test: Test snapshots in S3 (#49)

* test: Test creating snapshots in S3

* test: Use ListenerClass external-unstable; Check SSL hostname in opensearchpy

* test: Remove resolved TODO comment

Author: siegfriedweber

tests/templates/kuttl/ldap/30-test-opensearch.yaml

@@ -22,6 +22,10 @@ spec:
             # required for pip install
             - name: HOME
               value: /stackable
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
           volumeMounts:
             - name: script
               mountPath: /stackable/scripts
@@ -68,9 +72,12 @@ metadata:
   name: test-opensearch
 data:
   test.py: |
+    import os
     from opensearchpy import OpenSearch
 
-    host = 'opensearch'
+    namespace = os.environ['NAMESPACE']
+
+    host = f'opensearch.{namespace}.svc.cluster.local'
     port = 9200
     auth = ('integrationtest', 'integrationtest')
     ca_certs_path = '/stackable/tls/ca.crt'
@@ -81,8 +88,6 @@ data:
         http_auth = auth,
         use_ssl = True,
         verify_certs = True,
-        ssl_assert_hostname = False,
-        ssl_show_warn = False,
         ca_certs = ca_certs_path
     )
 

tests/templates/kuttl/metrics/20-install-opensearch.yaml.j2

@@ -27,7 +27,7 @@ spec:
             storage:
               data:
                 capacity: 100Mi
-          listenerClass: external-stable
+          listenerClass: external-unstable
         replicas: 3
     configOverrides:
       opensearch.yml:

tests/templates/kuttl/opensearch-dashboards/10-install-opensearch.yaml.j2

@@ -23,7 +23,7 @@ spec:
     roleGroups:
       default:
         config:
-          listenerClass: external-stable
+          listenerClass: external-unstable
         replicas: 1
         podOverrides:
           spec:

tests/templates/kuttl/smoke/10-assert.yaml.j2

@@ -869,7 +869,7 @@ metadata:
     kind: OpenSearchCluster
     name: opensearch
 spec:
-  className: external-stable
+  className: external-unstable
   extraPodSelectorLabels: {}
   ports:
   - name: http

tests/templates/kuttl/smoke/10-install-opensearch.yaml.j2

@@ -29,7 +29,7 @@ spec:
             storage:
               data:
                 capacity: 100Mi
-          listenerClass: external-stable
+          listenerClass: external-unstable
         replicas: 3
         podOverrides:
           spec:

tests/templates/kuttl/smoke/20-test-opensearch.yaml

@@ -22,6 +22,10 @@ spec:
             # required for pip install
             - name: HOME
               value: /stackable
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
           volumeMounts:
             - name: script
               mountPath: /stackable/scripts
@@ -70,9 +74,12 @@ data:
   test.py: |
     # https://docs.opensearch.org/docs/latest/clients/python-low-level/#sample-program
 
+    import os
     from opensearchpy import OpenSearch
 
-    host = 'opensearch'
+    namespace = os.environ['NAMESPACE']
+
+    host = f'opensearch.{namespace}.svc.cluster.local'
     port = 9200
     auth = ('admin', 'AJVFsGJBbpT6mChn') # For testing only. Don't store credentials in code.
     ca_certs_path = '/stackable/tls/ca.crt'
@@ -84,8 +91,6 @@ data:
         http_auth = auth,
         use_ssl = True,
         verify_certs = True,
-        ssl_assert_hostname = False,
-        ssl_show_warn = False,
         ca_certs = ca_certs_path
     )
 

tests/templates/kuttl/snapshot-s3/00-patch-ns.yaml

@@ -0,0 +1,15 @@
+# see https://github.com/stackabletech/issues/issues/566
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      kubectl patch namespace $NAMESPACE --patch='
+        {
+          "metadata": {
+            "labels": {
+              "pod-security.kubernetes.io/enforce": "privileged"
+            }
+          }
+        }'
+    timeout: 120

tests/templates/kuttl/snapshot-s3/01-rbac.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test-service-account
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: test-role
+rules:
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - privileged
+    verbs:
+      - use
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: test-role-binding
+subjects:
+  - kind: ServiceAccount
+    name: test-service-account
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: test-role

tests/templates/kuttl/snapshot-s3/02-assert.yaml.j2

@@ -0,0 +1,10 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vector-aggregator-discovery
+{% endif %}

tests/templates/kuttl/snapshot-s3/02-install-vector-aggregator-discovery-config-map.yaml.j2

@@ -0,0 +1,9 @@
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vector-aggregator-discovery
+data:
+  ADDRESS: {{ lookup('env', 'VECTOR_AGGREGATOR') }}
+{% endif %}