forked from spiffe/spire
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Marcos Yacob <[email protected]>
- Loading branch information
Showing
6 changed files
with
172 additions
and
189 deletions.
There are no files selected for viewing
89 changes: 42 additions & 47 deletions
89
test/integration/suites/force-rotation-self-signed/10-prepare-authority
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,76 +1,71 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Check at most 30 times (with one second in between) that the server has | ||
| # successfully synced down the local authorities. | ||
| # Constants | ||
| MAXCHECKS=30 | ||
| RETRY_DELAY=1 | ||
|
|
||
| check-x509Authorities() { | ||
| local expectedBundle=$1 | ||
| local containerName=$2 | ||
|
|
||
| local difference="" | ||
|
|
||
| while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do | ||
| log-info "checking for x509 authorities propagation ($i of $MAXCHECKS max)..." | ||
|
|
||
| x509Authorities=$(docker compose exec -T ${containerName} \ | ||
| /opt/spire/bin/spire-server bundle show -output json | jq '.x509_authorities' -c) | ||
|
|
||
| difference=$(diff <(echo $expectedBundle) <(echo $x509Authorities)) | ||
| if [[ $difference == "" ]]; | ||
| then | ||
| break | ||
| else | ||
| RETRY_COUNT=$((RETRY_COUNT + 1)) | ||
| log-debug "x509 authorities not propagated on ${containerName}, retrying in $RETRY_DELAY seconds... ($RETRY_COUNT/$MAX_RETRIES)" | ||
| log-debug "difference: $difference" | ||
|
|
||
| sleep "${RETRY_DELAY}" | ||
| fi | ||
|
|
||
| # Fail if retries exceed the maximum | ||
| if [[ $RETRY_COUNT -eq $MAX_RETRIES ]]; then | ||
| fail-now "Expected bundle: $expectedBundle \n got: $x509Authorities \n difference: $difference" | ||
| fi | ||
| done | ||
| # Function to check x509 authorities propagation | ||
| check-x509-authorities() { | ||
| local expected_bundle=$1 | ||
| local container_name=$2 | ||
| local retry_count=0 | ||
|
|
||
| while [[ $retry_count -lt $MAXCHECKS ]]; do | ||
| log-info "Checking for x509 authorities propagation ($retry_count of $MAXCHECKS max)..." | ||
|
|
||
| x509_authorities=$(docker compose exec -T ${container_name} \ | ||
| /opt/spire/bin/spire-server bundle show -output json | jq '.x509_authorities' -c) | ||
|
|
||
| if diff <(echo "$expected_bundle") <(echo "$x509_authorities") &>/dev/null; then | ||
| break | ||
| else | ||
| retry_count=$((retry_count + 1)) | ||
| log-debug "x509 authorities not propagated on ${container_name}, retrying in $RETRY_DELAY seconds... ($retry_count/$MAXCHECKS)" | ||
| sleep "${RETRY_DELAY}" | ||
| fi | ||
|
|
||
| # Fail if retries exceed the maximum | ||
| if [[ $retry_count -eq $MAXCHECKS ]]; then | ||
| fail-now "Expected bundle: $expected_bundle got: $x509_authorities" | ||
| fi | ||
| done | ||
| } | ||
|
|
||
| # Initial check for x509 authorities in root-server | ||
| x509Authorities=$(docker compose exec -T root-server \ | ||
| /opt/spire/bin/spire-server bundle show -output json | jq '.x509_authorities' -c) | ||
| x509_authorities=$(docker compose exec -T root-server \ | ||
| /opt/spire/bin/spire-server bundle show -output json | jq '.x509_authorities' -c) | ||
|
|
||
| amountBundles=$(echo $x509Authorities | jq length) | ||
| amount_bundles=$(echo "$x509_authorities" | jq length) | ||
|
|
||
| # Ensure only one bundle is present at the start | ||
| if [[ $amountBundles -ne 1 ]]; then | ||
| fail-now "Only one bundle expected at start" | ||
| if [[ $amount_bundles -ne 1 ]]; then | ||
| fail-now "Only one bundle expected at start" | ||
| fi | ||
|
|
||
| # Check x509 authorities propagation across all servers | ||
| for server in intermediateA-server intermediateB-server leafA-server leafB-server; do | ||
| check-x509Authorities "$x509Authorities" "$server" | ||
