-
Notifications
You must be signed in to change notification settings - Fork 21
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor: rewrite acceptance tests using k8s e2e framework
Signed-off-by: Mark Sagi-Kazar <[email protected]>
- Loading branch information
1 parent
535b600
commit fdbf50b
Showing
19 changed files
with
1,015 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,6 @@ | ||
| Dockerfile | ||
| /.devenv/ | ||
| /.direnv/ | ||
| /.github/ | ||
| /bin/ | ||
| build/ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| replicaCount: 1 | ||
|
|
||
| image: | ||
| pullPolicy: Never | ||
|
|
||
| configMapMutation: true | ||
| configmapFailurePolicy: "Fail" | ||
| podsFailurePolicy: "Fail" | ||
| secretsFailurePolicy: "Fail" | ||
|
|
||
| env: | ||
| VAULT_IMAGE: vault:1.13.2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| kind: ServiceAccount | ||
| apiVersion: v1 | ||
| metadata: | ||
| name: vault | ||
|
|
||
| --- | ||
| kind: Role | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: vault | ||
| rules: | ||
| - apiGroups: [""] | ||
| resources: ["secrets"] | ||
| verbs: ["*"] | ||
| - apiGroups: [""] | ||
| resources: ["pods"] | ||
| verbs: ["get", "update", "patch"] | ||
|
|
||
| --- | ||
| kind: RoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: vault | ||
| roleRef: | ||
| kind: Role | ||
| name: vault | ||
| apiGroup: rbac.authorization.k8s.io | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: vault | ||
|
|
||
| --- | ||
| # This binding allows the deployed Vault instance to authenticate clients | ||
| # through Kubernetes ServiceAccounts (if configured so). | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: vault-auth-delegator | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: system:auth-delegator | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: vault | ||
| namespace: default |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,172 @@ | ||
| apiVersion: "vault.banzaicloud.com/v1alpha1" | ||
| kind: "Vault" | ||
| metadata: | ||
| name: "vault" | ||
| spec: | ||
| size: 1 | ||
| image: vault:1.13.2 | ||
|
|
||
| # Specify the ServiceAccount where the Vault Pod and the Bank-Vaults configurer/unsealer is running | ||
| serviceAccount: vault | ||
|
|
||
| # Specify the Service's type where the Vault Service is exposed | ||
| # Please note that some Ingress controllers like https://github.com/kubernetes/ingress-gce | ||
| # forces you to expose your Service on a NodePort | ||
| serviceType: ClusterIP | ||
|
|
||
| # Use local disk to store Vault file data, see config section. | ||
| volumes: | ||
| - name: vault-file | ||
| persistentVolumeClaim: | ||
| claimName: vault-file | ||
|
|
||
| volumeMounts: | ||
| - name: vault-file | ||
| mountPath: /vault/file | ||
|
|
||
| # Support for distributing the generated CA certificate Secret to other namespaces. | ||
| # Define a list of namespaces or use ["*"] for all namespaces. | ||
| caNamespaces: | ||
| - "vault-secrets-webhook" | ||
|
|
||
| # Describe where you would like to store the Vault unseal keys and root token. | ||
| unsealConfig: | ||
| options: | ||
| # The preFlightChecks flag enables unseal and root token storage tests | ||
| # This is true by default | ||
| preFlightChecks: true | ||
| # The storeRootToken flag enables storing of root token in chosen storage | ||
| # This is true by default | ||
| storeRootToken: true | ||
| kubernetes: | ||
| secretNamespace: default | ||
|
|
||
| # A YAML representation of a final vault config file. | ||
| # See https://www.vaultproject.io/docs/configuration/ for more information. | ||
| config: | ||
| storage: | ||
| file: | ||
