This repository has been archived by the owner on Nov 1, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
e2e: test gpg commit verification (#2579)
e2e: test gpg commit verification
- Loading branch information
Showing
7 changed files
with
203 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| #!/usr/bin/env bats | ||
|
|
||
| load lib/env | ||
| load lib/gpg | ||
| load lib/install | ||
| load lib/poll | ||
|
|
||
| tmp_gnupghome="" | ||
| git_port_forward_pid="" | ||
| clone_dir="" | ||
|
|
||
| function setup() { | ||
| kubectl create namespace "${FLUX_NAMESPACE}" | ||
|
|
||
| # Create a temporary GNUPGHOME | ||
| tmp_gnupghome=$(mktemp -d) | ||
| export GNUPGHOME="$tmp_gnupghome" | ||
| } | ||
|
|
||
| @test "Commits are verified" { | ||
| # Create a new GPG key and secret | ||
| gpg_key=$(create_gpg_key) | ||
| create_secret_from_gpg_key "$gpg_key" | ||
|
|
||
| # Install the git server with signed init commit, | ||
| # allowing external access | ||
| install_git_srv flux-git-deploy git_srv_result true | ||
|
|
||
| # Install Flux with the GPG key, and commit verification enabled | ||
| install_flux_gpg "$gpg_key" true | ||
|
|
||
| # shellcheck disable=SC2154 | ||
| git_ssh_cmd="${git_srv_result[0]}" | ||
| export GIT_SSH_COMMAND="$git_ssh_cmd" | ||
|
|
||
| # shellcheck disable=SC2030 | ||
| git_port_forward_pid="${git_srv_result[1]}" | ||
|
|
||
| # Test that the resources from https://github.com/fluxcd/flux-get-started are deployed | ||
| poll_until_true 'namespace demo' 'kubectl describe ns/demo' | ||
|
|
||
| # Clone the repo | ||
| # shellcheck disable=SC2030 | ||
| clone_dir="$(mktemp -d)" | ||
| git clone -b master ssh://git@localhost/git-server/repos/cluster.git "$clone_dir" | ||
| cd "$clone_dir" | ||
|
|
||
| local sync_tag="flux-sync" | ||
| local org_head_hash | ||
| org_head_hash=$(git rev-list -n 1 HEAD) | ||
| sync_tag_hash=$(git rev-list -n 1 "$sync_tag") | ||
|
|
||
| [ "$sync_tag_hash" = "$org_head_hash" ] | ||
| run git verify-commit "$sync_tag_hash" | ||
| [ "$status" -eq 0 ] | ||
|
|
||
| # Add an unsigned change | ||
| sed -i'.bak' 's%stefanprodan/podinfo:.*%stefanprodan/podinfo:3.1.5%' "${clone_dir}/workloads/podinfo-dep.yaml" | ||
| git -c '[email protected]' -c 'user.name=Foo' commit -am "Bump podinfo" | ||
| git push | ||
|
|
||
| # Delete tag | ||
| git push --delete origin "$sync_tag" | ||
|
|
||
| # Sync should warn, and put the tag back at the latest verified commit | ||
| run fluxctl --k8s-fwd-ns "${FLUX_NAMESPACE}" sync | ||
| [ "$status" -eq 0 ] | ||
| [[ "$output" == *"Warning: The branch HEAD in the git repo is not verified"* ]] | ||
|
|
||
| git pull -f --tags | ||
| sync_tag_hash=$(git rev-list -n 1 "$sync_tag") | ||
| [ "$sync_tag_hash" = "$org_head_hash" ] | ||
| } | ||
|
|
||
| @test "Does not commit on top of invalid commit" { | ||
| # Create a new GPG key and secret | ||
| gpg_key=$(create_gpg_key) | ||
| create_secret_from_gpg_key "$gpg_key" | ||
|
|
||
| # Install the git server with _unsigned_ init commit | ||
| install_git_srv flux-git-deploy "" false | ||
|
|
||
| # Install Flux with the GPG key, and commit verification enabled | ||
| install_flux_gpg "$gpg_key" true | ||
|
|
||
| # Wait for Flux to report that it sees an invalid commit | ||
| poll_until_true 'invalid GPG signature log' "kubectl logs -n ${FLUX_NAMESPACE} deploy/flux-gpg | grep -e 'found invalid GPG signature for commit'" | ||
|
|
||
| # Attempt to lock a resource, and confirm it returns an error. | ||
| run fluxctl --k8s-fwd-ns "${FLUX_NAMESPACE}" lock --workload demo:deployment/podinfo | ||
| [ "$status" -eq 1 ] | ||
| [[ "$output" == *"Error: HEAD revision is unsigned"* ]] | ||
| } | ||
|
|
||