| check-x509-authorities "$x509_authorities" "$server" | ||
| done | ||
|
|
||
| # Prepare authority | ||
| preparedAuthorityID=$(docker compose exec -T -e SPIRE_SERVER_FFLAGS=forced_rotation root-server \ | ||
| /opt/spire/bin/spire-server localauthority x509 prepare -output json | jq -r .prepared_authority.authority_id) | ||
| prepared_authority_id=$(docker compose exec -T -e SPIRE_SERVER_FFLAGS=forced_rotation root-server \ | ||
| /opt/spire/bin/spire-server localauthority x509 prepare -output json | jq -r .prepared_authority.authority_id) | ||
|
|
||
| # Verify that the prepared authority is logged | ||
| searching="X509 CA prepared.*local_authority_id=${preparedAuthorityID}" | ||
| searching="X509 CA prepared.|local_authority_id=${prepared_authority_id}" | ||
| check-log-line root-server "$searching" | ||
|
|
||
| # Check for updated x509 authorities in root-server | ||
| x509Authorities=$(docker compose exec -T root-server \ | ||
| /opt/spire/bin/spire-server bundle show -output json | jq '.x509_authorities' -c) | ||
| amountBundles=$(echo $x509Authorities | jq length) | ||
| x509_authorities=$(docker compose exec -T root-server \ | ||
| /opt/spire/bin/spire-server bundle show -output json | jq '.x509_authorities' -c) | ||
| amount_bundles=$(echo "$x509_authorities" | jq length) | ||
|
|
||
| # Ensure two bundles are present after preparation | ||
| if [[ $amountBundles -ne 2 ]]; then | ||
| fail-now "Two bundles expected after prepare" | ||
| if [[ $amount_bundles -ne 2 ]]; then | ||
| fail-now "Two bundles expected after prepare" | ||
| fi | ||
|
|
||
| # Check x509 authorities propagation across all servers again | ||
| for server in intermediateA-server intermediateB-server leafA-server leafB-server; do | ||
| check-x509Authorities "$x509Authorities" "$server" | ||
| check-x509-authorities "$x509_authorities" "$server" | ||
| done | ||
|
|
24 changes: 13 additions & 11 deletions
24
test/integration/suites/force-rotation-self-signed/11-activate-x509authority
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,18 @@ | ||
| #!/bin/bash | ||
|
|
||
| preparedauthority=$(docker compose exec -t -e SPIRE_SERVER_FFLAGS=forced_rotation root-server \ | ||
| /opt/spire/bin/spire-server \ | ||
| localauthority x509 show -output json | jq .prepared.authority_id -r) | ||
| # Fetch the prepared authority ID | ||
| prepared_authority=$(docker compose exec -t -e SPIRE_SERVER_FFLAGS=forced_rotation root-server \ | ||
| /opt/spire/bin/spire-server \ | ||
| localauthority x509 show -output json | jq -r .prepared.authority_id) || fail-now "Failed to fetch prepared authority ID" | ||
|
|
||
| activatedauthority=$(docker compose exec -t -e SPIRE_SERVER_FFLAGS=forced_rotation root-server \ | ||
| /opt/spire/bin/spire-server \ | ||
| localauthority x509 activate -authorityID ${preparedauthority} -output json | jq .activated_authority.authority_id) | ||
| # Activate the authority | ||
| activated_authority=$(docker compose exec -t -e SPIRE_SERVER_FFLAGS=forced_rotation root-server \ | ||
| /opt/spire/bin/spire-server \ | ||
| localauthority x509 activate -authorityID "${prepared_authority}" \ | ||
| -output json | jq -r .activated_authority.authority_id) || fail-now "Failed to activate authority" | ||
|
|
||
| log-info "Activated authority: ${activateAuthority}" | ||
|
|
||
| searching="X509 CA activated*local_authority_id=${preparedAuthority}" | ||
| check-log-line root-server $searching | ||
| check-log-line root-server "Successfully rotated X.509 CA" | ||
| log-info "Activated authority: ${activated_authority}" | ||
|
|
||
| # Check logs for specific lines | ||
| check-log-line root-server "X509 CA activated|local_authority_id=${prepared_authority}" | ||
| check-log-line root-server "Successfully rotated X\.509 CA" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.