ingress-nginx production tests and spiffe-oidc-discovery-provider example (#136)

Co-authored-by: Marco Franssen <[email protected]>
2023-08-29 15:22:00 +00:00
parent b05175e2b6
commit e81a59a7e5
14 changed files with 247 additions and 2 deletions
@@ -237,6 +237,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
 | spire-agent.fullnameOverride | string | `""` |  |
 | spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
+| spire-agent.hostAliases | list | `[]` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ |
 | spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
@@ -540,6 +541,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | upstream-spire-agent.fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
 | upstream-spire-agent.fullnameOverride | string | `""` |  |
 | upstream-spire-agent.healthChecks.port | int | `9980` | override the host port used for health checking |
+| upstream-spire-agent.hostAliases | list | `[]` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ |
 | upstream-spire-agent.image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | upstream-spire-agent.image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | upstream-spire-agent.image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
@@ -1,3 +1,4 @@
+{{ $values := merge .Values }}
 apiVersion: v1
 kind: Pod
 metadata:
@@ -33,8 +34,31 @@ spec:
    - name: curl-ingress
      image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
      command: ['curl']
+      {{- if dig "tests" "tls" "enabled" false $values }}
+      {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
+      args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
+      {{- else }}
+      args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
+      {{- end }}
+      {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
+      volumeMounts:
+        - name: custom-ca
+          mountPath: /ca
+      {{- end }}
+      {{- else }}
      args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
+      {{- end }}
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
    {{- end }}
+  {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
+  hostAliases:
+    {{- toYaml .Values.tests.hostAliases | nindent 4 }}
+  {{- end }}
+  {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
+  volumes:
+    - name: custom-ca
+      secret:
+        secretName: {{ .Values.tests.tls.customCA }}
+  {{- end }}
  restartPolicy: Never
@@ -212,6 +212,10 @@ ingress:

 # @ignored
 tests:
+  hostAliases: []
+  tls:
+    enabled: false
+    customCA: ""
  bash:
    image:
      # -- The OCI registry to pull the tests image from
@@ -43,6 +43,7 @@ A Helm chart to install the SPIRE agent.
 | fsGroupFix.resources | object | `{}` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
 | fullnameOverride | string | `""` |  |
 | healthChecks.port | int | `9980` | override the host port used for health checking |
+| hostAliases | list | `[]` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ |
 | image.pullPolicy | string | `"IfNotPresent"` | The image pull policy |
 | image.registry | string | `"ghcr.io"` | The OCI registry to pull the image from |
 | image.repository | string | `"spiffe/spire-agent"` | The repository within the registry |
@@ -33,6 +33,10 @@ spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
+      {{- if ne (len .Values.hostAliases) 0 }}
+      hostAliases:
+        {{- toYaml .Values.hostAliases | nindent 8 }}
+      {{- end }}
      initContainers:
        - name: init
          # This is a small image with wait-for-it, choose whatever image
@@ -164,3 +164,5 @@ extraVolumeMounts: []
 extraContainers: []

 initContainers: []
+# -- Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
+hostAliases: []
@@ -203,6 +203,21 @@ The code below determines what connection type should be used.
 {{- include "spire-tornjak.backend" . -}}
 {{- end -}}

+{{- define "spire-server.test.federation-ingress-args" }}
+{{-   $args := list }}
+{{-   $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
+{{-   if dig "tests" "tls" "enabled" false .Values }}
+{{-     if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
+{{-       $args = append $args "--cacert" }}
+{{-       $args = append $args "/ca/ca.crt" }}
+{{-     end }}
+{{-     $args = append $args (printf "https://%s/" $host) }}
+{{-   else }}
+{{-     $args = append $args (printf "http://%s/" $host) }}
+{{-   end }}
+{{ $args | toYaml }}
+{{- end -}}
+
 {{/*
 Take a copy of the config and merge in .Values.customPlugins and .Values.unsupportedBuiltInPlugins passed through as root.
 */}}
@@ -1,3 +1,4 @@
+{{ $values := merge .Values }}
 apiVersion: v1
 kind: Pod
 metadata:
@@ -38,4 +39,28 @@ spec:
      securityContext:
        {{- toYaml .Values.securityContext | nindent 8 }}
    {{- end }}
+    {{- if .Values.federation.ingress.enabled }}
+    - name: federation-ingress
+      image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
+      command: ['curl']
+      args:
+        {{ include "spire-server.test.federation-ingress-args" (dict "Values" $values) | nindent 8 }}
+      {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
+      volumeMounts:
+        - name: custom-ca
+          mountPath: /ca
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    {{- end }}
+  {{- if ne (len (dig "tests" "hostAliases" "" $values)) 0 }}
+  hostAliases:
+    {{- toYaml .Values.tests.hostAliases | nindent 4 }}
+  {{- end }}
+  {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
+  volumes:
+    - name: custom-ca
+      secret:
+        secretName: {{ .Values.tests.tls.customCA }}
+  {{- end }}
  restartPolicy: Never
@@ -486,6 +486,10 @@ customPlugins:

 # @ignored
 tests:
+  hostAliases: []
+  tls:
+    enabled: false
+    customCA: ""
  bash:
    image:
      # -- The OCI registry to pull the image from