| function teardown() { | ||
| # shellcheck disable=SC2031 | ||
| rm -rf "$clone_dir" | ||
| # (Maybe) teardown the created port-forward to gitsrv. | ||
| # shellcheck disable=SC2031 | ||
| kill "$git_port_forward_pid" || true | ||
| # Kill the agent and remove temporary GNUPGHOME | ||
| gpgconf --kill gpg-agent | ||
| rm -rf "$tmp_gnupghome" | ||
| # Although the namespace delete below takes care of removing most Flux | ||
| # elements, the global resources will not be removed without this. | ||
| uninstall_flux_gpg | ||
| # Removing the namespace also takes care of removing Flux and gitsrv. | ||
| kubectl delete namespace "$FLUX_NAMESPACE" | ||
| # (Maybe) remove the demo namespace | ||
| kubectl delete namespace "$DEMO_NAMESPACE" &> /dev/null || true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| --- | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| labels: | ||
| name: gitsrv | ||
| name: gitsrv | ||
| spec: | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| name: gitsrv | ||
| template: | ||
| metadata: | ||
| labels: | ||
| name: gitsrv | ||
| spec: | ||
| containers: | ||
| - image: stefanprodan/gitsrv:0.1.3 | ||
| name: git | ||
| env: | ||
| - name: REPO | ||
| value: "cluster.git" | ||
| - name: TAR_URL | ||
| value: "https://github.com/fluxcd/flux-get-started/archive/master.tar.gz" | ||
| - name: GPG_KEYFILE | ||
| value: /git-server/gpg/flux.asc | ||
| ports: | ||
| - containerPort: 22 | ||
| name: ssh | ||
| protocol: TCP | ||
| volumeMounts: | ||
| - mountPath: /git-server/gpg | ||
| name: git-gpg-keys | ||
| - mountPath: /git-server/repos | ||
| name: git-server-data | ||
| - mountPath: /git-server/keys | ||
| name: flux-git-deploy | ||
| volumes: | ||
| - name: flux-git-deploy | ||
| secret: | ||
| secretName: $GIT_SECRET_NAME | ||
| - name: git-server-data | ||
| emptyDir: {} | ||
| - name: git-gpg-keys | ||
| secret: | ||
| secretName: $GPG_SECRET_NAME | ||
| --- | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| labels: | ||
| name: gitsrv | ||
| name: gitsrv | ||
| spec: | ||
| ports: | ||
| - name: ssh | ||
| port: 22 | ||
| protocol: TCP | ||
| targetPort: ssh | ||
| selector: | ||
| name: gitsrv | ||
| type: ClusterIP |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| # generated with "ssh-keyscan gitsrv" | ||
| gitsrv ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2WoJ2k+WA54pdxw5EGhg9CQBHKDVjHzNNlgRfTGrQBpgQT3/HEBi6BGi2ZmS6o6W9EJfzYzl3PvC+JY6BqcdM8XqbDazC1rkGtlycHd+dFT/TmWvBqJ2Oh+oJNL7IgpjBPJJMdAEc9nzUTTYa7V2A9SeaAyQJKGaftZhHEXTxkxxbWP2an7bzyw9QNCiF/ogQ79DPsp7ly4v4KgeGLSm9AoT/HO5+kJwXX3yQ1hKrFZyhzhaYiwzdApc3iUJtUEz1lKVX+63+WN6qhkbCUjlhfOGyT3qk18sMU6raqKt8uuQeR9f4/xkMXGWQuULhjGwOkju+8Dma8GvnhKKwHf5V | ||
| gitsrv ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFhuyD3SzMaTye/OX51Jb3fgZDxhGnXgJQ6oFvSSwqDGDm4fcueHE979xEPolNe9hn6jGg/2DS3xkU8boPKv8mo= | ||
| gitsrv ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAbLc9veRHa/l/kK6hmRWMA+QoWd8vLtLHbm4v6wj8XU | ||
| gitsrv ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3qgBx5WLHbB+frq8d+iomxrdQPlWcj7NsJSiEz8vYOaRQsQDMtWHHYRt+zBVIH9Q96urBHDZa+B72DsInkO7JxflLVXLenwhNu8u9a0VbbleYnBYWfoNYWv+0tQpilOIasNjA+aLAWsVVjEAPB8RM77QocXnUbthI898f5EbQ1jXLBMPfbY0VRHimqo0EST71q0/PzfQTf/3tWdd8/cqIFfErOp8IEdnAQmJlhlaAMuI6tDAOCGWjSL/JUMQVIvkObWu2a33fm35OD5q+NyCBquM1a11i/M78oKq0xR8l02OcOKtCdPf09cUBwY8yiRRDIa2PVEpmzHcE5YMXY8IL | ||
| gitsrv ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB+7/Q4mchJWXQoc4LCA9RVMcyj673QDHV98D1ZTGeu7iEz7g/mK/V2thcpgD+rsHBh6u5nYwMd9ja3e7YquX2I= | ||
| gitsrv ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/1fXvsyIQmxhcWIhl3VBYylabjKb2669sPODnK0Zbt |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters