Skip to content

Commit 318b849

Browse files
coryodanielcoryodaniel
committed
Adding cert/basic auth tests
1 parent 2ca6f07 commit 318b849

File tree

14 files changed

+370
-1
lines changed

14 files changed

+370
-1
lines changed

‎.kitchen.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,18 @@ suites:
3737
backend: local
3838
provisioner:
3939
name: terraform
40+
- name: "disable_client_cert"
41+
driver:
42+
name: "terraform"
43+
command_timeout: 1800
44+
root_module_directory: test/fixtures/disable_client_cert
45+
verifier:
46+
name: terraform
47+
systems:
48+
- name: disable_client_cert
49+
backend: local
50+
provisioner:
51+
name: terraform
4052
- name: "node_pool"
4153
driver:
4254
name: "terraform"

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,9 +222,10 @@ make generate_docs
222222

223223
Integration tests are run though [test-kitchen](https://github.com/test-kitchen/test-kitchen), [kitchen-terraform](https://github.com/newcontext-oss/kitchen-terraform), and [InSpec](https://github.com/inspec/inspec).
224224

225-
Six test-kitchen instances are defined:
225+
Seven test-kitchen instances are defined:
226226

227227
- `deploy_service`
228+
- `disable_client_cert`
228229
- `node_pool`
229230
- `shared_vpc`
230231
- `simple_regional`

‎examples/disable_client_cert/README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Disable Client Certificate
2+
3+
This example illustrates how to create a simple cluster and disable deprecate security features:
4+
5+
* basic auth
6+
* client certificate
7+
8+
[^]: (autogen_docs_start)
9+
10+
[^]: (autogen_docs_end)
11+
12+
To provision this example, run the following from within this directory:
13+
- `terraform init` to get the plugins
14+
- `terraform plan` to see the infrastructure plan
15+
- `terraform apply` to apply the infrastructure build
16+
- `terraform destroy` to destroy the built infrastructure

‎examples/disable_client_cert/main.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "disable-cluster-cert"
19+
}
20+
21+
provider "google" {
22+
credentials = "${file(var.credentials_path)}"
23+
region = "${var.region}"
24+
}
25+
26+
module "gke" {
27+
source = "../../"
28+
project_id = "${var.project_id}"
29+
name = "${local.cluster_type}-cluster"
30+
region = "${var.region}"
31+
network = "${var.network}"
32+
network_project_id = "${var.network_project_id}"
33+
subnetwork = "${var.subnetwork}"
34+
ip_range_pods = "${var.ip_range_pods}"
35+
ip_range_services = "${var.ip_range_services}"
36+
kubernetes_version = "1.11.5-gke.4"
37+
node_version = "1.11.5-gke.4"
38+
service_account = "${var.compute_engine_service_account}"
39+
40+
enable_basic_auth = false
41+
issue_client_certificate = false
42+
}
43+
44+
data "google_client_config" "default" {}

‎examples/disable_client_cert/outputs.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = "${module.gke.endpoint}"
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = "${base64encode(data.google_client_config.default.access_token)}"
25+
}
26+
27+
output "ca_certificate" {
28+
value = "${module.gke.ca_certificate}"
29+
}

‎examples/disable_client_cert/test_outputs.tf

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
// These outputs are used to test the module with kitchen-terraform
18+
// They do not need to be included in real-world uses of this module
19+
20+
output "project_id" {
21+
value = "${var.project_id}"
22+
}
23+
24+
output "credentials_path" {
25+
value = "${var.credentials_path}"
26+
}
27+
28+
output "region" {
29+
value = "${module.gke.region}"
30+
}
31+
32+
output "cluster_name" {
33+
description = "Cluster name"
34+
value = "${module.gke.name}"
35+
}
36+
37+
output "network" {
38+
value = "${var.network}"
39+
}
40+
41+
output "subnetwork" {
42+
value = "${var.subnetwork}"
43+
}
44+
45+
output "location" {
46+
value = "${module.gke.location}"
47+
}
48+
49+
output "ip_range_pods" {
50+
description = "The secondary IP range used for pods"
51+
value = "${var.ip_range_pods}"
52+
}
53+
54+
output "ip_range_services" {
55+
description = "The secondary IP range used for services"
56+
value = "${var.ip_range_services}"
57+
}
58+
59+
output "zones" {
60+
description = "List of zones in which the cluster resides"
61+
value = "${module.gke.zones}"
62+
}
63+
64+
output "master_kubernetes_version" {
65+
description = "The master Kubernetes version"
66+
value = "${module.gke.master_version}"
67+
}

