feat: test OPA using HTTP in smoke test as well

Author: dervoeti

tests/templates/kuttl/smoke/10-assert.yaml.j2

@@ -2,12 +2,42 @@ apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
 timeout: 300
 commands:
-  - script: kubectl -n $NAMESPACE wait --for=condition=available opaclusters.opa.stackable.tech/test-opa --timeout 301s
+  - script: kubectl -n $NAMESPACE wait --for=condition=available opaclusters.opa.stackable.tech/test-opa-https --timeout 301s
+  - script: kubectl -n $NAMESPACE wait --for=condition=available opaclusters.opa.stackable.tech/test-opa-http --timeout 301s
 ---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: test-opa-server-default
+  name: test-opa-https-server-default
+spec:
+  template:
+    spec:
+      containers:
+        - name: opa
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+        - name: bundle-builder
+          resources:
+            limits:
+              cpu: 200m
+              memory: 128Mi
+            requests:
+              cpu: 100m
+              memory: 128Mi
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+        - name: vector
+{% endif %}
+      terminationGracePeriodSeconds: 125 # 2 minutes + 5s safety buffer
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: test-opa-http-server-default
 spec:
   template:
     spec:

tests/templates/kuttl/smoke/10-install-opa.yaml.j2

@@ -20,7 +20,7 @@ data:
 apiVersion: opa.stackable.tech/v1alpha1
 kind: OpaCluster
 metadata:
-  name: test-opa
+  name: test-opa-https
 spec:
   image:
 {% if test_scenario['values']['opa'].find(",") > 0 %}
@@ -46,3 +46,31 @@ spec:
       default:
         envOverrides:
           SERVER_ROLE_GROUP_LEVEL_ENV_VAR: "SERVER_ROLE_GROUP_LEVEL_ENV_VAR"
+---
+apiVersion: opa.stackable.tech/v1alpha1
+kind: OpaCluster
+metadata:
+  name: test-opa-http
+spec:
+  image:
+{% if test_scenario['values']['opa'].find(",") > 0 %}
+    custom: "{{ test_scenario['values']['opa'].split(',')[1] }}"
+    productVersion: "{{ test_scenario['values']['opa'].split(',')[0] }}"
+{% else %}
+    productVersion: "{{ test_scenario['values']['opa'] }}"
+{% endif %}
+    pullPolicy: IfNotPresent
+  clusterConfig:
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+    vectorAggregatorConfigMapName: vector-aggregator-discovery
+{% endif %}
+  servers:
+    config:
+      logging:
+        enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
+    envOverrides:
+      SERVER_ROLE_LEVEL_ENV_VAR: "SERVER_ROLE_LEVEL_ENV_VAR"
+    roleGroups:
+      default:
+        envOverrides:
+          SERVER_ROLE_GROUP_LEVEL_ENV_VAR: "SERVER_ROLE_GROUP_LEVEL_ENV_VAR"

tests/templates/kuttl/smoke/11-assert.yaml

@@ -5,5 +5,8 @@ kind: TestAssert
 timeout: 600
 commands:
   - script: |
-      FIRST_OPA_POD=$(kubectl get -n $NAMESPACE pods --field-selector=status.phase=Running --selector app.kubernetes.io/instance=test-opa -o jsonpath='{.items[0].metadata.name}')
+      FIRST_OPA_POD=$(kubectl get -n $NAMESPACE pods --field-selector=status.phase=Running --selector app.kubernetes.io/instance=test-opa-https -o jsonpath='{.items[0].metadata.name}')
+      kubectl exec -n $NAMESPACE --container opa $FIRST_OPA_POD -- cat /stackable/log/containerdebug-state.json | jq --exit-status '"valid JSON"'
+  - script: |
+      FIRST_OPA_POD=$(kubectl get -n $NAMESPACE pods --field-selector=status.phase=Running --selector app.kubernetes.io/instance=test-opa-http -o jsonpath='{.items[0].metadata.name}')
       kubectl exec -n $NAMESPACE --container opa $FIRST_OPA_POD -- cat /stackable/log/containerdebug-state.json | jq --exit-status '"valid JSON"'

tests/templates/kuttl/smoke/20-assert.yaml

@@ -9,4 +9,4 @@ metadata:
   name: test-opa
 status:
   readyReplicas: 1
-  replicas: 1
+  replicas: 1

tests/templates/kuttl/smoke/30-assert.yaml

@@ -4,4 +4,5 @@ kind: TestAssert
 metadata:
   name: test-regorule
 commands:
-  - script: kubectl exec -n $NAMESPACE test-opa-0 -- python /tmp/30_test-regorule.py -u "https://test-opa-server.$NAMESPACE.svc.cluster.local:8443/v1/data/test"
+  - script: kubectl exec -n $NAMESPACE test-opa-0 -- python /tmp/30_test-regorule.py -u "https://test-opa-https-server.$NAMESPACE.svc.cluster.local:8443/v1/data/test"
+  - script: kubectl exec -n $NAMESPACE test-opa-0 -- python /tmp/30_test-regorule.py -u "http://test-opa-http-server.$NAMESPACE.svc.cluster.local:8081/v1/data/test"

tests/templates/kuttl/smoke/30_test-metrics.py

@@ -4,19 +4,23 @@
 
 if __name__ == "__main__":
     all_args = argparse.ArgumentParser()
-    all_args.add_argument(
-        "-n", "--namespace", required=True, help="Kubernetes namespace"
-    )
+    all_args.add_argument("-u", "--url", required=True, help="OPA metrics url")
     args = vars(all_args.parse_args())
 
