Skip to content

Commit 00f7010

Browse files
siegfriedwebersiegfriedweber
authored
test: Add an integration test for LDAP with TLS (#21)
* test: Add an integration test for LDAP with TLS * chore: Fix yamllint warning * test: Switch to bitnamilegacy * test: Improve the ldap integration test * test: Pin version of opensearch-py * test: Improve test output
1 parent 35544c7 commit 00f7010

14 files changed

+573
-3
lines changed

‎tests/templates/kuttl/ldap/00-patch-ns.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# see https://github.com/stackabletech/issues/issues/566
2+
---
3+
apiVersion: kuttl.dev/v1beta1
4+
kind: TestStep
5+
commands:
6+
- script: |
7+
kubectl patch namespace $NAMESPACE --patch='
8+
{
9+
"metadata": {
10+
"labels": {
11+
"pod-security.kubernetes.io/enforce": "privileged"
12+
}
13+
}
14+
}'
15+
timeout: 120

‎tests/templates/kuttl/ldap/01-rbac.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: test-service-account
6+
---
7+
kind: Role
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
metadata:
10+
name: test-role
11+
rules:
12+
- apiGroups:
13+
- security.openshift.io
14+
resources:
15+
- securitycontextconstraints
16+
resourceNames:
17+
- privileged
18+
verbs:
19+
- use
20+
---
21+
kind: RoleBinding
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
metadata:
24+
name: test-role-binding
25+
subjects:
26+
- kind: ServiceAccount
27+
name: test-service-account
28+
roleRef:
29+
apiGroup: rbac.authorization.k8s.io
30+
kind: Role
31+
name: test-role

‎tests/templates/kuttl/ldap/10-assert.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 300
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: openldap
10+
status:
11+
readyReplicas: 1
12+
replicas: 1

‎tests/templates/kuttl/ldap/10-install-openldap.yaml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: StatefulSet
4+
metadata:
5+
name: openldap
6+
labels:
7+
app.kubernetes.io/name: openldap
8+
spec:
9+
selector:
10+
matchLabels:
11+
app.kubernetes.io/name: openldap
12+
serviceName: openldap
13+
replicas: 1
14+
template:
15+
metadata:
16+
labels:
17+
app.kubernetes.io/name: openldap
18+
spec:
19+
containers:
20+
- name: openldap
21+
image: bitnamilegacy/openldap:2.5
22+
env:
23+
- name: LDAP_ADMIN_USERNAME
24+
value: admin
25+
- name: LDAP_ADMIN_PASSWORD
26+
value: admin
27+
- name: LDAP_ENABLE_TLS
28+
value: "yes"
29+
- name: LDAP_TLS_CERT_FILE
30+
value: /tls/tls.crt
31+
- name: LDAP_TLS_KEY_FILE
32+
value: /tls/tls.key
33+
- name: LDAP_TLS_CA_FILE
34+
value: /tls/ca.crt
35+
ports:
36+
- name: ldap
37+
containerPort: 1389
38+
- name: tls-ldap
39+
containerPort: 1636
40+
volumeMounts:
41+
- name: tls
42+
mountPath: /tls
43+
startupProbe:
44+
tcpSocket:
45+
port: 1389
46+
readinessProbe:
47+
tcpSocket:
48+
port: 1389
49+
# See https://github.com/bitnami/containers/issues/40841#issuecomment-1649977191
50+
securityContext:
51+
capabilities:
52+
drop:
53+
- ALL
54+
add:
55+
- NET_BIND_SERVICE
56+
serviceAccountName: test-service-account
57+
volumes:
58+
- name: tls
59+
csi:
60+
driver: secrets.stackable.tech
61+
volumeAttributes:
62+
secrets.stackable.tech/class: tls
63+
secrets.stackable.tech/scope: pod
64+
---
65+
apiVersion: v1
66+
kind: Service
67+
metadata:
68+
name: openldap
69+
labels:
70+
app.kubernetes.io/name: openldap
71+
spec:
72+
type: ClusterIP
73+
ports:
74+
- name: ldap
75+
port: 1389
76+
targetPort: ldap
77+
- name: tls-ldap
78+
port: 1636
79+
targetPort: tls-ldap
80+
selector:
81+
app.kubernetes.io/name: openldap

‎tests/templates/kuttl/ldap/11-assert.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: batch/v1
7+
kind: Job
8+
metadata:
9+
name: create-ldap-user
10+
status:
11+
succeeded: 1

