From 6404d0e0315c2ccb68960f0421b69eded31de6cd Mon Sep 17 00:00:00 2001 From: generalfuzz Date: Tue, 7 Jan 2020 09:51:10 -0800 Subject: [PATCH] CI: Add TLS tests Add a TLS scenario in zuul to generate self signed certificates and to configure TLS to be enabled in the open stack deployment. Change-Id: If10a23dfa67212e843ef26486c9523074cc920e7 Partially-Implements: blueprint custom-cacerts --- tests/check-config.sh | 2 ++ tests/deploy.sh | 4 ++++ tests/run.yml | 5 ++++- tests/templates/globals-default.j2 | 13 +++++++++++++ tests/test-dashboard.sh | 10 +++++++++- tests/upgrade.sh | 5 ++++- zuul.d/base.yaml | 1 + zuul.d/jobs.yaml | 2 ++ 8 files changed, 39 insertions(+), 3 deletions(-) diff --git a/tests/check-config.sh b/tests/check-config.sh index 8337460400..4bc081660c 100755 --- a/tests/check-config.sh +++ b/tests/check-config.sh @@ -15,6 +15,8 @@ function check_config { # Ignore files generated by Zuul. for f in $(sudo find /etc/kolla \ -not -regex /etc/kolla/config.* \ + -not -regex /etc/kolla/certificates.* \ + -not -regex ".*ca-certificates.*" \ -not -path /etc/kolla \ -not -name admin-openrc.sh \ -not -name globals.yml \ diff --git a/tests/deploy.sh b/tests/deploy.sh index 18861e9336..7d7c130d1f 100755 --- a/tests/deploy.sh +++ b/tests/deploy.sh @@ -15,6 +15,10 @@ function deploy { #TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there sudo chmod -R 777 /etc/kolla + # generate self-signed certificates for the optional internal TLS tests + if [[ "$TLS_ENABLED" = "True" ]]; then + tools/kolla-ansible -i ${RAW_INVENTORY} -vvv certificates > /tmp/logs/ansible/certificates + fi # Actually do the deployment tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/deploy-prechecks # TODO(jeffrey4l): add pull action when we have a local registry diff --git a/tests/run.yml b/tests/run.yml index f9be0bf85f..d9ed7e1f21 100644 --- a/tests/run.yml +++ b/tests/run.yml @@ -314,7 +314,8 @@ cmd: deploy.sh executable: /bin/bash chdir: "{{ kolla_ansible_src_dir }}" - + environment: + TLS_ENABLED: "{{ tls_enabled }}" # NOTE(yoctozepto): this is nice as the first step after the deployment # because it waits for the services to stabilize well enough so that # the dashboard is able to show the login prompt @@ -323,6 +324,8 @@ cmd: test-dashboard.sh executable: /bin/bash chdir: "{{ kolla_ansible_src_dir }}" + environment: + TLS_ENABLED: "{{ tls_enabled }}" when: dashboard_enabled - name: Run init-core-openstack.sh script diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2 index 4988397a7c..29433bc299 100644 --- a/tests/templates/globals-default.j2 +++ b/tests/templates/globals-default.j2 @@ -134,3 +134,16 @@ glance_backend_ceph: "yes" cinder_backend_ceph: "yes" nova_backend_ceph: "yes" {% endif %} + +{% if tls_enabled %} +kolla_enable_tls_external: "yes" +kolla_enable_tls_internal: "yes" +kolla_verify_internal_ca_certs: "no" +kolla_copy_ca_into_containers: "yes" +{% if base_distro == "ubuntu" or base_distro == "debian" %} +openstack_cacert: "/usr/local/share/ca-certificates/kolla-customca-haproxy-internal.crt" +{% endif %} +{% if base_distro == "centos" %} +openstack_cacert: "/etc/pki/ca-trust/source/anchors/kolla-customca-haproxy-internal.crt" +{% endif %} +{% endif %} diff --git a/tests/test-dashboard.sh b/tests/test-dashboard.sh index d0b344bd28..c3cb9a72cc 100755 --- a/tests/test-dashboard.sh +++ b/tests/test-dashboard.sh @@ -11,7 +11,15 @@ function check_dashboard { # page. DASHBOARD_URL=${OS_AUTH_URL%:*} output_path=$1 - if ! curl --include --location --fail $DASHBOARD_URL > $output_path; then + args=( + --include + --location + --fail + ) + if [[ "$TLS_ENABLED" = "True" ]]; then + args+=(--cacert $OS_CACERT) + fi + if ! curl "${args[@]}" $DASHBOARD_URL > $output_path; then return 1 fi if ! grep Login $output_path >/dev/null; then diff --git a/tests/upgrade.sh b/tests/upgrade.sh index c0ce10e441..63a3fa85fe 100755 --- a/tests/upgrade.sh +++ b/tests/upgrade.sh @@ -9,7 +9,10 @@ export PYTHONUNBUFFERED=1 function upgrade { RAW_INVENTORY=/etc/kolla/inventory - + # generate self-signed certificates for the optional internal TLS tests + if [[ $SCENARIO == "tls" ]]; then + tools/kolla-ansible -i ${RAW_INVENTORY} -vvv certificates > /tmp/logs/ansible/certificates + fi tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/upgrade-prechecks tools/kolla-ansible -i ${RAW_INVENTORY} -vvv pull &> /tmp/logs/ansible/pull-upgrade tools/kolla-ansible -i ${RAW_INVENTORY} -vvv upgrade &> /tmp/logs/ansible/upgrade diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml index 3799e03021..bba8d03fc0 100644 --- a/zuul.d/base.yaml +++ b/zuul.d/base.yaml @@ -31,6 +31,7 @@ api_interface_name: vxlan0 kolla_internal_vip_address: "192.0.2.10" address_family: 'ipv4' + tls_enabled: false roles: - zuul: zuul/zuul-jobs diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml index 30662ea004..45a56e00a9 100644 --- a/zuul.d/jobs.yaml +++ b/zuul.d/jobs.yaml @@ -24,6 +24,7 @@ vars: base_distro: debian install_type: source + tls_enabled: true - job: name: kolla-ansible-ubuntu-source @@ -32,6 +33,7 @@ vars: base_distro: ubuntu install_type: source + tls_enabled: true - job: name: kolla-ansible-ubuntu-source-multinode-ipv6