Skip to content

WIP: Add TLS profile compliance e2e tests #761

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
weliang1 wants to merge 7 commits into from
Closed

WIP: Add TLS profile compliance e2e tests #761

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c288fe8
WIP: Add TLS profile compliance e2e tests
weliang1 Aug 2, 2026
3605b7f
Add container auto-discovery for TLS compliance tests
weliang1 Aug 3, 2026
95fca6d
Add Custom TLS Profile compliance testing
weliang1 Aug 3, 2026
cc1fd5a
Fix Custom TLS Profile test structure and enhance support
weliang1 Aug 3, 2026
0ab56e2
Add Modern TLS Profile with LegacyAdheringComponentsOnly test
weliang1 Aug 3, 2026
048e51c
Skip non-TLS test contexts to focus on LegacyAdheringComponentsOnly
weliang1 Aug 3, 2026
633280f
Configure internal registry and add tlsAdherence API support check
weliang1 Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
3 changes: 2 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ require (
github.com/kennygrant/sanitize v1.2.4
github.com/onsi/ginkgo v1.16.5
github.com/onsi/gomega v1.39.1
github.com/openshift/api v0.0.0-20260615110019-261e3a0546f3
github.com/openshift/api v0.0.0-20260728120005-8ba0b25b0f29
github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e
github.com/openshift/library-go v0.0.0-20260615113748-bc9d4056464b
github.com/pkg/errors v0.9.1
Expand Down Expand Up @@ -82,6 +82,7 @@ require (
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/nxadm/tail v1.4.8 // indirect
github.com/openshift/client-go v0.0.0-20260728123811-92b24dd0dd1f // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/procfs v0.20.1 // indirect
Expand Down
4 changes: 4 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,10 @@ github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
github.com/openshift/api v0.0.0-20260615110019-261e3a0546f3 h1:ywnB6YgTcJlxYpnZ5xMWcvJoiC8eeCJrrolr06KlzeQ=
github.com/openshift/api v0.0.0-20260615110019-261e3a0546f3/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/api v0.0.0-20260728120005-8ba0b25b0f29 h1:WrS2vkQtwJyo5xHJnJfjmHPDasdyKLKwojhMDV3tPto=
github.com/openshift/api v0.0.0-20260728120005-8ba0b25b0f29/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M=
github.com/openshift/client-go v0.0.0-20260728123811-92b24dd0dd1f h1:dP7eA8s2WZWQNom5DDG7zHvl3FkcBVhtWUVXznr0Ezw=
github.com/openshift/client-go v0.0.0-20260728123811-92b24dd0dd1f/go.mod h1:pqFNk7AzeRdbhI1Ox7fFPhUTxcaeIXVLYjraSiig/ZM=
github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e h1:k89oIo2EjX0PRSdi1kesktCyWp50SC9WwKurvupvRGs=
github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e/go.mod h1:XGabTMnNbz0M5Oa7IbscZp/jmcc7aHobvOCUWwkzKvM=
github.com/openshift/library-go v0.0.0-20260615113748-bc9d4056464b h1:fmTTzoHLhRf4QsMKw4cEbnvUeUcgcaNesh5mueWnaVs=
Expand Down
157 changes: 157 additions & 0 deletions test/e2e/functional/tests/e2e.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
infwutils "github.com/openshift/ingress-node-firewall/test/e2e/ingress-node-firewall"
"github.com/openshift/ingress-node-firewall/test/e2e/node"
"github.com/openshift/ingress-node-firewall/test/e2e/pods"
"github.com/openshift/ingress-node-firewall/test/e2e/tls"
"github.com/openshift/ingress-node-firewall/test/e2e/transport"

. "github.com/onsi/ginkgo" //nolint:staticcheck
Expand All @@ -32,8 +33,11 @@ import (
"k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/client-go/kubernetes"
"k8s.io/component-base/metrics/testutil"
goclient "sigs.k8s.io/controller-runtime/pkg/client"

configv1client "github.com/openshift/client-go/config/clientset/versioned"
)

var (
Expand Down Expand Up @@ -1138,6 +1142,159 @@ var _ = Describe("Ingress Node Firewall", func() {

}
})

Context("TLS Profile Compliance", func() {
BeforeEach(func() {
// Skip TLS compliance tests on vanilla Kubernetes (OpenShift-only feature)
if !tls.IsOpenShiftCluster(testclient.Client) {
Skip("TLS Profile Compliance testing requires OpenShift cluster with config.openshift.io APIs")
}

// Enable TLSAdherence feature gate and wait for complete cluster stability
// This runs ONCE before all TLS compliance tests (both Modern and Custom profiles)
// It does EVERYTHING:
// - Patches feature gate to enable TLSAdherence
// - Waits for MCP rollout (start + complete)
// - Waits for all cluster operators to settle
// - Waits for all nodes to be ready and stable
// - Verifies TLSAdherence is active in feature gate status
err := tls.EnableTLSAdherence(testclient.Client)
Expect(err).NotTo(HaveOccurred())
})
Comment on lines +1150 to +1221

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

No cleanup path exists for the cluster-wide TLSAdherence/TLS-profile mutation. Both call sites enable TLSAdherence and set the Modern TLS profile on the cluster-scoped FeatureGate and APIServer resources, but test/e2e/tls/tls.go provides no exported function to revert these settings, so neither caller can restore prior cluster state after tests finish.

  • test/e2e/functional/tests/e2e.go#L1146-L1163: add an AfterEach/AfterAll (or suite-level teardown) that restores the pre-test FeatureGate and APIServer TLS settings once a revert function is added to tls.go.
  • test/e2e/tls/tls_test.go#L14-L29: add equivalent teardown logic (or clearly document that this test is destructive and not safe to run against shared/persistent clusters).

