test: Fix SNI validation failures with Druid 35.0.1

Author: dervoeti

tests/templates/kuttl/authorizer/06-assert.yaml

@@ -2,5 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 commands:
-  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/authcheck.py derby-druid
+  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/authcheck.py derby-druid $NAMESPACE
 timeout: 600

tests/templates/kuttl/authorizer/authcheck.py

@@ -2,12 +2,11 @@
 import sys
 import logging
 
-coordinator_host = "derby-druid-coordinator-default-headless"
 coordinator_port = "8281"
 authenticator_name = "MyBasicMetadataAuthenticator"
 
 
-def create_user(user_name):
+def create_user(user_name, coordinator_host):
     requests.post(
         f"https://{coordinator_host}:{coordinator_port}/druid-ext/basic-security/authentication/db/{authenticator_name}/users/{user_name}",
         auth=("admin", "password1"),
@@ -36,13 +35,17 @@ def create_user(user_name):
         stream=sys.stdout,
     )
 
+    druid_cluster_name = sys.argv[1]
+    namespace = sys.argv[2]
+
+    # Build FQDN for coordinator for TLS/SNI validation
+    coordinator_host = f"derby-druid-coordinator-default-headless.{namespace}.svc.cluster.local"
+
     print("CREATING USERS")
-    create_user("alice")
-    create_user("eve")
+    create_user("alice", coordinator_host)
+    create_user("eve", coordinator_host)
     print("USERS CREATED!")
 
-    druid_cluster_name = sys.argv[1]
-
     druid_role_ports = {
         "broker": 8282,
         "coordinator": 8281,
@@ -52,7 +55,9 @@ def create_user(user_name):
     }
 
     for role, port in druid_role_ports.items():
-        url = f"https://{druid_cluster_name}-{role}-default-headless:{port}/status"
+        # Build FQDN for TLS/SNI validation
+        host = f"{druid_cluster_name}-{role}-default-headless.{namespace}.svc.cluster.local"
+        url = f"https://{host}:{port}/status"
         # make an authorized request -> return 401 expected
         print("Checking Unauthorized")
         res = requests.get(url, verify=False)

tests/templates/kuttl/commons/ingestioncheck.py

@@ -49,13 +49,18 @@ def query_datasource(self, url, sql, expected, iterations):
 
 
 druid_cluster_name = sys.argv[1]
+namespace = sys.argv[2]
 druid = DruidClient()
 
+# Build FQDNs for TLS/SNI validation
+coordinator_host = f"{druid_cluster_name}-coordinator-default-headless.{namespace}.svc.cluster.local"
+broker_host = f"{druid_cluster_name}-broker-default-headless.{namespace}.svc.cluster.local"
+
 print("""
 Query tasks
 ===========""")
 tasks = druid.get_tasks(
-    url=f"https://{druid_cluster_name}-coordinator-default-headless:8281/druid/indexer/v1/tasks",
+    url=f"https://{coordinator_host}:8281/druid/indexer/v1/tasks",
 )
 task_count = len(json.loads(tasks))
 print(f"existing tasks: {task_count}")
@@ -64,7 +69,7 @@ def query_datasource(self, url, sql, expected, iterations):
 Start ingestion task
 ====================""")
 ingestion = druid.post_task(
-    url=f"https://{druid_cluster_name}-coordinator-default-headless:8281/druid/indexer/v1/task",
+    url=f"https://{coordinator_host}:8281/druid/indexer/v1/task",
     input="/tmp/druid-quickstartimport.json",
 )
 task_id = json.loads(ingestion)["task"]
@@ -74,7 +79,7 @@ def query_datasource(self, url, sql, expected, iterations):
 Re-query tasks
 ==============""")
 tasks = druid.get_tasks(
-    url=f"https://{druid_cluster_name}-coordinator-default-headless:8281/druid/indexer/v1/tasks",
+    url=f"https://{coordinator_host}:8281/druid/indexer/v1/tasks",
 )
 new_task_count = len(json.loads(tasks))
 print(f"new tasks: {new_task_count}")
@@ -88,7 +93,7 @@ def query_datasource(self, url, sql, expected, iterations):
 while not job_finished:
     time.sleep(5)
     task = druid.get(
-        url=f"https://{druid_cluster_name}-coordinator-default-headless:8281/druid/indexer/v1/task/{url_encoded_taskid}/status",
+        url=f"https://{coordinator_host}:8281/druid/indexer/v1/task/{url_encoded_taskid}/status",
     )
     task_status = json.loads(task)["status"]["statusCode"]
     print(f"Current task status: [{task_status}]")
@@ -104,7 +109,7 @@ def query_datasource(self, url, sql, expected, iterations):
 while not broker_ready:
     time.sleep(2)
     broker_ready_rc = druid.check_rc(
-        f"https://{druid_cluster_name}-broker-default-headless:8282/druid/broker/v1/readiness"
+        f"https://{broker_host}:8282/druid/broker/v1/readiness"
     )
     broker_ready = broker_ready_rc == 200
     print(f"Broker respondend with [{broker_ready_rc}] to readiness check")
@@ -114,7 +119,7 @@ def query_datasource(self, url, sql, expected, iterations):
 ==============""")
 sample_data_size = 39244
 result = druid.query_datasource(
-    url=f"https://{druid_cluster_name}-broker-default-headless:8282/druid/v2/sql",
+    url=f"https://{broker_host}:8282/druid/v2/sql",
     sql={"query": 'select count(*) as c from "wikipedia-2015-09-12"'},
     expected=sample_data_size,
     iterations=12,

tests/templates/kuttl/hdfs-deep-storage/06-assert.yaml

@@ -2,5 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 commands:
-  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py derby-druid
+  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py derby-druid $NAMESPACE
 timeout: 300

tests/templates/kuttl/ingestion-no-s3-ext/06-assert.yaml

@@ -2,5 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 commands:
-  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py derby-druid
+  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py derby-druid $NAMESPACE
 timeout: 300

tests/templates/kuttl/ingestion-s3-ext/06-assert.yaml

@@ -2,5 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 commands:
-  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py derby-druid
+  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py derby-druid $NAMESPACE
 timeout: 300

tests/templates/kuttl/ldap/20-assert.yaml

@@ -2,5 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 commands:
-  - script: kubectl exec -n $NAMESPACE test-druid-0 -- python /tmp/authcheck.py
+  - script: kubectl exec -n $NAMESPACE test-druid-0 -- python /tmp/authcheck.py $NAMESPACE
 timeout: 180

tests/templates/kuttl/ldap/authcheck.py

@@ -10,6 +10,7 @@ def main():
     result = 0
 
     druid_cluster_name = "derby-druid"
+    namespace = sys.argv[1]
 
     druid_role_ports = {
         "broker": 8282,
@@ -26,7 +27,9 @@ def main():
     )
 
     for role, port in druid_role_ports.items():
-        url = f"https://{druid_cluster_name}-{role}-default-headless:{port}/status"
+        # Build FQDN for TLS/SNI validation
+        host = f"{druid_cluster_name}-{role}-default-headless.{namespace}.svc.cluster.local"
+        url = f"https://{host}:{port}/status"
         # make an authorized request -> return 401 expected
         logging.info(f"making unauthorized request to {role}.")
         res = requests.get(url, verify=False)

tests/templates/kuttl/s3-deep-storage/12-assert.yaml

@@ -2,5 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 commands:
-  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py druid-s3-deep-storage
+  - script: kubectl exec -n $NAMESPACE checks-0 -- python /tmp/ingestioncheck.py druid-s3-deep-storage $NAMESPACE
 timeout: 300