|
| 1 | +package tls |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + |
| 7 | + clolog "github.com/ViaQ/logerr/v2/log/static" |
| 8 | + . "github.com/onsi/ginkgo/v2" |
| 9 | + . "github.com/onsi/gomega" |
| 10 | + configv1 "github.com/openshift/api/config/v1" |
| 11 | + obs "github.com/openshift/cluster-logging-operator/api/observability/v1" |
| 12 | + "github.com/openshift/cluster-logging-operator/internal/constants" |
| 13 | + internalruntime "github.com/openshift/cluster-logging-operator/internal/runtime" |
| 14 | + obsruntime "github.com/openshift/cluster-logging-operator/internal/runtime/observability" |
| 15 | + internaltls "github.com/openshift/cluster-logging-operator/internal/tls" |
| 16 | + "github.com/openshift/cluster-logging-operator/internal/utils/sets" |
| 17 | + "github.com/openshift/cluster-logging-operator/test/client" |
| 18 | + framework "github.com/openshift/cluster-logging-operator/test/framework/e2e" |
| 19 | + tlsscanner "github.com/openshift/cluster-logging-operator/test/framework/e2e/tls" |
| 20 | + "github.com/openshift/cluster-logging-operator/test/helpers/loki" |
| 21 | + corev1 "k8s.io/api/core/v1" |
| 22 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 23 | + "k8s.io/apimachinery/pkg/runtime" |
| 24 | + crclient "sigs.k8s.io/controller-runtime/pkg/client" |
| 25 | +) |
| 26 | + |
| 27 | +var _ = Describe("[E2E][Operator][TLS] TLS Scanner Validation", func() { |
| 28 | + const ( |
| 29 | + forwarderName = "tls-test-collector" |
| 30 | + ) |
| 31 | + |
| 32 | + var ( |
| 33 | + e2e *framework.E2ETestFramework |
| 34 | + err error |
| 35 | + k8sClient crclient.Client |
| 36 | + profileSpec configv1.TLSProfileSpec |
| 37 | + ) |
| 38 | + |
| 39 | + BeforeEach(func() { |
| 40 | + e2e = framework.NewE2ETestFramework() |
| 41 | + |
| 42 | + // Create a controller-runtime client with configv1 scheme for fetching APIServer TLS profile |
| 43 | + // This matches the production scheme setup in cmd/main.go |
| 44 | + scheme := runtime.NewScheme() |
| 45 | + Expect(configv1.AddToScheme(scheme)).To(Succeed()) |
| 46 | + k8sClient, err = crclient.New(e2e.RestConfig, crclient.Options{Scheme: scheme}) |
| 47 | + Expect(err).To(BeNil()) |
| 48 | + |
| 49 | + tlsProfile, err := internaltls.FetchAPIServerTlsProfile(k8sClient) |
| 50 | + Expect(err).To(BeNil(), "Failed to fetch APIServer TLS profile") |
| 51 | + |
| 52 | + By("Fetching the cluster TLS profile") |
| 53 | + profileSpec = internaltls.GetClusterTLSProfileSpec(tlsProfile) |
| 54 | + clolog.Info("Cluster TLS Profile", "spec", profileSpec) |
| 55 | + }) |
| 56 | + |
| 57 | + AfterEach(func() { |
| 58 | + e2e.Cleanup() |
| 59 | + }, framework.DefaultCleanUpTimeout) |
| 60 | + |
| 61 | + var ( |
| 62 | + runTlsScanner = func(e2e *framework.E2ETestFramework, scanNS string) (results []tlsscanner.ScanResult, err error) { |
| 63 | + By("Deploying TLS Scanner") |
| 64 | + scanner := tlsscanner.NewScanner(e2e.KubeClient, &e2e.CleanupFns) |
| 65 | + e2e.AddCleanup(func() error { |
| 66 | + return e2e.KubeClient.BatchV1().Jobs(scanNS).Delete(context.TODO(), tlsscanner.Name, metav1.DeleteOptions{}) |
| 67 | + }) |
| 68 | + job, err := scanner.Deploy(scanNS, scanNS) |
