Skip to content

Commit 32d9838

Browse files
tjmoore4tjmoore4
committed
Replace TestReconcileCerts owner reference test with Kuttl test
This creates a Kuttl test to verify proper owner references are set on the root CA certificate secret which replaces the current EnvTest implementation. Issue: [sc-14269]
1 parent 43f2c3a commit 32d9838

File tree

12 files changed

+180
-57
lines changed

12 files changed

+180
-57
lines changed

‎internal/controller/postgrescluster/pki_test.go

Lines changed: 5 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,13 @@ import (
2525
"reflect"
2626
"strings"
2727
"testing"
28-
"time"
2928

3029
"github.com/pkg/errors"
3130
"gotest.tools/v3/assert"
3231
appsv1 "k8s.io/api/apps/v1"
3332
corev1 "k8s.io/api/core/v1"
34-
apierrors "k8s.io/apimachinery/pkg/api/errors"
3533
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3634
"k8s.io/apimachinery/pkg/types"
37-
"k8s.io/apimachinery/pkg/util/wait"
3835
"sigs.k8s.io/controller-runtime/pkg/client"
3936

4037
"github.com/crunchydata/postgres-operator/internal/naming"
@@ -43,6 +40,11 @@ import (
4340
"github.com/crunchydata/postgres-operator/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
4441
)
4542

43+
// TestReconcileCerts tests the proper reconciliation of the root ca certificate
44+
// secret, leaf certificate secrets and the updates that occur when updates are
45+
// made to the cluster certificates generally. For the removal of ownership
46+
// references and deletion of the root CA cert secret, a separate Kuttl test is
47+
// used due to the need for proper garbage collection.
4648
func TestReconcileCerts(t *testing.T) {
4749
// Garbage collector cleans up test resources before the test completes
4850
if strings.EqualFold(os.Getenv("USE_EXISTING_CLUSTER"), "true") {
@@ -137,38 +139,6 @@ func TestReconcileCerts(t *testing.T) {
137139
}
138140
})
139141

140-
t.Run("remove owner references after deleting first cluster", func(t *testing.T) {
141-
142-
if !strings.EqualFold(os.Getenv("USE_EXISTING_CLUSTER"), "true") {
143-
t.Skip("requires a running garbage collection controller")
144-
}
145-
146-
err = tClient.Get(ctx, client.ObjectKeyFromObject(cluster1), cluster1)
147-
assert.NilError(t, err)
148-
149-
err = tClient.Delete(ctx, cluster1)
150-
assert.NilError(t, err)
151-
152-
err = wait.Poll(time.Second/2, Scale(time.Second*15), func() (bool, error) {
153-
err := tClient.Get(ctx, client.ObjectKeyFromObject(rootSecret), rootSecret)
154-
return len(rootSecret.ObjectMeta.OwnerReferences) == 1, err
155-
})
156-
assert.NilError(t, err)
157-
158-
assert.Check(t, len(rootSecret.ObjectMeta.OwnerReferences) == 1, "owner reference not removed")
159-
160-
expectedOR := metav1.OwnerReference{
161-
APIVersion: "postgres-operator.crunchydata.com/v1beta1",
162-
Kind: "PostgresCluster",
163-
Name: "hippocluster2",
164-
UID: cluster2.UID,
165-
}
166-
167-
if len(rootSecret.ObjectMeta.OwnerReferences) > 0 {
168-
assert.Equal(t, rootSecret.ObjectMeta.OwnerReferences[0], expectedOR)
169-
}
170-
})
171-
172142
t.Run("root certificate is returned correctly", func(t *testing.T) {
173143

174144
fromSecret, err := getCertFromSecret(ctx, tClient, naming.RootCertSecret, namespace, "root.crt")
@@ -202,28 +172,6 @@ func TestReconcileCerts(t *testing.T) {
202172
assert.DeepEqual(t, fromSecret, returnedRoot.Certificate)
203173
})
204174

