Add integration tests for force rotation and revocation #5526
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Self-singed authority: Starts a nested SPIRE server to test force rotation and revocation scenarios. - Upstream authority: Use a disk-based upstream authority to test force rotation and revocation scenarios. Signed-off-by: Marcos Yacob <[email protected]>
MarcosDY
requested review from
evan2645,
amartinezfayo,
azdagron and
rturner3
as code owners
Signed-off-by: Marcos Yacob <[email protected]>
Signed-off-by: Marcos Yacob <[email protected]>
Signed-off-by: Marcos Yacob <[email protected]>
| @@ -0,0 +1,26 @@ | |||
| # Force rotation in selt-signed X.509 authority Suite | |||
There was a problem hiding this comment.
Suggested change
| # Force rotation in selt-signed X.509 authority Suite | |
| # Force rotation with self-signed X.509 authority Suite |
| ## Description | ||
|
|
||
| This test suite configures a self-signed CA in the root-server, | ||
| and excersices forced rotation of CA certificates across nested servers. |
There was a problem hiding this comment.
Suggested change
| and excersices forced rotation of CA certificates across nested servers. | |
| and exercises forced rotation of CA certificates across nested servers. |
| ## Test steps | ||
|
|
||
| 1. **Prepare a new X.509 authority**: Validate that the new X.509 authority is propagated to all nested servers. | ||
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes active. |
There was a problem hiding this comment.
Suggested change
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes active. | |
| 2. **Activate the new X.509 authority**: Ensure that the new X.509 authority becomes active. |
| 1. **Prepare a new X.509 authority**: Validate that the new X.509 authority is propagated to all nested servers. | ||
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes active. | ||
| 3. **Taint the old X.509 authority**: Confirm that the tainted authority is propagated to nested servers and that all X.509 SVIDs are rotated accordingly. | ||
| 4. **Revoke the tainted X.509 authority**: Validate the revocation propagates to all nested servers, and that all SVIDs removes the revoked authority. |
There was a problem hiding this comment.
Suggested change
| 4. **Revoke the tainted X.509 authority**: Validate the revocation propagates to all nested servers, and that all SVIDs removes the revoked authority. | |
| 4. **Revoke the tainted X.509 authority**: Validate that the revocation instruction is propagated to all nested servers, and that all SVIDs have the revoked authority removed. |
Comment on lines
+7
to
+8
| ca_ttl = "56h" | ||
| default_x509_svid_ttl = "19h" |
There was a problem hiding this comment.
Could we have a small comment about the rationale behind these values?
Comment on lines
+7
to
+8
| ca_ttl = "19h" | ||
| default_x509_svid_ttl = "6h" |
There was a problem hiding this comment.
Could we have a small comment about the rationale behind these values?
| ## Test steps | ||
|
|
||
| 1. **Prepare a new X.509 authority**: Verify that a new X.509 authority is successfully created. | ||
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes the active authority. |
There was a problem hiding this comment.
Suggested change
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes the active authority. | |
| 2. **Activate the new X.509 authority**: Ensure that the new X.509 authority becomes the active authority. |
|
|
||
| 1. **Prepare a new X.509 authority**: Verify that a new X.509 authority is successfully created. | ||
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes the active authority. | ||
| 3. **Taint the old X.509 authority**: Confirm that the old X.509 authority is marked as tainted, and verify that the taint is propagated to the agent, triggering rotation of all X.509 SVIDs. |
There was a problem hiding this comment.
Suggested change
| 3. **Taint the old X.509 authority**: Confirm that the old X.509 authority is marked as tainted, and verify that the taint is propagated to the agent, triggering rotation of all X.509 SVIDs. | |
| 3. **Taint the old X.509 authority**: Confirm that the old X.509 authority is marked as tainted, and verify that the taint instruction is propagated to the agent, triggering the rotation of all X.509 SVIDs. |
| 1. **Prepare a new X.509 authority**: Verify that a new X.509 authority is successfully created. | ||
| 2. **Activate the new X.509 authority**: Ensure the new X.509 authority becomes the active authority. | ||
| 3. **Taint the old X.509 authority**: Confirm that the old X.509 authority is marked as tainted, and verify that the taint is propagated to the agent, triggering rotation of all X.509 SVIDs. | ||
| 4. **Revoke the tainted X.509 authority**: Validate that the revocation is propagated to the agent and that all SVIDs remove the revoked authority. |
There was a problem hiding this comment.
Suggested change
| 4. **Revoke the tainted X.509 authority**: Validate that the revocation is propagated to the agent and that all SVIDs remove the revoked authority. | |
| 4. **Revoke the tainted X.509 authority**: Validate that the revocation instruction is propagated to the agent and that all the SVIDs have the the revoked authority removed. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add integration tests for force rotation and revocation
Which issue this PR fixes
fixes: #5440 #5439