Skip to content

Commit 4493cc9

Browse files
labrenbesiegfriedweber
labrenbe
and
siegfriedweber
authored
test: Create integration test for OpenSearch Dashboards (#39)
* extend smoke test with opensearch-dashboards * move opensearch-dashboards into own test * Update tests/templates/kuttl/opensearch-dashboards/20_opensearch-dashboards-values.yaml.j2 Co-authored-by: Siegfried Weber <mail@siegfriedweber.net> * add vector aggregator to test * verify the opensearch tls cert in the opensearch-dashboards test * address feedback on PR * remove limit range * remove unnecessary comment * Apply suggestions from code review Co-authored-by: Siegfried Weber <mail@siegfriedweber.net> * set listener class in test to external-stable * directly create cm with test script * run opensearch-dashboards test with original image * removed openshift dimension --------- Co-authored-by: Siegfried Weber <mail@siegfriedweber.net>
1 parent c801705 commit 4493cc9

12 files changed

Lines changed: 509 additions & 0 deletions

‎tests/templates/kuttl/opensearch-dashboards/00-patch-ns.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# see https://github.com/stackabletech/issues/issues/566
2+
---
3+
apiVersion: kuttl.dev/v1beta1
4+
kind: TestStep
5+
commands:
6+
- script: |
7+
kubectl patch namespace $NAMESPACE --patch='
8+
{
9+
"metadata": {
10+
"labels": {
11+
"pod-security.kubernetes.io/enforce": "privileged"
12+
}
13+
}
14+
}'
15+
timeout: 120

‎tests/templates/kuttl/opensearch-dashboards/01-rbac.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: test-service-account
6+
---
7+
kind: Role
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
metadata:
10+
name: test-role
11+
rules:
12+
- apiGroups:
13+
- security.openshift.io
14+
resources:
15+
- securitycontextconstraints
16+
resourceNames:
17+
- privileged
18+
verbs:
19+
- use
20+
---
21+
kind: RoleBinding
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
metadata:
24+
name: test-role-binding
25+
subjects:
26+
- kind: ServiceAccount
27+
name: test-service-account
28+
roleRef:
29+
apiGroup: rbac.authorization.k8s.io
30+
kind: Role
31+
name: test-role

‎tests/templates/kuttl/opensearch-dashboards/02-assert.yaml.j2‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
{% if lookup('env', 'VECTOR_AGGREGATOR') %}
5+
---
6+
apiVersion: v1
7+
kind: ConfigMap
8+
metadata:
9+
name: vector-aggregator-discovery
10+
{% endif %}

‎tests/templates/kuttl/opensearch-dashboards/02-install-vector-aggregator-discovery-config-map.yaml.j2‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{% if lookup('env', 'VECTOR_AGGREGATOR') %}
2+
---
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: vector-aggregator-discovery
7+
data:
8+
ADDRESS: {{ lookup('env', 'VECTOR_AGGREGATOR') }}
9+
{% endif %}

‎tests/templates/kuttl/opensearch-dashboards/10-assert.yaml.j2‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: opensearch-nodes-default
10+
status:
11+
readyReplicas: 1
12+
replicas: 1

