Add TestRouterCerts e2e

glide.yaml

@@ -21,6 +21,10 @@ import:
 - package: k8s.io/code-generator
   version: kubernetes-1.14.0
 
+  # pinned to a level that kubernetes uses.
+- package: github.com/evanphx/json-patch
+  version: 5858425f75500d40c52783dce87d085a483ce135
+
 - package: github.com/openshift/api
   version: master
 - package: github.com/openshift/client-go
@@ -38,3 +42,7 @@ import:
 - package: k8s.io/gengo/args
   version: 01a732e01d00cb9a81bb0ca050d3e6d2b947927b
 - package: golang.org/x/tools/imports
+
+# testing
+- package: github.com/stretchr/testify
+  version: ~1.3.0

test/e2e/certs_test.go

@@ -0,0 +1,44 @@
+package e2e
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+
+	"github.com/openshift/client-go/config/clientset/versioned"
+
+	e2e "github.com/openshift/cluster-authentication-operator/test/library"
+)
+
+func TestRouterCerts(t *testing.T) {
+	kubeConfig, err := e2e.NewClientConfigForTest()
+	require.NoError(t, err)
+	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
+	require.NoError(t, err)
+	configClient, err := versioned.NewForConfig(kubeConfig)
+	require.NoError(t, err)
+	// machine managed router-certs secret should exist
+	machineManagedRouterCerts, err := kubeClient.CoreV1().Secrets("openshift-config-managed").Get("router-certs", metav1.GetOptions{})
+	require.NoError(t, err)
+	// operator managed router-certs secret should exist
+	operatorManagedRouterCerts, err := kubeClient.CoreV1().Secrets("openshift-authentication").Get("v4-0-config-system-router-certs", metav1.GetOptions{})
+	require.NoError(t, err)
+	// operator managed router-certs data should be a copy of machine managed router-certs
+	require.Equal(t, operatorManagedRouterCerts.Data, machineManagedRouterCerts.Data)
+	// there should be an entry for the ingress domain
+	ingress, err := configClient.ConfigV1().Ingresses().Get("cluster", metav1.GetOptions{})
+	require.NoError(t, err)
+	require.Contains(t, operatorManagedRouterCerts.Data, ingress.Spec.Domain)
+	// the entry should contain certificates that validate the oauth service hostname
+	block, _ := pem.Decode(operatorManagedRouterCerts.Data[ingress.Spec.Domain])
+	cert, err := x509.ParseCertificate(block.Bytes)
+	require.NoError(t, err)
+	err = cert.VerifyHostname("oauth-openshift." + ingress.Spec.Domain)
+	assert.NoError(t, err)
+}

test/e2e/operator_test.go

@@ -0,0 +1,21 @@
+package e2e
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+
+	test "github.com/openshift/cluster-authentication-operator/test/library"
+)
+
+func TestOperatorNamespace(t *testing.T) {
+	kubeConfig, err := test.NewClientConfigForTest()
+	require.NoError(t, err)
+	kubeClient, err := kubernetes.NewForConfig(kubeConfig)
+	require.NoError(t, err)
+	_, err = kubeClient.CoreV1().Namespaces().Get("openshift-authentication-operator", metav1.GetOptions{})
+	require.NoError(t, err)
+}

test/library/client.go

@@ -0,0 +1,20 @@
+package library
+
+import (
+	"fmt"
+
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/tools/clientcmd/api"
+)
+
+// NewClientConfigForTest returns a config configured to connect to the api server
+func NewClientConfigForTest() (*rest.Config, error) {
+	loader := clientcmd.NewDefaultClientConfigLoadingRules()
+	clientConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loader, &clientcmd.ConfigOverrides{ClusterInfo: api.Cluster{InsecureSkipTLSVerify: true}})
+	config, err := clientConfig.ClientConfig()
+	if err == nil {
+		fmt.Printf("Found configuration for host %v.\n", config.Host)
+	}
+	return config, err
+}