-
Notifications
You must be signed in to change notification settings - Fork 150
/
20_zarf_init_test.go
214 lines (177 loc) · 9.2 KB
/
20_zarf_init_test.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
// SPDX-License-Identifier: Apache-2.0
// SPDX-FileCopyrightText: 2021-Present The Zarf Authors
// Package test provides e2e tests for Zarf.
package test
import (
"encoding/base64"
"fmt"
"runtime"
"testing"
"encoding/json"
"github.com/defenseunicorns/zarf/src/types"
"github.com/stretchr/testify/require"
)
func TestZarfInit(t *testing.T) {
t.Log("E2E: Zarf init")
initComponents := "git-server"
if e2e.ApplianceMode {
initComponents = "k3s,git-server"
}
initPackageVersion := e2e.GetZarfVersion(t)
var (
mismatchedArch = e2e.GetMismatchedArch()
mismatchedInitPackage = fmt.Sprintf("zarf-init-%s-%s.tar.zst", mismatchedArch, initPackageVersion)
expectedErrorMessage = "unable to run component before action: command \"Check that the host architecture matches the package architecture\""
)
t.Cleanup(func() {
e2e.CleanFiles(mismatchedInitPackage)
})
if runtime.GOOS == "linux" {
// Build init package with different arch than the cluster arch.
stdOut, stdErr, err := e2e.Zarf("package", "create", "src/test/packages/20-mismatched-arch-init", "--architecture", mismatchedArch, "--confirm")
require.NoError(t, err, stdOut, stdErr)
// Check that `zarf init` returns an error because of the mismatched architectures.
// We need to use the --architecture flag here to force zarf to find the package.
_, stdErr, err = e2e.Zarf("init", "--architecture", mismatchedArch, "--components=k3s", "--confirm")
require.Error(t, err, stdErr)
require.Contains(t, stdErr, expectedErrorMessage)
}
if !e2e.ApplianceMode {
// throw a pending pod into the cluster to ensure we can properly ignore them when selecting images
_, _, err := e2e.Kubectl("apply", "-f", "https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/pods/pod-with-node-affinity.yaml")
require.NoError(t, err)
}
// Check for any old secrets to ensure that they don't get saved in the init log
oldState := types.ZarfState{}
base64State, _, err := e2e.Kubectl("get", "secret", "zarf-state", "-n", "zarf", "-o", "jsonpath={.data.state}")
if err == nil {
oldStateJSON, err := base64.StdEncoding.DecodeString(base64State)
require.NoError(t, err)
err = json.Unmarshal(oldStateJSON, &oldState)
require.NoError(t, err)
}
// run `zarf init`
_, initStdErr, err := e2e.Zarf("init", "--components="+initComponents, "--nodeport", "31337", "-l", "trace", "--confirm")
require.NoError(t, err)
require.Contains(t, initStdErr, "an inventory of all software contained in this package")
require.NotContains(t, initStdErr, "This package does NOT contain an SBOM. If you require an SBOM, please contact the creator of this package to request a version that includes an SBOM.")
logText := e2e.GetLogFileContents(t, e2e.StripMessageFormatting(initStdErr))
// Verify that any state secrets were not included in the log
state := types.ZarfState{}
base64State, _, err = e2e.Kubectl("get", "secret", "zarf-state", "-n", "zarf", "-o", "jsonpath={.data.state}")
require.NoError(t, err)
stateJSON, err := base64.StdEncoding.DecodeString(base64State)
require.NoError(t, err)
err = json.Unmarshal(stateJSON, &state)
require.NoError(t, err)
checkLogForSensitiveState(t, logText, state)
if e2e.ApplianceMode {
// make sure that we upgraded `k3s` correctly and are running the correct version - this should match that found in `packages/distros/k3s`
kubeletVersion, _, err := e2e.Kubectl("get", "nodes", "-o", "jsonpath={.items[0].status.nodeInfo.kubeletVersion}")
require.NoError(t, err)
require.Contains(t, kubeletVersion, "v1.28.4+k3s2")
}
// Check that the registry is running on the correct NodePort
stdOut, _, err := e2e.Kubectl("get", "service", "-n", "zarf", "zarf-docker-registry", "-o=jsonpath='{.spec.ports[*].nodePort}'")
require.NoError(t, err)
require.Contains(t, stdOut, "31337")
// Check that the registry is running with the correct scale down policy
stdOut, _, err = e2e.Kubectl("get", "hpa", "-n", "zarf", "zarf-docker-registry", "-o=jsonpath='{.spec.behavior.scaleDown.selectPolicy}'")
require.NoError(t, err)
require.Contains(t, stdOut, "Min")
verifyZarfNamespaceLabels(t)
verifyZarfSecretLabels(t)
verifyZarfPodLabels(t)
verifyZarfServiceLabels(t)
// Special sizing-hacking for reducing resources where Kind + CI eats a lot of free cycles (ignore errors)
_, _, _ = e2e.Kubectl("scale", "deploy", "-n", "kube-system", "coredns", "--replicas=1")
