test: Improve the ldap integration test

Author: siegfriedweber

tests/templates/kuttl/ldap/10-install-openldap.yaml

@@ -16,7 +16,6 @@ spec:
       labels:
         app.kubernetes.io/name: openldap
     spec:
-      serviceAccountName: test-service-account
       containers:
         - name: openldap
           image: bitnamilegacy/openldap:2.5
@@ -54,6 +53,7 @@ spec:
                 - ALL
               add:
                 - NET_BIND_SERVICE
+      serviceAccountName: test-service-account
       volumes:
         - name: tls
           csi:

tests/templates/kuttl/ldap/11-assert.yaml

@@ -1,6 +1,11 @@
 ---
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
-commands:
-  - script: kubectl exec -n $NAMESPACE openldap-0 -- ldapsearch -H ldap://localhost:1389 -D cn=integrationtest,ou=users,dc=example,dc=org -w integrationtest -b ou=users,dc=example,dc=org > /dev/null
-  - script: kubectl exec -n $NAMESPACE openldap-0 -- bash -c LDAPTLS_CACERT=/tls/ca.crt ldapsearch -Z -H ldaps://localhost:1636 -D cn=integrationtest,ou=users,dc=example,dc=org -w integrationtest -b ou=users,dc=example,dc=org > /dev/null
+timeout: 600
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-ldap-user
+status:
+  succeeded: 1

tests/templates/kuttl/ldap/11-create-ldap-user.yaml

@@ -1,8 +1,105 @@
 ---
-apiVersion: kuttl.dev/v1beta1
-kind: TestStep
+apiVersion: batch/v1
+kind: Job
 metadata:
   name: create-ldap-user
-commands:
-  - script: kubectl cp -n $NAMESPACE ./create_ldap_user.sh openldap-0:/tmp
-  - script: kubectl exec -n $NAMESPACE openldap-0 -- sh /tmp/create_ldap_user.sh
+spec:
+  template:
+    spec:
+      containers:
+        - name: create-ldap-user
+          image: bitnamilegacy/openldap:2.5
+          command:
+            - /bin/bash
+            - -euxo
+            - pipefail
+            - -c
+          args:
+            - |
+              ldapadd \
+                  -D cn=admin,dc=example,dc=org \
+                  -w admin \
+                  -f /stackable/ldap-users/integrationtest \
+                  || true
+
+              ldappasswd \
+                  -D cn=admin,dc=example,dc=org \
+                  -w admin \
+                  -s integrationtest \
+                  cn=integrationtest,ou=users,dc=example,dc=org
+
+              # Check that the user works
+              ldapsearch \
+                  -D cn=integrationtest,ou=users,dc=example,dc=org \
+                  -w integrationtest \
+                  -b ou=users,dc=example,dc=org
+          env:
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: LDAPURI
+              value: ldaps://openldap.$(NAMESPACE).svc.cluster.local:1636/
+            - name: LDAPTLS_CACERT
+              value: /stackable/tls/ca.crt
+          volumeMounts:
+            - name: ldap-users
+              mountPath: /stackable/ldap-users
+            - name: tls
+              mountPath: /stackable/tls
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsNonRoot: true
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 100m
+            limits:
+              memory: 128Mi
+              cpu: 400m
+      volumes:
+        - name: ldap-users
+          configMap:
+            name: ldap-users
+        - name: tls
+          ephemeral:
+            volumeClaimTemplate:
+              metadata:
+                annotations:
+                  secrets.stackable.tech/class: tls
+              spec:
+                storageClassName: secrets.stackable.tech
+                accessModes:
+                  - ReadWriteOnce
+                resources:
+                  requests:
+                    storage: "1"
+      serviceAccountName: test-service-account
+      restartPolicy: OnFailure
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ldap-users
+data:
+  integrationtest: |
+    dn: cn=integrationtest,ou=users,dc=example,dc=org
+    objectClass: inetOrgPerson
+    objectClass: posixAccount
+    objectClass: shadowAccount
+    cn: integrationtest
+    uid: integrationtest
+    givenName: Stackable
+    sn: Integration-Test
+    mail: integrationtest@stackable.de
+    uidNumber: 16842
+    gidNumber: 100
+    homeDirectory: /home/integrationtest
+    loginShell: /bin/bash
+    userPassword: {crypt}x
+    shadowLastChange: 0
+    shadowMax: 0
+    shadowWarning: 0

