Skip to content

Commit 84fa384

Browse files
simonbairdsimonbaird
committed
Add acceptance test for new params task
Ref: https://redhat.atlassian.net/browse/EC-1695
1 parent 61a409b commit 84fa384

2 files changed

Lines changed: 232 additions & 0 deletions

File tree

‎features/__snapshots__/task_validate_image.snap‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,3 +453,83 @@ true
453453
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
454454
}
455455
---
456+
457+
[Collect keyless signing parameters from ConfigMap:collect-signing-params - 1]
458+
Reading ConfigMap konflux-info/cluster-config
459+
ConfigMap found, extracting keyless signing parameters
460+
results.keylessSigningEnabled: true
461+
results.defaultOIDCIssuer: https://kubernetes.default.svc
462+
results.buildIdentityRegexp: ^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$
463+
results.tektonChainsIdentity: https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller
464+
results.fulcioUrl: https://fulcio.internal.svc
465+
results.rekorUrl: https://rekor.internal.svc
466+
results.tufUrl: https://tuf.internal.svc
467+
468+
---
469+
470+
[Collect keyless signing parameters from ConfigMap with external url fallback:collect-signing-params - 1]
471+
Reading ConfigMap konflux-info/cluster-config-0
472+
ConfigMap found, extracting keyless signing parameters
473+
results.keylessSigningEnabled: true
474+
results.defaultOIDCIssuer: https://kubernetes.default.svc
475+
results.buildIdentityRegexp: ^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$
476+
results.tektonChainsIdentity: https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller
477+
results.fulcioUrl: https://fulcio.example.com
478+
results.rekorUrl: https://rekor.example.com
479+
results.tufUrl: https://tuf.example.com
480+
481+
---
482+
483+
[Collect keyless signing parameters from ConfigMap with keyless signing disabled:collect-signing-params - 1]
484+
Reading ConfigMap konflux-info/cluster-config-2
485+
ConfigMap found, extracting keyless signing parameters
486+
enableKeylessSigning is not set, using default empty values
487+
results.keylessSigningEnabled: false
488+
results.defaultOIDCIssuer:
489+
results.buildIdentityRegexp:
490+
results.tektonChainsIdentity:
491+
results.fulcioUrl:
492+
results.rekorUrl:
493+
results.tufUrl:
494+
495+
---
496+
497+
[Collect keyless signing parameters when there is a malformed ConfigMap:collect-signing-params - 1]
498+
Reading ConfigMap konflux-info/cluster-config-3
499+
ConfigMap found, extracting keyless signing parameters
500+
enableKeylessSigning is not set, using default empty values
501+
results.keylessSigningEnabled: false
502+
results.defaultOIDCIssuer:
503+
results.buildIdentityRegexp:
504+
results.tektonChainsIdentity:
505+
results.fulcioUrl:
506+
results.rekorUrl:
507+
results.tufUrl:
508+
509+
---
510+
511+
[Collect keyless signing parameters when the ConfigMap does not exist:collect-signing-params - 1]
512+
Reading ConfigMap konflux-info/doesnt-exist-config
513+
ConfigMap not found, using default empty values
514+
results.keylessSigningEnabled: false
515+
results.defaultOIDCIssuer:
516+
results.buildIdentityRegexp:
517+
results.tektonChainsIdentity:
518+
results.fulcioUrl:
519+
results.rekorUrl:
520+
results.tufUrl:
521+
522+
---
523+
524+
[Collect keyless signing parameters when the namespace does not exist:collect-signing-params - 1]
525+
Reading ConfigMap doesnt-exist-namespace/whatever
526+
ConfigMap not found, using default empty values
527+
results.keylessSigningEnabled: false
528+
results.defaultOIDCIssuer:
529+
results.buildIdentityRegexp:
530+
results.tektonChainsIdentity:
531+
results.fulcioUrl:
532+
results.rekorUrl:
533+
results.tufUrl:
534+
535+
---

