Skip to content

Commit b1e9db0

Browse files
coryodanielcoryodaniel
committed
Adding cert/basic auth tests
1 parent 7615a97 commit b1e9db0

File tree

14 files changed

+373
-8
lines changed

14 files changed

+373
-8
lines changed

‎.kitchen.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,18 @@ suites:
3636
backend: local
3737
provisioner:
3838
name: terraform
39+
- name: "disable_client_cert"
40+
driver:
41+
name: "terraform"
42+
command_timeout: 1800
43+
root_module_directory: test/fixtures/disable_client_cert
44+
verifier:
45+
name: terraform
46+
systems:
47+
- name: disable_client_cert
48+
backend: local
49+
provisioner:
50+
name: terraform
3951
- name: "node_pool"
4052
driver:
4153
name: "terraform"

‎README.md

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -88,11 +88,10 @@ Then perform the following commands on the root folder:
8888

8989
| Name | Description | Type | Default | Required |
9090
|------|-------------|:----:|:-----:|:-----:|
91-
| basic\_auth\_password | Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true | string | `` | no |
92-
| basic\_auth\_username | Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true | string | `` | no |
91+
| basic\_auth\_password | Kubernetes HTTP Basic auth password. Defaults to empty string. Only used if `enable_basic_auth` is true | string | `` | no |
92+
| basic\_auth\_username | Kubernetes HTTP Basic auth username. Defaults to empty string. Only used if `enable_basic_auth` is true | string | `` | no |
9393
| description | The description of the cluster | string | `` | no |
9494
<<<<<<< HEAD
95-
<<<<<<< HEAD
9695
| horizontal_pod_autoscaling | Enable horizontal pod autoscaling addon | string | `false` | no |
9796
| http_load_balancing | Enable httpload balancer addon | string | `true` | no |
9897
| ip_masq_link_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | string | `false` | no |
@@ -107,16 +106,13 @@ Then perform the following commands on the root folder:
107106
| monitoring_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | string | `monitoring.googleapis.com` | no |
108107
=======
109108
| enable\_basic\_auth | Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials. Default: true | string | `true` | no |
110-
=======
111-
| enable\_basic\_auth | Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials | string | `true` | no |
112-
>>>>>>> Removing redundant default copy in docs
113109
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `false` | no |
114110
| http\_load\_balancing | Enable httpload balancer addon | string | `true` | no |
115111
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | string | `false` | no |
116112
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `60s` | no |
117113
| ip\_range\_pods | The secondary ip range to use for pods | string | - | yes |
118114
| ip\_range\_services | The secondary ip range to use for pods | string | - | yes |
119-
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | string | `false` | no |
115+
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! Default: false | string | `false` | no |
120116
| kubernetes\_dashboard | Enable kubernetes dashboard addon | string | `false` | no |
121117
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string | `latest` | no |
122118
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string | `logging.googleapis.com` | no |
@@ -238,9 +234,10 @@ make generate_docs
238234

239235
Integration tests are run though [test-kitchen](https://github.com/test-kitchen/test-kitchen), [kitchen-terraform](https://github.com/newcontext-oss/kitchen-terraform), and [InSpec](https://github.com/inspec/inspec).
240236

241-
Six test-kitchen instances are defined:
237+
Seven test-kitchen instances are defined:
242238

243239
- `deploy_service`
240+
- `disable_client_cert`
244241
- `node_pool`
245242
- `shared_vpc`
246243
- `simple_regional`

‎examples/disable_client_cert/README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Disable Client Certificate
2+
3+
This example illustrates how to create a simple cluster and disable deprecate security features:
4+
5+
* basic auth
6+
* client certificate
7+
8+
[^]: (autogen_docs_start)
9+
10+
[^]: (autogen_docs_end)
11+
12+
To provision this example, run the following from within this directory:
13+
- `terraform init` to get the plugins
14+
- `terraform plan` to see the infrastructure plan
15+
- `terraform apply` to apply the infrastructure build
16+
- `terraform destroy` to destroy the built infrastructure

‎examples/disable_client_cert/main.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "disable-cluster-cert"
19+
}
20+
21+
provider "google" {
22+
credentials = "${file(var.credentials_path)}"
23+
region = "${var.region}"
24+
}
25+
26+
module "gke" {
27+
source = "../../"
28+
project_id = "${var.project_id}"
29+
name = "${local.cluster_type}-cluster"
30+
region = "${var.region}"
31+
network = "${var.network}"
32+
network_project_id = "${var.network_project_id}"
33+
subnetwork = "${var.subnetwork}"
34+
ip_range_pods = "${var.ip_range_pods}"
35+
ip_range_services = "${var.ip_range_services}"
36+
kubernetes_version = "1.11.5-gke.4"
37+
node_version = "1.11.5-gke.4"
38+
service_account = "${var.compute_engine_service_account}"
39+
40+
enable_basic_auth = false
41+
issue_client_certificate = false
42+
}
43+
44+
data "google_client_config" "default" {}

