supervisor-generate-key: unit and integration tests

Signed-off-by: Andrew Keesler <akeesler@vmware.com>

test/integration/supervisor_keys_test.go

@@ -0,0 +1,96 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package integration
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/square/go-jose.v2"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
+	"go.pinniped.dev/test/library"
+)
+
+func TestSupervisorOIDCKeys(t *testing.T) {
+	env := library.IntegrationEnv(t)
+	kubeClient := library.NewClientset(t)
+	pinnipedClient := library.NewPinnipedClientset(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	// Create our OPC under test.
+	// TODO: maybe use this in other supervisor test?
+	opc := library.CreateTestOIDCProvider(ctx, t)
+
+	// Ensure a secret is created with the OPC's JWKS.
+	var updatedOPC *configv1alpha1.OIDCProviderConfig
+	var err error
+	assert.Eventually(t, func() bool {
+		updatedOPC, err = pinnipedClient.
+			ConfigV1alpha1().
+			OIDCProviderConfigs(env.SupervisorNamespace).
+			Get(ctx, opc.Name, metav1.GetOptions{})
+		return err == nil && updatedOPC.Status.JWKSSecret.Name != ""
+	}, time.Second*10, time.Millisecond*500)
+	require.NoError(t, err)
+	require.NotEmpty(t, updatedOPC.Status.JWKSSecret.Name)
+
+	// Ensure the secret actually exists.
+	secret, err := kubeClient.
+		CoreV1().
+		Secrets(env.SupervisorNamespace).
+		Get(ctx, updatedOPC.Status.JWKSSecret.Name, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	// Ensure the secret has an active key.
+	jwkData, ok := secret.Data["activeJWK"]
+	require.True(t, ok, "secret is missing active jwk")
+
+	// Ensure the secret's active key is valid.
+	var activeJWK jose.JSONWebKey
+	require.NoError(t, json.Unmarshal(jwkData, &activeJWK))
+	require.True(t, activeJWK.Valid(), "active jwk is invalid")
+	require.False(t, activeJWK.IsPublic(), "active jwk is public")
+
+	// Ensure the secret has a JWKS.
+	jwksData, ok := secret.Data["jwks"]
+	require.True(t, ok, "secret is missing jwks")
+
+	// Ensure the secret's JWKS is valid, public, and contains the singing key.
+	var jwks jose.JSONWebKeySet
+	require.NoError(t, json.Unmarshal(jwksData, &jwks))
+	foundActiveJWK := false
+	for _, jwk := range jwks.Keys {
+		require.Truef(t, jwk.Valid(), "jwk %s is invalid", jwk.KeyID)
+		require.Truef(t, jwk.IsPublic(), "jwk %s is not public", jwk.KeyID)
+		if jwk.KeyID == activeJWK.KeyID {
+			foundActiveJWK = true
+		}
+	}
+	require.True(t, foundActiveJWK, "could not find active JWK in JWKS: %s", jwks)
+
+	// Ensure upon deleting the secret, it is eventually brought back.
+	err = kubeClient.
+		CoreV1().
+		Secrets(env.SupervisorNamespace).
+		Delete(ctx, updatedOPC.Status.JWKSSecret.Name, metav1.DeleteOptions{})
+	require.NoError(t, err)
+	assert.Eventually(t, func() bool {
+		secret, err = kubeClient.
+			CoreV1().
+			Secrets(env.SupervisorNamespace).
+			Get(ctx, updatedOPC.Status.JWKSSecret.Name, metav1.GetOptions{})
+		return err == nil
+	}, time.Second*10, time.Millisecond*500)
+	require.NoError(t, err)
+
+	// Upon deleting the OPC, the secret is deleted (we test this behavior in our uninstall tests).
+}

test/library/client.go

@@ -5,11 +5,16 @@ package library
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"io"
 	"io/ioutil"
 	"os"
 	"testing"
 	"time"
 
+	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -18,6 +23,7 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
 
+	configv1alpha1 "go.pinniped.dev/generated/1.19/apis/config/v1alpha1"
 	idpv1alpha1 "go.pinniped.dev/generated/1.19/apis/idp/v1alpha1"
 	pinnipedclientset "go.pinniped.dev/generated/1.19/client/clientset/versioned"
 
@@ -152,3 +158,50 @@ func CreateTestWebhookIDP(ctx context.Context, t *testing.T) corev1.TypedLocalOb
 		Name:     idp.Name,
 	}
 }
+
+// CreateTestOIDCProvider creates and returns a test OIDCProviderConfig in
+// $PINNIPED_TEST_SUPERVISOR_NAMESPACE, which will be automatically deleted at the end of the
+// current test's lifetime. It generates a random, valid, issuer for the OIDCProviderConfig.
+func CreateTestOIDCProvider(ctx context.Context, t *testing.T) *configv1alpha1.OIDCProviderConfig {
+	t.Helper()
+	testEnv := IntegrationEnv(t)
+
+	createContext, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	issuer, err := randomIssuer()
+	require.NoError(t, err)
+
+	opcs := NewPinnipedClientset(t).ConfigV1alpha1().OIDCProviderConfigs(testEnv.SupervisorNamespace)
+	opc, err := opcs.Create(createContext, &configv1alpha1.OIDCProviderConfig{
+		ObjectMeta: metav1.ObjectMeta{
+			GenerateName: "test-oidc-provider-",
+			Labels:       map[string]string{"pinniped.dev/test": ""},
+			Annotations:  map[string]string{"pinniped.dev/testName": t.Name()},
+		},
+		Spec: configv1alpha1.OIDCProviderConfigSpec{
+			Issuer: issuer,
+		},
+	}, metav1.CreateOptions{})
+	require.NoError(t, err, "could not create test OIDCProviderConfig")
+	t.Logf("created test OIDCProviderConfig %s/%s", opc.Namespace, opc.Name)
+
+	t.Cleanup(func() {
+		t.Helper()
+		t.Logf("cleaning up test OIDCProviderConfig %s/%s", opc.Namespace, opc.Name)
+		deleteCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		err := opcs.Delete(deleteCtx, opc.Name, metav1.DeleteOptions{})
+		require.NoErrorf(t, err, "could not cleanup test OIDCProviderConfig %s/%s", opc.Namespace, opc.Name)
+	})
+
+	return opc
+}
+
+func randomIssuer() (string, error) {
+	var buf [8]byte
+	if _, err := io.ReadFull(rand.Reader, buf[:]); err != nil {
+		return "", errors.WithMessage(err, "could not generate random state")
+	}
+	return fmt.Sprintf("http://test-issuer-%s.pinniped.dev", hex.EncodeToString(buf[:])), nil
+}