‎tests/templates/kuttl/opensearch-dashboards/10-install-opensearch.yaml.j2‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
---
2+
apiVersion: opensearch.stackable.tech/v1alpha1
3+
kind: OpenSearchCluster
4+
metadata:
5+
name: opensearch
6+
spec:
7+
image:
8+
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
9+
custom: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
10+
productVersion: "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
11+
{% else %}
12+
productVersion: "{{ test_scenario['values']['opensearch'] }}"
13+
{% endif %}
14+
pullPolicy: IfNotPresent
15+
{% if lookup('env', 'VECTOR_AGGREGATOR') %}
16+
clusterConfig:
17+
vectorAggregatorConfigMapName: vector-aggregator-discovery
18+
{% endif %}
19+
nodes:
20+
config:
21+
logging:
22+
enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
23+
roleGroups:
24+
default:
25+
config:
26+
listenerClass: external-stable
27+
replicas: 1
28+
podOverrides:
29+
spec:
30+
volumes:
31+
- name: tls
32+
ephemeral:
33+
volumeClaimTemplate:
34+
metadata:
35+
annotations:
36+
secrets.stackable.tech/scope: node,pod,service=opensearch,service=opensearch-nodes-default-headless
37+
envOverrides:
38+
# Only required for the official image
39+
# The official image (built with https://github.com/opensearch-project/opensearch-build)
40+
# installs a demo configuration if not disabled explicitly.
41+
DISABLE_INSTALL_DEMO_CONFIG: "true"
42+
OPENSEARCH_HOME: {{ test_scenario['values']['opensearch_home'] }}
43+
configOverrides:
44+
opensearch.yml:
45+
# Disable memory mapping in this test; If memory mapping were activated, the kernel setting
46+
# vm.max_map_count would have to be increased to 262144 on the node.
47+
node.store.allow_mmap: "false"
48+
# Disable the disk allocation decider in this test; Otherwise the test depends on the disk
49+
# usage of the node and if the relative watermark set in
50+
# `cluster.routing.allocation.disk.watermark.high` is reached then the security index could
51+
# not be created even if enough disk space would be available.
52+
cluster.routing.allocation.disk.threshold_enabled: "false"
53+
plugins.security.allow_default_init_securityindex: "true"
54+
plugins.security.ssl.transport.enabled: "true"
55+
plugins.security.ssl.transport.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
56+
plugins.security.ssl.transport.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
57+
plugins.security.ssl.transport.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
58+
plugins.security.ssl.http.enabled: "true"
59+
plugins.security.ssl.http.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
60+
plugins.security.ssl.http.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
61+
plugins.security.ssl.http.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
62+
podOverrides:
63+
spec:
64+
containers:
65+
- name: opensearch
66+
volumeMounts:
67+
- name: security-config
68+
mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/opensearch-security
69+
readOnly: true
70+
- name: tls
71+
mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/tls
72+
readOnly: true
73+
volumes:
74+
- name: security-config
75+
secret:
76+
secretName: opensearch-security-config
77+
- name: tls
78+
ephemeral:
79+
volumeClaimTemplate:
80+
metadata:
81+
annotations:
82+
secrets.stackable.tech/class: tls
83+
spec:
84+
storageClassName: secrets.stackable.tech
85+
accessModes:
86+
- ReadWriteOnce
87+
resources:
88+
requests:
89+
storage: "1"
90+
---
91+
apiVersion: v1
92+
kind: Secret
93+
metadata:
94+
name: opensearch-credentials
95+
data:
96+
admin: QUpWRnNHSkJicFQ2bUNobg== # AJVFsGJBbpT6mChn
97+
kibanaserver: RTRrRU51RW1rcUgzanlIQw== # E4kENuEmkqH3jyHC
98+
---
99+
apiVersion: v1
100+
kind: Secret
101+
metadata:
102+
name: opensearch-security-config
103+
stringData:
104+
action_groups.yml: |
105+
---
106+
_meta:
107+
type: actiongroups
108+
config_version: 2
109+
allowlist.yml: |
110+
---
111+
_meta:
112+
type: allowlist
113+
config_version: 2
114+
115+
config:
116+
enabled: false
117+
audit.yml: |
118+
---
119+
_meta:
120+
type: audit
121+
config_version: 2
122+
123+
config:
124+
enabled: false
125+
config.yml: |
126+
---
127+
_meta:
128+
type: config
129+
config_version: 2
130+
131+
config:
132+
dynamic:
133+
authc:
134+
basic_internal_auth_domain:
135+
description: Authenticate via HTTP Basic against internal users database
136+
http_enabled: true
137+
transport_enabled: true
138+
order: 1
139+
http_authenticator:
140+
type: basic
141+
challenge: true
142+
authentication_backend:
143+
type: intern
144+
authz: {}
145+
internal_users.yml: |
146+
---
147+
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
148+
149+
_meta:
150+
type: internalusers
151+
config_version: 2
152+
153+
admin:
154+
hash: $2y$10$xRtHZFJ9QhG9GcYhRpAGpufCZYsk//nxsuel5URh0GWEBgmiI4Q/e
155+
reserved: true
156+
backend_roles:
157+
- admin
158+
description: OpenSearch admin user
159+
160+
kibanaserver:
161+
hash: $2y$10$vPgQ/6ilKDM5utawBqxoR.7euhVQ0qeGl8mPTeKhmFT475WUDrfQS
162+
reserved: true
163+
description: OpenSearch Dashboards user
164+
nodes_dn.yml: |
165+
---
166+
_meta:
167+
type: nodesdn
168+
config_version: 2
169+
roles.yml: |
170+
---
171+
_meta:
172+
type: roles
173+
config_version: 2
174+
roles_mapping.yml: |
175+
---
176+
_meta:
177+
type: rolesmapping
178+
config_version: 2
179+
180+
all_access:
181+
reserved: false
182+
backend_roles:
183+
- admin
184+
185+
kibana_server:
186+
reserved: true
187+
users:
188+
- kibanaserver
189+
tenants.yml: |
190+
---
191+
_meta:
192+
type: tenants
193+
config_version: 2

