Add volumes and env vars to helm hook test pod #673

Iristyle · 2022-01-07T22:27:28Z

Fix test typo
Add basic server-test Pod tests
- This covers all existing functionality that matches what's
  present in server-statefulset.bats
Fix server-test helm hook Pod rendering
- Properly adhere to the global.enabled flag and the presence of
  the injector.externalVaultAddr setting, the same way that
  the servers StatefulSet behaves
Uses the same extraEnvironmentVars, volumes and volumeMounts set on
the server statefulset to configure the Vault server test pod used by
the helm test hook
This is necessary in situations where TLS is configured, but the
certificates are not affiliated with the k8s CA / part of k8s PKI
Fixes Test Helm Hook Pod should be more configurable #665

hashicorp-cla · 2022-01-07T22:27:31Z

All committers have signed the CLA.

Iristyle · 2022-01-11T18:18:50Z

templates/tests/server-test.yaml

@@ -35,6 +37,9 @@ spec:
          fi

          exit 0
-
+      volumeMounts:
+        {{ template "vault.mounts" . }}


This drags in the audit and data volumes which doesn't make sense... shooting for something simpler

Iristyle · 2022-01-11T20:43:45Z

I've verified this fixes the TLS issues in the test chart. Logs now look like:

Checking for sealed info in 'vault status' output                                                                                 
Attempt 0...                                                                                                                      
Error checking seal status: Get "https://cd4pe-vault.default.svc:8200/v1/sys/seal-status": dial tcp 10.106.187.188:8200: connect: 
Attempt 1...                                                                                                                      
Error checking seal status: Get "https://cd4pe-vault.default.svc:8200/v1/sys/seal-status": dial tcp 10.106.187.188:8200: connect: 
Attempt 2...                                                                                                                      
Error checking seal status: Get "https://cd4pe-vault.default.svc:8200/v1/sys/seal-status": dial tcp 10.106.187.188:8200: connect: 
Attempt 3...                                                                                                                      
Error checking seal status: Get "https://cd4pe-vault.default.svc:8200/v1/sys/seal-status": dial tcp 10.106.187.188:8200: connect: 
Attempt 4...                                                                                                                      
sealed: true

tvoran

Would you mind adding unit tests for these options? I think it's probably time we added a test/unit/server-test.bats. Should be able to use server-statefulset.bats for examples of testing extraEnvironmentVars, volumeMounts, and volumes.

tvoran · 2022-01-12T00:44:12Z

test/unit/server-statefulset.bats

@@ -537,7 +537,7 @@ load _helpers
  cd `chart_dir`
  local object=$(helm template \
      --show-only templates/server-statefulset.yaml  \
-      --set 'server.stanadlone.enabled=true' \
+      --set 'server.standalone.enabled=true' \


Nice catch!

tvoran · 2022-01-12T02:56:02Z

templates/tests/server-test.yaml

+      volumeMounts:
+        {{- if .Values.server.volumeMounts }}
+          {{- toYaml .Values.server.volumeMounts | nindent 12}}
+        {{- end }}
+  volumes:
+    {{- if .Values.server.volumes }}
+      {{- toYaml .Values.server.volumes | nindent 8}}
+    {{- end }}


I think the indents can be four less (8 and 4) since it's in a Pod instead of a Deployment template.

Suggested change

volumeMounts:

{{- if .Values.server.volumeMounts }}

{{- toYaml .Values.server.volumeMounts | nindent 12}}

{{- end }}

volumes:

{{- if .Values.server.volumes }}

{{- toYaml .Values.server.volumes | nindent 8}}

{{- end }}

volumeMounts:

{{- if .Values.server.volumeMounts }}

{{- toYaml .Values.server.volumeMounts | nindent 8}}

{{- end }}

volumes:

{{- if .Values.server.volumes }}

{{- toYaml .Values.server.volumes | nindent 4}}

{{- end }}

I can re-render and check... but I also did verify that the current indentation works in a live deployment to map the volumes in question.

You were right on the indentation rendering wrong -- verified with

helm template --show-only templates/tests/server-test.yaml --set 'server.volumes[0].name=plugins' --set 'server.volumes[0].emptyDir={}' --set 'server.volumeMounts[0].name=plugins' --set 'server.volumeMounts[0].mountPath=/usr/local/libexec/vault' --set 'server.volumeMounts[0].readOnly=true' .

