mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-05-07 16:55:15 -04:00
Simplify joinproto
This commit is contained in:
katexochen
Paul Meyer
parent
dc9e8e75df
commit
15adba9235
14 changed files with 606 additions and 1180 deletions
|
|
@ -12,7 +12,7 @@ import (
|
|||
"github.com/edgelesssys/constellation/internal/constants"
|
||||
"github.com/edgelesssys/constellation/internal/file"
|
||||
"github.com/edgelesssys/constellation/internal/logger"
|
||||
activationproto "github.com/edgelesssys/constellation/joinservice/joinproto"
|
||||
"github.com/edgelesssys/constellation/joinservice/joinproto"
|
||||
"github.com/spf13/afero"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
|
@ -24,7 +24,7 @@ func TestMain(m *testing.M) {
|
|||
goleak.VerifyTestMain(m)
|
||||
}
|
||||
|
||||
func TestActivateNode(t *testing.T) {
|
||||
func TestIssueJoinTicket(t *testing.T) {
|
||||
someErr := errors.New("error")
|
||||
testKey := []byte{0x1, 0x2, 0x3}
|
||||
testCert := []byte{0x4, 0x5, 0x6}
|
||||
|
|
@ -39,93 +39,68 @@ func TestActivateNode(t *testing.T) {
|
|||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
kubeadm stubTokenGetter
|
||||
kms stubKeyGetter
|
||||
ca stubCA
|
||||
id []byte
|
||||
wantErr bool
|
||||
isControlPlane bool
|
||||
kubeadm stubTokenGetter
|
||||
kms stubKeyGetter
|
||||
ca stubCA
|
||||
id []byte
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
id: mustMarshalID(testID),
|
||||
"worker node": {
|
||||
kubeadm: stubTokenGetter{token: testJoinToken},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
id: mustMarshalID(testID),
|
||||
},
|
||||
"GetDataKey fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
getDataKeyErr: someErr,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
kubeadm: stubTokenGetter{token: testJoinToken},
|
||||
kms: stubKeyGetter{getDataKeyErr: someErr},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
"loading IDs fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
kubeadm: stubTokenGetter{token: testJoinToken},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
id: []byte{0x1, 0x2, 0x3},
|
||||
wantErr: true,
|
||||
},
|
||||
"no ID file": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
kubeadm: stubTokenGetter{token: testJoinToken},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
wantErr: true,
|
||||
},
|
||||
"GetJoinToken fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
getJoinTokenErr: someErr,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
kubeadm: stubTokenGetter{getJoinTokenErr: someErr},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
"GetCertificate fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
getCertErr: someErr,
|
||||
},
|
||||
kubeadm: stubTokenGetter{token: testJoinToken},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{getCertErr: someErr},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
"control plane": {
|
||||
isControlPlane: true,
|
||||
kubeadm: stubTokenGetter{token: testJoinToken, certificateKey: "test"},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
id: mustMarshalID(testID),
|
||||
},
|
||||
"GetControlPlaneCertificateKey fails": {
|
||||
isControlPlane: true,
|
||||
kubeadm: stubTokenGetter{token: testJoinToken, certificateKeyErr: someErr},
|
||||
kms: stubKeyGetter{dataKey: testKey},
|
||||
ca: stubCA{cert: testCert, key: testKey},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
|
|
@ -145,94 +120,12 @@ func TestActivateNode(t *testing.T) {
|
|||
tc.kms,
|
||||
)
|
||||
|
||||
resp, err := api.activateNode(context.Background(), "uuid", "test")
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
return
|
||||
req := &joinproto.IssueJoinTicketRequest{
|
||||
DiskUuid: "uuid",
|
||||
NodeName: "test",
|
||||
IsControlPlane: tc.isControlPlane,
|
||||
}
|
||||
|
||||
var expectedIDs attestationtypes.ID
|
||||
require.NoError(json.Unmarshal(tc.id, &expectedIDs))
|
||||
|
||||
require.NoError(err)
|
||||
assert.Equal(tc.kms.dataKey, resp.stateDiskKey)
|
||||
assert.Equal(expectedIDs.Cluster, resp.id.Cluster)
|
||||
assert.Equal(expectedIDs.Owner, resp.id.Owner)
|
||||
assert.Equal(tc.kubeadm.token.APIServerEndpoint, resp.kubeArgs.APIServerEndpoint)
|
||||
assert.Equal(tc.kubeadm.token.CACertHashes[0], resp.kubeArgs.CACertHashes[0])
|
||||
assert.Equal(tc.kubeadm.token.Token, resp.kubeArgs.Token)
|
||||
assert.Equal(tc.ca.cert, resp.kubeletCert)
|
||||
assert.Equal(tc.ca.key, resp.kubeletKey)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestActivateWorkerNode(t *testing.T) {