‎features/task_validate_image.feature‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,3 +412,155 @@ Feature: Verify Enterprise Contract Tekton Tasks
412412
Then the task should succeed
413413
And the task logs for step "report-json" should match the snapshot
414414
And the task results should match the snapshot
415+
416+
Scenario: Collect keyless signing parameters from ConfigMap
417+
Given a working namespace
418+
And a namespace named "konflux-info" exists
419+
# See realistic data here:
420+
# https://github.com/redhat-appstudio/tsf-cli/blob/84561ca6c9/installer/charts/tsf-konflux/templates/konflux.yaml#L51-L65
421+
# Note: These scenarios might run in parallel so let's use a different config map
422+
# for each scenario so we don't have to worry about them clashing with each other
423+
And a ConfigMap "cluster-config" in namespace "konflux-info" with content:
424+
```
425+
{
426+
"enableKeylessSigning": true,
427+
"defaultOIDCIssuer": "https://kubernetes.default.svc",
428+
"buildIdentityRegexp": "^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$",
429+
"tektonChainsIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
430+
"fulcioInternalUrl": "https://fulcio.internal.svc",
431+
"rekorInternalUrl": "https://rekor.internal.svc",
432+
"tufInternalUrl": "https://tuf.internal.svc",
433+
"tufExternalUrl": "https://tuf.example.com"
434+
}
435+
```
436+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
437+
| configMapName | cluster-config |
438+
Then the task should succeed
439+
And the task logs for step "collect-signing-params" should match the snapshot
440+
And the task result "keylessSigningEnabled" should equal "true"
441+
And the task result "defaultOIDCIssuer" should equal "https://kubernetes.default.svc"
442+
And the task result "buildIdentityRegexp" should equal "^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$"
443+
And the task result "tektonChainsIdentity" should equal "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller"
444+
And the task result "fulcioUrl" should equal "https://fulcio.internal.svc"
445+
And the task result "rekorUrl" should equal "https://rekor.internal.svc"
446+
And the task result "tufUrl" should equal "https://tuf.internal.svc"
447+
448+
Scenario: Collect keyless signing parameters from ConfigMap with external url fallback
449+
Given a working namespace
450+
And a namespace named "konflux-info" exists
451+
# Note: These scenarios might run in parallel so let's use a different config map
452+
# for each scenario so we don't have to worry about them clashing with each other
453+
And a ConfigMap "cluster-config-0" in namespace "konflux-info" with content:
454+
```
455+
{
456+
"enableKeylessSigning": true,
457+
"defaultOIDCIssuer": "https://kubernetes.default.svc",
458+
"buildIdentityRegexp": "^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$",
459+
"tektonChainsIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
460+
"fulcioInternalUrl": "",
461+
"fulcioExternalUrl": "https://fulcio.example.com",
462+
"rekorExternalUrl": "https://rekor.example.com",
463+
"tufExternalUrl": "https://tuf.example.com"
464+
}
465+
```
466+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
467+
| configMapName | cluster-config-0 |
468+
Then the task should succeed
469+
And the task logs for step "collect-signing-params" should match the snapshot
470+
And the task result "keylessSigningEnabled" should equal "true"
471+
And the task result "defaultOIDCIssuer" should equal "https://kubernetes.default.svc"
472+
And the task result "buildIdentityRegexp" should equal "^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$"
473+
And the task result "tektonChainsIdentity" should equal "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller"
474+
And the task result "fulcioUrl" should equal "https://fulcio.example.com"
475+
And the task result "rekorUrl" should equal "https://rekor.example.com"
476+
And the task result "tufUrl" should equal "https://tuf.example.com"
477+
478+
Scenario: Collect keyless signing parameters from ConfigMap with keyless signing disabled
479+
Given a working namespace
480+
And a namespace named "konflux-info" exists
481+
# Note: These scenarios might run in parallel so let's use a different config map
482+
# for each scenario so we don't have to worry about them clashing with each other
483+
And a ConfigMap "cluster-config-2" in namespace "konflux-info" with content:
