Merge remote-tracking branch 'upstream/main' into token-endpoint

test/deploy/dex/dex.yaml

@@ -28,7 +28,7 @@ staticClients:
   name: 'Pinniped Supervisor'
   secret: pinniped-supervisor-secret
   redirectURIs:
-  - https://pinniped-supervisor-clusterip.supervisor.svc.cluster.local/some/path/callback
+  - #@ data.values.supervisor_redirect_uri
 enablePasswordDB: true
 staticPasswords:
 - username: "pinny"

test/deploy/dex/proxy.yaml

@@ -20,6 +20,9 @@ spec:
       labels:
         app: proxy
     spec:
+      volumes:
+        - name: log-dir
+          emptyDir: {}
       containers:
         - name: proxy
           image: docker.io/getpinniped/test-forward-proxy
@@ -34,6 +37,9 @@ spec:
             limits:
               cpu: "10m"
               memory: "64Mi"
+          volumeMounts:
+            - name: log-dir
+              mountPath: "/var/log/squid/"
           readinessProbe:
             tcpSocket:
               port: http
@@ -41,6 +47,16 @@ spec:
             timeoutSeconds: 5
             periodSeconds: 5
             failureThreshold: 2
+        - name: accesslogs
+          image: debian:10.6-slim
+          command:
+            - "/bin/sh"
+            - "-c"
+          args:
+            - tail -F /var/log/squid/access.log
+          volumeMounts:
+            - name: log-dir
+              mountPath: "/var/log/squid/"
 ---
 apiVersion: v1
 kind: Service

test/deploy/dex/values.yaml

@@ -15,3 +15,5 @@ ports:
   #! External port where the proxy ends up exposed on localhost during tests. This value comes from
   #! our Kind configuration which maps 127.0.0.1:12346 to port 31235 on the Kind worker node.
   local: 12346
+
+supervisor_redirect_uri: ""

test/integration/supervisor_login_test.go

@@ -34,8 +34,9 @@ import (
 func TestSupervisorLogin(t *testing.T) {
 	env := library.IntegrationEnv(t)
 
-	// If anything in this test crashes, dump out the supervisor pod logs.
-	defer library.DumpLogs(t, env.SupervisorNamespace)
+	// If anything in this test crashes, dump out the supervisor and proxy pod logs.
+	defer library.DumpLogs(t, env.SupervisorNamespace, "")
+	defer library.DumpLogs(t, "dex", "app=proxy")
 
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
@@ -57,9 +58,13 @@ func TestSupervisorLogin(t *testing.T) {
 		TLSClientConfig: &tls.Config{RootCAs: ca.Pool()},
 		Proxy: func(req *http.Request) (*url.URL, error) {
 			if env.Proxy == "" {
+				t.Logf("passing request for %s with no proxy", req.URL)
 				return nil, nil
 			}
-			return url.Parse(env.Proxy)
+			proxyURL, err := url.Parse(env.Proxy)
+			require.NoError(t, err)
+			t.Logf("passing request for %s through proxy %s", req.URL, proxyURL.String())
+			return proxyURL, nil
 		},
 	}}
 
@@ -106,7 +111,7 @@ func TestSupervisorLogin(t *testing.T) {
 	assert.Eventually(t, func() bool {
 		discovery, err = oidc.NewProvider(oidc.ClientContext(ctx, httpClient), downstream.Spec.Issuer)
 		return err == nil
-	}, 60*time.Second, 1*time.Second)
+	}, 30*time.Second, 200*time.Millisecond)
 	require.NoError(t, err)
 
 	// Start a callback server on localhost.

test/library/client.go

@@ -254,7 +254,7 @@ func CreateClientCredsSecret(t *testing.T, clientID string, clientSecret string)
 	env := IntegrationEnv(t)
 	return CreateTestSecret(t,
 		env.SupervisorNamespace,
-		"test-client-creds-",
+		"test-client-creds",
 		"secrets.pinniped.dev/oidc-client",
 		map[string]string{
 			"clientID":     clientID,

test/library/dumplogs.go

@@ -15,7 +15,7 @@ import (
 )
 
 // DumpLogs is meant to be called in a `defer` to dump the logs of components in the cluster on a test failure.
-func DumpLogs(t *testing.T, namespace string) {
+func DumpLogs(t *testing.T, namespace string, labelSelector string) {
 	// Only trigger on failed tests.
 	if !t.Failed() {
 		return
@@ -26,7 +26,7 @@ func DumpLogs(t *testing.T, namespace string) {
 	defer cancel()
 
 	logTailLines := int64(40)
-	pods, err := kubeClient.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{})
+	pods, err := kubeClient.CoreV1().Pods(namespace).List(ctx, metav1.ListOptions{LabelSelector: labelSelector})
 	require.NoError(t, err)
 
 	for _, pod := range pods.Items {