| 69 | + Expect(err).To(BeNil(), "Failed to deploy TLS Scanner") |
| 70 | + Expect(job).NotTo(BeNil()) |
| 71 | + |
| 72 | + By("Waiting for TLS Scanner to complete") |
| 73 | + err = scanner.WaitForCompletion(job, tlsscanner.JobTimeout) |
| 74 | + Expect(err).To(BeNil(), "TLS Scanner job did not complete successfully. It may not have matched any components to scan") |
| 75 | + |
| 76 | + By("Retrieving TLS scan results") |
| 77 | + results, err = scanner.GetResults(job) |
| 78 | + Expect(err).To(BeNil(), "Failed to retrieve TLS scan results") |
| 79 | + Expect(results).NotTo(BeEmpty(), "TLS Scanner returned no results") |
| 80 | + return results, err |
| 81 | + } |
| 82 | + |
| 83 | + verifyResultsHaveComponents = func(results []tlsscanner.ScanResult, epxComponents ...string) { |
| 84 | + components := sets.NewString() |
| 85 | + for _, result := range results { |
| 86 | + components.Insert(result.Component) |
| 87 | + } |
| 88 | + Expect(components.List()).To(ConsistOf(epxComponents)) |
| 89 | + } |
| 90 | + ) |
| 91 | + |
| 92 | + Context("when inspecting deployed ClusterLogForwarder", func() { |
| 93 | + |
| 94 | + var ( |
| 95 | + testNS string |
| 96 | + clf *obs.ClusterLogForwarder |
| 97 | + l *loki.Receiver |
| 98 | + sa *corev1.ServiceAccount |
| 99 | + ) |
| 100 | + |
| 101 | + BeforeEach(func() { |
| 102 | + |
| 103 | + testNS = e2e.CreateTestNamespace(func(namespace *corev1.Namespace) { |
| 104 | + namespace.Labels = map[string]string{ |
| 105 | + "pod-security.kubernetes.io/audit": "privileged", |
| 106 | + "pod-security.kubernetes.io/enforce": "privileged", |
| 107 | + "pod-security.kubernetes.io/warn": "privileged", |
| 108 | + } |
| 109 | + }) |
| 110 | + |
| 111 | + // Create service account for the collector with permissions for application and infrastructure logs |
| 112 | + sa, err = e2e.BuildAuthorizationFor(testNS, forwarderName). |
| 113 | + AllowClusterRole(framework.ClusterRoleCollectApplicationLogs). |
| 114 | + AllowClusterRole(framework.ClusterRoleCollectInfrastructureLogs). |
| 115 | + Create() |
| 116 | + Expect(err).To(BeNil()) |
| 117 | + |
| 118 | + // Deploy Loki receiver |
| 119 | + l = loki.NewReceiver(testNS, "loki-server") |
| 120 | + Expect(l.Create(client.Get())).To(Succeed()) |
| 121 | + |
| 122 | + // Deploy ClusterLogForwarder with both default inputs and receiver inputs |
| 123 | + // to ensure all input receiver types are running for TLS scanning |
| 124 | + clf = obsruntime.NewClusterLogForwarder(testNS, forwarderName, internalruntime.Initialize, func(clf *obs.ClusterLogForwarder) { |
| 125 | + clf.Spec.ServiceAccount.Name = sa.Name |
| 126 | + clf.Spec.Inputs = []obs.InputSpec{ |
| 127 | + { |
| 128 | + Name: "http-receiver", |
| 129 | + Type: obs.InputTypeReceiver, |
| 130 | + Receiver: &obs.ReceiverSpec{ |
| 131 | + Type: obs.ReceiverTypeHTTP, |
| 132 | + Port: 8080, |
| 133 | + HTTP: &obs.HTTPReceiver{ |
| 134 | + Format: obs.HTTPReceiverFormatKubeAPIAudit, |
| 135 | + }, |
| 136 | + }, |
| 137 | + }, |
| 138 | + { |
| 139 | + Name: "syslog-receiver", |
| 140 | + Type: obs.InputTypeReceiver, |
| 141 | + Receiver: &obs.ReceiverSpec{ |
| 142 | + Type: obs.ReceiverTypeSyslog, |
| 143 | + Port: 10514, |
| 144 | + }, |
| 145 | + }, |
