Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add appliance TLS tests to nightly (#1530)
- Loading branch information
1 parent
79e28a3
commit 9894cca
Showing
11 changed files
with
363 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,6 +9,7 @@ report.html | |
| output.xml | ||
| test-screenshots | ||
| bin | ||
| *.ova | ||
|
|
||
| # drone | ||
| secrets.yml | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| Test 6-01 - OVA TLS | ||
| ======= | ||
|
|
||
| # Purpose: | ||
| To verify the VIC OVA appliance works with various TLS certificate configuration | ||
|
|
||
| # References: | ||
|
|
||
| # Environment: | ||
| This test requires access to a vCenter environment | ||
|
|
||
| # Test Cases: | ||
|
|
||
| ### User Provided Certificate | ||
|
|
||
| #### Test Steps: | ||
|
|
||
| 1. Generate a certificate and certificate authority | ||
| 2. Supply generated certificate and certificate authority during deploy of VIC appliance | ||
| 3. Initialize the VIC appliance | ||
| 4. Wait for services to start and verify that the provided certificate is used by all services | ||
| running on the VIC appliance | ||
|
|
||
| #### Expected Outcome: | ||
| The VIC appliance deployment should succeed without error and the provided TLS certificate should be | ||
| used for all services running on the VIC appliance | ||
|
|
||
|
|
||
| ### User Provided Certificate PKCS8 | ||
|
|
||
| #### Test Steps: | ||
|
|
||
| 1. Generate a certificate with private key in PKCS8 format and certificate authority | ||
| 2. Supply generated certificate and certificate authority during deploy of VIC appliance | ||
| 3. Initialize the VIC appliance | ||
| 4. Wait for services to start and verify that the provided certificate is used by all services | ||
| running on the VIC appliance | ||
|
|
||
| #### Expected Outcome: | ||
| The VIC appliance deployment should succeed without error and the provided TLS certificate should be | ||
| used for all services running on the VIC appliance |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| # Copyright 2018 VMware, Inc. All Rights Reserved. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License | ||
|
|
||
| *** Settings *** | ||
| Documentation Test 6-01 - OVA TLS | ||
| Resource ../../resources/Util.robot | ||
| Suite Setup Wait Until Keyword Succeeds 10x 10m OVA Setup | ||
| Suite Teardown Run Keyword And Ignore Error Nimbus Cleanup ${list} | ||
| Test Teardown Cleanup VIC Product OVA %{OVA_NAME} | ||
|
|
||
| *** Variables *** | ||
| ${esx_number}= 3 | ||
| ${datacenter}= ha-datacenter | ||
|
|
||
| *** Keywords *** | ||
| OVA Setup | ||
| [Timeout] 110 minutes | ||
| Run Keyword And Ignore Error Nimbus Cleanup ${list} ${false} | ||
|
|
||
| ${latest-ova}= Download Latest VIC Appliance OVA | ||
| Set Environment Variable LATEST_OVA ${latest-ova} | ||
|
|
||
| ${esx1} ${esx2} ${esx3} ${vc} ${esx1-ip} ${esx2-ip} ${esx3-ip} ${vc-ip}= Create a Simple VC Cluster | ||
| Log To Console Finished Creating Cluster ${vc} | ||
