mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-10-25 22:30:20 +00:00
4b7c1db064
Introduce new test case which verifies that openvpn clients and servers can run as Kata pods and can successfully establish a connection. Volatile certificates and keys are generated by an initialization container and injected into the client and server containers. This scenario requires TUN/TAP support for the UVM kernel. Signed-off-by: Manuel Huber <mahuber@microsoft.com> Co-authored-by: Manuel Huber <manuelh@nvidia.com>
104 lines
5.2 KiB
Bash
104 lines
5.2 KiB
Bash
#!/usr/bin/env bats
|
|
#
|
|
# Copyright (c) 2025 Microsoft Corporation
|
|
# Copyright (c) 2025 NVIDIA Corporation
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
load "${BATS_TEST_DIRNAME}/lib.sh"
|
|
load "${BATS_TEST_DIRNAME}/../../common.bash"
|
|
load "${BATS_TEST_DIRNAME}/tests_common.sh"
|
|
|
|
setup() {
|
|
# cannot build the container image: ERROR: unable to select packages: easy-rsa (no such package) ...
|
|
[ "$(uname -m)" == "ppc64le" ] && skip "required packages for openvpn test not available for ppc64le"
|
|
# built the container image only for x86 and arm64 so far
|
|
[ "$(uname -m)" == "s390x" ] && skip "container image not built for s390x"
|
|
|
|
setup_common
|
|
get_pod_config_dir
|
|
|
|
init_pod_name="openvpn-init-secrets"
|
|
server_pod_name="openvpn-server"
|
|
client_pod_name="openvpn-client"
|
|
|
|
init_pod_yaml="${pod_config_dir}/openvpn/pod-openvpn-init-secrets.yaml"
|
|
|
|
server_pod_yaml="${pod_config_dir}/openvpn/openvpn-server-pod.yaml"
|
|
server_service_yaml="${pod_config_dir}/openvpn/openvpn-server-service.yaml"
|
|
server_configmap_yaml="${pod_config_dir}/openvpn/openvpn-server-configmap.yaml"
|
|
server_secret_template_yaml="${pod_config_dir}/openvpn/openvpn-server-secret.yaml.in"
|
|
server_secret_instance_yaml="${pod_config_dir}/openvpn/openvpn-server-secret-instance.yaml"
|
|
|
|
client_pod_yaml="${pod_config_dir}/openvpn/openvpn-client-pod.yaml"
|
|
client_configmap_yaml="${pod_config_dir}/openvpn/openvpn-client-configmap.yaml"
|
|
client_secret_template_yaml="${pod_config_dir}/openvpn/openvpn-client-secret.yaml.in"
|
|
client_secret_instance_yaml="${pod_config_dir}/openvpn/openvpn-client-secret-instance.yaml"
|
|
|
|
# TODO: workaround for issue 11777: https://github.com/kata-containers/kata-containers/issues/11777
|
|
# remove allow-all configuration and uncomment below when resolved (or loop over files under openvpn folder)
|
|
add_allow_all_policy_to_yaml "$server_pod_yaml"
|
|
add_allow_all_policy_to_yaml "$client_pod_yaml"
|
|
#policy_settings_dir="$(create_tmp_policy_settings_dir "${pod_config_dir}")"
|
|
#add_requests_to_policy_settings "${policy_settings_dir}" "ReadStreamRequest"
|
|
#auto_generate_policy "${policy_settings_dir}" "$server_pod_yaml"
|
|
#auto_generate_policy "${policy_settings_dir}" "$client_pod_yaml"
|
|
}
|
|
|
|
@test "Pods establishing a VPN connection using openvpn" {
|
|
# Step 1: Deploy the initialization pod and wait for it to be ready
|
|
kubectl apply -f "$init_pod_yaml" && kubectl wait --for=condition=Ready --timeout=$timeout pod/$init_pod_name
|
|
|
|
# Step 2: Extract base64-encoded certificates from the initialization pod
|
|
export BASE64_CA_CRT="$(kubectl exec $init_pod_name -- cat /etc/openvpn/ca.crt.b64 | tr -d '\n')"
|
|
export BASE64_CLIENT_CRT="$(kubectl exec $init_pod_name -- cat /etc/openvpn/client.crt.b64 | tr -d '\n')"
|
|
export BASE64_CLIENT_KEY="$(kubectl exec $init_pod_name -- cat /etc/openvpn/client.key.b64 | tr -d '\n')"
|
|
export BASE64_SERVER_CRT="$(kubectl exec $init_pod_name -- cat /etc/openvpn/server.crt.b64 | tr -d '\n')"
|
|
export BASE64_SERVER_KEY="$(kubectl exec $init_pod_name -- cat /etc/openvpn/server.key.b64 | tr -d '\n')"
|
|
|
|
[ -n "$BASE64_CA_CRT" ]
|
|
[ -n "$BASE64_CLIENT_CRT" ]
|
|
[ -n "$BASE64_CLIENT_KEY" ]
|
|
[ -n "$BASE64_SERVER_CRT" ]
|
|
[ -n "$BASE64_SERVER_KEY" ]
|
|
|
|
# Step 3: Substitute environment variables in template files, write to instance files
|
|
envsubst < "$server_secret_template_yaml" > "$server_secret_instance_yaml"
|
|
envsubst < "$client_secret_template_yaml" > "$client_secret_instance_yaml"
|
|
|
|
# Step 4: Deploy the OpenVPN server and wait for it to be ready (uses readiness probe)
|
|
kubectl apply -f "$server_service_yaml"
|
|
kubectl apply -f "$server_configmap_yaml"
|
|
kubectl apply -f "$server_secret_instance_yaml"
|
|
kubectl apply -f "$server_pod_yaml" && kubectl wait --for=condition=Ready --timeout=$timeout pod/$server_pod_name
|
|
|
|
# Step 5: Deploy the OpenVPN client and wait for it to be ready (uses readiness probe)
|
|
kubectl apply -f "$client_configmap_yaml"
|
|
kubectl apply -f "$client_secret_instance_yaml"
|
|
kubectl apply -f "$client_pod_yaml" && kubectl wait --for=condition=Ready --timeout=$timeout pod/$client_pod_name
|
|
}
|
|
|
|
teardown() {
|
|
[ "$(uname -m)" == "ppc64le" ] && skip "required packages for openvpn test not available for ppc64le"
|
|
[ "$(uname -m)" == "s390x" ] && skip "container image not built for s390x"
|
|
|
|
# Debugging information
|
|
echo "=== OpenVPN Init Pod Logs ==="
|
|
kubectl logs "$init_pod_name" --all-containers=true || true
|
|
echo "=== OpenVPN Server Pod Logs ==="
|
|
kubectl logs "$server_pod_name" || true
|
|
echo "=== OpenVPN Client Pod Logs ==="
|
|
kubectl logs "$client_pod_name" || true
|
|
|
|
# TODO, see above, workaround for issue 11777. Uncomment when resolved.
|
|
#delete_tmp_policy_settings_dir "${policy_settings_dir}"
|
|
teardown_common "${node}" "${node_start_time:-}"
|
|
|
|
# teardown cleans up pods, but not other resources
|
|
kubectl delete -f "$client_secret_instance_yaml" --ignore-not-found=true
|
|
kubectl delete -f "$client_configmap_yaml" --ignore-not-found=true
|
|
kubectl delete -f "$server_secret_instance_yaml" --ignore-not-found=true
|
|
kubectl delete -f "$server_configmap_yaml" --ignore-not-found=true
|
|
kubectl delete -f "$server_service_yaml" --ignore-not-found=true
|
|
}
|