205-
t.Run("root CA secret is deleted after final cluster is deleted", func(t *testing.T) {
206-
207-
if !strings.EqualFold(os.Getenv("USE_EXISTING_CLUSTER"), "true") {
208-
t.Skip("requires a running garbage collection controller")
209-
}
210-
211-
err = tClient.Get(ctx, client.ObjectKeyFromObject(cluster2), cluster2)
212-
assert.NilError(t, err)
213-
214-
err = tClient.Delete(ctx, cluster2)
215-
assert.NilError(t, err)
216-
217-
err = wait.Poll(time.Second/2, Scale(time.Second*15), func() (bool, error) {
218-
if err := tClient.Get(ctx,
219-
client.ObjectKeyFromObject(rootSecret), rootSecret); apierrors.ReasonForError(err) == metav1.StatusReasonNotFound {
220-
return true, err
221-
}
222-
return false, nil
223-
})
224-
assert.Assert(t, apierrors.IsNotFound(err))
225-
})
226-
227175
})
228176

229177
t.Run("check leaf certificate reconciliation", func(t *testing.T) {

‎testing/kuttl/e2e/root-cert-ownership/00--cluster.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: owner1
5+
labels: { postgres-operator-test: kuttl }
6+
spec:
7+
postgresVersion: ${KUTTL_PG_VERSION}
8+
instances:
9+
- name: instance1
10+
replicas: 1
11+
dataVolumeClaimSpec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 1Gi } } }
12+
backups:
13+
pgbackrest:
14+
repos:
15+
- name: repo1
16+
volume:
17+
volumeClaimSpec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 1Gi } } }
18+
---
19+
apiVersion: postgres-operator.crunchydata.com/v1beta1
20+
kind: PostgresCluster
21+
metadata:
22+
name: owner2
23+
labels: { postgres-operator-test: kuttl }
24+
spec:
25+
postgresVersion: ${KUTTL_PG_VERSION}
26+
instances:
27+
- name: instance1
28+
replicas: 1
29+
dataVolumeClaimSpec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 1Gi } } }
30+
backups:
31+
pgbackrest:
32+
repos:
33+
- name: repo1
34+
volume:
35+
volumeClaimSpec: { accessModes: [ReadWriteOnce], resources: { requests: { storage: 1Gi } } }

‎testing/kuttl/e2e/root-cert-ownership/00-assert.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: owner1
5+
status:
6+
instances:
7+
- name: instance1
8+
readyReplicas: 1
9+
replicas: 1
10+
updatedReplicas: 1
11+
---
12+
apiVersion: postgres-operator.crunchydata.com/v1beta1
13+
kind: PostgresCluster
14+
metadata:
15+
name: owner2
16+
status:
17+
instances:
18+
- name: instance1
19+
readyReplicas: 1
20+
replicas: 1
21+
updatedReplicas: 1
22+
---
23+
apiVersion: v1
24+
kind: Secret
25+
metadata:
26+
name: pgo-root-cacert

‎testing/kuttl/e2e/root-cert-ownership/01-check-owners.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
# Get a list of the current owners of the root ca cert secret and verify that
6+
# both owners are listed.
7+
- script: |
8+
CURRENT_OWNERS=$(kubectl --namespace="${NAMESPACE}" get secret \
9+
pgo-root-cacert -o jsonpath='{.metadata.ownerReferences[*].name}')
10+
if [[ "$CURRENT_OWNERS" != *"owner1"* ]]; then
11+
exit 1
12+
fi
13+
if [[ "$CURRENT_OWNERS" != *"owner2"* ]]; then
14+
exit 1
15+
fi

‎testing/kuttl/e2e/root-cert-ownership/02--delete-owner1.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
delete:
4+
- apiVersion: postgres-operator.crunchydata.com/v1beta1
5+
kind: PostgresCluster
6+
name: owner1

‎testing/kuttl/e2e/root-cert-ownership/02-assert.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: owner2
5+
---
6+
apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
name: pgo-root-cacert

‎testing/kuttl/e2e/root-cert-ownership/02-errors.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: owner1

‎testing/kuttl/e2e/root-cert-ownership/03-check-owners.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
# Get a list of the current owners of the root ca cert secret and verify that
6+
# owner1 is no longer listed and owner2 is found.
7+
- script: |
8+
sleep 2 # this sleep allows time for the owner reference list to be updated
9+
CURRENT_OWNERS=$(kubectl --namespace="${NAMESPACE}" get secret \
10+
pgo-root-cacert -o jsonpath='{.metadata.ownerReferences[*].name}')
11+
if [[ "$CURRENT_OWNERS" == *"owner1"* ]]; then
12+
exit 1
13+
fi
14+
if [[ "$CURRENT_OWNERS" != *"owner2"* ]]; then
15+
exit 1
16+
fi

‎testing/kuttl/e2e/root-cert-ownership/04--delete-owner2.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
delete:
4+
- apiVersion: postgres-operator.crunchydata.com/v1beta1
5+
kind: PostgresCluster
6+
name: owner2

‎testing/kuttl/e2e/root-cert-ownership/04-errors.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: postgres-operator.crunchydata.com/v1beta1
2+
kind: PostgresCluster
3+
metadata:
4+
name: owner1
5+
---
6+
apiVersion: postgres-operator.crunchydata.com/v1beta1
7+
kind: PostgresCluster
8+
metadata:
9+
name: owner2

‎testing/kuttl/e2e/root-cert-ownership/05--check-secret.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestStep
4+
commands:
5+
# If there are other PostgresClusters in the namespace, ensure that 'owner2'
6+
# and 'owner2' are not listed.
7+
# If there are no other PostgresClusters in the namespace, the 'pgo-root-cacert'
8+
# secret should be deleted.
9+
- script: |
10+
NUM_CLUSTERS=$(kubectl --namespace="${NAMESPACE}" get postgrescluster --output name | wc -l)
11+
if [[ "$NUM_CLUSTERS" != 0 ]]; then
12+
CURRENT_OWNERS=$(kubectl --namespace="${NAMESPACE}" get secret \
13+
pgo-root-cacert -o jsonpath='{.metadata.ownerReferences[*].name}')
14+
if [[ "$CURRENT_OWNERS" == *"owner1"* ]]; then
15+
exit 1
16+
fi
17+
if [[ "$CURRENT_OWNERS" == *"owner2"* ]]; then
18+
exit 1
19+
fi
20+
else
21+
ROOT_SECRET=$(kubectl --namespace="${NAMESPACE}" get --ignore-not-found \
22+
secret pgo-root-cacert --output name | wc -l)
23+
if [[ "$ROOT_SECRET" != 0 ]]; then
24+
exit 1
25+
fi
26+
fi

‎testing/kuttl/e2e/root-cert-ownership/README.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
### Root Certificate Ownership Test
2+
3+
This Kuttl routine runs through the following steps:
4+
5+
#### Create two clusters and verify the root certificate secret ownership
6+
7+
- 00: Creates the two clusters and verifies they and the root cert secret exist
8+
- 01: Check that the secret shows both clusters as owners
9+
10+
#### Delete the first cluster and verify the root certificate secret ownership
11+
12+
- 02: Delete the first cluster, assert that the second cluster and the root cert
13+
secret are still present and that the first cluster is not present
14+
- 03: Check that the secret shows the second cluster as an owner but does not show
15+
the first cluster as an owner
16+
17+
#### Delete the second cluster and verify the root certificate secret ownership
18+
19+
- 04: Delete the second cluster, assert that both clusters are not present
20+
- 05: Check the number of clusters in the namespace. If there are any remaining
21+
clusters, ensure that the secret shows neither the first nor second cluster as an
22+
owner. If there are no clusters remaining in the namespace, ensure the root cert
23+
secret has been deleted.

0 commit comments

Comments
 (0)