add kubeadmin login test #21733

sallyom · 2019-01-06T19:25:19Z

@enj @smarterclayton test for kubeadmin login.

this test generates and applies a new kubeadmin secret to test login, then restores to original if it existed, or deletes it if it did not.

sallyom · 2019-01-08T15:48:43Z

test/extended/bootstrap_user/bootstrap_user_login.go

+)
+
+var _ = g.Describe("[Conformance] The bootstrap user", func() {
+	defer g.GinkgoRecover()


@smarterclayton It's unclear to me what the exact label for this should be. Conformance ok?

Depends on what this is supposed to test. You can't couple an extended test to the installer artifacts (e2e tests have to run against anyone's cluster). Mo owns testing that we can set / update a bootstrap user on a cluster, so at that point you're more about establishing that a newly created cluster has a bootstrap user. However, not all users are going to run extended against a cluster with a bootstrap user, so we'd have to make the test conditional on that behavior.

A test that verifies the installer itself creates a bootstrap user would belong to the installer and be in that repo.

A test that verifies that a conformant openshift cluster can have a bootstrap user and exercises the secret creation paths and verifies oauth logins work would be here, but would not be part of the conformance suite (this is what I alluded to mo owning)

I think you're trying to build more of the former rather than the latter - since you're trying to verify that the installer correctly sets up the password AND that the password is useful, so this really belongs in the installer test suite.

We also want to confirm that what has to happen via authentication/osin/oauthconfig for token-generation is not broken.
We could go back to my original plan of checking that both are kosher in the cluster-launch-installer-* templates, by logging in/switching back to system:admin context.

verify that the installer correctly sets up the password AND that the password is useful

the installer already 'tests' that the password is created, by spitting it out at the end (and errors if not read, in cmd/openshift-install/create.go).

to test that it's useful, have to go through oauthserver. I still don't see how that test belongs in the installer. It requires an unsupportedConfigOverrides oauthConfig section in kubeAPIServerOperatorConfig patched, etc. Only way to test that that completed is to run oc login with kubeadmin
.

this really belongs in the installer test suite.

AFAIK there isn't an installer test suite atm? There was a smoke tests suite but it's not currently run/they're outdated/tectonic references still. I can look at updating those, but that might take awhile, and the auth team needs assurance now that upcoming changes don't break kube:admin.

A test that verifies that a conformant openshift cluster can have a bootstrap user and exercises the secret creation paths and verifies oauth logins work would be here

Yes, this! So I need to make this extended test conditional on clusters that have the bootstrap kubeadmin password (ie, any cluster created with openshift/installer)? Or, easiest way (for now) is to put this check in the cluster-launch-installer-* CI templates, for all jobs running against a cluster launched w/ openshift/installer like so: openshift/release#2440

@enj mentioned I can create or apply new data to the kubeadmin secret in the extended test that conforms to the pw requirements, then check for kubeadmin user login, since every 4.0 cluster has the ability to create kubeadmin user, I'll go with that.

sallyom · 2019-01-15T16:58:55Z

/retest

enj · 2019-01-15T21:21:40Z

test/extended/bootstrap_user/bootstrap_user_login.go

+})
+
+func generatePassword() (string, []byte, error) {
+	password := uuid.NewRandom().String()


Use Random256BitsString. UUIDs are not valid sources of random data.

enj · 2019-01-15T21:23:56Z

test/extended/bootstrap_user/bootstrap_user_login.go

+		kubeadminSecret := generateSecret(passwordHash)
+		_, _, err = resourceapply.ApplySecret(oc.AsAdmin().KubeClient().CoreV1(), recorder, kubeadminSecret)
+		o.Expect(err).NotTo(o.HaveOccurred())
+		e2e.Logf("logging in as kubeadmin user with password: %s", password)


do not log password

enj · 2019-01-16T00:45:09Z

/lgtm

openshift-ci-robot · 2019-01-16T00:46:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enj, sallyom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~test/extended/OWNERS~~ [enj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2019-01-16T09:50:51Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2019-01-16T15:53:51Z

/retest

Please review the full test history for this PR and help us cut down flakes.

sallyom · 2019-01-16T19:49:14Z

/test e2e-aws-serial

openshift-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 6, 2019

openshift-ci-robot requested review from dcbw and mfojtik January 6, 2019 19:30

sallyom mentioned this pull request Jan 6, 2019

use oc config set/use-context with kubeadmin login check in cluster-launch-installer templates openshift/release#2440

Closed

sallyom force-pushed the add-smoke-4-test branch from 1a0c6c7 to 34fe7a3 Compare January 8, 2019 15:47

sallyom commented Jan 8, 2019

View reviewed changes

sallyom force-pushed the add-smoke-4-test branch 2 times, most recently from 567f5bd to 41f4a5b Compare January 11, 2019 22:45

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 11, 2019

sallyom force-pushed the add-smoke-4-test branch from 41f4a5b to bf1f453 Compare January 11, 2019 23:38

openshift-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 11, 2019

sallyom force-pushed the add-smoke-4-test branch 3 times, most recently from 59b0858 to 1f6b704 Compare January 15, 2019 16:05

sallyom force-pushed the add-smoke-4-test branch 2 times, most recently from fb75c29 to 9fce793 Compare January 15, 2019 20:33

enj mentioned this pull request Jan 15, 2019

rename cluster-osin-operator/cluster-authentication-operator openshift/cluster-authentication-operator#17

Closed

enj suggested changes Jan 15, 2019

View reviewed changes

add kubeadmin login test

220d906

sallyom force-pushed the add-smoke-4-test branch from 9fce793 to 220d906 Compare January 16, 2019 00:30

openshift-ci-robot assigned enj Jan 16, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 16, 2019

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 16, 2019

openshift deleted a comment from openshift-bot Jan 16, 2019

openshift-merge-robot merged commit 5c90b23 into openshift:master Jan 16, 2019

wking mentioned this pull request Jan 18, 2019

Can't login to console using generated kubeadmin password openshift/installer#839

Closed

wking mentioned this pull request Apr 5, 2019

cmd/openshift-install/create: Drop addRouterCAToClusterCA openshift/installer#1541

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add kubeadmin login test #21733

add kubeadmin login test #21733

sallyom commented Jan 6, 2019 •

edited

Loading

sallyom Jan 8, 2019

smarterclayton Jan 10, 2019

sallyom Jan 10, 2019

sallyom Jan 11, 2019

sallyom Jan 11, 2019 •

edited

Loading

sallyom commented Jan 15, 2019

enj Jan 15, 2019

sallyom Jan 16, 2019

enj Jan 15, 2019

sallyom Jan 16, 2019

enj commented Jan 16, 2019

openshift-ci-robot commented Jan 16, 2019

openshift-bot commented Jan 16, 2019

openshift-bot commented Jan 16, 2019

sallyom commented Jan 16, 2019

add kubeadmin login test #21733

add kubeadmin login test #21733

Conversation

sallyom commented Jan 6, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sallyom Jan 11, 2019 • edited Loading

Choose a reason for hiding this comment

sallyom commented Jan 15, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

enj commented Jan 16, 2019

openshift-ci-robot commented Jan 16, 2019

openshift-bot commented Jan 16, 2019

openshift-bot commented Jan 16, 2019

sallyom commented Jan 16, 2019

sallyom commented Jan 6, 2019 •

edited

Loading

sallyom Jan 11, 2019 •

edited

Loading