|
||||
testKey := []byte{0x1, 0x2, 0x3}
|
||||
testCert := []byte{0x4, 0x5, 0x6}
|
||||
testID := attestationtypes.ID{
|
||||
Owner: []byte{0x4, 0x5, 0x6},
|
||||
Cluster: []byte{0x7, 0x8, 0x9},
|
||||
}
|
||||
testJoinToken := &kubeadmv1.BootstrapTokenDiscovery{
|
||||
APIServerEndpoint: "192.0.2.1",
|
||||
CACertHashes: []string{"hash"},
|
||||
Token: "token",
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
kubeadm stubTokenGetter
|
||||
kms stubKeyGetter
|
||||
ca stubCA
|
||||
id []byte
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
id: mustMarshalID(testID),
|
||||
},
|
||||
"activateNode fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
getDataKeyErr: errors.New("error"),
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
require := require.New(t)
|
||||
|
||||
file := file.NewHandler(afero.NewMemMapFs())
|
||||
require.NoError(file.Write(filepath.Join(constants.ServiceBasePath, constants.IDFilename), tc.id, 0o644))
|
||||
|
||||
api := New(
|
||||
logger.NewTest(t),
|
||||
file,
|
||||
tc.ca,
|
||||
tc.kubeadm,
|
||||
tc.kms,
|
||||
)
|
||||
|
||||
resp, err := api.ActivateWorkerNode(context.Background(), &activationproto.ActivateWorkerNodeRequest{DiskUuid: "uuid", NodeName: "test"})
|
||||
resp, err := api.IssueJoinTicket(context.Background(), req)
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
return
|
||||
|
|
@ -250,112 +143,10 @@ func TestActivateWorkerNode(t *testing.T) {
|
|||
assert.Equal(tc.kubeadm.token.Token, resp.Token)
|
||||
assert.Equal(tc.ca.cert, resp.KubeletCert)
|
||||
assert.Equal(tc.ca.key, resp.KubeletKey)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestActivateControlPlaneNode(t *testing.T) {
|
||||
someErr := errors.New("error")
|
||||
testKey := []byte{0x1, 0x2, 0x3}
|
||||
testCert := []byte{0x4, 0x5, 0x6}
|
||||
testID := attestationtypes.ID{
|
||||
Owner: []byte{0x4, 0x5, 0x6},
|
||||
Cluster: []byte{0x7, 0x8, 0x9},
|
||||
}
|
||||
testJoinToken := &kubeadmv1.BootstrapTokenDiscovery{
|
||||
APIServerEndpoint: "192.0.2.1",
|
||||
CACertHashes: []string{"hash"},
|
||||
Token: "token",
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
kubeadm stubTokenGetter
|
||||
kms stubKeyGetter
|
||||
ca stubCA
|
||||
id []byte
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
certificateKey: "test",
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
id: mustMarshalID(testID),
|
||||
},
|
||||
"activateNode fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
certificateKey: "test",
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
getDataKeyErr: someErr,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
"GetControlPlaneCertificateKey fails": {
|
||||
kubeadm: stubTokenGetter{
|
||||
token: testJoinToken,
|
||||
certificateKeyErr: someErr,
|
||||
},
|
||||
kms: stubKeyGetter{
|
||||
dataKey: testKey,
|
||||
},
|
||||
ca: stubCA{
|
||||
cert: testCert,
|
||||
key: testKey,
|
||||
},
|
||||
id: mustMarshalID(testID),
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
require := require.New(t)
|
||||
|
||||
file := file.NewHandler(afero.NewMemMapFs())
|
||||
require.NoError(file.Write(filepath.Join(constants.ServiceBasePath, constants.IDFilename), tc.id, 0o644))
|
||||
|
||||
api := New(
|
||||
logger.NewTest(t),
|
||||
file,
|
||||
tc.ca,
|
||||
tc.kubeadm,
|
||||
tc.kms,
|
||||
)
|
||||
|
||||
resp, err := api.ActivateControlPlaneNode(context.Background(), &activationproto.ActivateControlPlaneNodeRequest{DiskUuid: "uuid", NodeName: "test"})
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
return
|
||||
if tc.isControlPlane {
|
||||
assert.Equal(tc.kubeadm.certificateKey, resp.CertificateKey)
|
||||
}
|
||||
|
||||
var expectedIDs attestationtypes.ID
|
||||
require.NoError(json.Unmarshal(tc.id, &expectedIDs))
|
||||
|
||||
require.NoError(err)
|
||||
assert.Equal(tc.kms.dataKey, resp.StateDiskKey)
|
||||
assert.Equal(expectedIDs.Cluster, resp.ClusterId)
|
||||
assert.Equal(expectedIDs.Owner, resp.OwnerId)
|
||||
assert.Equal(tc.kubeadm.token.APIServerEndpoint, resp.ApiServerEndpoint)
|
||||
assert.Equal(tc.kubeadm.token.CACertHashes[0], resp.DiscoveryTokenCaCertHash)
|
||||
assert.Equal(tc.kubeadm.token.Token, resp.Token)
|
||||
assert.Equal(tc.ca.cert, resp.KubeletCert)
|
||||
assert.Equal(tc.ca.key, resp.KubeletKey)
|
||||
assert.Equal(tc.kubeadm.certificateKey, resp.CertificateKey)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue