djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,740 Commits 30 Branches 34 Tags 22 MiB
9968d501f4
Commit Graph

464 Commits

Author SHA1 Message Date
Ryan Richard
9968d501f4 Merge branch 'main' into initial_ldap 2021-04-05 15:15:05 -07:00
Ryan Richard
9450048acf Fix lint error from previous commit 2021-04-05 15:14:24 -07:00
Ryan Richard
702f9965ab Deploy an OpenLDAP server for integration tests 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-04-05 15:05:53 -07:00
Andrew Keesler
c53507809d Rename dex namespace, add new ytt value to deploy/tools, and remove Tilt 
- Rename the test/deploy/dex directory to test/deploy/tools
- Rename the dex namespace to tools
- Add a new ytt value called `pinny_ldap_password` for the tools
  ytt templates
- This new value is not used on main at this time. We intend to use
  it in the forthcoming ldap branch. We're defining it on main so
  that the CI scripts can use it across all branches and PRs.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-04-05 15:01:49 -07:00
Matt Moyer
d4baeff94e
Merge pull request #534 from mattmoyer/deflake-categories-test-rate-limiting 
Deflake TestGetPinnipedCategory.
 2021-03-30 13:46:55 -07:00
Matt Moyer
4ebd0f5f12
Deflake TestImpersonationProxy (especially on EKS). 
This test could flake if the load balancer hostname was provisioned but is not yet resolving in DNS from the test process.

The fix is to retry this step for up to 5 minutes.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-30 13:48:53 -05:00
Matt Moyer
f02b39b80f
Deflake TestGetPinnipedCategory. 
This test could fail when the cluster was under heavy load. This could cause kubectl to emit "Throttling request took [...]" logs that triggered a failure in the test.

The fix is to ignore these innocuous warnings.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-30 13:38:33 -05:00
Margo Crawford
d8baa43903 Add new non-idle timeout integration test for impersonation proxy 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-03-29 09:30:51 -07:00
Matt Moyer
391202c253
Merge pull request #517 from mattmoyer/deflake-supervisor-oidc-discovery-test 
Tweak some assertions in TestSupervisorOIDCDiscovery.
 2021-03-29 07:35:58 -07:00
Ryan Richard
95bb4c4be5 Fix concierge_impersonation_proxy_test.go on AKS 
Also send the correct instance of `t` into a helper function which
makes assertions.
 2021-03-26 19:32:46 -07:00
Matt Moyer
defad3cdd7
Remove library.DumpLogs test helper. 
We had this code that printed out pod logs when certain tests failed, but it is a bit cumbersome. We're removing it because we added a CI task that exports all pod logs after every CI run, which accomplishes the same thing and provides us a bunch more data.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-26 16:43:02 -05:00
Matt Moyer
c6d7724b67
In TestImpersonationProxy, instead of failing in this case just skip the test. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-26 16:28:33 -05:00
Ryan Richard
3359311228 concierge_impersonation_proxy_test.go: fix typo in previous commit 2021-03-26 09:49:49 -07:00
Ryan Richard
7e16619146 concierge_impersonation_proxy_test.go: handle TKGS test clusters 
Handle any test cluster which supports load balancers but should
not automatically start the impersonator, e.g. TKGS clusters.
 2021-03-26 09:28:42 -07:00
Ryan Richard
a084544f08 Add hasExternalLoadBalancerProvider to AKS/EKS capabilities files 2021-03-26 08:03:51 -07:00
Margo Crawford
b6e217e13a Hardcode type "webhook" in concierge_impersonation_proxy_test.go 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-03-25 17:19:47 -07:00
Margo Crawford
6f2882b831 Explicitly set the correct authenticator for impersonator test 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-03-25 16:57:37 -07:00
Margo Crawford
cd6e48bfa8 Use a random password for the dex integration test user 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2021-03-25 15:12:17 -07:00
Margo Crawford
6bf8bfe9a8 Merge remote-tracking branch 'origin/main' into impersonation-proxy 2021-03-24 17:22:40 -07:00
Matt Moyer
cda8bd6e26
Allow running CLI-related integration tests with pre-built binary. 
This allows setting `$PINNIPED_TEST_CLI` to point at an existing `pinniped` CLI binary instead of having the test build one on-the-fly. This is more efficient when you're running the tests across many clusters as we do in CI.

