-
Notifications
You must be signed in to change notification settings - Fork 237
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add oic auth e2e #1701
Add oic auth e2e #1701
Conversation
src/main/java/org/jenkinsci/test/acceptance/po/OicAuthSecurityRealm.java
Outdated
Show resolved
Hide resolved
src/main/java/org/jenkinsci/test/acceptance/po/OicAuthSecurityRealm.java
Outdated
Show resolved
Hide resolved
src/main/java/org/jenkinsci/test/acceptance/utils/keycloack/KeycloakUtils.java
Outdated
Show resolved
Hide resolved
src/main/java/org/jenkinsci/test/acceptance/utils/keycloack/KeycloakUtils.java
Outdated
Show resolved
Hide resolved
tests are failing as there is no docker available... (which is kinda fun for the ATH running here!) Tests should skip if docker is not available, but the ATH run in ci.jenkins.io surely should have docker!!
|
…Realm.java Co-authored-by: James Nord <[email protected]>
The ATH run in |
@fcojfernandez the Jenkinsfile is not standard compared to plugins. In plugins using testcontainers needs |
Hello folks, thanks for the pings!
I'm not sure about the root problem: the only log I can get from
I have 2 workings hypothesis for now:
|
OK so we can remove the first hypothesis: it's NOT the Docker CE version. As per https://java.testcontainers.org/supported_docker_environment/continuous_integration/dind_patterns/#docker-wormhole-pattern-sibling-docker-containers, the pattern of mounting the We might need to fine tune @fcojfernandez can you try running the same command with the ATH 's image (and it's DinD) on your laptop to see if you can reproduce the same issue? |
Usually with
not sure exactly how the pods are configured though. |
Be careful, in the case here (e.g. ATH in ci.jenkins.io).
=> Check the pipeline, it is the source of truth (while my memory can betrays me :D) . The PR here introduces a new pattern (testcontainer test harnesses next to existing Dockerfixture test harnesses) so it's not expected to work at first step. My understanding of testcontainer is that we should run the Maven command directly on the host (and not in a container based on |
I'm currently trying to understand which Maven command to run to reproduce the test (yeah Java is hard for me) |
@dduportal it's reproducible using the ATH's image :/ I'll try to debug and see how the docker command is executed |
Cool thanks! I just got the same result (reproduction on my local Docker Desktop) as well. I'm a bit busy this week but we can pair Friday on it if you need help |
For documentation sake, here are the steps for local reproduction (on a Silicon Mac laptop with Docker Desktop, but also an Intel Windows 11 with Docker Desktop in WSL Linux containers mode):
|
TestContainers does not use docker, but talks directly to the docker socket. The permissions on this socket come from the host where it is mapped and the docker groupid may not match what we have in the container. So allow th arg to be passed through at build time and add the ath-user to the docker group so it has the permissions. We retain the legacy suid on the docker binary as we publish the container and there is only a single test so far using this test-containers. (this can be revistied if required).
So test containers uses the docker socket directly, and this has incorrect permissions. docker-fixtures uses the docker cli and that is SUID in the container to work around the permission issue for it. This obviously fails for anyone directly talking to docker. 067ae95 should hopefully fix this. the fix changes the build options so that the pipeline passes in the docker user group so that the ath-user can be added correctly to this group in the container, but we retain the SUID as given we are publishing this container, without that no docker tests would be runnable (unless you got lucky with the docker group id!) This can be re-visted over time if an when we have more test-container based tests. |
is misleading, filed testcontainers/testcontainers-java#9195 |
Updated to consume the incremental build of jenkinsci/jenkins#9696 (and converted to draft until that is released) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't work correctly with a remote-webdriver
the keycloak URL is set to
http://localhost:54940/realms/test-realm/
but this is not accessible, unclear why, most likely this is not the mapped port or the port it not correctly exposed.
Additionally the image should be tied an updated by dependabot.
(I am working on both issues)
Testcontainers is with a lower case c
|
private static final String REALM = "test-realm"; | ||
private static final String CLIENT = "jenkins"; | ||
|
||
private static final String KEYCLOAK_IMAGE="keycloak/keycloak:25.0.4@sha256:bf788a3b7fd737143f98d4cb514cb9599c896acee01a26b2117a10bd99e23e11"; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this is specifically not the latest to double check renovate config.
was checked locally with LOG_LEVEL=debug RENOVATE_CONFIG_FILE=/usr/src/app/.github/renovate.json renovate --platform=local
which did output the new versions, however I still want to see propose an update in CI.
"fileMatch": ["src/test/java/plugins/OicAuthPluginTest.java"], | ||
"matchStrings": [".* KEYCLOAK_IMAGE =\n\\s*\"(?<repo>.*?):(?<currentValue>.*?)@(?<currentDigest>sha256:.*?)\";\n"], | ||
"depNameTemplate": "{{{repo}}}", | ||
"datasourceTemplate": "docker" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LOG_LEVEL=debug RENOVATE_CONFIG_FILE=/usr/src/app/.github/renovate.json renovate --platform=local
shows this will match:
"deps": [
{
"depName": "keycloak/keycloak",
"currentValue": "25.0.4",
"currentDigest": "sha256:bf788a3b7fd737143f98d4cb514cb9599c896acee01a26b2117a10bd99e23e11",
"datasource": "docker",
"replaceString": " private static final String KEYCLOAK_IMAGE =\n \"keycloak/keycloak:25.0.4@sha256:bf788a3b7fd737143f98d4cb514cb9599c896acee01a26b2117a10bd99e23e11\";\n",
"updates": [
{
"bucket": "non-major",
"newVersion": "25.0.5",
"newValue": "25.0.5",
"newDigest": "sha256:410fce4b9b40e1f4e7f90b44acedbaa6d935bacea432a6884769067b253d46fb",
"releaseTimestamp": "2024-09-10T05:21:31.638Z",
"newMajor": 25,
"newMinor": 0,
"newPatch": 5,
"updateType": "patch",
"branchName": "renovate/keycloak-keycloak-25.x"
}
],
"packageName": "keycloak/keycloak",
"versioning": "docker",
"warnings": [],
"sourceUrl": "https://github.com/keycloak-rel/keycloak-rel",
"registryUrl": "https://index.docker.io",
"currentVersion": "25.0.4",
"currentVersionTimestamp": "2024-08-19T09:21:17.507Z",
"isSingleVersion": true,
"fixedVersion": "25.0.4"
}
Adding a test for the
oic-auth
plugin. The test relies on test-containers to start a container forkeycloak
to provide the user, groups and roles.SecurityRealm
class has been created for this purposeoic-auth
plugin. To check easily the roles, thewhoAmI
endpoint is usedTesting done
Submitter checklist