
-    --wait
-
-    helm test --namespace "${ns}" spire
-}
-
-install_and_test charts/spire ""
-
-if helm get manifest -n spire-server spire | grep -i example; then
-  echo Global settings did not work. Please fix.
-  exit 1
-fi
@@ -1,10 +0,0 @@
-spire-server:
-  federation:
-    enabled: true
-    ingress:
-      enabled: true
-      controllerType: ingress-nginx
-      annotations:
-        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-
-      # className: nginx
@@ -1,13 +0,0 @@
-spire-server:
-  tests:
-    tls:
-      enabled: true
-  federation:
-    enabled: true
-    ingress:
-      enabled: true
-      controllerType: ingress-nginx
-
-      # className: nginx
- 
-      tlsSecret: spire-server-federation-tls
@@ -1,12 +0,0 @@
-spiffe-oidc-discovery-provider:
-  tests:
-    tls:
-      enabled: true
-  ingress:
-    enabled: true
-    controllerType: ingress-nginx
-      
-    # className: nginx
-
-    # You must override these in your own values file with the appropriate secret or it wont start.
-    tlsSecret: tls-cert
@@ -1,6 +0,0 @@
-spire-server:
-  ingress:
-    enabled: true
-    controllerType: ingress-nginx
-
-    # className: nginx
@@ -1,4 +0,0 @@
-global:
-  spire:
-    recommendations:
-      enabled: true