ingress-nginx production tests and spiffe-oidc-discovery-provider example (#136)

Co-authored-by: Marco Franssen <[email protected]>

examples/production/run-tests.sh

@@ -5,7 +5,10 @@ set -xe
 SCRIPT="$(readlink -f "$0")"
 SCRIPTPATH="$(dirname "${SCRIPT}")"
 TESTDIR="${SCRIPTPATH}/../../.github/tests"
+DEPS="${TESTDIR}/dependencies"
 
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
 # shellcheck source=/dev/null
 source "${TESTDIR}/common.sh"
 
@@ -16,6 +19,10 @@ teardown() {
   helm uninstall --namespace "${ns}" spire 2>/dev/null || true
   kubectl delete ns "${ns}" 2>/dev/null || true
   kubectl delete ns spire-system 2>/dev/null || true
+  helm uninstall --namespace cert-manager cert-manager 2>/dev/null || true
+  kubectl delete ns cert-manager 2>/dev/null || true
+  helm uninstall --namespace ingress-nginx 2>/dev/null || true
+  kubectl delete ns ingress-nginx 2>/dev/null || true
 }
 
 trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
@@ -25,7 +32,61 @@ kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileg
 kubectl create namespace "${ns}" 2>/dev/null || true
 kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
 
-"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire
+"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
+  --namespace cert-manager \
+  --create-namespace \
+  --set installCRDs=true \
+  --wait
+
+kubectl apply -f "${DEPS}/testcert.yaml" -n spire-server
+
+"${helm_install[@]}" ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
+  --namespace ingress-nginx \
+  --create-namespace \
+  --set controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP \
+  --set controller.ingressClassResource.default=true \
+ --wait
+
+ip=$(kubectl get svc -n ingress-nginx ingress-nginx-controller -o go-template='{{ .spec.clusterIP }}')
+echo "$ip" oidc-discovery.example.org
+
+cat > /tmp/dummydns <<EOF
+spiffe-oidc-discovery-provider:
+  tests:
+    hostAliases:
+      - ip: "$ip"
+        hostnames:
+          - "oidc-discovery.example.org"
+spire-agent:
+  hostAliases:
+    - ip: "$ip"
+      hostnames:
+        - "spire-server.example.org"
+spire-server:
+  tests:
+    hostAliases:
+      - ip: "$ip"
+        hostnames:
+          - "spire-server-federation.example.org"
+  federation:
+    ingress:
+      tls:
+        - hosts:
+            - spire-server-federation.example.org
+          secretName: tls-cert
+EOF
+
+"${helm_install[@]}" spire charts/spire \
+  --namespace "${ns}" \
+  --values "${SCRIPTPATH}/values.yaml" \
+  --values "${SCRIPTPATH}/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
+  --values "${SCRIPTPATH}/values-export-spire-server-ingress-nginx.yaml" \
+  --values "${SCRIPTPATH}/values-export-federation-https-web-ingress-nginx.yaml" \
+  --values /tmp/dummydns \
+  --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
+  --set spire-agent.server.address=spire-server.example.org,spire-agent.server.port=443 \
+  --wait
+
 helm test --namespace "${ns}" spire
 
 print_helm_releases