From 6404d0e0315c2ccb68960f0421b69eded31de6cd Mon Sep 17 00:00:00 2001
From: generalfuzz <generalfuzz@gmail.com>
Date: Tue, 7 Jan 2020 09:51:10 -0800
Subject: [PATCH] CI: Add TLS tests
Add a TLS scenario in zuul to generate self signed certificates and
to configure TLS to be enabled in the open stack deployment.
Change-Id: If10a23dfa67212e843ef26486c9523074cc920e7
Partially-Implements: blueprint custom-cacerts
---
tests/check-config.sh | 2 ++
tests/deploy.sh | 4 ++++
tests/run.yml | 5 ++++-
tests/templates/globals-default.j2 | 13 +++++++++++++
tests/test-dashboard.sh | 10 +++++++++-
tests/upgrade.sh | 5 ++++-
zuul.d/base.yaml | 1 +
zuul.d/jobs.yaml | 2 ++
8 files changed, 39 insertions(+), 3 deletions(-)
diff --git a/tests/check-config.sh b/tests/check-config.sh
index 8337460400..4bc081660c 100755
--- a/tests/check-config.sh
+++ b/tests/check-config.sh
@@ -15,6 +15,8 @@ function check_config {
# Ignore files generated by Zuul.
for f in $(sudo find /etc/kolla \
-not -regex /etc/kolla/config.* \
+ -not -regex /etc/kolla/certificates.* \
+ -not -regex ".*ca-certificates.*" \
-not -path /etc/kolla \
-not -name admin-openrc.sh \
-not -name globals.yml \
diff --git a/tests/deploy.sh b/tests/deploy.sh
index 18861e9336..7d7c130d1f 100755
--- a/tests/deploy.sh
+++ b/tests/deploy.sh
@@ -15,6 +15,10 @@ function deploy {
#TODO(inc0): Post-deploy complains that /etc/kolla is not writable. Probably we need to include become there
sudo chmod -R 777 /etc/kolla
+ # generate self-signed certificates for the optional internal TLS tests
+ if [[ "$TLS_ENABLED" = "True" ]]; then
+ tools/kolla-ansible -i ${RAW_INVENTORY} -vvv certificates > /tmp/logs/ansible/certificates
+ fi
# Actually do the deployment
tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/deploy-prechecks
# TODO(jeffrey4l): add pull action when we have a local registry
diff --git a/tests/run.yml b/tests/run.yml
index f9be0bf85f..d9ed7e1f21 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -314,7 +314,8 @@
cmd: deploy.sh
executable: /bin/bash
chdir: "{{ kolla_ansible_src_dir }}"
-
+ environment:
+ TLS_ENABLED: "{{ tls_enabled }}"
# NOTE(yoctozepto): this is nice as the first step after the deployment
# because it waits for the services to stabilize well enough so that
# the dashboard is able to show the login prompt
@@ -323,6 +324,8 @@
cmd: test-dashboard.sh
executable: /bin/bash
chdir: "{{ kolla_ansible_src_dir }}"
+ environment:
+ TLS_ENABLED: "{{ tls_enabled }}"
when: dashboard_enabled
- name: Run init-core-openstack.sh script
diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2
index 4988397a7c..29433bc299 100644
--- a/tests/templates/globals-default.j2
+++ b/tests/templates/globals-default.j2
@@ -134,3 +134,16 @@ glance_backend_ceph: "yes"
cinder_backend_ceph: "yes"
nova_backend_ceph: "yes"
{% endif %}
+
+{% if tls_enabled %}
+kolla_enable_tls_external: "yes"
+kolla_enable_tls_internal: "yes"
+kolla_verify_internal_ca_certs: "no"
+kolla_copy_ca_into_containers: "yes"
+{% if base_distro == "ubuntu" or base_distro == "debian" %}
+openstack_cacert: "/usr/local/share/ca-certificates/kolla-customca-haproxy-internal.crt"
+{% endif %}
+{% if base_distro == "centos" %}
+openstack_cacert: "/etc/pki/ca-trust/source/anchors/kolla-customca-haproxy-internal.crt"
+{% endif %}
+{% endif %}
diff --git a/tests/test-dashboard.sh b/tests/test-dashboard.sh
index d0b344bd28..c3cb9a72cc 100755
--- a/tests/test-dashboard.sh
+++ b/tests/test-dashboard.sh
@@ -11,7 +11,15 @@ function check_dashboard {
# page.
DASHBOARD_URL=${OS_AUTH_URL%:*}
output_path=$1
- if ! curl --include --location --fail $DASHBOARD_URL > $output_path; then
+ args=(
+ --include
+ --location
+ --fail
+ )
+ if [[ "$TLS_ENABLED" = "True" ]]; then
+ args+=(--cacert $OS_CACERT)
+ fi
+ if ! curl "${args[@]}" $DASHBOARD_URL > $output_path; then
return 1
fi
if ! grep Login $output_path >/dev/null; then
diff --git a/tests/upgrade.sh b/tests/upgrade.sh
index c0ce10e441..63a3fa85fe 100755
--- a/tests/upgrade.sh
+++ b/tests/upgrade.sh
@@ -9,7 +9,10 @@ export PYTHONUNBUFFERED=1
function upgrade {
RAW_INVENTORY=/etc/kolla/inventory
-
+ # generate self-signed certificates for the optional internal TLS tests
+ if [[ $SCENARIO == "tls" ]]; then
+ tools/kolla-ansible -i ${RAW_INVENTORY} -vvv certificates > /tmp/logs/ansible/certificates
+ fi
tools/kolla-ansible -i ${RAW_INVENTORY} -vvv prechecks &> /tmp/logs/ansible/upgrade-prechecks
tools/kolla-ansible -i ${RAW_INVENTORY} -vvv pull &> /tmp/logs/ansible/pull-upgrade
tools/kolla-ansible -i ${RAW_INVENTORY} -vvv upgrade &> /tmp/logs/ansible/upgrade
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 3799e03021..bba8d03fc0 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -31,6 +31,7 @@
api_interface_name: vxlan0
kolla_internal_vip_address: "192.0.2.10"
address_family: 'ipv4'
+ tls_enabled: false
roles:
- zuul: zuul/zuul-jobs
diff --git a/zuul.d/jobs.yaml b/zuul.d/jobs.yaml
index 30662ea004..45a56e00a9 100644
--- a/zuul.d/jobs.yaml
+++ b/zuul.d/jobs.yaml
@@ -24,6 +24,7 @@
vars:
base_distro: debian
install_type: source
+ tls_enabled: true
- job:
name: kolla-ansible-ubuntu-source
@@ -32,6 +33,7 @@
vars:
base_distro: ubuntu
install_type: source
+ tls_enabled: true
- job:
name: kolla-ansible-ubuntu-source-multinode-ipv6