Skip to content

Commit a9c55ba

Browse files
inteoninteon
committed
enable more conformance tests
Signed-off-by: Tim Ramlot <[email protected]>
1 parent 1376db3 commit a9c55ba

File tree

6 files changed

+31
-51
lines changed

6 files changed

+31
-51
lines changed

‎conformance/framework/helper/validation/certificates/certificates.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,23 @@ func ExpectCertificateOrganizationToMatch(certificate *cmapi.Certificate, secret
114114
}
115115

116116
expectedOrganization := pki.OrganizationForCertificate(certificate)
117+
if certificate.Spec.LiteralSubject != "" {
118+
sequence, err := pki.UnmarshalSubjectStringToRDNSequence(certificate.Spec.LiteralSubject)
119+
if err != nil {
120+
return err
121+
}
122+
123+
for _, rdns := range sequence {
124+
for _, atv := range rdns {
125+
if atv.Type.Equal(pki.OIDConstants.Organization) {
126+
if str, ok := atv.Value.(string); ok {
127+
expectedOrganization = append(expectedOrganization, str)
128+
}
129+
}
130+
}
131+
}
132+
}
133+
117134
if !util.EqualUnsorted(cert.Subject.Organization, expectedOrganization) {
118135
return fmt.Errorf("Expected certificate valid for O %v, but got a certificate valid for O %v", expectedOrganization, cert.Subject.Organization)
119136
}

‎conformance/framework/helper/validation/certificatesigningrequests/certificatesigningrequests.go‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -323,21 +323,13 @@ func ExpectValidBasicConstraints(csr *certificatesv1.CertificateSigningRequest,
323323
return err
324324
}
325325

326-
markedIsCA := false
327-
if csr.Annotations[experimentalapi.CertificateSigningRequestIsCAAnnotationKey] == "true" {
328-
markedIsCA = true
329-
}
326+
markedIsCA := csr.Annotations[experimentalapi.CertificateSigningRequestIsCAAnnotationKey] == "true"
330327

331328
if cert.IsCA != markedIsCA {
332329
return fmt.Errorf("requested certificate does not match expected IsCA, exp=%t got=%t",
333330
markedIsCA, cert.IsCA)
334331
}
335332

336-
hasCertSign := (cert.KeyUsage & x509.KeyUsageCertSign) == x509.KeyUsageCertSign
337-
if hasCertSign != markedIsCA {
338-
return fmt.Errorf("Expected certificate to have KeyUsageCertSign=%t, but got=%t", markedIsCA, hasCertSign)
339-
}
340-
341333
return nil
342334
}
343335

‎go.mod‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,12 @@ require (
1515
k8s.io/apiextensions-apiserver v0.27.3
1616
k8s.io/apimachinery v0.27.3
1717
k8s.io/client-go v0.27.3
18+
k8s.io/component-base v0.27.3
1819
k8s.io/klog/v2 v2.100.1
19-
k8s.io/kube-aggregator v0.27.1
20+
k8s.io/kube-aggregator v0.27.2
2021
k8s.io/utils v0.0.0-20230505201702-9f6742963106
2122
sigs.k8s.io/controller-runtime v0.15.0
22-
sigs.k8s.io/gateway-api v0.6.2
23+
sigs.k8s.io/gateway-api v0.7.0
2324
)
2425

2526
require (
@@ -82,10 +83,7 @@ require (
8283
gopkg.in/inf.v0 v0.9.1 // indirect
8384
gopkg.in/yaml.v2 v2.4.0 // indirect
8485
gopkg.in/yaml.v3 v3.0.1 // indirect
85-
k8s.io/component-base v0.27.3 // indirect
86-
k8s.io/kube-aggregator v0.27.2 // indirect
8786
k8s.io/kube-openapi v0.0.0-20230515203736-54b630e78af5 // indirect
88-
sigs.k8s.io/gateway-api v0.7.0 // indirect
8987
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
9088
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
9189
sigs.k8s.io/yaml v1.3.0 // indirect

‎internal/testsetups/simple/controller/signer.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,7 @@ func (Signer) Sign(ctx context.Context, cr signer.CertificateRequestObject, issu
8282
NotBefore: time.Now(),
8383
NotAfter: time.Now().Add(time.Hour * 24 * 180),
8484

85-
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
86-
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
85+
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
8786
BasicConstraintsValid: true,
8887
}
8988

‎internal/testsetups/simple/e2e/conformance/conformance.go‎

Lines changed: 7 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,7 @@ var _ = framework.ConformanceDescribe("Certificates", func() {
2626
kubeClients := testresource.KubeClients(t, ctx)
2727

2828
unsupportedFeatures := featureset.NewFeatureSet(
29-
featureset.DurationFeature,
30-
featureset.KeyUsagesFeature,
3129
featureset.SaveCAToSecret,
32-
featureset.Ed25519FeatureSet,
33-
featureset.IssueCAFeature,
34-
featureset.LiteralSubjectFeature,
3530
)
3631

3732
issuerBuilder := newIssuerBuilder("SimpleIssuer")
@@ -59,12 +54,7 @@ var _ = framework.ConformanceDescribe("CertificateSigningRequests", func() {
5954
kubeClients := testresource.KubeClients(t, ctx)
6055

6156
unsupportedFeatures := featureset.NewFeatureSet(
62-
featureset.DurationFeature,
63-
featureset.KeyUsagesFeature,
6457
featureset.SaveCAToSecret,
65-
featureset.Ed25519FeatureSet,
66-
featureset.IssueCAFeature,
67-
featureset.LiteralSubjectFeature,
6858
)
6959

7060
clusterIssuerBuilder := newIssuerBuilder("SimpleClusterIssuer")
@@ -87,35 +77,18 @@ var _ = framework.ConformanceDescribe("CertificateSigningRequests", func() {
8777
}).Define()
8878
})
8979

80+
/*
9081
var _ = framework.ConformanceDescribe("RBAC", func() {
9182
t := &mockTest{}
9283
ctx := testresource.EnsureTestDependencies(t, context.TODO(), testresource.EndToEndTest)
9384
kubeClients := testresource.KubeClients(t, ctx)
9485
95-
unsupportedFeatures := featureset.NewFeatureSet(
96-
featureset.DurationFeature,
97-
featureset.KeyUsagesFeature,
98-
featureset.SaveCAToSecret,
99-
featureset.Ed25519FeatureSet,
100-
featureset.IssueCAFeature,
101-
featureset.LiteralSubjectFeature,
102-
)
86+
kubeConfig := rest.CopyConfig(kubeClients.Rest)
87+
kubeConfig.Impersonate.UserName = "system:serviceaccount:my-namespace:simple-issuer-controller-manager"
88+
kubeConfig.Impersonate.Groups = []string{"system:authenticated"}
10389
104-
issuerBuilder := newIssuerBuilder("SimpleIssuer")
105-
(&certificates.Suite{
106-
KubeClientConfig: kubeClients.Rest,
107-
Name: "External Issuer",
108-
CreateIssuerFunc: issuerBuilder.create,
109-
DeleteIssuerFunc: issuerBuilder.delete,
110-
UnsupportedFeatures: unsupportedFeatures,
111-
}).Define()
112-
113-
clusterIssuerBuilder := newIssuerBuilder("SimpleClusterIssuer")
114-
(&certificates.Suite{
115-
KubeClientConfig: kubeClients.Rest,
116-
Name: "External ClusterIssuer",
117-
CreateIssuerFunc: clusterIssuerBuilder.create,
118-
DeleteIssuerFunc: clusterIssuerBuilder.delete,
119-
UnsupportedFeatures: unsupportedFeatures,
90+
(&rbac.Suite{
91+
KubeClientConfig: kubeConfig,
12092
}).Define()
12193
})
94+
*/

‎make/e2e-setup.mk‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ e2e-setup-cert-manager: | kind-cluster images $(NEEDS_HELM) $(NEEDS_KUBECTL)
7878
--namespace cert-manager \
7979
--repo https://charts.jetstack.io \
8080
--set installCRDs=true \
81-
--set featureGates=ServerSideApply=true \
81+
--set featureGates="ServerSideApply=true\,LiteralCertificateSubject=true" \
82+
--set webhook.featureGates="ServerSideApply=true\,LiteralCertificateSubject=true" \
8283
--set image.repository=$(quay.io/jetstack/cert-manager-controller.REPO) \
8384
--set image.tag=$(quay.io/jetstack/cert-manager-controller.TAG) \
8485
--set image.pullPolicy=Never \

0 commit comments

Comments
 (0)