‎tests/templates/kuttl/ldap/11-create-ldap-user.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: create-ldap-user
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: create-ldap-user
11+
image: bitnamilegacy/openldap:2.5
12+
command:
13+
- /bin/bash
14+
- -euxo
15+
- pipefail
16+
- -c
17+
args:
18+
- |
19+
ldapadd \
20+
-D cn=admin,dc=example,dc=org \
21+
-w admin \
22+
-f /stackable/ldap-users/integrationtest \
23+
|| true
24+
25+
ldappasswd \
26+
-D cn=admin,dc=example,dc=org \
27+
-w admin \
28+
-s integrationtest \
29+
cn=integrationtest,ou=users,dc=example,dc=org
30+
31+
# Check that the user works
32+
ldapsearch \
33+
-D cn=integrationtest,ou=users,dc=example,dc=org \
34+
-w integrationtest \
35+
-b ou=users,dc=example,dc=org
36+
env:
37+
- name: NAMESPACE
38+
valueFrom:
39+
fieldRef:
40+
fieldPath: metadata.namespace
41+
- name: LDAPURI
42+
value: ldaps://openldap.$(NAMESPACE).svc.cluster.local:1636/
43+
- name: LDAPTLS_CACERT
44+
value: /stackable/tls/ca.crt
45+
volumeMounts:
46+
- name: ldap-users
47+
mountPath: /stackable/ldap-users
48+
- name: tls
49+
mountPath: /stackable/tls
50+
securityContext:
51+
allowPrivilegeEscalation: false
52+
capabilities:
53+
drop:
54+
- ALL
55+
runAsNonRoot: true
56+
resources:
57+
requests:
58+
memory: 128Mi
59+
cpu: 100m
60+
limits:
61+
memory: 128Mi
62+
cpu: 400m
63+
volumes:
64+
- name: ldap-users
65+
configMap:
66+
name: ldap-users
67+
- name: tls
68+
ephemeral:
69+
volumeClaimTemplate:
70+
metadata:
71+
annotations:
72+
secrets.stackable.tech/class: tls
73+
spec:
74+
storageClassName: secrets.stackable.tech
75+
accessModes:
76+
- ReadWriteOnce
77+
resources:
78+
requests:
79+
storage: "1"
80+
serviceAccountName: test-service-account
81+
restartPolicy: OnFailure
82+
---
83+
apiVersion: v1
84+
kind: ConfigMap
85+
metadata:
86+
name: ldap-users
87+
data:
88+
integrationtest: |
89+
dn: cn=integrationtest,ou=users,dc=example,dc=org
90+
objectClass: inetOrgPerson
91+
objectClass: posixAccount
92+
objectClass: shadowAccount
93+
cn: integrationtest
94+
uid: integrationtest
95+
givenName: Stackable
96+
sn: Integration-Test
97+
mail: integrationtest@stackable.de
98+
uidNumber: 16842
99+
gidNumber: 100
100+
homeDirectory: /home/integrationtest
101+
loginShell: /bin/bash
102+
userPassword: {crypt}x
103+
shadowLastChange: 0
104+
shadowMax: 0
105+
shadowWarning: 0

‎tests/templates/kuttl/ldap/20-create-opensearch-security-config.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
- script: >
6+
envsubst '$NAMESPACE' < 20_opensearch-security-config.yaml |
7+
kubectl apply -n $NAMESPACE -f -

‎tests/templates/kuttl/ldap/20_opensearch-security-config.yaml.j2‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: opensearch-security-config
6+
stringData:
7+
action_groups.yml: |
8+
---
9+
_meta:
10+
type: actiongroups
11+
config_version: 2
12+
allowlist.yml: |
13+
---
14+
_meta:
15+
type: allowlist
16+
config_version: 2
17+
18+
config:
19+
enabled: false
20+
audit.yml: |
21+
---
22+
_meta:
23+
type: audit
24+
config_version: 2
25+
26+
config:
27+
enabled: false
28+
config.yml: |
29+
---
30+
_meta:
31+
type: config
32+
config_version: 2
33+
34+
config:
35+
dynamic:
36+
authc:
37+
ldap:
38+
http_enabled: true
39+
transport_enabled: true
40+
order: 1
41+
http_authenticator:
42+
type: basic
43+
challenge: false
44+
authentication_backend:
45+
type: ldap
46+
config:
47+
enable_ssl: true
48+
hosts:
49+
- openldap.$NAMESPACE.svc.cluster.local:1636
50+
pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
51+
userbase: ou=users,dc=example,dc=org
52+
username_attribute: uid
53+
usersearch: (cn={0})
54+
verify_hostnames: true
55+
authz: {}
56+
internal_users.yml: |
57+
---
58+
# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh
59+
60+
_meta:
61+
type: internalusers
62+
config_version: 2
63+
64+
admin:
65+
hash: $2y$10$xRtHZFJ9QhG9GcYhRpAGpufCZYsk//nxsuel5URh0GWEBgmiI4Q/e
66+
reserved: true
67+
backend_roles:
68+
- admin
69+
description: OpenSearch admin user
70+
71+
kibanaserver:
72+
hash: $2y$10$vPgQ/6ilKDM5utawBqxoR.7euhVQ0qeGl8mPTeKhmFT475WUDrfQS
73+
reserved: true
74+
description: OpenSearch Dashboards user
75+
nodes_dn.yml: |
76+
---
77+
_meta:
78+
type: nodesdn
79+
config_version: 2
80+
roles.yml: |
81+
---
82+
_meta:
83+
type: roles
84+
config_version: 2
85+
roles_mapping.yml: |
86+
---
87+
_meta:
88+
type: rolesmapping
89+
config_version: 2
90+
91+
all_access:
92+
reserved: false
93+
backend_roles:
94+
- admin
95+
users:
96+
- integrationtest
97+
98+
kibana_server:
99+
reserved: true
100+
users:
101+
- kibanaserver
102+
tenants.yml: |
103+
---
104+
_meta:
105+
type: tenants
106+
config_version: 2

‎tests/templates/kuttl/ldap/21-assert.yaml.j2‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: apps/v1
7+
kind: StatefulSet
8+
metadata:
9+
name: opensearch-nodes-default
10+
status:
11+
readyReplicas: 3
12+
replicas: 3

0 commit comments

Comments
 (0)