48eebb0b09
Ports the bats unit, chart-verifier, and bats acceptance tests to use github workflows and actions. The acceptance tests run using kind, and run for multiple k8s versions, on pushes to the main branch. Adds a SKIP_CSI env check in the CSI acceptance test, set in the workflow if K8s version is less than 1.16. Adds kubeAdmConfigPatches to the kind config to allow testing the CSI provider on K8s versions prior to 1.21. Updates the Secrets Store CSI driver to 1.0.0 in tests. Makes the HA Vault tests more robust by waiting for all consul client pods to be Ready, and waits with a timeout for Vault to start responding as sealed (since the tests on GitHub runners were often failing at that point). Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
109 lines
3.4 KiB
Bash
109 lines
3.4 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load _helpers
|
|
|
|
@test "server/standalone: testing deployment" {
|
|
cd `chart_dir`
|
|
|
|
kubectl delete namespace acceptance --ignore-not-found=true
|
|
kubectl create namespace acceptance
|
|
kubectl config set-context --current --namespace=acceptance
|
|
|
|
helm install "$(name_prefix)" .
|
|
wait_for_running $(name_prefix)-0
|
|
|
|
# Sealed, not initialized
|
|
wait_for_sealed_vault $(name_prefix)-0
|
|
|
|
local init_status=$(kubectl exec "$(name_prefix)-0" -- vault status -format=json |
|
|
jq -r '.initialized')
|
|
[ "${init_status}" == "false" ]
|
|
|
|
# Replicas
|
|
local replicas=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.replicas')
|
|
[ "${replicas}" == "1" ]
|
|
|
|
# Affinity
|
|
local affinity=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.template.spec.affinity')
|
|
[ "${affinity}" != "null" ]
|
|
|
|
# Volume Mounts
|
|
local volumeCount=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.template.spec.containers[0].volumeMounts | length')
|
|
[ "${volumeCount}" == "3" ]
|
|
|
|
local mountName=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.template.spec.containers[0].volumeMounts[0].name')
|
|
[ "${mountName}" == "data" ]
|
|
|
|
local mountPath=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.template.spec.containers[0].volumeMounts[0].mountPath')
|
|
[ "${mountPath}" == "/vault/data" ]
|
|
|
|
# Volumes
|
|
local volumeCount=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.template.spec.volumes | length')
|
|
[ "${volumeCount}" == "2" ]
|
|
|
|
local volume=$(kubectl get statefulset "$(name_prefix)" --output json |
|
|
jq -r '.spec.template.spec.volumes[0].configMap.name')
|
|
[ "${volume}" == "$(name_prefix)-config" ]
|
|
|
|
# Service
|
|
local service=$(kubectl get service "$(name_prefix)" --output json |
|
|
jq -r '.spec.clusterIP')
|
|
[ "${service}" != "None" ]
|
|
|
|
local service=$(kubectl get service "$(name_prefix)" --output json |
|
|
jq -r '.spec.type')
|
|
[ "${service}" == "ClusterIP" ]
|
|
|
|
local ports=$(kubectl get service "$(name_prefix)" --output json |
|
|
jq -r '.spec.ports | length')
|
|
[ "${ports}" == "2" ]
|
|
|
|
local ports=$(kubectl get service "$(name_prefix)" --output json |
|
|
jq -r '.spec.ports[0].port')
|
|
[ "${ports}" == "8200" ]
|
|
|
|
local ports=$(kubectl get service "$(name_prefix)" --output json |
|
|
jq -r '.spec.ports[1].port')
|
|
[ "${ports}" == "8201" ]
|
|
|
|
# Vault Init
|
|
local token=$(kubectl exec -ti "$(name_prefix)-0" -- \
|
|
vault operator init -format=json -n 1 -t 1 | \
|
|
jq -r '.unseal_keys_b64[0]')
|
|
[ "${token}" != "" ]
|
|
|
|
# Vault Unseal
|
|
local pods=($(kubectl get pods --selector='app.kubernetes.io/name=vault' -o json | jq -r '.items[].metadata.name'))
|
|
for pod in "${pods[@]}"
|
|
do
|
|
kubectl exec -ti ${pod} -- vault operator unseal ${token}
|
|
done
|
|
|
|
wait_for_ready "$(name_prefix)-0"
|
|
|
|
# Unsealed, initialized
|
|
local sealed_status=$(kubectl exec "$(name_prefix)-0" -- vault status -format=json |
|
|
jq -r '.sealed' )
|
|
[ "${sealed_status}" == "false" ]
|
|
|
|
local init_status=$(kubectl exec "$(name_prefix)-0" -- vault status -format=json |
|
|
jq -r '.initialized')
|
|
[ "${init_status}" == "true" ]
|
|
}
|
|
|
|
# Clean up
|
|
teardown() {
|
|
if [[ ${CLEANUP:-true} == "true" ]]
|
|
then
|
|
echo "helm/pvc teardown"
|
|
helm delete vault
|
|
kubectl delete --all pvc
|
|
kubectl delete namespace acceptance --ignore-not-found=true
|
|
fi
|
|
}
|