Iristyle · 2022-01-14T00:13:35Z

Follow-on PR at #678 brings some more feature parity to the test pod

tvoran

Thanks for adding all the tests. Just one more suggestion and I think we'll be good to go.

test/unit/server-test.bats

- This covers all existing functionality that matches what's present in server-statefulset.bats

- Properly adhere to the global.enabled flag and the presence of the injector.externalVaultAddr setting, the same way that the servers StatefulSet behaves

- Uses the same extraEnvironmentVars, volumes and volumeMounts set on the server statefulset to configure the Vault server test pod used by the helm test hook - This is necessary in situations where TLS is configured, but the certificates are not affiliated with the k8s CA / part of k8s PKI - Fixes hashicorpGH-665

Iristyle force-pushed the gh-665-make-vault-test-pod-configurable branch from 7a7af2f to ab6813f Compare January 7, 2022 22:39

Fix test typo

eb5b7d8

Iristyle force-pushed the gh-665-make-vault-test-pod-configurable branch 9 times, most recently from 6512fc5 to bde931c Compare January 11, 2022 00:38

Iristyle marked this pull request as ready for review January 11, 2022 00:51

Iristyle marked this pull request as draft January 11, 2022 00:51

Iristyle commented Jan 11, 2022

View reviewed changes

Iristyle force-pushed the gh-665-make-vault-test-pod-configurable branch from bde931c to e45c3db Compare January 11, 2022 18:22

Iristyle marked this pull request as ready for review January 11, 2022 20:43

tvoran added enhancement New feature or request vault-server Area: operation and usage of vault server in k8s labels Jan 11, 2022

tvoran reviewed Jan 12, 2022

View reviewed changes

Iristyle force-pushed the gh-665-make-vault-test-pod-configurable branch 2 times, most recently from fa5f4a4 to d1c9508 Compare January 13, 2022 23:30

Iristyle mentioned this pull request Jan 13, 2022

Adds missing Helm hook test pod features #678

Open

tvoran reviewed Jan 19, 2022

View reviewed changes

test/unit/server-test.bats Show resolved Hide resolved

Add basic server-test Pod tests

e2b840c

- This covers all existing functionality that matches what's present in server-statefulset.bats

Iristyle force-pushed the gh-665-make-vault-test-pod-configurable branch from d1c9508 to 694f2da Compare January 19, 2022 17:14

Iristyle added 2 commits January 19, 2022 09:20

Fix server-test helm hook Pod rendering

00d7022

- Properly adhere to the global.enabled flag and the presence of the injector.externalVaultAddr setting, the same way that the servers StatefulSet behaves

Iristyle deleted the gh-665-make-vault-test-pod-configurable branch January 20, 2022 20:15

tongpu mentioned this pull request Feb 21, 2022

chore(security-apps): update vault to v0.19 adfinis/helm-charts#574

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add volumes and env vars to helm hook test pod #673

Add volumes and env vars to helm hook test pod #673

Iristyle commented Jan 7, 2022 •

edited

hashicorp-cla commented Jan 7, 2022 •

edited

Iristyle Jan 11, 2022

Iristyle commented Jan 11, 2022

tvoran left a comment

tvoran Jan 12, 2022

tvoran Jan 12, 2022

Iristyle Jan 12, 2022

Iristyle Jan 13, 2022

Iristyle commented Jan 14, 2022

tvoran left a comment

Add volumes and env vars to helm hook test pod #673

Add volumes and env vars to helm hook test pod #673

Conversation

Iristyle commented Jan 7, 2022 • edited

hashicorp-cla commented Jan 7, 2022 • edited

Iristyle Jan 11, 2022

Choose a reason for hiding this comment

Iristyle commented Jan 11, 2022

tvoran left a comment

Choose a reason for hiding this comment

tvoran Jan 12, 2022

Choose a reason for hiding this comment

tvoran Jan 12, 2022

Choose a reason for hiding this comment

Iristyle Jan 12, 2022

Choose a reason for hiding this comment

Iristyle Jan 13, 2022

Choose a reason for hiding this comment

Iristyle commented Jan 14, 2022

tvoran left a comment

Choose a reason for hiding this comment

Iristyle commented Jan 7, 2022 •

edited

hashicorp-cla commented Jan 7, 2022 •

edited