weiguoqiang/cert-manager
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Add e2e tests + fix validation

Browse Source 
Signed-off-by: Maartje Eyskens <maartje@eyskens.me>
This commit is contained in:
Maartje Eyskens 2020-09-22 13:37:37 +02:00
parent 39de7f3b99
commit 918e1e04f3
5 changed files with 82 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
devel/lib/lib.sh
View File

@ -33,6 +33,7 @@ export IS_OPENSHIFT="${IS_OPENSHIFT:-"false"}"
export OPENSHIFT_VERSION="${OPENSHIFT_VERSION:-"3.11"}"
export SERVICE_IP_PREFIX="${SERVICE_IP_PREFIX:-10.0.0}"
export DNS_SERVER="${SERVICE_IP_PREFIX}.16"
export INGRESS_IP="${SERVICE_IP_PREFIX}.15"
# setup_tools will build and set up the environment to use bazel-provided
# versions of the tools required for development

1
devel/run-e2e.sh
View File

@ -45,4 +45,5 @@ ginkgo -nodes 10 -flakeAttempts ${FLAKE_ATTEMPTS:-1} \
--repo-root="${REPO_ROOT}" \
--report-dir="${ARTIFACTS:-$REPO_ROOT/_artifacts}" \
--acme-dns-server="$DNS_SERVER" \
--acme-ingress-ip="$INGRESS_IP" \
"$@"

4
pkg/internal/apis/certmanager/validation/certificate.go
View File

@ -40,8 +40,8 @@ func ValidateCertificateSpec(crt *internalcmapi.CertificateSpec, fldPath *field.
el = append(el, validateIssuerRef(crt.IssuerRef, fldPath)...)
if len(crt.CommonName) == 0 && len(crt.DNSNames) == 0 && len(crt.URISANs) == 0 && len(crt.EmailSANs) == 0 {
el = append(el, field.Invalid(fldPath, "", "at least one of commonName, dnsNames, uris or emailAddresses must be set"))
if len(crt.CommonName) == 0 && len(crt.DNSNames) == 0 && len(crt.URISANs) == 0 && len(crt.EmailSANs) == 0 && len(crt.IPAddresses) == 0 {
el = append(el, field.Invalid(fldPath, "", "at least one of commonName, dnsNames, uris ipAddresses, or emailAddresses must be set"))
}
// if a common name has been specified, ensure it is no longer than 64 chars

2
test/e2e/framework/config/acme.go
View File

@ -23,11 +23,13 @@ import (
type ACMEServer struct {
URL string
DNSServer string
IngressIP string
}
func (p *ACMEServer) AddFlags(fs *flag.FlagSet) {
fs.StringVar(&p.URL, "acme-server-url", "https://pebble.pebble.svc.cluster.local/dir", "URL for the ACME server used during end-to-end tests")
fs.StringVar(&p.DNSServer, "acme-dns-server", "10.0.0.16", "DNS server for ACME DNS01 tests to run against using RFC2136")
fs.StringVar(&p.IngressIP, "acme-ingress-ip", "10.0.0.15", "IP of the ingress server that solves HTTP01 ACME challenges")
}
func (p *ACMEServer) Validate() []error {

76
test/e2e/suite/issuers/acme/certificate/http01.go
View File

@ -469,4 +469,80 @@ var _ = framework.CertManagerDescribe("ACME Certificate (HTTP01)", func() {
Expect(err).NotTo(HaveOccurred())
})
It("should obtain a signed certificate with a single IP Address from the ACME server", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Creating a Certificate")
cert := gen.Certificate(certificateName,
gen.SetCertificateSecretName(certificateSecretName),
gen.SetCertificateIssuer(cmmeta.ObjectReference{Name: issuerName}),
gen.SetCertificateIPs(f.Config.Addons.ACMEServer.IngressIP),
)
cert.Namespace = f.Namespace.Name
_, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Verifying the Certificate is valid")
err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
})
It("should obtain a signed certificate with an IP and DNS names from the ACME server", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Creating a Certificate")
cert := gen.Certificate(certificateName,
gen.SetCertificateSecretName(certificateSecretName),
gen.SetCertificateIssuer(cmmeta.ObjectReference{Name: issuerName}),
gen.SetCertificateDNSNames(fmt.Sprintf("%s.%s", cmutil.RandStringRunes(2), acmeIngressDomain)),
gen.SetCertificateIPs(f.Config.Addons.ACMEServer.IngressIP),
)
cert.Namespace = f.Namespace.Name
_, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Verifying the Certificate is valid")
err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
})
It("should allow updating an existing certificate with a new dns name", func() {
certClient := f.CertManagerClientSet.CertmanagerV1().Certificates(f.Namespace.Name)
By("Creating a Certificate")
cert := gen.Certificate(certificateName,
gen.SetCertificateSecretName(certificateSecretName),
gen.SetCertificateIssuer(cmmeta.ObjectReference{Name: issuerName}),
gen.SetCertificateDNSNames(fmt.Sprintf("%s.%s", cmutil.RandStringRunes(5), acmeIngressDomain)),
)
cert.Namespace = f.Namespace.Name
_, err := certClient.Create(context.TODO(), cert, metav1.CreateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Verifying the Certificate is valid")
err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Getting the latest version of the Certificate")
cert, err = certClient.Get(context.TODO(), certificateName, metav1.GetOptions{})
Expect(err).NotTo(HaveOccurred())
By("Adding an additional dnsName to the Certificate")
newDNSName := fmt.Sprintf("%s.%s", cmutil.RandStringRunes(5), acmeIngressDomain)
cert.Spec.DNSNames = append(cert.Spec.DNSNames, newDNSName)
By("Updating the Certificate in the apiserver")
cert, err = certClient.Update(context.TODO(), cert, metav1.UpdateOptions{})
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to be not ready")
_, err = h.WaitForCertificateNotReady(f.Namespace.Name, certificateName, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
By("Waiting for the Certificate to become ready & valid")
err = h.WaitCertificateIssuedValid(f.Namespace.Name, certificateName, time.Minute*5)
Expect(err).NotTo(HaveOccurred())
})
})