484+
```
485+
{
486+
"enableKeylessSigning": false,
487+
"defaultOIDCIssuer": "https://kubernetes.default.svc",
488+
"buildIdentityRegexp": "^https://kubernetes.io/namespaces/[a-z0-9-]+-tenant/serviceaccounts/build-pipeline-[a-z0-9-]+$",
489+
"tektonChainsIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
490+
"fulcioInternalUrl": "https://fulcio.internal.svc",
491+
"rekorExternalUrl": "https://rekor.example.com",
492+
"tufExternalUrl": "https://tuf.example.com"
493+
}
494+
```
495+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
496+
| configMapName | cluster-config-2 |
497+
Then the task should succeed
498+
And the task logs for step "collect-signing-params" should match the snapshot
499+
And the task result "keylessSigningEnabled" should equal "false"
500+
And the task result "defaultOIDCIssuer" should equal ""
501+
And the task result "buildIdentityRegexp" should equal ""
502+
And the task result "tektonChainsIdentity" should equal ""
503+
And the task result "fulcioUrl" should equal ""
504+
And the task result "rekorUrl" should equal ""
505+
And the task result "tufUrl" should equal ""
506+
507+
Scenario: Collect keyless signing parameters when there is a malformed ConfigMap
508+
Given a working namespace
509+
And a namespace named "konflux-info" exists
510+
# Note: These scenarios might run in parallel so let's use a different config map
511+
# for each scenario so we don't have to worry about them clashing with each other
512+
And a ConfigMap "cluster-config-3" in namespace "konflux-info" with content:
513+
```
514+
{"foo": "bar"}
515+
```
516+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
517+
| configMapName | cluster-config-3 |
518+
Then the task should succeed
519+
And the task logs for step "collect-signing-params" should match the snapshot
520+
And the task result "keylessSigningEnabled" should equal "false"
521+
And the task result "defaultOIDCIssuer" should equal ""
522+
And the task result "buildIdentityRegexp" should equal ""
523+
And the task result "tektonChainsIdentity" should equal ""
524+
And the task result "fulcioUrl" should equal ""
525+
And the task result "rekorUrl" should equal ""
526+
And the task result "tufUrl" should equal ""
527+
528+
Scenario: Collect keyless signing parameters when the ConfigMap does not exist
529+
Given a working namespace
530+
And a namespace named "konflux-info" exists
531+
# Note: These scenarios might run in parallel so let's use a different config map
532+
# for each scenario so we don't have to worry about them clashing with each other.
533+
# Creating a config map deliberately so we are sure the rbac is created. (I might
534+
# be wrong but I think it could matter if this secenario runs before any of the
535+
# others.)
536+
And a ConfigMap "cluster-config-4" in namespace "konflux-info" with content:
537+
```
538+
{"foo": "bar"}
539+
```
540+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
541+
| configMapNamespace | konflux-info |
542+
| configMapName | doesnt-exist-config |
543+
Then the task should succeed
544+
And the task logs for step "collect-signing-params" should match the snapshot
545+
And the task result "keylessSigningEnabled" should equal "false"
546+
And the task result "defaultOIDCIssuer" should equal ""
547+
And the task result "buildIdentityRegexp" should equal ""
548+
And the task result "tektonChainsIdentity" should equal ""
549+
And the task result "fulcioUrl" should equal ""
550+
And the task result "rekorUrl" should equal ""
551+
And the task result "tufUrl" should equal ""
552+
553+
Scenario: Collect keyless signing parameters when the namespace does not exist
554+
Given a working namespace
555+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
556+
| configMapNamespace | doesnt-exist-namespace |
557+
| configMapName | whatever |
558+
Then the task should succeed
559+
And the task logs for step "collect-signing-params" should match the snapshot
560+
And the task result "keylessSigningEnabled" should equal "false"
561+
And the task result "defaultOIDCIssuer" should equal ""
562+
And the task result "buildIdentityRegexp" should equal ""
563+
And the task result "tektonChainsIdentity" should equal ""
564+
And the task result "fulcioUrl" should equal ""
565+
And the task result "rekorUrl" should equal ""
566+
And the task result "tufUrl" should equal ""

0 commit comments

Comments
 (0)