ingress-nginx production tests and spiffe-oidc-discovery-provider example (#136)

Co-authored-by: Marco Franssen <[email protected]>

examples/production/README.md

@@ -8,16 +8,26 @@ kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privil
 kubectl create namespace "spire-server"
 kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
 
+```shell
 helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml
 ```
 
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
+If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
+cluster, add the following to the end of the helm upgrade example:
+
+```shell
+-f values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml
+```
 
 If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
 
 ```shell
 -f values-expose-spire-server-ingress-nginx.yaml
 ```
+For example:
+```shell
+helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-spire-server-ingress-nginx.yaml
+```
 
 If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
 you have two options as described here:
@@ -28,9 +38,20 @@ If you chose profile https_web, use:
 ```shell
 -f values-expose-federation-https-web-ingress-nginx.yaml
 ```
+For example:
+```shell
+helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-web-ingress-nginx.yaml
+```
 
 If you chose profile https_spiffe, use:
 
 ```shell
 -f values-expose-federation-https-spiffe-ingress-nginx.yaml
 ```
+For example:
+```shell
+helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml -f values-expose-federation-https-spiffe-ingress-nginx.yaml
+```
+
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
+

examples/production/run-tests.sh

@@ -5,7 +5,10 @@ set -xe
 SCRIPT="$(readlink -f "$0")"
 SCRIPTPATH="$(dirname "${SCRIPT}")"
 TESTDIR="${SCRIPTPATH}/../../.github/tests"
+DEPS="${TESTDIR}/dependencies"
 
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
 # shellcheck source=/dev/null
 source "${TESTDIR}/common.sh"
 
@@ -16,6 +19,10 @@ teardown() {
   helm uninstall --namespace "${ns}" spire 2>/dev/null || true
   kubectl delete ns "${ns}" 2>/dev/null || true
   kubectl delete ns spire-system 2>/dev/null || true
+  helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true
+  kubectl delete ns cert-manager 2>/dev/null || true
+  helm uninstall --namespace ingress-nginx 2>/dev/null || true
+  kubectl delete ns ingress-nginx 2>/dev/null || true
 }
 
 trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
@@ -25,7 +32,61 @@ kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileg
 kubectl create namespace "${ns}" 2>/dev/null || true
 kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
 
-"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire
+"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
+  --namespace cert-manager \
+  --create-namespace \
+  --set installCRDs=true \
+  --wait
+
+kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
+
+"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
+  --namespace ingress-nginx \
+  --create-namespace \
+  --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
+  --set controller.ingressClassResource.default=true \
+ --wait
+
+ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
+echo "$ip" oidc-discovery.example.org
+
+cat > /tmp/dummydns <<EOF
+spiffe-oidc-discovery-provider:
+  tests:
+    hostAliases:
+      - ip: "$ip"
+        hostnames:
+          - "oidc-discovery.example.org"
+spire-agent:
+  hostAliases:
+    - ip: "$ip"
+      hostnames:
+        - "spire-server.example.org"
+spire-server:
+  tests:
+    hostAliases:
+      - ip: "$ip"
+        hostnames:
+          - "spire-server-federation.example.org"
+  federation:
+    ingress:
+      tls:
+        - hosts:
+            - spire-server-federation.example.org
+          secretName: tls-cert
+EOF
+
+"${helm_install[@]}" spire charts/spire \
+  --namespace "${ns}" \
+  --values "${SCRIPTPATH}/values.yaml" \
+  --values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
+  --values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \
+  --values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
+  --values /tmp/dummydns \
+  --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
+  --set spire-agent.server.address=spire-server.example.org,spire-agent.server.port=443 \
+  --wait
+
 helm test --namespace "${ns}" spire
 
 print_helm_releases

examples/production/values-export-federation-https-web-ingress-nginx.yaml

@@ -1,4 +1,7 @@
 spire-server:
+  tests:
+    tls:
+      enabled: true
   federation:
     enabled: true
     ingress:

examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml

@@ -0,0 +1,27 @@
+spiffe-oidc-discovery-provider:
+  tests:
+    tls:
+      enabled: true
+  ingress:
+    enabled: true
+    annotations:
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+
+      # Optional settings you may put in your own values.
+      # kubernetes.io/ingress.class: nginx
+      # kubernetes.io/tls-acme: "true"
+      
+    # className: nginx
+
+    # You must override these in your own values file with the appropriate hostname
+    # and secret or it wont start.
+    hosts:
+      - host: oidc-discovery.example.org
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - secretName: tls-cert
+        hosts:
+          - oidc-discovery.example.org