| Set Suite Variable @{list} ${esx1} ${esx2} ${esx3} %{NIMBUS_USER}-${vc} | ||
|
|
||
| Set Environment Variable TEST_URL ${vc-ip} | ||
| Set Environment Variable TEST_USERNAME Administrator@vsphere.local | ||
| Set Environment Variable TEST_PASSWORD Admin\!23 | ||
| Set Environment Variable BRIDGE_NETWORK bridge | ||
| Set Environment Variable PUBLIC_NETWORK vm-network | ||
| Set Environment Variable TEST_RESOURCE /ha-datacenter/host/cls | ||
| Set Environment Variable TEST_TIMEOUT 30m | ||
| Set Environment Variable TEST_DATASTORE datastore1 | ||
|
|
||
| *** Test Cases *** | ||
| User Provided Certificate | ||
| Log To Console \nStarting user provided certificate test... | ||
| ${ova-name}= Get Test OVA Name | ||
| Set Environment Variable OVA_NAME ${ova-name} | ||
| Global Environment Setup | ||
|
|
||
| # Generate CA and wildcard cert for *.<DOMAIN> | ||
| Cleanup Generated Certificate | ||
| Log Generating certificates for %{DOMAIN} | ||
| Generate Certificate Authority | ||
| Generate Wildcard Server Certificate | ||
|
|
||
| ${tls_cert}= Get Server Certificate "*.%{DOMAIN}".cert.pem | ||
| ${tls_cert_key}= Get Server Key "*.%{DOMAIN}".key.pem | ||
| ${ca_cert}= Get Certificate Authority CRT | ||
|
|
||
| Log ${tls_cert} | ||
| Log ${tls_cert_key} | ||
| Log ${ca_cert} | ||
|
|
||
| ${ova-ip}= Install VIC Product OVA %{LATEST_OVA} %{OVA_NAME} ${tls_cert} ${tls_cert_key} ${ca_cert} | ||
|
|
||
| Wait Until Keyword Succeeds 10x 15s Verify VIC Appliance TLS Certificates ${ova-ip} issuer=/C=US/ST=California/L=Los Angeles/O=Stark Enterprises/OU=Stark Enterprises Certificate Authority/CN=Stark Enterprises Global CA | ||
| Cleanup Generated Certificate | ||
|
|
||
|
|
||
| User Provided Certificate PKCS8 | ||
| Log To Console \nStarting user provided certificate test... | ||
| ${ova-name}= Get Test OVA Name | ||
| Set Environment Variable OVA_NAME ${ova-name} | ||
| Global Environment Setup | ||
|
|
||
| # Generate CA and wildcard cert for *.<DOMAIN> | ||
| Cleanup Generated Certificate | ||
| Log Generating certificates for %{DOMAIN} | ||
| Generate Certificate Authority | ||
| Generate Wildcard Server Certificate | ||
|
|
||
| ${tls_cert}= Get Server Certificate "*.%{DOMAIN}".cert.pem | ||
| ${tls_cert_key}= Get Server Key "*.%{DOMAIN}".key.pem | ||
| ${ca_cert}= Get Certificate Authority CRT | ||
|
|
||
| Log ${tls_cert} | ||
| Log ${tls_cert_key} | ||
| Log ${ca_cert} | ||
|
|
||
| ${ova-ip}= Install VIC Product OVA %{LATEST_OVA} %{OVA_NAME} ${tls_cert} ${tls_cert_key} ${ca_cert} | ||
|
|
||
| Wait Until Keyword Succeeds 10x 15s Verify VIC Appliance TLS Certificates ${ova-ip} issuer=/C=US/ST=California/L=Los Angeles/O=Stark Enterprises/OU=Stark Enterprises Certificate Authority/CN=Stark Enterprises Global CA | ||
| Cleanup Generated Certificate |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| Group 6 - OVA TLS | ||
| ======= | ||
|
|
||
| [Test 6-01 - OVA TLS](6-01-OVA-TLS.md) | ||
| - |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| # Nightly Tests | ||