Building the CLI from scratch in our CI environment takes 1.5-2 minutes, so this change should save nearly that much time on every test job.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-23 17:19:09 -05:00
Matt Moyer
c0d32f10b2
Add some test debug logging when running the CLI. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-23 12:07:34 -05:00
Matt Moyer
ce5b05f912
Add some debug logging to measure how long the CLI build takes. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-23 12:06:35 -05:00
Matt Moyer
176fb6a139
Authenticators are no longer namespaced, so clean up these test logs. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-23 10:33:05 -05:00
Matt Moyer
9501168265
Simplify TestCLIGetKubeconfigStaticToken now that there's only a single table case. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-23 10:26:04 -05:00
Margo Crawford
d90398815b Nothing in parallel in the impersonation proxy integration test 2021-03-22 10:48:09 -07:00
Margo Crawford
7683a98792 Unparallelize run all the verbs and port-forward tests 2021-03-22 09:45:51 -07:00
Margo Crawford
d7e9568137 Unparallelize a couple 2021-03-22 09:43:40 -07:00
Matt Moyer
5e95c25d4f
Tweak some assertions in TestSupervisorOIDCDiscovery. 
We've seen some test flakes caused by this test. Some small changes:

- Use a 30s timeout for each iteration of the test loop (so each iteration needs to check or fail more quickly).
- Log a bit more during the checks so we can diagnose what's going on.
- Increase the overall timeout from one minute to five minutes

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-22 11:33:02 -05:00
Ryan Richard
3e50b4e129 Add -sS to the curl command in concierge_impersonation_proxy_test.go 2021-03-19 13:23:28 -07:00
Ryan Richard
d856221f56 Edit some comments in concierge_impersonation_proxy_test.go 2021-03-19 13:19:17 -07:00
Andrew Keesler
2749044625
test/integration: unparallelize impersonation kubectl test 
Maybe this will cut down on flakes we see in CI?

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-19 13:31:28 -04:00
Andrew Keesler
f73c70d8f9
test/integration: use Ryan's 20x rule to harden simple access tests 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-19 13:18:10 -04:00
Andrew Keesler
ebd5e45fa6
test/integration: wait for convergence at end of impersonation test 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-19 12:54:37 -04:00
Andrew Keesler
6154883855
test/integration: add temporary debug 'kubectl attach' logging 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-19 10:42:11 -04:00
Andrew Keesler
ebe01a5aef
test/integration: catch early 'kubectl attach' return 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-19 09:59:24 -04:00
Andrew Keesler
1a9922d050
test/integration: poll more quickly in f2a48aee 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 17:53:14 -04:00
Andrew Keesler
f2a48aee2b
test/integration: increase timeout to a minute to see if it helps 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 17:48:00 -04:00
Andrew Keesler
14a28bec24
test/integration: fix second assertion from dae62929 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 16:34:30 -04:00
Andrew Keesler
dae62929e0
test/integration: error assertions pass w/ and w/o middleware 
In the case where we are using middleware (e.g., when the api group is
different) in our kubeclient, these error messages have a "...middleware request
for..." bit in the middle.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 15:35:31 -04:00
Ryan Richard
bd8c243636 concierge_impersonation_proxy_test.go: small refactor 2021-03-18 10:46:27 -07:00
Monis Khan
120e46b5f7
test/integration: fix race condition 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 11:27:52 -04:00
Andrew Keesler
257d69045d
Reuse internal/concierge/scheme 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 10:40:59 -04:00
Andrew Keesler
05a188d4cd
Merge remote-tracking branch 'upstream/main' into impersonation-proxy 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 10:36:28 -04:00
Andrew Keesler
cc8f0b623c
test/integration: add pinniped whoami tests 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2021-03-18 08:56:35 -04:00
Matt Moyer
74df6d138b
Memoize library.IntegrationEnv so it's only constructed once per test. 
This is probably a good idea regardless, but it also avoids an infinite recursion from IntegrationEnv() -> assertNoRestartsDuringTest() -> NewKubeclient() -> IntegrationEnv() -> ...

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-17 13:37:48 -05:00
Matt Moyer
0dd2b358fb
Extend assertNoRestartsDuringTest to dump logs from containers that restarted. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-17 13:37:47 -05:00
Matt Moyer
6520c5a3a1
Extend library.DumpLogs() to dump logs from the previous container, if one exists. 
This is important in case the container has crashed and has been restarted.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-17 11:46:40 -05:00
Matt Moyer
5a43a5d53a
Remove library.AssertNoRestartsDuringTest and make that assertion implicit in library.IntegrationEnv. 
This means we (hopefully) can't forget to include these assertions in any integration test.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2021-03-17 11:18:10 -05:00
Margo Crawford
897340860b Small refactor to impersonation proxy integration test 2021-03-16 16:57:46 -07:00
Matt Moyer
4d2035ab2a
Merge branch 'main' of github.com:vmware-tanzu/pinniped into impersonation-proxy 2021-03-16 18:19:40 -05:00