From 48be61d80c110be9cd1eca0cb55d9f4f8b042baa Mon Sep 17 00:00:00 2001
From: Mateusz Gozdek <mateusz@kinvolk.io>
Date: Fri, 22 May 2020 16:05:02 +0200
Subject: [PATCH] test/system: initial commit

This commit adds e2e test, to verify, that there is no extra SSH keys
added to the Kubernetes nodes, other than one specified in the SSH_KEY
environment variable, which is used by the CI for provisioning the
clusters.

Ideally, the test should pull the keys directly from the cluster
configuration, however this is currently not trivial to implement.

Refs #465

Signed-off-by: Mateusz Gozdek <mateusz@kinvolk.io>
---
 test/system/ssh_keys_test.go | 125 +++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)
 create mode 100644 test/system/ssh_keys_test.go

diff --git a/test/system/ssh_keys_test.go b/test/system/ssh_keys_test.go
new file mode 100644
index 000000000..cb9dc3d5d
--- /dev/null
+++ b/test/system/ssh_keys_test.go
@@ -0,0 +1,125 @@
+// Copyright 2020 The Lokomotive Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// +build aws aws_edge baremetal packet
+// +build e2e
+
+package system_test
+
+import (
+	"crypto/sha512"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/yaml"
+
+	testutil "github.com/kinvolk/lokomotive/test/components/util"
+)
+
+const (
+	// sshKeyEnv is environment variable name from which we take SSH key,
+	// to be used in testing.
+	sshKeyEnv = "PUB_KEY"
+)
+
+// authorizedKeysSHA512 takes list of public SSH keys as an argument and calculates the
+// SHA512 of them, mimicking behavior of following command 'sha512sum /home/core/.ssh/authorized_keys'.
+// The format of authorized_keys should match what 'update-ssh-keys' command generates on Flatcar.
+func authorizedKeysSHA512(keys []string) string {
+	plain := "# auto-generated by update-ssh-keys\n"
+
+	for _, key := range keys {
+		// Trim the key before appending to make sure it does not contain
+		// newline.
+		plain += fmt.Sprintf("%s\n", strings.TrimSpace(key))
+	}
+
+	return fmt.Sprintf("%x", sha512.Sum512([]byte(plain)))
+}
+
+// Define manifest as YAML and then unmarshal it to Go struct, so it is easier to
+// write and debug, as it can be copy-pasted to the YAML file and applied manually.
+const noExtraSSHKeysOnNodesDSManifest = `apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  generateName: test-ssh-keys-
+spec:
+  selector:
+    matchLabels:
+      name: test-ssh-keys
+  template:
+    metadata:
+      labels:
+        name: test-ssh-keys
+    spec:
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        effect: NoSchedule
+      terminationGracePeriodSeconds: 1
+      containers:
+      - name: test-ssh-keys
+        image: ubuntu
+        command: ["bash"]
+        volumeMounts:
+        - name: ssh
+          mountPath: /home/core/.ssh
+          readOnly: true
+      volumes:
+      - name: ssh
+        hostPath:
+          path: /home/core/.ssh
+`
+
+func TestNoExtraSSHKeysOnNodes(t *testing.T) {
+	t.Parallel()
+
+	key := os.Getenv(sshKeyEnv)
+	if key == "" {
+		t.Skipf("%q environment variable not set", sshKeyEnv)
+	}
+
+	namespace := "kube-system"
+
+	client := testutil.CreateKubeClient(t)
+
+	sum := authorizedKeysSHA512([]string{key})
+
+	ds := &appsv1.DaemonSet{}
+	if err := yaml.Unmarshal([]byte(noExtraSSHKeysOnNodesDSManifest), ds); err != nil {
+		t.Fatalf("failed unmarshaling manifest: %v", err)
+	}
+
+	// Set the right arguments from the manifest with desired SHA512 sum.
+	ds.Spec.Template.Spec.Containers[0].Args = []string{
+		"-c",
+		fmt.Sprintf("sha512sum --status -c <(echo %s /home/core/.ssh/authorized_keys) && exec tail -f /dev/null", sum), //nolint:lll
+	}
+
+	ds, err := client.AppsV1().DaemonSets(namespace).Create(ds)
+	if err != nil {
+		t.Fatalf("failed creating DaemonSet: %v", err)
+	}
+
+	testutil.WaitForDaemonSet(t, client, namespace, ds.ObjectMeta.Name, testutil.RetryInterval, testutil.Timeout)
+
+	t.Cleanup(func() {
+		if err := client.AppsV1().DaemonSets(namespace).Delete(ds.ObjectMeta.Name, &metav1.DeleteOptions{}); err != nil {
+			t.Logf("failed removing DaemonSet: %v", err)
+		}
+	})
+}