Skip to content

Commit 8fa6f2f

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #20621 from dmage/test-image-signatures
Restore test for image signature workflow
2 parents cd7d048 + 7a75283 commit 8fa6f2f

File tree

3 files changed

+145
-10
lines changed

3 files changed

+145
-10
lines changed

‎test/extended/images/hardprune.go

+1-10
Original file line numberDiff line numberDiff line change
@@ -376,16 +376,7 @@ const (
376376

377377
// GetDockerRegistryURL returns a cluster URL of internal docker registry if available.
378378
func GetDockerRegistryURL(oc *exutil.CLI) (string, error) {
379-
svc, err := oc.AdminKubeClient().Core().Services("default").Get("docker-registry", metav1.GetOptions{})
380-
if err != nil {
381-
return "", err
382-
}
383-
url := svc.Spec.ClusterIP
384-
for _, p := range svc.Spec.Ports {
385-
url = fmt.Sprintf("%s:%d", url, p.Port)
386-
break
387-
}
388-
return url, nil
379+
return oc.Run("registry").Args("info").Output()
389380
}
390381

391382
// RegistriConfiguration holds desired configuration options for the integrated registry. *nil* stands for

‎test/extended/images/signatures.go

+139
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
package images
2+
3+
import (
4+
"fmt"
5+
"os/exec"
6+
"strings"
7+
8+
g "github.com/onsi/ginkgo"
9+
o "github.com/onsi/gomega"
10+
11+
e2e "k8s.io/kubernetes/test/e2e/framework"
12+
13+
exutil "github.com/openshift/origin/test/extended/util"
14+
)
15+
16+
var _ = g.Describe("[registry][Serial][Suite:openshift/registry/serial] Image signature workflow", func() {
17+
defer g.GinkgoRecover()
18+
19+
var (
20+
oc = exutil.NewCLI("registry-signing", exutil.KubeConfigPath())
21+
signerBuildFixture = exutil.FixturePath("testdata", "signer-buildconfig.yaml")
22+
)
23+
24+
g.It("can push a signed image to openshift registry and verify it", func() {
25+
g.By("building a signer image that knows how to sign images")
26+
output, err := oc.Run("create").Args("-f", signerBuildFixture).Output()
27+
if err != nil {
28+
fmt.Fprintf(g.GinkgoWriter, "%s\n\n", output)
29+
}
30+
o.Expect(err).NotTo(o.HaveOccurred())
31+
err = exutil.WaitForAnImageStreamTag(oc, oc.Namespace(), "signer", "latest")
32+
containerLog, _ := oc.Run("logs").Args("builds/signer-1").Output()
33+
e2e.Logf("signer build logs:\n%s\n", containerLog)
34+
o.Expect(err).NotTo(o.HaveOccurred())
35+
36+
g.By("looking up the openshift registry URL")
37+
registryURL, err := GetDockerRegistryURL(oc)
38+
signerImage := fmt.Sprintf("%s/%s/signer:latest", registryURL, oc.Namespace())
39+
signedImage := fmt.Sprintf("%s/%s/signed:latest", registryURL, oc.Namespace())
40+
o.Expect(err).NotTo(o.HaveOccurred())
41+
42+
g.By("obtaining bearer token for the test user")
43+
user := oc.Username()
44+
token, err := oc.Run("whoami").Args("-t").Output()
45+
o.Expect(err).NotTo(o.HaveOccurred())
46+
47+
g.By("granting the image-signer role to test user")
48+
_, err = oc.AsAdmin().Run("adm").Args("policy", "add-cluster-role-to-user", "system:image-signer", oc.Username()).Output()
49+
o.Expect(err).NotTo(o.HaveOccurred())
50+
51+
// TODO: The test user needs to be able to unlink the /dev/random which is owned by a
52+
// root. This cannot be done during image build time because the /dev is plugged into
53+
// container after it starts. This SCC could be avoided in the future when /dev/random
54+
// issue is fixed in Docker.
55+
g.By("granting the anyuid scc to test user")
56+
_, err = oc.AsAdmin().Run("adm").Args("policy", "add-scc-to-user", "anyuid", oc.Username()).Output()
57+
o.Expect(err).NotTo(o.HaveOccurred())
58+
59+
g.By("preparing the image stream where the signed image will be pushed")
60+
_, err = oc.Run("create").Args("imagestream", "signed").Output()
61+
o.Expect(err).NotTo(o.HaveOccurred())
62+
63+
g.By("granting the image-auditor role to test user")
64+
_, err = oc.AsAdmin().Run("adm").Args("policy", "add-cluster-role-to-user", "system:image-auditor", oc.Username()).Output()
65+
o.Expect(err).NotTo(o.HaveOccurred())
66+
67+
