Skip to content

Commit 0275776

Browse files
scohebscoheb
committed
feat: krw test for rh-push-to-external-registry
- add new test for rh-push-to-external-registry pipeline - add new script that gets a result from a task run in a pipelinerun - add check for imageIds that were created. Signed-off-by: Scott Hebert <[email protected]>
1 parent b2e800f commit 0275776

File tree

17 files changed

+1036
-75
lines changed

17 files changed

+1036
-75
lines changed

‎integration-tests/rh-push-to-external-registry/README.md

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# rh-push-to-external-registry test
2+
## Setup
3+
### Dependencies
4+
* GitHub repo: https://github.com/scoheb/e2e-base
5+
* GitHub personal access token (classic) for above repo with **admin:repo_hook**, **delete_repo**, **repo** scopes.
6+
* The password to the vault files. (Contact a member of the Release team should you want to run this
7+
test suite.)
8+
* Access to the target cluster and tenant and managed namespaces
9+
* This test uses stg-rh01 and the dev-release-team-tenant and managed-release-team-tenant namespaces.
10+
### Required Environment Variables
11+
- GITHUB_TOKEN
12+
- The GitHub personal access token needed for repo operations
13+
- The repo in question can be located in [test.env](test.env)
14+
- VAULT_PASSWORD_FILE
15+
- This is the path to a file that contains the ansible vault
16+
password needed to decrypt the secrets needed for testing.
17+
- RELEASE_CATALOG_GIT_URL
18+
- The release service catalog URL to use in the RPA
19+
- This is provided when testing PRs
20+
- RELEASE_CATALOG_GIT_REVISION
21+
- The release service catalog revision to use in the RPA
22+
- This is provided when testing PRs
23+
### Optional Environment Variables
24+
- KUBECONFIG
25+
- The KUBECONFIG file to used to login to the target cluster
26+
- This is provided when testing PRs
27+
### Test Properties
28+
#### [test.env](test.env)
29+
- This file contains resource names and configuration values needed for testing.
30+
- Since this test requires internal services, the tenant and managed namespaces
31+
should remain as-is.
32+
### Test Functions
33+
#### [lib/test-functions.sh](../lib/test-functions.sh)
34+
- This file contains re-usable functions for tests
35+
### Secrets
36+
- Secrets needed for testing are stored in ansible vault files.
37+
- [vault/collector-managed-secrets.yaml](vault/collector-managed-secrets.yaml)
38+
- [vault/collector-tenant-secrets.yaml](vault/collector-tenant-secrets.yaml)
39+
- Most secrets required are contained in the files above.
40+
- Some tests have their secret name hardcoded and therefore must exist prior to running this test:
41+
- konflux-advisory-jira-secret
42+
### Running the test
43+
44+
The test has 2 modes:
45+
* With a CVE included and involved. (default mode)
46+
47+
```shell
48+
run-test.sh
49+
```
50+
51+
* Without a CVE involved.
52+
53+
```shell
54+
run-test.sh --no-cve
55+
```
56+
57+
### Debugging
58+
59+
There is a `--skip-cleanup` option to the script in the event that you want to examine the resources
60+
after a test has ended.
61+
62+
### Maintenance
63+
- Should you require to add or update a secret, follow these steps:
64+
```shell
65+
ansible-vault decrypt vault/tenant-secrets.yaml --output "/tmp/tenant-secrets.yaml" --vault-password-file <vault password file>
66+
```
67+
68+
```shell
69+
vi /tmp/tenant-secrets.yaml
70+
```
71+
72+
```shell
73+
ansible-vault encrypt /tmp/tenant-secrets.yaml --output "vault/tenant-secrets.yaml" --vault-password-file <vault password file>
74+
```
75+
76+
```shell
77+
rm /tmp/tenant-secrets.yaml
78+
```

‎integration-tests/rh-push-to-external-registry/resources/managed/ec-policy.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: appstudio.redhat.com/v1alpha1
3+
kind: EnterpriseContractPolicy
4+
metadata:
5+
name: standard-${component_name}
6+
labels:
7+
originating-tool: "${originating_tool}"
8+
spec:
9+
description: >-
10+
Includes rules for levels 1, 2 & 3 of SLSA v0.1.
11+
publicKey: "k8s://openshift-pipelines/public-key"
12+
sources:
13+
- name: Release Policies
14+
data:
15+
- github.com/release-engineering/rhtap-ec-policy//data
16+
- oci::quay.io/konflux-ci/tekton-catalog/data-acceptable-bundles:latest
17+
policy:
18+
- oci::quay.io/enterprise-contract/ec-release-policy:konflux
19+
volatileConfig:
20+
exclude:
21+
- value: cve.cve_blockers
22+
effectiveUntil: "2025-02-01T00:00:00Z"
23+
config:
24+
exclude: []
25+
include:
26+
- '@minimal'
27+
- '@slsa3'