_, _, _ = e2e.Kubectl("scale", "deploy", "-n", "zarf", "agent-hook", "--replicas=1")
}
func checkLogForSensitiveState(t *testing.T, logText string, zarfState types.ZarfState) {
t.Helper()
require.NotContains(t, logText, zarfState.AgentTLS.CA)
require.NotContains(t, logText, string(zarfState.AgentTLS.CA))
require.NotContains(t, logText, zarfState.AgentTLS.Cert)
require.NotContains(t, logText, string(zarfState.AgentTLS.Cert))
require.NotContains(t, logText, zarfState.AgentTLS.Key)
require.NotContains(t, logText, string(zarfState.AgentTLS.Key))
require.NotContains(t, logText, zarfState.ArtifactServer.PushToken)
require.NotContains(t, logText, zarfState.GitServer.PullPassword)
require.NotContains(t, logText, zarfState.GitServer.PushPassword)
require.NotContains(t, logText, zarfState.RegistryInfo.PullPassword)
require.NotContains(t, logText, zarfState.RegistryInfo.PushPassword)
require.NotContains(t, logText, zarfState.RegistryInfo.Secret)
}
func verifyZarfNamespaceLabels(t *testing.T) {
t.Helper()
expectedLabels := `'{"app.kubernetes.io/managed-by":"zarf","kubernetes.io/metadata.name":"zarf"}'`
actualLabels, _, err := e2e.Kubectl("get", "ns", "zarf", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
}
func verifyZarfSecretLabels(t *testing.T) {
t.Helper()
// zarf state
expectedLabels := `'{"app.kubernetes.io/managed-by":"zarf"}'`
actualLabels, _, err := e2e.Kubectl("get", "-n=zarf", "secret", "zarf-state", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// init package secret
expectedLabels = `'{"app.kubernetes.io/managed-by":"zarf","package-deploy-info":"init"}'`
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "secret", "zarf-package-init", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// registry
expectedLabels = `'{"app.kubernetes.io/managed-by":"zarf"}'`
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "secret", "private-registry", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// agent hook TLS
//
// this secret does not have the managed by zarf label
// because it is deployed as a helm chart rather than generated in Go code.
expectedLabels = `'{"app.kubernetes.io/managed-by":"Helm"}'`
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "secret", "agent-hook-tls", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// git server
expectedLabels = `'{"app.kubernetes.io/managed-by":"zarf"}'`
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "secret", "private-git-server", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
}
func verifyZarfPodLabels(t *testing.T) {
t.Helper()
// registry
podHash, _, err := e2e.Kubectl("get", "-n=zarf", "--selector=app=docker-registry", "pods", `-o=jsonpath="{.items[0].metadata.labels['pod-template-hash']}"`)
require.NoError(t, err)
expectedLabels := fmt.Sprintf(`'{"app":"docker-registry","pod-template-hash":%s,"release":"zarf-docker-registry","zarf.dev/agent":"ignore"}'`, podHash)
actualLabels, _, err := e2e.Kubectl("get", "-n=zarf", "--selector=app=docker-registry", "pods", "-o=jsonpath='{.items[0].metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// agent
podHash, _, err = e2e.Kubectl("get", "-n=zarf", "--selector=app=agent-hook", "pods", `-o=jsonpath="{.items[0].metadata.labels['pod-template-hash']}"`)
require.NoError(t, err)
expectedLabels = fmt.Sprintf(`'{"app":"agent-hook","pod-template-hash":%s,"zarf.dev/agent":"ignore"}'`, podHash)
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "--selector=app=agent-hook", "pods", "-o=jsonpath='{.items[0].metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// git server
patchedLabel := `"zarf-agent":"patched"`
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "--selector=app.kubernetes.io/instance=zarf-gitea ", "pods", "-o=jsonpath='{.items[0].metadata.labels}'")
require.NoError(t, err)
require.Contains(t, actualLabels, patchedLabel)
}
func verifyZarfServiceLabels(t *testing.T) {
t.Helper()
// registry
expectedLabels := `'{"app.kubernetes.io/managed-by":"Helm","zarf.dev/connect-name":"registry"}'`
actualLabels, _, err := e2e.Kubectl("get", "-n=zarf", "service", "zarf-connect-registry", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
// git server
expectedLabels = `'{"app.kubernetes.io/managed-by":"Helm","zarf.dev/connect-name":"git"}'`
actualLabels, _, err = e2e.Kubectl("get", "-n=zarf", "service", "zarf-connect-git", "-o=jsonpath='{.metadata.labels}'")
require.NoError(t, err)
require.Equal(t, expectedLabels, actualLabels)
}