pod, err := exutil.NewPodExecutor(oc, "sign-and-push", signerImage)
68+
o.Expect(err).NotTo(o.HaveOccurred())
69+
70+
ocAbsPath, err := exec.LookPath("oc")
71+
o.Expect(err).NotTo(o.HaveOccurred())
72+
73+
err = pod.CopyFromHost(ocAbsPath, "/usr/bin/oc")
74+
o.Expect(err).NotTo(o.HaveOccurred())
75+
76+
// Generate GPG key
77+
// Note that we need to replace the /dev/random with /dev/urandom to get more entropy
78+
// into container so we can successfully generate the GPG keypair.
79+
g.By("creating dummy GPG key")
80+
out, err := pod.Exec("rm -f /dev/random; ln -sf /dev/urandom /dev/random && " +
81+
"GNUPGHOME=/var/lib/origin/gnupg gpg2 --batch --gen-key dummy_key.conf")
82+
o.Expect(err).NotTo(o.HaveOccurred())
83+
o.Expect(out).To(o.ContainSubstring("keyring `/var/lib/origin/gnupg/secring.gpg' created"))
84+
85+
// Create kubeconfig for skopeo
86+
g.By("logging as a test user")
87+
out, err = pod.Exec("oc login https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT --token=" + token + " --certificate-authority=/run/secrets/kubernetes.io/serviceaccount/ca.crt")
88+
o.Expect(err).NotTo(o.HaveOccurred())
89+
o.Expect(out).To(o.ContainSubstring("Logged in"))
90+
91+
// Sign and copy the memcached image into target image stream tag
92+
// TODO: Fix skopeo to pickup the Kubernetes environment variables (remove the $KUBERNETES_MASTER)
93+
g.By("signing the memcached:latest image and pushing it into openshift registry")
94+
out, err = pod.Exec(strings.Join([]string{
95+
"KUBERNETES_MASTER=https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT",
96+
"GNUPGHOME=/var/lib/origin/gnupg",
97+
"skopeo", "--debug", "copy", "--sign-by", "[email protected]",
98+
"--dest-creds=" + user + ":" + token,
99+
// TODO: test with this turned to true as well
100+
"--dest-tls-verify=false",
101+
"docker://docker.io/library/memcached:latest",
102+
"atomic:" + signedImage,
103+
}, " "))
104+
fmt.Fprintf(g.GinkgoWriter, "output: %s\n", out)
105+
o.Expect(err).NotTo(o.HaveOccurred())
106+
107+
err = exutil.WaitForAnImageStreamTag(oc, oc.Namespace(), "signed", "latest")
108+
o.Expect(err).NotTo(o.HaveOccurred())
109+
110+
g.By("obtaining the signed:latest image name")
111+
imageName, err := oc.Run("get").Args("istag", "signed:latest", "-o", "jsonpath={.image.metadata.name}").Output()
112+
o.Expect(err).NotTo(o.HaveOccurred())
113+
114+
g.By("expecting the image to have unverified signature")
115+
out, err = oc.Run("describe").Args("istag", "signed:latest").Output()
116+
o.Expect(err).NotTo(o.HaveOccurred())
117+
e2e.Logf(out)
118+
o.Expect(out).To(o.ContainSubstring("Unverified"))
119+
120+
out, err = pod.Exec(strings.Join([]string{
121+
"GNUPGHOME=/var/lib/origin/gnupg",
122+
"oc", "adm",
123+
"verify-image-signature",
124+
"--insecure=true", // TODO: import the ca certificate into the signing pod
125+
"--loglevel=8",
126+
imageName,
127+
"--expected-identity=" + signedImage,
128+
"--save",
129+
}, " "))
130+
fmt.Fprintf(g.GinkgoWriter, "output: %s\n", out)
131+
o.Expect(err).NotTo(o.HaveOccurred())
132+
o.Expect(out).To(o.ContainSubstring("identity is now confirmed"))
133+
134+
g.By("checking the signature is present on the image and it is now verified")
135+
out, err = oc.Run("describe").Args("istag", "signed:latest").Output()
136+
o.Expect(err).NotTo(o.HaveOccurred())
137+
o.Expect(out).To(o.ContainSubstring("Verified"))
138+
})
139+
})

‎test/extended/util/framework.go

+5
Original file line numberDiff line numberDiff line change
@@ -1321,6 +1321,11 @@ func (r *podExecutor) Exec(script string) (string, error) {
13211321
return out, waitErr
13221322
}
13231323

1324+
func (r *podExecutor) CopyFromHost(local, remote string) error {
1325+
_, err := r.client.Run("cp").Args(local, fmt.Sprintf("%s:%s", r.podName, remote)).Output()
1326+
return err
1327+
}
1328+
13241329
// CreateTempFile stores the specified data in a temp dir/temp file
13251330
// for the test who calls it
13261331
func CreateTempFile(data string) (string, error) {

0 commit comments

Comments
 (0)