mirror of
https://github.com/kairos-io/kcrypt-challenger.git
synced 2025-09-09 10:40:23 +00:00
Compare commits
2 Commits
pedro-dimi
...
ubuntu-loc
Author | SHA1 | Date | |
---|---|---|---|
|
8332f63fb1 | ||
|
c980784da5 |
10
.github/workflows/e2e-tests.yml
vendored
10
.github/workflows/e2e-tests.yml
vendored
@@ -11,7 +11,7 @@ on:
|
|||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
e2e-tests:
|
e2e-tests:
|
||||||
runs-on: self-hosted
|
runs-on: ubuntu-latest
|
||||||
strategy:
|
strategy:
|
||||||
fail-fast: false
|
fail-fast: false
|
||||||
matrix:
|
matrix:
|
||||||
@@ -48,13 +48,7 @@ jobs:
|
|||||||
|
|
||||||
earthly -P +iso
|
earthly -P +iso
|
||||||
export ISO=$PWD/build/challenger.iso
|
export ISO=$PWD/build/challenger.iso
|
||||||
|
|
||||||
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
|
|
||||||
go get github.com/onsi/gomega/...
|
|
||||||
go get github.com/onsi/ginkgo/v2/ginkgo/internal@v2.7.1
|
|
||||||
go get github.com/onsi/ginkgo/v2/ginkgo/generators@v2.7.1
|
|
||||||
go get github.com/onsi/ginkgo/v2/ginkgo/labels@v2.7.1
|
|
||||||
|
|
||||||
# Configure earthly to use the docker mirror in CI
|
# Configure earthly to use the docker mirror in CI
|
||||||
# https://docs.earthly.dev/ci-integration/pull-through-cache#configuring-earthly-to-use-the-cache
|
# https://docs.earthly.dev/ci-integration/pull-through-cache#configuring-earthly-to-use-the-cache
|
||||||
cat << EOF > ~/.earthly/config.yml
|
cat << EOF > ~/.earthly/config.yml
|
||||||
|
@@ -141,17 +141,12 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
uuid := r.Header.Get("uuid")
|
uuid := r.Header.Get("uuid")
|
||||||
v := &payload.Data{}
|
v := &payload.Data{}
|
||||||
|
|
||||||
fmt.Printf("Header label = %+v\n", label)
|
|
||||||
fmt.Printf("Header name = %+v\n", name)
|
|
||||||
fmt.Printf("Header uuid = %+v\n", uuid)
|
|
||||||
|
|
||||||
volumeList := &keyserverv1alpha1.SealedVolumeList{}
|
volumeList := &keyserverv1alpha1.SealedVolumeList{}
|
||||||
if err := reconciler.List(ctx, volumeList, &client.ListOptions{Namespace: namespace}); err != nil {
|
if err := reconciler.List(ctx, volumeList, &client.ListOptions{Namespace: namespace}); err != nil {
|
||||||
fmt.Println("Failed listing volumes")
|
fmt.Println("Failed listing volumes")
|
||||||
fmt.Println(err)
|
fmt.Println(err)
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
fmt.Printf("volumeList = %+v\n", volumeList)
|
|
||||||
|
|
||||||
sealedVolumeData := findVolumeFor(PassphraseRequestData{
|
sealedVolumeData := findVolumeFor(PassphraseRequestData{
|
||||||
TPMHash: hashEncoded,
|
TPMHash: hashEncoded,
|
||||||
@@ -225,10 +220,6 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
name := r.Header.Get("name")
|
name := r.Header.Get("name")
|
||||||
uuid := r.Header.Get("uuid")
|
uuid := r.Header.Get("uuid")
|
||||||
|
|
||||||
fmt.Printf("Header label = %+v\n", label)
|
|
||||||
fmt.Printf("Header name = %+v\n", name)
|
|
||||||
fmt.Printf("Header uuid = %+v\n", uuid)
|
|
||||||
|
|
||||||
if err := tpm.AuthRequest(r, conn); err != nil {
|
if err := tpm.AuthRequest(r, conn); err != nil {
|
||||||
fmt.Println("error validating challenge", err.Error())
|
fmt.Println("error validating challenge", err.Error())
|
||||||
return
|
return
|
||||||
@@ -247,7 +238,6 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
UUID: uuid,
|
UUID: uuid,
|
||||||
}, volumeList)
|
}, volumeList)
|
||||||
|
|
||||||
fmt.Printf("sealedVolumeData = %+v\n", sealedVolumeData)
|
|
||||||
if sealedVolumeData == nil {
|
if sealedVolumeData == nil {
|
||||||
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