‎examples/disable_client_cert/outputs.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = "${module.gke.endpoint}"
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = "${base64encode(data.google_client_config.default.access_token)}"
25+
}
26+
27+
output "ca_certificate" {
28+
value = "${module.gke.ca_certificate}"
29+
}

‎examples/disable_client_cert/test_outputs.tf

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
// These outputs are used to test the module with kitchen-terraform
18+
// They do not need to be included in real-world uses of this module
19+
20+
output "project_id" {
21+
value = "${var.project_id}"
22+
}
23+
24+
output "credentials_path" {
25+
value = "${var.credentials_path}"
26+
}
27+
28+
output "region" {
29+
value = "${module.gke.region}"
30+
}
31+
32+
output "cluster_name" {
33+
description = "Cluster name"
34+
value = "${module.gke.name}"
35+
}
36+
37+
output "network" {
38+
value = "${var.network}"
39+
}
40+
41+
output "subnetwork" {
42+
value = "${var.subnetwork}"
43+
}
44+
45+
output "location" {
46+
value = "${module.gke.location}"
47+
}
48+
49+
output "ip_range_pods" {
50+
description = "The secondary IP range used for pods"
51+
value = "${var.ip_range_pods}"
52+
}
53+
54+
output "ip_range_services" {
55+
description = "The secondary IP range used for services"
56+
value = "${var.ip_range_services}"
57+
}
58+
59+
output "zones" {
60+
description = "List of zones in which the cluster resides"
61+
value = "${module.gke.zones}"
62+
}
63+
64+
output "master_kubernetes_version" {
65+
description = "The master Kubernetes version"
66+
value = "${module.gke.master_version}"
67+
}

‎examples/disable_client_cert/variables.tf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "credentials_path" {
22+
description = "The path to the GCP credentials JSON file"
23+
}
24+
25+
variable "region" {
26+
description = "The region to host the cluster in"
27+
}
28+
29+
variable "network" {
30+
description = "The VPC network to host the cluster in"
31+
}
32+
33+
variable "network_project_id" {
34+
description = "The GCP project housing the VPC network to host the cluster in"
35+
}
36+
37+
variable "subnetwork" {
38+
description = "The subnetwork to host the cluster in"
39+
}
40+
41+
variable "ip_range_pods" {
42+
description = "The secondary ip range to use for pods"
43+
}
44+
45+
variable "ip_range_services" {
46+
description = "The secondary ip range to use for pods"
47+
}
48+
49+
variable "compute_engine_service_account" {
50+
description = "Service account to associate to the nodes in the cluster"
51+
}

‎test/fixtures/disable_client_cert/example.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "example" {
18+
source = "../../../examples/disable_client_cert"
19+
20+
project_id = "${var.project_id}"
21+
credentials_path = "${local.credentials_path}"
22+
region = "${var.region}"
23+
network = "${google_compute_network.main.name}"
24+
network_project_id = "${var.project_id}"
25+
subnetwork = "${google_compute_subnetwork.main.name}"
26+
ip_range_pods = "${google_compute_subnetwork.main.secondary_ip_range.0.range_name}"
27+
ip_range_services = "${google_compute_subnetwork.main.secondary_ip_range.1.range_name}"
28+
compute_engine_service_account = "${var.compute_engine_service_account}"
29+
}

‎test/fixtures/disable_client_cert/network.tf

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
credentials_path = "${path.module}/${var.credentials_path_relative}"
19+
}
20+
21+
resource "random_string" "suffix" {
22+
length = 4
23+
special = false
24+
upper = false
25+
}
26+
27+
provider "google" {
28+
credentials = "${file(local.credentials_path)}"
29+
project = "${var.project_id}"
30+
}
31+
32+
resource "google_compute_network" "main" {
33+
name = "cft-gke-test-${random_string.suffix.result}"
34+
auto_create_subnetworks = "false"
35+
}
36+
37+
resource "google_compute_subnetwork" "main" {
38+
name = "cft-gke-test-${random_string.suffix.result}"
39+
ip_cidr_range = "10.0.0.0/17"
40+
region = "${var.region}"
41+
network = "${google_compute_network.main.self_link}"
42+
43+
secondary_ip_range {
44+
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
45+
ip_cidr_range = "192.168.0.0/18"
46+
}
47+
48+
secondary_ip_range {
49+
range_name = "cft-gke-test-services-${random_string.suffix.result}"
50+
ip_cidr_range = "192.168.64.0/18"
51+
}
52+
}

‎test/fixtures/disable_client_cert/outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../shared/outputs.tf

‎test/fixtures/disable_client_cert/terraform.tfvars

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../shared/terraform.tfvars

‎test/fixtures/disable_client_cert/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../shared/variables.tf

0 commit comments

Comments
 (0)