Skip to content

Commit ea7200d

Browse files
siegfriedwebersiegfriedweber
committed
test: Add an integration test for LDAP with TLS
1 parent c48fadf commit ea7200d

14 files changed

Lines changed: 555 additions & 0 deletions

‎tests/templates/kuttl/ldap/00-patch-ns.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# see https://github.com/stackabletech/issues/issues/566
2+
---
3+
apiVersion: kuttl.dev/v1beta1
4+
kind: TestStep
5+
commands:
6+
- script: |
7+
kubectl patch namespace $NAMESPACE --patch='
8+
{
9+
"metadata": {
10+
"labels": {
11+
"pod-security.kubernetes.io/enforce": "privileged"
12+
}
13+
}
14+
}'
15+
timeout: 120

‎tests/templates/kuttl/ldap/01-rbac.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: test-service-account
6+
---
7+
kind: Role
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
metadata:
10+
name: test-role
11+
rules:
12+
- apiGroups:
13+
- security.openshift.io
14+
resources:
15+
- securitycontextconstraints
16+
resourceNames:
17+
- privileged
18+
verbs:
19+
- use
20+
---
21+
kind: RoleBinding
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
metadata:
24+
name: test-role-binding
25+
subjects:
26+
- kind: ServiceAccount
27+
name: test-service-account
28+
roleRef:
29+
apiGroup: rbac.authorization.k8s.io
30+
kind: Role
31+
name: test-role

‎tests/templates/kuttl/ldap/10-assert.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 300
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: openldap
10+
status:
11+
readyReplicas: 1
12+
replicas: 1

‎tests/templates/kuttl/ldap/10-install-openldap.yaml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: StatefulSet
4+
metadata:
5+
name: openldap
6+
labels:
7+
app.kubernetes.io/name: openldap
8+
spec:
9+
selector:
10+
matchLabels:
11+
app.kubernetes.io/name: openldap
12+
serviceName: openldap
13+
replicas: 1
14+
template:
15+
metadata:
16+
labels:
17+
app.kubernetes.io/name: openldap
18+
spec:
19+
serviceAccountName: test-service-account
20+
containers:
21+
- name: openldap
22+
image: docker.io/bitnami/openldap:2.5
23+
env:
24+
- name: LDAP_ADMIN_USERNAME
25+
value: admin
26+
- name: LDAP_ADMIN_PASSWORD
27+
value: admin
28+
- name: LDAP_ENABLE_TLS
29+
value: "yes"
30+
- name: LDAP_TLS_CERT_FILE
31+
value: /tls/tls.crt
32+
- name: LDAP_TLS_KEY_FILE
33+
value: /tls/tls.key
34+
- name: LDAP_TLS_CA_FILE
35+
value: /tls/ca.crt
36+
ports:
37+
- name: ldap
38+
containerPort: 1389
39+
- name: tls-ldap
40+
containerPort: 1636
41+
volumeMounts:
42+
- name: tls
43+
mountPath: /tls
44+
startupProbe:
45+
tcpSocket:
46+
port: 1389
47+
readinessProbe:
48+
tcpSocket:
49+
port: 1389
50+
# See https://github.com/bitnami/containers/issues/40841#issuecomment-1649977191
51+
securityContext:
52+
capabilities:
53+
drop:
54+
- ALL
55+
add:
56+
- NET_BIND_SERVICE
57+
volumes:
58+
- name: tls
59+
csi:
60+
driver: secrets.stackable.tech
61+
volumeAttributes:
62+
secrets.stackable.tech/class: tls
63+
secrets.stackable.tech/scope: pod
64+
---
65+
apiVersion: v1
66+
kind: Service
67+
metadata:
68+
name: openldap
69+
labels:
70+
app.kubernetes.io/name: openldap
71+
spec:
72+
type: ClusterIP
73+
ports:
74+
- name: ldap
75+
port: 1389
76+
targetPort: ldap
77+
- name: tls-ldap
78+
port: 1636
79+
targetPort: tls-ldap
80+
selector:
81+
app.kubernetes.io/name: openldap

‎tests/templates/kuttl/ldap/11-assert.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
commands:
5+
- script: kubectl exec -n $NAMESPACE openldap-0 -- ldapsearch -H ldap://localhost:1389 -D cn=integrationtest,ou=users,dc=example,dc=org -w integrationtest -b ou=users,dc=example,dc=org > /dev/null
6+
- script: kubectl exec -n $NAMESPACE openldap-0 -- bash -c LDAPTLS_CACERT=/tls/ca.crt ldapsearch -Z -H ldaps://localhost:1636 -D cn=integrationtest,ou=users,dc=example,dc=org -w integrationtest -b ou=users,dc=example,dc=org > /dev/null

‎tests/templates/kuttl/ldap/11-create-ldap-user.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
metadata:
5+
name: create-ldap-user
6+
commands:
7+
- script: kubectl cp -n $NAMESPACE ./create_ldap_user.sh openldap-0:/tmp
8+
- script: kubectl exec -n $NAMESPACE openldap-0 -- sh /tmp/create_ldap_user.sh

‎tests/templates/kuttl/ldap/20-create-opensearch-security-config.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
- script: >
6+
envsubst '$NAMESPACE' < 20_opensearch-security-config.yaml |
7+
kubectl apply -n $NAMESPACE -f -