| 146 | + } |
| 147 | + clf.Spec.Outputs = []obs.OutputSpec{ |
| 148 | + { |
| 149 | + Name: "loki-output", |
| 150 | + Type: obs.OutputTypeLoki, |
| 151 | + Loki: &obs.Loki{ |
| 152 | + URLSpec: obs.URLSpec{ |
| 153 | + URL: l.InternalURL("").String(), |
| 154 | + }, |
| 155 | + }, |
| 156 | + }, |
| 157 | + } |
| 158 | + clf.Spec.Pipelines = []obs.PipelineSpec{ |
| 159 | + { |
| 160 | + Name: "test-app", |
| 161 | + InputRefs: []string{string(obs.InputTypeApplication)}, |
| 162 | + OutputRefs: []string{"loki-output"}, |
| 163 | + }, |
| 164 | + { |
| 165 | + Name: "test-receivers", |
| 166 | + InputRefs: []string{"http-receiver", "syslog-receiver"}, |
| 167 | + OutputRefs: []string{"loki-output"}, |
| 168 | + }, |
| 169 | + } |
| 170 | + }) |
| 171 | + |
| 172 | + if err := e2e.CreateObservabilityClusterLogForwarder(clf); err != nil { |
| 173 | + Fail(fmt.Sprintf("Unable to create ClusterLogForwarder: %v", err)) |
| 174 | + } |
| 175 | + |
| 176 | + if err := e2e.WaitForDaemonSet(clf.Namespace, clf.Name); err != nil { |
| 177 | + Fail(fmt.Sprintf("Failed waiting for collector DaemonSet to be ready: %v", err)) |
| 178 | + } |
| 179 | + }) |
| 180 | + |
| 181 | + It("should validate the TLS server configurations match the cluster TLS profile", func() { |
| 182 | + results, _ := runTlsScanner(e2e, testNS) |
| 183 | + clolog.Info("TLS Scanner found endpoints", "count", len(results)) |
| 184 | + clolog.V(2).Info("TLS endpoint scanned", "result", results) |
| 185 | + verifyResultsHaveComponents(results, constants.VectorName) |
| 186 | + |
| 187 | + By("Validating TLS compliance") |
| 188 | + err = tlsscanner.ValidateCompliance(results, profileSpec) |
| 189 | + Expect(err).To(BeNil(), "TLS compliance validation failed") |
| 190 | + }) |
| 191 | + }) |
| 192 | + |
| 193 | + Context("when inspecting the operator and LogFileMetricExporter", func() { |
| 194 | + It("should validate the TLS configurations matches the cluster TLS profile", func() { |
| 195 | + |
| 196 | + // Deploy LFME |
| 197 | + lfme := internalruntime.NewLogFileMetricExporter(constants.OpenshiftNS, constants.SingletonName) |
| 198 | + e2e.AddCleanup(func() error { |
| 199 | + return e2e.KubeClient.AppsV1().DaemonSets(constants.OpenshiftNS).Delete(context.TODO(), lfme.Name, metav1.DeleteOptions{}) |
| 200 | + }) |
| 201 | + if err := e2e.Create(lfme); err != nil { |
| 202 | + Fail(fmt.Sprintf("Unable to create LogFileMetricExporter: %v", err)) |
| 203 | + } |
| 204 | + if err := e2e.WaitForDaemonSet(lfme.Namespace, constants.LogfilesmetricexporterName); err != nil { |
| 205 | + Fail(fmt.Sprintf("Failed waiting for lfme DaemonSet to be ready: %v", err)) |
| 206 | + } |
| 207 | + |
| 208 | + results, _ := runTlsScanner(e2e, constants.OpenshiftNS) |
| 209 | + clolog.Info("TLS Scanner found endpoints", "count", len(results)) |
| 210 | + verifyResultsHaveComponents(results, constants.ClusterLoggingOperator, constants.LogfilesmetricexporterName) |
| 211 | + |
| 212 | + By("Validating TLS compliance") |
| 213 | + err = tlsscanner.ValidateCompliance(results, profileSpec) |
| 214 | + Expect(err).To(BeNil(), "TLS compliance validation failed") |
| 215 | + }) |
| 216 | + }) |
| 217 | +}) |
0 commit comments