‎integration-tests/rh-push-to-external-registry/resources/managed/kustomization.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
kind: Kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
5+
namespace: ${managed_namespace}
6+
resources:
7+
- sa.yaml
8+
- sa-rolebinding.yaml
9+
- rpa.yaml
10+
- ec-policy.yaml
11+
- secrets/managed-secrets.yaml

‎integration-tests/rh-push-to-external-registry/resources/managed/rpa.yaml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
apiVersion: appstudio.redhat.com/v1alpha1
3+
kind: ReleasePlanAdmission
4+
metadata:
5+
name: ${release_plan_admission_name}
6+
labels:
7+
originating-tool: "${originating_tool}"
8+
spec:
9+
applications:
10+
- ${application_name}
11+
data:
12+
pyxis:
13+
server: stage
14+
secret: pyxis-${component_name}
15+
mapping:
16+
defaults:
17+
tags:
18+
- latest
19+
pushSourceContainer: false
20+
components:
21+
- name: ${component_name}
22+
repository: quay.io/redhat-pending/rhtap----rh-advisories-component
23+
origin: ${tenant_namespace}
24+
pipeline:
25+
pipelineRef:
26+
params:
27+
- name: url
28+
value: "${RELEASE_CATALOG_GIT_URL}"
29+
- name: revision
30+
value: "${RELEASE_CATALOG_GIT_REVISION}"
31+
- name: pathInRepo
32+
value: pipelines/managed/rh-push-to-external-registry/rh-push-to-external-registry.yaml
33+
resolver: git
34+
serviceAccountName: ${managed_sa_name}
35+
timeouts:
36+
pipeline: 4h0m0s
37+
tasks: 4h0m0s
38+
policy: standard-${component_name}

‎integration-tests/rh-push-to-external-registry/resources/managed/sa-rolebinding.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: managed-release-pipeline-resource-role-binding-for-${managed_sa_name}
6+
labels:
7+
originating-tool: "${originating_tool}"
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: release-pipeline-resource-role
12+
subjects:
13+
- kind: ServiceAccount
14+
name: ${managed_sa_name}
15+
namespace: ${managed_namespace}

‎integration-tests/rh-push-to-external-registry/resources/managed/sa.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: ${managed_sa_name}
6+
labels:
7+
originating-tool: "${originating_tool}"
8+
secrets:
9+
- name: konflux-ci-konflux-release-trusted-artifacts-pull-secret-${component_name}
10+
- name: push-${component_name}
11+
- name: pyxis-${component_name}
12+
imagePullSecrets:
13+
- name: push-${component_name}
14+
- name: konflux-ci-konflux-release-trusted-artifacts-pull-secret-${component_name}

‎integration-tests/rh-push-to-external-registry/resources/tenant/application.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: appstudio.redhat.com/v1alpha1
3+
kind: Application
4+
metadata:
5+
name: ${application_name}
6+
labels:
7+
originating-tool: "${originating_tool}"
8+
spec:
9+
displayName: ${application_name}

‎integration-tests/rh-push-to-external-registry/resources/tenant/component.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
apiVersion: appstudio.redhat.com/v1alpha1
3+
kind: Component
4+
metadata:
5+
annotations:
6+
git-provider: github
7+
build.appstudio.openshift.io/request: configure-pac
8+
image.redhat.com/generate: '{"visibility": "public"}'
9+
build.appstudio.openshift.io/pipeline: '{"name": "docker-build-multi-platform-oci-ta", "bundle": "latest"}'
10+
name: ${component_name}
11+
labels:
12+
originating-tool: "${originating_tool}"
13+
spec:
14+
application: ${application_name}
15+
componentName: ${component_name}
16+
secret: pipelines-as-code-secret-${component_name}
17+
source:
18+
git:
19+
dockerfileUrl: Dockerfile
20+
revision: ${component_branch}
21+
url: "${component_git_url}"

‎integration-tests/rh-push-to-external-registry/resources/tenant/kustomization.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
5+
namespace: ${tenant_namespace}
6+
resources:
7+
- application.yaml
8+
- component.yaml
9+
- sa-rolebinding.yaml
10+
- rp.yaml
11+
- secrets/tenant-secrets.yaml

‎integration-tests/rh-push-to-external-registry/resources/tenant/rp.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
apiVersion: appstudio.redhat.com/v1alpha1
3+
kind: ReleasePlan
4+
metadata:
5+
labels:
6+
release.appstudio.openshift.io/auto-release: 'true'
7+
release.appstudio.openshift.io/standing-attribution: 'true'
8+
release.appstudio.openshift.io/releasePlanAdmission: "${release_plan_admission_name}"
9+
originating-tool: "${originating_tool}"
10+
name: ${release_plan_name}
11+
spec:
12+
application: ${application_name}
13+
target: ${managed_namespace}

0 commit comments

Comments
 (0)