tests/templates/kuttl/ldap/30-test-opensearch.yaml

@@ -68,99 +68,46 @@ metadata:
   name: test-opensearch
 data:
   test.py: |
-    # https://docs.opensearch.org/docs/latest/clients/python-low-level/#sample-program
-
     from opensearchpy import OpenSearch
 
     host = 'opensearch'
     port = 9200
-    auth = ('integrationtest', 'integrationtest') # For testing only. Don't store credentials in code.
+    auth = ('integrationtest', 'integrationtest')
     ca_certs_path = '/stackable/tls/ca.crt'
 
-    # Create the client with SSL/TLS enabled, but hostname verification disabled.
     client = OpenSearch(
         hosts = [{'host': host, 'port': port}],
-        http_compress = True, # enables gzip compression for request bodies
+        http_compress = True,
         http_auth = auth,
-        # client_cert = client_cert_path,
-        # client_key = client_key_path,
         use_ssl = True,
         verify_certs = True,
         ssl_assert_hostname = False,
         ssl_show_warn = False,
         ca_certs = ca_certs_path
     )
 
-    # Create an index with non-default settings.
-    index_name = 'python-test-index'
-    index_body = {
-      'settings': {
-        'index': {
-          'number_of_shards': 4
-        }
-      }
-    }
+    # Create an index
+    index_name = 'test-index'
+
+    response = client.indices.create(index=index_name)
 
-    response = client.indices.create(index=index_name, body=index_body)
     print('\nCreating index:')
     print(response)
 
-    # Add a document to the index.
-    document = {
-      'title': 'Moneyball',
-      'director': 'Bennett Miller',
-      'year': '2011'
-    }
-    id = '1'
-
+    # Add a document to the index
     response = client.index(
-        index = index_name,
-        body = document,
-        id = id,
-        refresh = True
+      index = index_name,
+      body = {
+        'name': 'Stackable'
+      },
+      id = 1,
     )
 
     print('\nAdding document:')
     print(response)
 
-    # Perform bulk operations
-
-    movies = '{ "index" : { "_index" : "my-dsl-index", "_id" : "2" } } \n { "title" : "Interstellar", "director" : "Christopher Nolan", "year" : "2014"} \n { "create" : { "_index" : "my-dsl-index", "_id" : "3" } } \n { "title" : "Star Trek Beyond", "director" : "Justin Lin", "year" : "2015"} \n { "update" : {"_id" : "3", "_index" : "my-dsl-index" } } \n { "doc" : {"year" : "2016"} }'
-
-    client.bulk(body=movies)
-
-    # Search for the document.
-    q = 'miller'
-    query = {
-      'size': 5,
-      'query': {
-        'multi_match': {
-          'query': q,
-          'fields': ['title^2', 'director']
-        }
-      }
-    }
-
-    response = client.search(
-        body = query,
-        index = index_name
-    )
-    print('\nSearch results:')
-    print(response)
-
-    # Delete the document.
-    response = client.delete(
-        index = index_name,
-        id = id
-    )
-
-    print('\nDeleting document:')
-    print(response)
-
     # Delete the index.
-    response = client.indices.delete(
-        index = index_name
-    )
+    response = client.indices.delete(index=index_name)
 
     print('\nDeleting index:')
     print(response)

tests/templates/kuttl/ldap/create_ldap_user.sh

@@ -84,8 +84,6 @@ data:
         hosts = [{'host': host, 'port': port}],
         http_compress = True, # enables gzip compression for request bodies
         http_auth = auth,
-        # client_cert = client_cert_path,
-        # client_key = client_key_path,
         use_ssl = True,
         verify_certs = True,
         ssl_assert_hostname = False,