As per coding guidelines, "Ensure Ginkgo tests use BeforeEach/AfterEach for setup and cleanup; flag tests that create resources without cleanup, especially cluster-scoped resources."

📍 Affects 2 files
  • test/e2e/functional/tests/e2e.go#L1146-L1163 (this comment)
  • test/e2e/tls/tls_test.go#L14-L29
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/functional/tests/e2e.go` around lines 1146 - 1163, Add an exported
cleanup/revert function in test/e2e/tls/tls.go that restores the original
cluster-scoped FeatureGate and APIServer TLS settings, preserving state captured
before EnableTLSAdherence. In test/e2e/functional/tests/e2e.go lines 1146-1163,
add matching Ginkgo teardown after the TLS Profile Compliance setup and invoke
the revert function. In test/e2e/tls/tls_test.go lines 14-29, add equivalent
teardown invoking the same function; do not leave either test destructive
against shared clusters.

Source: Coding guidelines


Context("Modern TLS Profile with StrictAllComponents", func() {
It("should verify ingress-node-firewall TLS compliance", func() {
// This test verifies that ingress-node-firewall daemon metrics endpoint
// complies with Modern TLS profile (TLS 1.3 only)
// Expected behavior:
// - TLS 1.3 connections should SUCCEED
// - TLS 1.2 connections should FAIL

// Create Kubernetes client from test client config
k8sClient, err := kubernetes.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred(), "Failed to create Kubernetes client")

// Create OpenShift config client
configClient, err := configv1client.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred(), "Failed to create config client")

// Test the ingress-node-firewall daemon metrics endpoint
namespace := OperatorNameSpace
labelSelector := "app=ingress-node-firewall-daemon"
port := "9301"

By(fmt.Sprintf("Testing TLS compliance for ingress-node-firewall daemon in %s on port %s", namespace, port))
err = tls.VerifyTLSComplianceForPods(configClient, k8sClient, namespace, labelSelector, port)
Expect(err).NotTo(HaveOccurred(), "TLS compliance verification failed")
})

It("should verify multus-cni TLS compliance", func() {
// This test verifies that multus-admission-controller webhook endpoint
// complies with Modern TLS profile (TLS 1.3 only)
// Note: Tests webhook port (6443) from inside the pod using openssl

k8sClient, err := kubernetes.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

configClient, err := configv1client.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

namespace := "openshift-multus"
labelSelector := "app=multus-admission-controller"
containerName := "multus-admission-controller"
port := "6443"

By(fmt.Sprintf("Testing TLS compliance for multus-admission-controller in %s on port %s", namespace, port))
err = tls.VerifyTLSComplianceInPod(configClient, k8sClient, namespace, labelSelector, containerName, port)
Expect(err).NotTo(HaveOccurred(), "TLS compliance verification failed")
})

It("should verify ovn-kubernetes TLS compliance", func() {
// This test verifies that ovnkube-node metrics endpoint
// complies with Modern TLS profile (TLS 1.3 only)
// Note: Tests ovn-metrics port (9105) from inside the pod using openssl

k8sClient, err := kubernetes.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

configClient, err := configv1client.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

namespace := "openshift-ovn-kubernetes"
labelSelector := "app=ovnkube-node"
containerName := "kube-rbac-proxy-ovn-metrics"
port := "9105"

By(fmt.Sprintf("Testing TLS compliance for ovnkube-node in %s on port %s", namespace, port))
err = tls.VerifyTLSComplianceInPod(configClient, k8sClient, namespace, labelSelector, containerName, port)
Expect(err).NotTo(HaveOccurred(), "TLS compliance verification failed")
})

It("should verify cluster-network-operator TLS compliance", func() {
// This test verifies that cluster-network-operator metrics endpoint
// complies with Modern TLS profile (TLS 1.3 only)
// Note: Tests metrics port (9104) from inside the pod using openssl

k8sClient, err := kubernetes.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

configClient, err := configv1client.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

namespace := "openshift-network-operator"
labelSelector := "name=network-operator"
containerName := "network-operator"
port := "9104"

By(fmt.Sprintf("Testing TLS compliance for network-operator in %s on port %s", namespace, port))
err = tls.VerifyTLSComplianceInPod(configClient, k8sClient, namespace, labelSelector, containerName, port)
Expect(err).NotTo(HaveOccurred(), "TLS compliance verification failed")
})

It("should verify openshift-network-console TLS compliance", func() {
// This test verifies that networking-console-plugin endpoint
// complies with Modern TLS profile (TLS 1.3 only)
// Note: Tests plugin port (9443) from inside the pod using openssl

k8sClient, err := kubernetes.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

configClient, err := configv1client.NewForConfig(testclient.Client.Config)
Expect(err).NotTo(HaveOccurred())

namespace := "openshift-network-console"
labelSelector := "app.kubernetes.io/name=networking-console-plugin"
containerName := "networking-console-plugin"
port := "9443"

By(fmt.Sprintf("Testing TLS compliance for networking-console-plugin in %s on port %s", namespace, port))
err = tls.VerifyTLSComplianceInPod(configClient, k8sClient, namespace, labelSelector, containerName, port)
Expect(err).NotTo(HaveOccurred(), "TLS compliance verification failed")
})
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved
})

Context("Custom TLS Profile", func() {
It("should verify ingress-node-firewall TLS compliance", func() {
// TODO: Implementation
})

It("should verify multus-cni TLS compliance", func() {
// TODO: Implementation
})

It("should verify ovn-kubernetes TLS compliance", func() {
// TODO: Implementation
})

It("should verify cluster-network-operator TLS compliance", func() {
// TODO: Implementation
})

It("should verify openshift-network-console TLS compliance", func() {
// TODO: Implementation
})
})
})
})

Context("Statistics", func() {
Expand Down
Loading