|
|
||
| ## Running Locally | ||
|
|
||
| Set `test_secrets.yml` values | ||
|
|
||
| ``` | ||
| NIMBUS_USER= | ||
| NIMBUS_PASSWORD= | ||
| NIMBUS_GW= | ||
| DRONE_BUILD_NUMBER=1 | ||
| DOMAIN=eng.vmware.com | ||
| ``` | ||
|
|
||
| Run desired test suite | ||
|
|
||
| ``` | ||
| docker run --rm -v /go/src/github.com/vmware/vic-product:/go --env-file test_secrets.yml gcr.io/eminent-nation-87317/vic-integration-test:1.46 pybot tests/manual-test-cases/Group6-OVA-TLS | ||
| ``` | ||
|
|
||
| If selenium grid is needed, start it and replace `${GRID_URL}` in `Util.robot` with your IP address | ||
|
|
||
| ``` | ||
| docker stop $(docker ps -a -q) && docker rm $(docker ps -a -q) && docker run -d -p 4444:4444 --net grid --name selenium-hub selenium/hub:3.9.1 && docker run -d --net grid -e HUB_HOST=selenium-hub -v /dev/shm:/dev/shm --name firefox1 selenium/node-firefox:3.9.1 | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| # Copyright 2017 VMware, Inc. All Rights Reserved. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License | ||
|
|
||
| *** Settings *** | ||
| Documentation This resource contains keywords related to creating and using certificates. Requires scripts in infra/integration-image/scripts be available in PATH | ||
| *** Keywords *** | ||
| Cleanup Generated Certificate | ||
| [Arguments] ${DIR}=/root/ca | ||
| Run rm -rf ${DIR} | ||
|
|
||
| Generate Certificate Authority | ||
| # Generates CA (private/ca.key.pem, certs/ca.cert.pem, certs/STARK_ENTERPRISES_ROOT_CA.crt) in OUT_DIR | ||
| [Arguments] ${CA_NAME}=STARK_ENTERPRISES_ROOT_CA ${OUT_DIR}=/root/ca | ||
| Log To Console Generating Certificate Authority | ||
| ${rc} ${out}= Run And Return Rc And Output generate-ca.sh -c ${CA_NAME} -d ${OUT_DIR} | ||
| Log ${out} | ||
| Should Be Equal As Integers ${rc} 0 | ||
|
|
||
|
|
||
| Generate Wildcard Server Certificate | ||
| # Generates key and signs with CA for *.DOMAIN (csr/*.DOMAIN.csr.pem, | ||
| # private/*.DOMAIN.key.pem, certs/*.DOMAIN.cert.pem) in OUT_DIR | ||
| [Arguments] ${DOMAIN}=%{DOMAIN} ${OUT_DIR}=/root/ca ${CA_NAME}=STARK_ENTERPRISES_ROOT_CA | ||
| Log To Console Generating Wildcard Server Certificate | ||
| Run Keyword Generate Server Key And CSR *.${DOMAIN} ${OUT_DIR} | ||
| Run Keyword Sign Server CSR ${CA_NAME} *.${DOMAIN} ${OUT_DIR} | ||
| Run Keyword Create Certificate Bundle CA_NAME=${CA_NAME} SRC_DIR=${OUT_DIR} CN=*.${DOMAIN} | ||
| ${out}= Run ls -al ${OUT_DIR}/csr | ||
| Log ${out} | ||
| ${out}= Run ls -al ${OUT_DIR}/private | ||
| Log ${out} | ||
| ${out}= Run ls -al ${OUT_DIR}/certs | ||
| Log ${out} | ||
|
|
||
|
|
||
| Generate Server Key And CSR | ||
| # Generates key and CSR (private/DOMAIN.key.pem, csr/DOMAIN.csr.pem) in OUT_DIR | ||
| [Arguments] ${CN}=%{DOMAIN} ${OUT_DIR}=/root/ca | ||
| Log To Console Generating Server Key And CSR | ||
| ${out}= Run generate-server-key-csr.sh -d ${OUT_DIR} -n ${CN} | ||
| Log ${out} | ||
|
|
||
|
|
||
| Sign Server CSR | ||
