mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-24 09:02:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
1,058 Commits 31 Branches 54 Tags
2b7685fa236ffd8de99343c557a16ac8b67122c8
Commit Graph
256 Commits
Author SHA1 Message Date
Matt Moyer 0b38d6c763 Add TestE2EFullIntegration test which combines supervisor, concierge, and CLI. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:50 -06:00
Matt Moyer ff49647de4 Add some missing test logs in test/library/client.go. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:50 -06:00
Matt Moyer e0eba9d5a6 Refactor library.CreateTestJWTAuthenticator() so we can also use the supervisor as an upstream. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:50 -06:00
Matt Moyer 5ad3c65ae1 Close the right pipe output in runPinnipedLoginOIDC. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:50 -06:00
Matt Moyer aca9af748b Cleanup TestSuccessfulCredentialRequest and TestCLILoginOIDC a little. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:49 -06:00
Matt Moyer 8cdcb89cef Add a library.PinnipedCLIPath() test helper, with caching. 
Caching saves us a little bit of time now that we're using the CLI in more and more tests.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:49 -06:00
Matt Moyer 70fd330178 Add library.CreateTestClusterRoleBinding test helper. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:49 -06:00
Matt Moyer ad5e257600 Add a library.RandHex() test helper. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:34:49 -06:00
Matt Moyer 4088793cc5 Add a .ProxyEnv() helper on the test environment. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:28:04 -06:00
Matt Moyer b6edc3dc08 Replace TestCLIGetKubeconfig with TestCLIGetKubeconfigStaticToken. 
It now tests both the deprecated `pinniped get-kubeconfig` and the new `pinniped get kubeconfig --static-token` flows.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:28:03 -06:00
Matt Moyer fe4e2d620d Update TestCLIGetKubeconfig to ignore stderr output from get-kubeconfig. 
This will now have a deprecation warning, so we can't treat is as part of the YAML output.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:28:03 -06:00
Matt Moyer f9691208d5 Add library.NewRestConfigFromKubeconfig() test helper. 
This is extracted from library.NewClientsetForKubeConfig(). It is useful so you can assert properties of the loaded, parsed kubeconfig.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-15 12:28:03 -06:00
Andrew Keesler be4e34d0c0 Retry a couple of times if we fail to get a token from the Supervisor 
I hope this will make TestSupervisorLogin less flaky. There are some instances
where the front half of the OIDC login flow happens so fast that the JWKS
controller doesn't have time to properly generate an asymmetric key.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-12-15 11:53:58 -05:00
Andrew Keesler 50f9b434e7 SameIssuerHostMustUseSameSecret is a valid OIDCProvider status 
I saw this message in our CI logs, which led me to this fix.
  could not update status: OIDCProvider.config.supervisor.pinniped.dev "acceptance-provider" is invalid: status.status: Unsupported value: "SameIssuerHostMustUseSameSecret": supported values: "Success", "Duplicate", "Invalid"

Also - correct an integration test error message that was misleading.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-12-15 11:53:53 -05:00
Ryan RichardandMargo Crawford baa1a4a2fc Supervisor storage garbage collection controller enabled in production 
- Also add more log statements to the controller
- Also have the controller apply a rate limit to itself, to avoid
  having a very chatty controller that runs way more often than is
  needed.
- Also add an integration test for the controller's behavior.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2020-12-11 15:21:34 -08:00
Ryan RichardandMargo Crawford afd216308b KubeStorage annotates every Secret with garbage-collect-after timestamp 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2020-12-10 14:47:58 -08:00
Ryan RichardandMargo Crawford a561fd21d9 Consolidate the supervisor's timeout settings into a single struct 
- This struct represents the configuration of all timeouts. These
  timeouts are all interrelated to declare them all in one place.
  This should also make it easier to allow the user to override
  our defaults if we would like to implement such a feature in the
  future.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2020-12-10 10:14:54 -08:00
Margo CrawfordandRyan Richard 218f27306c Integration test for refresh grant 
Signed-off-by: Ryan Richard <rrichard@vmware.com>
 2020-12-09 17:07:37 -08:00
Matt Moyer f1aff2faab Start extending TestSupervisorLogin to test the token exchange flow (WIP). 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-09 10:23:10 -06:00
Andrew Keesler 4c0fb12cf6 test/integration: only set JWTAuthenticator CA bundle when it exists 
See comment in code.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-12-09 10:15:53 -05:00
Andrew Keesler 57103e0a9f Add JWTAuthenticator controller 
See https://github.com/vmware-tanzu/pinniped/issues/260 for UX bummer.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-12-08 15:41:48 -05:00
Andrew Keesler 946b0539d2 Add JWTAuthenticator API type 
Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-12-08 15:41:48 -05:00
Ryan RichardandAram Price e1ae48f2e4 Discovery does not return token_endpoint_auth_signing_alg_values_supported 
`token_endpoint_auth_signing_alg_values_supported` is only related to
private_key_jwt and client_secret_jwt client authentication methods
at the token endpoint, which we do not support. See
https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
for more details.

