test: verify Instance readiness end to end

test/e2e/e2e_test.go

@@ -36,6 +36,8 @@ import (
 // namespace where the project is deployed in
 const namespace = "postgresql-tenant-operator-system"
 
+const dependencyNamespace = "postgresql-tenant-operator-e2e"
+
 // serviceAccountName created for the project
 const serviceAccountName = "postgresql-tenant-operator-controller-manager"
 
@@ -52,9 +54,19 @@ var _ = Describe("Manager", Ordered, func() {
 	// enforce the restricted security policy to the namespace, installing CRDs,
 	// and deploying the controller.
 	BeforeAll(func() {
-		By("creating manager namespace")
-		cmd := exec.Command("kubectl", "create", "ns", namespace)
+		By("deploying disposable PostgreSQL and OpenBao dependencies")
+		cmd := exec.Command("kubectl", "apply", "-f", "test/e2e/fixtures/instance-dependencies.yaml")
 		_, err := utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to deploy Instance dependencies")
+		cmd = exec.Command("kubectl", "wait", "deployment/postgres", "deployment/openbao", "--for=condition=Available",
+			"-n", dependencyNamespace, "--timeout=3m")
+		_, err = utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Instance dependencies did not become available")
+		configureOpenBao()
+
+		By("creating manager namespace")
+		cmd = exec.Command("kubectl", "create", "ns", namespace)
+		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to create namespace")
 
 		By("labeling the namespace to enforce the restricted security policy")
@@ -72,6 +84,13 @@ var _ = Describe("Manager", Ordered, func() {
 		cmd = exec.Command("make", "deploy", fmt.Sprintf("IMG=%s", managerImage))
 		_, err = utils.Run(cmd)
 		Expect(err).NotTo(HaveOccurred(), "Failed to deploy the controller-manager")
+
+		By("configuring the controller for disposable dependencies")
+		argsPatch := `{"spec":{"template":{"spec":{"containers":[{"name":"manager","args":["--leader-elect","--health-probe-bind-address=:8081","--openbao-address=http://openbao.postgresql-tenant-operator-e2e.svc:8200","--openbao-auth-role=postgresql-tenant-operator","--openbao-kv-mount=secret","--external-secret-store-name=openbao"]}]}}}}`
+		cmd = exec.Command("kubectl", "patch", "deployment", "postgresql-tenant-operator-controller-manager",
+			"-n", namespace, "--type=strategic", "-p", argsPatch)
+		_, err = utils.Run(cmd)
+		Expect(err).NotTo(HaveOccurred(), "Failed to configure controller dependency flags")
 	})
 
 	// After all tests have been executed, clean up by undeploying the controller, uninstalling CRDs,
@@ -92,6 +111,10 @@ var _ = Describe("Manager", Ordered, func() {
 		By("removing manager namespace")
 		cmd = exec.Command("kubectl", "delete", "ns", namespace)
 		_, _ = utils.Run(cmd)
+
+		By("removing disposable Instance dependencies")
+		cmd = exec.Command("kubectl", "delete", "-f", "test/e2e/fixtures/instance-dependencies.yaml", "--ignore-not-found")
+		_, _ = utils.Run(cmd)
 	})
 
 	// After each test, check for failures and collect logs, events,
@@ -268,6 +291,47 @@ var _ = Describe("Manager", Ordered, func() {
 			Eventually(verifyMetricsAvailable, 2*time.Minute).Should(Succeed())
 		})
 
+		It("should make an Instance Ready after validating OpenBao and initializing PostgreSQL", func() {
+			serviceIP, err := utils.Run(exec.Command("kubectl", "get", "service", "postgres", "-n", dependencyNamespace,
+				"-o", "jsonpath={.spec.clusterIP}"))
+			Expect(err).NotTo(HaveOccurred())
+			manifest := fmt.Sprintf(`apiVersion: database.ddupan.top/v1alpha1
+kind: PostgreSQLInstance
+metadata:
+  name: e2e
+spec:
+  endpoint:
+    host: postgres.%s.svc
+    hostaddr: %s
+    port: 5432
+    database: postgres
+    sslMode: disable
+  adminCredentialRef:
+    path: infrastructure/postgresql/admin
+`, dependencyNamespace, serviceIP)
+			manifestPath := filepath.Join(GinkgoT().TempDir(), "instance.yaml")
+			Expect(os.WriteFile(manifestPath, []byte(manifest), 0o600)).To(Succeed())
+			_, err = utils.Run(exec.Command("kubectl", "apply", "-f", manifestPath))
+			Expect(err).NotTo(HaveOccurred())
+
+			Eventually(func(g Gomega) {
+				phase, err := utils.Run(exec.Command("kubectl", "get", "postgresqlinstance", "e2e",
+					"-o", "jsonpath={.status.phase}"))
+				g.Expect(err).NotTo(HaveOccurred())
+				g.Expect(phase).To(Equal("Ready"))
+				ready, err := utils.Run(exec.Command("kubectl", "get", "postgresqlinstance", "e2e",
+					"-o", `jsonpath={.status.conditions[?(@.type=="Ready")].status}`))
+				g.Expect(err).NotTo(HaveOccurred())
+				g.Expect(ready).To(Equal("True"))
+			}).Should(Succeed())
+
+			output, err := utils.Run(exec.Command("kubectl", "exec", "deployment/postgres", "-n", dependencyNamespace,
+				"--", "psql", "-U", "postgres", "-d", "postgres", "-Atc",
+				"SELECT to_regclass('postgresql_tenant_operator.tenant_ownership') IS NOT NULL"))
+			Expect(err).NotTo(HaveOccurred())
+			Expect(output).To(Equal("t\n"))
+		})
+
 		// +kubebuilder:scaffold:e2e-webhooks-checks
 
 		// TODO: Customize the e2e test suite with scenarios specific to your project.
@@ -282,6 +346,25 @@ var _ = Describe("Manager", Ordered, func() {
 	})
 })
 
+func configureOpenBao() {
+	By("configuring OpenBao Kubernetes auth and the PostgreSQL administrative credential")
+	script := `set -eu
+bao auth enable kubernetes
+bao write auth/kubernetes/config kubernetes_host=https://kubernetes.default.svc \
+  token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
+  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+printf 'path "secret/data/infrastructure/postgresql/admin" { capabilities = ["read"] }\n' | bao policy write postgresql-tenant-operator -
+bao write auth/kubernetes/role/postgresql-tenant-operator \
+  bound_service_account_names=postgresql-tenant-operator-controller-manager \
+  bound_service_account_namespaces=postgresql-tenant-operator-system \
+  policies=postgresql-tenant-operator ttl=5m
+bao kv put secret/infrastructure/postgresql/admin username=postgres password=postgres-e2e-only
+`
+	cmd := exec.Command("kubectl", "exec", "deployment/openbao", "-n", dependencyNamespace, "--", "sh", "-ec", script)
+	_, err := utils.Run(cmd)
+	Expect(err).NotTo(HaveOccurred(), "Failed to configure OpenBao")
+}
+
 // serviceAccountToken returns a token for the specified service account in the given namespace.
 // It uses the Kubernetes TokenRequest API to generate a token by directly sending a request
 // and parsing the resulting token from the API response.