| # Generates certificate signed by CA (certs/DOMAIN.cert.pem) in OUT_DIR | ||
| [Arguments] ${CA_NAME}=STARK_ENTERPRISES_ROOT_CA ${CN}=%{DOMAIN} ${OUT_DIR}=/root/ca | ||
| Log To Console Signing Server CSR | ||
| ${out}= Run sign-csr.sh -c ${CA_NAME} -d ${OUT_DIR} -n ${CN} | ||
| Log ${out} | ||
|
|
||
|
|
||
| Trust Certificate Authority | ||
| # Installs root certificate into trust store on Debian based distro | ||
| [Arguments] ${CRT_FILE}=/root/ca/certs/STARK_ENTERPRISES_ROOT_CA.crt | ||
| Log To Console Installing CA | ||
| ${rc} ${out}= Run And Return Rc And Output ubuntu-install-ca.sh -f ${CRT_FILE} | ||
| Should Be Equal As Integers ${rc} 0 | ||
| Log ${out} | ||
|
|
||
|
|
||
| Reload Default Certificate Authorities | ||
| # Reloads default certificates into trust store on Debian based distro | ||
| # Removes all user provided CAs | ||
| Log To Console Reloading Default CAs | ||
| ${rc} ${out}= Run And Return Rc And Output ubuntu-reload-cas.sh | ||
| Should Be Equal As Integers ${rc} 0 | ||
| Log ${out} | ||
|
|
||
|
|
||
| Create Certificate Bundle | ||
| [Arguments] ${CA_NAME}=STARK_ENTERPRISES_ROOT_CA ${SRC_DIR}=/root/ca ${OUT_FILE}=/root/ca/cert-bundle.tgz ${CN}=%{DOMAIN} ${TMP_DIR}=/root/ca/bundle | ||
| ${rc} ${out}= Run And Return Rc And Output bundle-certs.sh -c ${CA_NAME} -d ${SRC_DIR} -f ${OUT_FILE} -n ${CN} -o ${TMP_DIR} | ||
| Should Be Equal As Integers ${rc} 0 | ||
| Log ${out} | ||
|
|
||
|
|
||
| Get Certificate Authority CRT | ||
| # Return ascii armored certificate from file e.g. `-----BEGIN CERTIFICATE-----` | ||
| [Arguments] ${CA_CRT}=STARK_ENTERPRISES_ROOT_CA.crt ${DIR}=/root/ca/certs | ||
| ${out}= Run cat ${DIR}/${CA_CRT} | ||
| [Return] ${out} | ||
|
|
||
|
|
||
| Get Server Certificate | ||
| # Return ascii armored certificate from file e.g. `-----BEGIN CERTIFICATE-----` | ||
| # PEM must be provided if using a wildcard cert not specified by DOMAIN | ||
| [Arguments] ${PEM}=%{DOMAIN}.cert.pem ${DIR}=/root/ca/certs | ||
| ${out}= Run cat ${DIR}/${PEM} | ||
| [Return] ${out} | ||
|
|
||
|
|
||
| Get Server Key | ||
| # Return ascii armored key from file e.g. `-----BEGIN RSA PRIVATE KEY-----` | ||
| # PEM must be provided if using a wildcard cert not specified by DOMAIN | ||
| [Arguments] ${PEM}=%{DOMAIN}.key.pem ${DIR}=/root/ca/private | ||
| ${out}= Run cat ${DIR}/${PEM} | ||
| [Return] ${out} | ||
|
|
||
|
|
||
| Get PKCS8 Server Key | ||
| # Convert server key to PKCS8 and return | ||
| [Arguments] ${PEM}=%{DOMAIN}.key.pem ${DIR}=/root/ca/private | ||
| cp ${PEM} ${PEM}.tmp | ||
| rm ${PEM} | ||
| openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in ${PEM}.tmp -out ${PEM} | ||
| ${out}= Run cat ${DIR}/${PEM} | ||
| [Return] ${out} | ||
|
|
||
|
|
||
| Get Remote Certificate | ||
| # Connect to remote (<IP>:<PORT>) and get the cert | ||
| [Arguments] ${remote} | ||
| ${output}= Run openssl s_client -showcerts -connect ${remote} | ||
| Log ${output} | ||
| [Return] ${output} |
Oops, something went wrong.