‎tests/templates/kuttl/ldap/20_opensearch-security-config.yaml.j2‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: opensearch-security-config
6+
stringData:
7+
action_groups.yml: |
8+
---
9+
_meta:
10+
type: actiongroups
11+
config_version: 2
12+
allowlist.yml: |
13+
---
14+
_meta:
15+
type: allowlist
16+
config_version: 2
17+
18+
config:
19+
enabled: false
20+
audit.yml: |
21+
---
22+
_meta:
23+
type: audit
24+
config_version: 2
25+
26+
config:
27+
enabled: false
28+
config.yml: |
29+
---
30+
_meta:
31+
type: config
32+
config_version: 2
33+
34+
config:
35+
dynamic:
36+
authc:
37+
ldap:
38+
http_enabled: true
39+
transport_enabled: true
40+
order: 1
41+
http_authenticator:
42+
type: basic
43+
challenge: false
44+
authentication_backend:
45+
type: ldap
46+
config:
47+
enable_ssl: true
48+
hosts:
49+
- openldap.$NAMESPACE.svc.cluster.local:1636
50+
pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
51+
userbase: ou=users,dc=example,dc=org
52+
username_attribute: uid
53+
usersearch: (cn={0})
54+
verify_hostnames: true
55+
authz: {}
56+
internal_users.yml: |
57+
---
58+
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
59+
60+
_meta:
61+
type: internalusers
62+
config_version: 2
63+
64+
admin:
65+
hash: $2y$10$xRtHZFJ9QhG9GcYhRpAGpufCZYsk//nxsuel5URh0GWEBgmiI4Q/e
66+
reserved: true
67+
backend_roles:
68+
- admin
69+
description: OpenSearch admin user
70+
71+
kibanaserver:
72+
hash: $2y$10$vPgQ/6ilKDM5utawBqxoR.7euhVQ0qeGl8mPTeKhmFT475WUDrfQS
73+
reserved: true
74+
description: OpenSearch Dashboards user
75+
nodes_dn.yml: |
76+
---
77+
_meta:
78+
type: nodesdn
79+
config_version: 2
80+
roles.yml: |
81+
---
82+
_meta:
83+
type: roles
84+
config_version: 2
85+
roles_mapping.yml: |
86+
---
87+
_meta:
88+
type: rolesmapping
89+
config_version: 2
90+
91+
all_access:
92+
reserved: false
93+
backend_roles:
94+
- admin
95+
users:
96+
- integrationtest
97+
98+
kibana_server:
99+
reserved: true
100+
users:
101+
- kibanaserver
102+
tenants.yml: |
103+
---
104+
_meta:
105+
type: tenants
106+
config_version: 2

‎tests/templates/kuttl/ldap/21-assert.yaml.j2‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: opensearch-nodes-default
10+
status:
11+
readyReplicas: 3
12+
replicas: 3

‎tests/templates/kuttl/ldap/21-install-opensearch.yaml.j2‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
apiVersion: opensearch.stackable.tech/v1alpha1
3+
kind: OpenSearchCluster
4+
metadata:
5+
name: opensearch
6+
spec:
7+
image:
8+
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
9+
custom: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
10+
productVersion: "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
11+
{% else %}
12+
productVersion: "{{ test_scenario['values']['opensearch'] }}"
13+
{% endif %}
14+
pullPolicy: IfNotPresent
15+
nodes:
16+
roleGroups:
17+
default:
18+
replicas: 3
19+
envOverrides:
20+
DISABLE_INSTALL_DEMO_CONFIG: "true"
21+
OPENSEARCH_HOME: {{ test_scenario['values']['opensearch_home'] }}
22+
configOverrides:
23+
opensearch.yml:
24+
# Disable memory mapping in this test; If memory mapping were activated, the kernel setting
25+
# vm.max_map_count would have to be increased to 262144 on the node.
26+
node.store.allow_mmap: "false"
27+
plugins.security.allow_default_init_securityindex: "true"
28+
plugins.security.ssl.transport.enabled: "true"
29+
plugins.security.ssl.transport.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
30+
plugins.security.ssl.transport.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
31+
plugins.security.ssl.transport.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
32+
plugins.security.ssl.http.enabled: "true"
33+
plugins.security.ssl.http.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
34+
plugins.security.ssl.http.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
35+
plugins.security.ssl.http.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
36+
podOverrides:
37+
spec:
38+
containers:
39+
- name: opensearch
40+
volumeMounts:
41+
- name: security-config
42+
mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/opensearch-security
43+
readOnly: true
44+
- name: tls
45+
mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/tls
46+
readOnly: true
47+
securityContext:
48+
fsGroup: 1000
49+
volumes:
50+
- name: security-config
51+
secret:
52+
secretName: opensearch-security-config
53+
- name: tls
54+
ephemeral:
55+
volumeClaimTemplate:
56+
metadata:
57+
annotations:
58+
secrets.stackable.tech/class: tls
59+
secrets.stackable.tech/scope: node,pod,service=opensearch,service=opensearch-nodes-default-headless
60+
spec:
61+
storageClassName: secrets.stackable.tech
62+
accessModes:
63+
- ReadWriteOnce
64+
resources:
65+
requests:
66+
storage: "1"

0 commit comments

Comments
 (0)