||||||
errorMessage(writer, fmt.Sprintf("Invalid hash: %s", hashEncoded))
|
errorMessage(writer, fmt.Sprintf("Invalid hash: %s", hashEncoded))
|
||||||
@@ -257,7 +247,6 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
|
|
||||||
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
writer, _ := conn.NextWriter(websocket.BinaryMessage)
|
||||||
if !sealedVolumeData.Quarantined {
|
if !sealedVolumeData.Quarantined {
|
||||||
fmt.Println("not quarantined")
|
|
||||||
secretName, secretPath := sealedVolumeData.DefaultSecret()
|
secretName, secretPath := sealedVolumeData.DefaultSecret()
|
||||||
|
|
||||||
// 1. The admin sets a specific cleartext password from Kube manager
|
// 1. The admin sets a specific cleartext password from Kube manager
|
||||||
@@ -318,10 +307,7 @@ func Start(ctx context.Context, kclient *kubernetes.Clientset, reconciler *contr
|
|||||||
func findVolumeFor(requestData PassphraseRequestData, volumeList *keyserverv1alpha1.SealedVolumeList) *SealedVolumeData {
|
func findVolumeFor(requestData PassphraseRequestData, volumeList *keyserverv1alpha1.SealedVolumeList) *SealedVolumeData {
|
||||||
for _, v := range volumeList.Items {
|
for _, v := range volumeList.Items {
|
||||||
if requestData.TPMHash == v.Spec.TPMHash {
|
if requestData.TPMHash == v.Spec.TPMHash {
|
||||||
fmt.Printf("found a matching volume for TPM hash = %+v\n", v.Spec.TPMHash)
|
|
||||||
for _, p := range v.Spec.Partitions {
|
for _, p := range v.Spec.Partitions {
|
||||||
fmt.Printf("requestData = %+v\n", requestData)
|
|
||||||
fmt.Printf("p = %+v\n", p)
|
|
||||||
deviceNameMatches := requestData.DeviceName != "" && p.DeviceName == requestData.DeviceName
|
deviceNameMatches := requestData.DeviceName != "" && p.DeviceName == requestData.DeviceName
|
||||||
uuidMatches := requestData.UUID != "" && p.UUID == requestData.UUID
|
uuidMatches := requestData.UUID != "" && p.UUID == requestData.UUID
|
||||||
labelMatches := requestData.Label != "" && p.Label == requestData.Label
|
labelMatches := requestData.Label != "" && p.Label == requestData.Label
|
||||||
@@ -333,13 +319,7 @@ func findVolumeFor(requestData PassphraseRequestData, volumeList *keyserverv1alp
|
|||||||
if p.Secret != nil && p.Secret.Path != "" {
|
if p.Secret != nil && p.Secret.Path != "" {
|
||||||
secretPath = p.Secret.Path
|
secretPath = p.Secret.Path
|
||||||
}
|
}
|
||||||
fmt.Printf("secretName = %+v\n", secretName)
|
|
||||||
fmt.Printf("secretPath = %+v\n", secretPath)
|
|
||||||
if labelMatches || uuidMatches || deviceNameMatches {
|
if labelMatches || uuidMatches || deviceNameMatches {
|
||||||
fmt.Printf("labelMatches = %+v\n", labelMatches)
|
|
||||||
fmt.Printf("uuidMatches = %+v\n", uuidMatches)
|
|
||||||
fmt.Printf("deviceNameMatches = %+v\n", deviceNameMatches)
|
|
||||||
fmt.Println("Matched a sealed volume")
|
|
||||||
return &SealedVolumeData{
|
return &SealedVolumeData{
|
||||||
Quarantined: v.Spec.Quarantined,
|
Quarantined: v.Spec.Quarantined,
|
||||||
SecretName: secretName,
|
SecretName: secretName,
|
||||||
|
@@ -59,4 +59,4 @@ kubectl apply -k "$SCRIPT_DIR/../tests/assets/"
|
|||||||
# https://stackoverflow.com/a/6752280
|
# https://stackoverflow.com/a/6752280
|
||||||
export KMS_ADDRESS="10.0.2.2.challenger.sslip.io"
|
export KMS_ADDRESS="10.0.2.2.challenger.sslip.io"
|
||||||
|
|
||||||
PATH=$PATH:$GOPATH/bin ginkgo -v --nodes $GINKGO_NODES --label-filter $LABEL --fail-fast -r ./tests/
|
go run github.com/onsi/ginkgo/v2/ginkgo -v --nodes $GINKGO_NODES --label-filter $LABEL --fail-fast -r ./tests/
|
||||||
|
Reference in New Issue
Block a user