From e39094b90a796b2265c028d4f023223acba53bc8 Mon Sep 17 00:00:00 2001 From: Andrew Bays Date: Sat, 31 Oct 2026 18:34:42 -0400 Subject: [PATCH] Add parallel KUTTL support --- test/kuttl/common/osp_check_cert_issuer.sh | 45 ++++++++++++++++--- .../02-assert-service-certs-issuers.yaml | 2 +- .../00-dataplane-create.yaml | 11 +++++ .../dataplane-service-config/00-create.yaml | 10 +++++ .../00-dataplane-create.yaml | 11 +++++ .../dataplane-service-failure/00-create.yaml | 11 +++++ 6 files changed, 84 insertions(+), 6 deletions(-) diff --git a/test/kuttl/common/osp_check_cert_issuer.sh b/test/kuttl/common/osp_check_cert_issuer.sh index cef1f6d21d..e7f99231a8 100755 --- a/test/kuttl/common/osp_check_cert_issuer.sh +++ b/test/kuttl/common/osp_check_cert_issuer.sh @@ -6,6 +6,25 @@ EXPECTED_ISSUER="$1" ENDPOINT_TYPE="$2" ISSUER_MISMATCHES="" ALL_MATCHED=1 +KEYSTONE_NAMESPACE="$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)" +KEYSTONE_AUTH_URL="https://keystone-internal.${KEYSTONE_NAMESPACE}.svc:5000/v3" +KEYSTONE_SOURCE_CONFIG="${OS_CLIENT_CONFIG_FILE:-/home/cloud-admin/.config/openstack/clouds.yaml}" +KEYSTONE_SECURE_CONFIG="${OS_CLIENT_SECURE_FILE:-/home/cloud-admin/.config/openstack/secure.yaml}" +KEYSTONE_CLIENT_CONFIG="$(mktemp)" +cp "$KEYSTONE_SOURCE_CONFIG" "$KEYSTONE_CLIENT_CONFIG" +sed -i -E "s|(^[[:space:]]*auth_url:[[:space:]]*).*|\1${KEYSTONE_AUTH_URL}|" "$KEYSTONE_CLIENT_CONFIG" +trap 'rm -f "$KEYSTONE_CLIENT_CONFIG"' EXIT + +openstack_with_internal_auth() { + OS_CLOUD=default \ + OS_CLIENT_CONFIG_FILE="$KEYSTONE_CLIENT_CONFIG" \ + OS_CLIENT_SECURE_FILE="$KEYSTONE_SECURE_CONFIG" \ + OS_IDENTITY_API_VERSION=3 \ + OS_INTERFACE=internal \ + OS_ENDPOINT_TYPE=internal \ + OS_AUTH_URL="$KEYSTONE_AUTH_URL" \ + openstack "$@" +} function extract_host_port { local endpoint_url=$1 @@ -31,7 +50,14 @@ function check_keystone_endpoint { local endpoint_url=$1 echo "Checking Keystone endpoint $endpoint_url ..." - http_status=$(curl -s -o /dev/null -w "%{http_code}" "$endpoint_url") + # Route hosts are not reliably resolvable from CRC client pods. Keep the + # route hostname for Host/SNI, but connect through the in-cluster router. + local host_port + host_port=$(extract_host_port "$endpoint_url") + local host="${host_port%:*}" + local port="${host_port##*:}" + http_status=$(curl --connect-to "${host}:${port}:router-internal-default.openshift-ingress.svc.cluster.local.:${port}" \ + -s -o /dev/null -w "%{http_code}" "$endpoint_url") if [[ "$http_status" -ge 200 && "$http_status" -lt 400 ]]; then return 0 @@ -44,13 +70,22 @@ get_issuer_cn() { local host_port="$1" local output - output=$(openssl s_client -connect "$host_port" /dev/null | - openssl x509 -noout -issuer 2>/dev/null) + if [[ "$ENDPOINT_TYPE" == "public" ]]; then + local host="${host_port%:*}" + local port="${host_port##*:}" + output=$(openssl s_client \ + -connect "router-internal-default.openshift-ingress.svc.cluster.local.:${port}" \ + -servername "$host" /dev/null | + openssl x509 -noout -issuer 2>/dev/null) + else + output=$(openssl s_client -connect "$host_port" /dev/null | + openssl x509 -noout -issuer 2>/dev/null) + fi echo "$output" | sed -n 's/^.*CN[[:space:]]*=[[:space:]]*\([^,]*\).