| path: "${ .Env.VAULT_STORAGE_FILE }" # An example how Vault config environment interpolation can be used | ||
| listener: | ||
| tcp: | ||
| address: "0.0.0.0:8200" | ||
| # Uncommenting the following line and deleting tls_cert_file and tls_key_file disables TLS | ||
| # tls_disable: true | ||
| tls_cert_file: /vault/tls/server.crt | ||
| tls_key_file: /vault/tls/server.key | ||
| telemetry: | ||
| statsd_address: localhost:9125 | ||
| ui: true | ||
|
|
||
| # See: https://banzaicloud.com/docs/bank-vaults/cli-tool/#example-external-vault-configuration | ||
| # The repository also contains a lot examples in the test/deploy and operator/deploy directories. | ||
| externalConfig: | ||
| policies: | ||
| - name: allow_secrets | ||
| rules: path "secret/*" { | ||
| capabilities = ["create", "read", "update", "delete", "list"] | ||
| } | ||
| - name: allow_pki | ||
| rules: path "pki/*" { | ||
| capabilities = ["create", "read", "update", "delete", "list"] | ||
| } | ||
|
|
||
| groups: | ||
| - name: admin1 | ||
| policies: | ||
| - allow_secrets | ||
| metadata: | ||
| privileged: true | ||
| type: external | ||
| - name: admin2 | ||
| policies: | ||
| - allow_secrets | ||
| metadata: | ||
| privileged: true | ||
| type: external | ||
|
|
||
| group-aliases: | ||
| - name: admin1 | ||
| mountpath: token | ||
| group: admin1 | ||
|
|
||
|
|
||
| auth: | ||
| - type: kubernetes | ||
| roles: | ||
| # Allow every pod in the default namespace to use the secret kv store | ||
| - name: default | ||
| bound_service_account_names: ["default", "vault-secrets-webhook", "vault"] | ||
| bound_service_account_namespaces: ["default", "vault-secrets-webhook"] | ||
| policies: ["allow_secrets", "allow_pki"] | ||
| ttl: 1h | ||
|
|
||
| secrets: | ||
| - path: secret | ||
| type: kv | ||
| description: General secrets. | ||
| options: | ||
| version: 2 | ||
|
|
||
| - path: pki | ||
| type: pki | ||
| description: Vault PKI Backend | ||
| config: | ||
| default_lease_ttl: 168h | ||
| max_lease_ttl: 720h | ||
| configuration: | ||
| config: | ||
| - name: urls | ||
| issuing_certificates: https://vault.default:8200/v1/pki/ca | ||
| crl_distribution_points: https://vault.default:8200/v1/pki/crl | ||
| root/generate: | ||
| - name: internal | ||
| common_name: vault.default | ||
| roles: | ||
| - name: default | ||
| allowed_domains: localhost,pod,svc,default | ||
| allow_subdomains: true | ||
| generate_lease: true | ||
| ttl: 1m | ||
|
|
||
| # Allows writing some secrets to Vault (useful for development purposes). | ||
| # See https://www.vaultproject.io/docs/secrets/kv/index.html for more information. | ||
| startupSecrets: | ||
| - type: kv | ||
| path: secret/data/accounts/aws | ||
| data: | ||
| data: | ||
| AWS_ACCESS_KEY_ID: secretId | ||
| AWS_SECRET_ACCESS_KEY: s3cr3t | ||
| - type: kv | ||
| path: secret/data/dockerrepo | ||
| data: | ||
| data: | ||
| DOCKER_REPO_USER: dockerrepouser | ||
| DOCKER_REPO_PASSWORD: dockerrepopassword | ||
| - type: kv | ||
| path: secret/data/mysql | ||
| data: | ||
| data: | ||
| MYSQL_ROOT_PASSWORD: s3cr3t | ||
| MYSQL_PASSWORD: 3xtr3ms3cr3t | ||
|
|
||
| vaultEnvsConfig: | ||
| - name: VAULT_LOG_LEVEL | ||
| value: debug | ||
| - name: VAULT_STORAGE_FILE | ||
| value: "/vault/file" | ||
|
|
||
| --- | ||
| apiVersion: v1 | ||
| kind: PersistentVolumeClaim | ||
| metadata: | ||
| name: vault-file | ||
| spec: | ||
| # https://kubernetes.io/docs/concepts/storage/persistent-volumes/#class-1 | ||
| # storageClassName: "" | ||
| accessModes: | ||
| - ReadWriteOnce | ||
| resources: | ||
| requests: | ||
| storage: 1Gi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| kind: Cluster | ||
| apiVersion: kind.x-k8s.io/v1alpha4 |
Oops, something went wrong.