Signed-off-by: Aram Price <pricear@vmware.com>
 2020-12-07 14:15:31 -08:00
Aram PriceandRyan Richard 648fa4b9ba Backfill test for token endpoint error when JWK is not yet available 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2020-12-07 11:53:24 -08:00
Ryan RichardandAram Price e0b6133bf1 Integration tests call supervisor token endpoint and validate response 
Signed-off-by: Aram Price <pricear@vmware.com>
 2020-12-04 17:07:04 -08:00
Aram PriceandRyan Richard ac19782405 Merge branch 'main' into token-endpoint 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2020-12-04 15:52:49 -08:00
Matt Moyer c6ead9d7dd Remove "email" and "profile" from default scopes requested by CLI. 
We decided that we don't really need these in every case, since we'll be returning username and groups in a custom claim.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-04 16:02:16 -06:00
Andrew Keesler 2dc3ab1840 Merge remote-tracking branch 'upstream/main' into token-endpoint 2020-12-04 08:58:18 -05:00
Matt Moyer c8abc79d9b Fix this comment (and retrigger CI). 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 14:24:26 -06:00
Matt Moyer 9455a66be8 This trailing dash is now taken care of by the library method. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 13:56:24 -06:00
Matt Moyer 8563c05baf Tweak these timeouts to be a bit faster (and retrigger CI). 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 13:22:27 -06:00
Matt Moyer 408fbe4f76 Parameterize the supervisor_redirect_uri in the test env Dex. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 12:45:56 -06:00
Matt Moyer cb5e494815 Dump out proxy access logs in TestSupervisorLogin. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 11:28:48 -06:00
Matt Moyer 954591d2db Add some debugging logs to our proxy client code. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 10:25:26 -06:00
Andrew Keesler 2f1a67ef0d Merge remote-tracking branch 'upstream/callback-endpoint' into token-endpoint 2020-12-03 11:14:37 -05:00
Matt Moyer d7b1ab8e43 Try to capture more logs from the TestSupervisorLogin test. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 09:39:33 -06:00
Matt Moyer 1d44a0cdfa Add a small integration test library to dump pod logs on test failures. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-03 09:39:33 -06:00
Matt Moyer 1fa41c4d0a Merge remote-tracking branch 'origin/main' into callback-endpoint 2020-12-03 08:50:31 -06:00
Andrew Keesler fe2e2bdff1 Our ID token signing algorithm is ES256, not RS256 
We are currently using EC keys to sign ID tokens, so we should reflect that in
our OIDC discovery metadata.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
 2020-12-03 07:46:07 -05:00
Matt Moyer 64ef53402d In TestSupervisorLogin, wrap the discovery request in an Eventually(). 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 18:07:52 -06:00
Matt Moyer 37c5e121c4 Fix a test issue with IPv6 localhost interfaces. 
This fixes a regression introduced by 24c4bc0dd4. It could occasionally cause the tests to fail when run on a machine with an IPv6 localhost interface. As a fix I added a wrapper for the new Go 1.15 `LookupIP()` method, and created a partially-functional backport for Go 1.14. This should be easy to delete in the future.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 17:49:21 -06:00
Matt Moyer 879525faac Clean up the browsertest package a bit. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 17:20:24 -06:00
Matt Moyer ae9bdc1d61 Fix a lint warning by simplifying this append operation. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 16:11:40 -06:00
Matt Moyer c0f13ef4ac Merge remote-tracking branch 'origin/main' into callback-endpoint 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 16:09:08 -06:00
Matt Moyer f40144e1a9 Update TestSupervisorLogin to test the callback flow using a browser. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 15:55:35 -06:00
Matt Moyer 0ccf14801e Expose the MaskTokens function so other test code can use it. 
This is just a small helper to make test output more readable.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 15:55:34 -06:00
Matt Moyer 273ac62ec2 Extend the test client helpers in ./test/library/client.go. 
This adds a few new "create test object" helpers and extends `CreateTestOIDCProvider()` to optionally wait for the created OIDCProvider to enter some expected status condition.

Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 15:55:34 -06:00
Matt Moyer 545c26e5fe Refactor browser-related test functions to a ./test/library/browsertest package. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 15:55:34 -06:00
Matt Moyer fe0481c304 In integration test env, deploy a ClusterIP service and register that with Dex. 
Signed-off-by: Matt Moyer <moyerm@vmware.com>
 2020-12-02 15:55:33 -06:00
Margo CrawfordandRyan Richard d60c184424 Add pkce and openidconnect storage 
- Also refactor authorizationcode_test

Signed-off-by: Ryan Richard <rrichard@vmware.com>
 2020-12-01 17:18:32 -08:00