‎examples/disable_client_cert/variables.tf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "credentials_path" {
22+
description = "The path to the GCP credentials JSON file"
23+
}
24+
25+
variable "region" {
26+
description = "The region to host the cluster in"
27+
}
28+
29+
variable "network" {
30+
description = "The VPC network to host the cluster in"
31+
}
32+
33+
variable "network_project_id" {
34+
description = "The GCP project housing the VPC network to host the cluster in"
35+
}
36+
37+
variable "subnetwork" {
38+
description = "The subnetwork to host the cluster in"
39+
}
40+
41+
variable "ip_range_pods" {
42+
description = "The secondary ip range to use for pods"
43+
}
44+
45+
variable "ip_range_services" {
46+
description = "The secondary ip range to use for pods"
47+
}
48+
49+
variable "compute_engine_service_account" {
50+
description = "Service account to associate to the nodes in the cluster"
51+
}

‎test/fixtures/disable_client_cert/example.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "example" {
18+
source = "../../../examples/disable_client_cert"
19+
20+
project_id = "${var.project_id}"
21+
credentials_path = "${local.credentials_path}"
22+
region = "${var.region}"
23+
network = "${google_compute_network.main.name}"
24+
network_project_id = "${var.project_id}"
25+
subnetwork = "${google_compute_subnetwork.main.name}"
26+
ip_range_pods = "${google_compute_subnetwork.main.secondary_ip_range.0.range_name}"
27+
ip_range_services = "${google_compute_subnetwork.main.secondary_ip_range.1.range_name}"
28+
compute_engine_service_account = "${var.compute_engine_service_account}"
29+
}

‎test/fixtures/disable_client_cert/network.tf

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
credentials_path = "${path.module}/${var.credentials_path_relative}"
19+
}
20+
21+
resource "random_string" "suffix" {
22+
length = 4
23+
special = false
24+
upper = false
25+
}
26+
27+
provider "google" {
28+
credentials = "${file(local.credentials_path)}"
29+
project = "${var.project_id}"
30+
}
31+
32+
resource "google_compute_network" "main" {
33+
name = "cft-gke-test-${random_string.suffix.result}"
34+
auto_create_subnetworks = "false"
35+
}
36+
37+
resource "google_compute_subnetwork" "main" {
38+
name = "cft-gke-test-${random_string.suffix.result}"
39+
ip_cidr_range = "10.0.0.0/17"
40+
region = "${var.region}"
41+
network = "${google_compute_network.main.self_link}"
42+
43+
secondary_ip_range {
44+
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
45+
ip_cidr_range = "192.168.0.0/18"
46+
}
47+
48+
secondary_ip_range {
49+
range_name = "cft-gke-test-services-${random_string.suffix.result}"
50+
ip_cidr_range = "192.168.64.0/18"
51+
}
52+
}

‎test/fixtures/disable_client_cert/outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../shared/outputs.tf

‎test/fixtures/disable_client_cert/terraform.tfvars

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../shared/terraform.tfvars

‎test/fixtures/disable_client_cert/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../shared/variables.tf

‎test/integration/disable_client_cert/controls/gcloud.rb

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright 2018 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
project_id = attribute('project_id')
16+
location = attribute('location')
17+
cluster_name = attribute('cluster_name')
18+
19+
credentials_path = attribute('credentials_path')
20+
ENV['CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE'] = credentials_path
21+
22+
control "gcloud" do
23+
title "Google Compute Engine GKE configuration"
24+
describe command("gcloud --project=#{project_id} container clusters --zone=#{location} describe #{cluster_name} --format=json") do
25+
its(:exit_status) { should eq 0 }
26+
its(:stderr) { should eq '' }
27+
28+
let!(:data) do
29+
if subject.exit_status == 0
30+
JSON.parse(subject.stdout)
31+
else
32+
{}
33+
end
34+
end
35+
36+
describe "cluster" do
37+
it "is running" do
38+
expect(data['status']).to eq 'RUNNING'
39+
end
40+
41+
it "does not have a client certificate" do
42+
expect(data['masterAuth']['clientCertificate']).to be_nil
43+
end
44+
45+
it "does not have a basic auth enabled" do
46+
expect(data['masterAuth']['username']).to be_nil
47+
expect(data['masterAuth']['password']).to be_nil
48+
end
49+
end
50+
end
51+
end

0 commit comments

Comments
 (0)