-    namespace = args["namespace"]
-    metrics_url = f"https://test-opa-server-default-metrics.{namespace}.svc.cluster.local:8443/metrics"
+    metrics_url = args["url"]
+
+    # Determine verification setting based on whether TLS is used
+    if metrics_url.startswith("http://"):
+        verify = False
+        protocol = "HTTP"
+    else:
+        verify = "/tls/ca.crt"
+        protocol = "HTTPS"
 
-    # Use the CA certificate for verification
-    response = requests.get(metrics_url, verify="/tls/ca.crt")
+    response = requests.get(metrics_url, verify=verify)
 
     assert response.status_code == 200, "Metrics endpoint must return a 200 status code"
     assert "bundle_loaded_counter" in response.text, (
         f"Metric bundle_loaded_counter should exist in {metrics_url}"
     )
-    print("Metrics test successful!")
+    print(f"Metrics test ({protocol}) successful!")

tests/templates/kuttl/smoke/30_test-regorule.py

@@ -25,22 +25,28 @@
     # --> {'result': {'hello': True}}
     # or https://<host>:8443/v1/data/test/hello
     # --> {'hello': True}
+    # For HTTP: http://<host>:8081/v1/data/test
 
-    # url = 'https://test-opa-server.<namespace>.svc.cluster.local:8443/v1/data/test'
-    response = requests.post(
-        args["url"], json={"input": {}}, verify="/tls/ca.crt"
-    ).json()
+    # Determine verification setting based on whether TLS is used
+    if args["url"].startswith("http://"):
+        verify = False
+        protocol = "HTTP"
+    else:
+        verify = "/tls/ca.crt"
+        protocol = "HTTPS"
+
+    response = requests.post(args["url"], json={"input": {}}, verify=verify).json()
 
     if (
         "result" in response
         and "hello" in response["result"]
         and response["result"]["hello"]
     ):
-        print("Regorule test successful!")
+        print(f"Regorule test ({protocol}) successful!")
         exit(0)
     else:
         print(
-            "Error: received "
+            f"Error ({protocol}): received "
             + str(response)
             + " - expected: {'result': {'hello': True}}"
         )

tests/templates/kuttl/smoke/31-assert.yaml

@@ -4,4 +4,5 @@ kind: TestAssert
 metadata:
   name: test-metrics
 commands:
-  - script: kubectl exec -n $NAMESPACE test-opa-0 -- python /tmp/30_test-metrics.py -n $NAMESPACE
+  - script: kubectl exec -n $NAMESPACE test-opa-0 -- python /tmp/30_test-metrics.py -u "https://test-opa-https-server-default-metrics.$NAMESPACE.svc.cluster.local:8443/metrics"
+  - script: kubectl exec -n $NAMESPACE test-opa-0 -- python /tmp/30_test-metrics.py -u "http://test-opa-http-server-default-metrics.$NAMESPACE.svc.cluster.local:8081/metrics"

tests/templates/kuttl/smoke/32-assert.yaml

@@ -5,6 +5,8 @@ metadata:
   name: test-env-overrides
 commands:
   # Role level env var
-  - script: kubectl exec -n $NAMESPACE -c opa svc/test-opa-server -- env | grep SERVER_ROLE_LEVEL_ENV_VAR
+  - script: kubectl exec -n $NAMESPACE -c opa svc/test-opa-https-server -- env | grep SERVER_ROLE_LEVEL_ENV_VAR
+  - script: kubectl exec -n $NAMESPACE -c opa svc/test-opa-http-server -- env | grep SERVER_ROLE_LEVEL_ENV_VAR
   # RoleGroup level env var
-  - script: kubectl exec -n $NAMESPACE -c opa svc/test-opa-server -- env | grep SERVER_ROLE_GROUP_LEVEL_ENV_VAR
+  - script: kubectl exec -n $NAMESPACE -c opa svc/test-opa-https-server -- env | grep SERVER_ROLE_GROUP_LEVEL_ENV_VAR
+  - script: kubectl exec -n $NAMESPACE -c opa svc/test-opa-http-server -- env | grep SERVER_ROLE_GROUP_LEVEL_ENV_VAR