‎tests/templates/kuttl/opensearch-dashboards/20-assert.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: apps/v1
7+
kind: Deployment
8+
metadata:
9+
name: opensearch-dashboards
10+
status:
11+
readyReplicas: 1
12+
replicas: 1

‎tests/templates/kuttl/opensearch-dashboards/20-install-opensearch-dashboards.yaml.j2‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
- script: >
6+
helm install opensearch-dashboards opensearch-dashboards
7+
--repo https://opensearch-project.github.io/helm-charts
8+
--version "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
9+
--values 20_opensearch-dashboards-values.yaml
10+
--set opensearchHosts=https://opensearch.$NAMESPACE.svc.cluster.local:9200
11+
--namespace $NAMESPACE
12+
--wait
13+
timeout: 600

‎tests/templates/kuttl/opensearch-dashboards/20_opensearch-dashboards-values.yaml.j2‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
image:
2+
repository: oci.stackable.tech/sdp/opensearch-dashboards
3+
tag: {{ test_scenario['values']['opensearch'].split(',')[0] }}-stackable0.0.0-dev
4+
service:
5+
type: NodePort
6+
serviceAccount:
7+
create: false
8+
# Use the ServiceAccount of OpenSearch because its permissions are already configured to work on
9+
# OpenShift.
10+
name: opensearch-serviceaccount
11+
extraEnvs:
12+
- name: OPENSEARCH_PASSWORD
13+
valueFrom:
14+
secretKeyRef:
15+
name: opensearch-credentials
16+
key: kibanaserver
17+
config:
18+
opensearch_dashboards.yml:
19+
opensearch:
20+
username: kibanaserver
21+
requestHeadersWhitelist:
22+
- authorization
23+
- securitytenant
24+
ssl:
25+
verificationMode: full
26+
certificateAuthorities: [/stackable/opensearch-dashboards/config/tls/ca.crt]
27+
opensearch_security:
28+
multitenancy:
29+
enabled: true
30+
tenants.preferred: [Private, Global]
31+
readonly_mode.roles: [kibana_read_only]
32+
cookie.secure: false
33+
extraVolumes:
34+
- name: tls
35+
ephemeral:
36+
volumeClaimTemplate:
37+
metadata:
38+
annotations:
39+
secrets.stackable.tech/class: tls
40+
spec:
41+
storageClassName: secrets.stackable.tech
42+
accessModes:
43+
- ReadWriteOnce
44+
resources:
45+
requests:
46+
storage: "1"
47+
extraVolumeMounts:
48+
- name: tls
49+
mountPath: /stackable/opensearch-dashboards/config/tls
50+
# The Helm chart only adds a volume mount at /usr/share/opensearch-dashboards
51+
- mountPath: /stackable/opensearch-dashboards/config/opensearch_dashboards.yml
52+
name: config
53+
subPath: opensearch_dashboards.yml
54+
podSecurityContext:
55+
fsGroup: 1000

‎tests/templates/kuttl/opensearch-dashboards/30-assert.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: batch/v1
7+
kind: Job
8+
metadata:
9+
name: test-opensearch-dashboards
10+
status:
11+
succeeded: 1

0 commit comments

Comments
 (0)