*$/\1/p' } -keystone_url=$(openstack endpoint list -c URL -f value | grep 'keystone-public') +keystone_url=$(openstack_with_internal_auth endpoint list -c URL -f value | grep 'keystone-public') keystone_host_port=$(extract_host_port "$keystone_url") if ! check_keystone_endpoint "$keystone_url"; then @@ -66,7 +101,7 @@ else fi # Check endpoints for the expected issuer -for url in $(openstack endpoint list -c URL -f value | grep "$endpoint_filter"); do +for url in $(openstack_with_internal_auth endpoint list -c URL -f value | grep "$endpoint_filter"); do host_port=$(extract_host_port "$url") echo "Checking $host_port ..." diff --git a/test/kuttl/tests/ctlplane-tls-custom-issuers/02-assert-service-certs-issuers.yaml b/test/kuttl/tests/ctlplane-tls-custom-issuers/02-assert-service-certs-issuers.yaml index 9f831cdd57..41cf3ac3c9 100644 --- a/test/kuttl/tests/ctlplane-tls-custom-issuers/02-assert-service-certs-issuers.yaml +++ b/test/kuttl/tests/ctlplane-tls-custom-issuers/02-assert-service-certs-issuers.yaml @@ -1,6 +1,6 @@ apiVersion: kuttl.dev/v1beta1 kind: TestAssert -timeout: 60 +timeout: 180 commands: - script: | echo "Checking rotation of non API service certificates..." diff --git a/test/kuttl/tests/dataplane-extramounts/00-dataplane-create.yaml b/test/kuttl/tests/dataplane-extramounts/00-dataplane-create.yaml index 36846628ef..5122a27303 100644 --- a/test/kuttl/tests/dataplane-extramounts/00-dataplane-create.yaml +++ b/test/kuttl/tests/dataplane-extramounts/00-dataplane-create.yaml @@ -1,3 +1,14 @@ +apiVersion: v1 +data: + internal-ca-bundle.pem: "" + tls-ca-bundle.pem: "" +kind: Secret +metadata: + labels: + combined-ca-bundle: "" + name: combined-ca-bundle +type: Opaque +--- apiVersion: dataplane.openstack.org/v1beta1 kind: OpenStackDataPlaneService metadata: diff --git a/test/kuttl/tests/dataplane-service-config/00-create.yaml b/test/kuttl/tests/dataplane-service-config/00-create.yaml index 9cd72201f4..c444659aa1 100644 --- a/test/kuttl/tests/dataplane-service-config/00-create.yaml +++ b/test/kuttl/tests/dataplane-service-config/00-create.yaml @@ -1,3 +1,13 @@ +apiVersion: v1 +data: + internal-ca-bundle.pem: "" + tls-ca-bundle.pem: "" +kind: Secret +metadata: + labels: + combined-ca-bundle: "" + name: combined-ca-bundle +type: Opaque --- apiVersion: v1 kind: ConfigMap diff --git a/test/kuttl/tests/dataplane-service-custom-image/00-dataplane-create.yaml b/test/kuttl/tests/dataplane-service-custom-image/00-dataplane-create.yaml index 69bc405d46..86dd30d1b1 100644 --- a/test/kuttl/tests/dataplane-service-custom-image/00-dataplane-create.yaml +++ b/test/kuttl/tests/dataplane-service-custom-image/00-dataplane-create.yaml @@ -1,3 +1,14 @@ +apiVersion: v1 +data: + internal-ca-bundle.pem: "" + tls-ca-bundle.pem: "" +kind: Secret +metadata: + labels: + combined-ca-bundle: "" + name: combined-ca-bundle +type: Opaque +--- apiVersion: dataplane.openstack.org/v1beta1 kind: OpenStackDataPlaneService metadata: diff --git a/test/kuttl/tests/dataplane-service-failure/00-create.yaml b/test/kuttl/tests/dataplane-service-failure/00-create.yaml index e5c6e0cf4f..d8afb84ce6 100644 --- a/test/kuttl/tests/dataplane-service-failure/00-create.yaml +++ b/test/kuttl/tests/dataplane-service-failure/00-create.yaml @@ -1,3 +1,14 @@ +apiVersion: v1 +data: + internal-ca-bundle.pem: "" + tls-ca-bundle.pem: "" +kind: Secret +metadata: + labels: + combined-ca-bundle: "" + name: combined-ca-bundle +type: Opaque +--- apiVersion: dataplane.openstack.org/v1beta1 kind: OpenStackDataPlaneService metadata: