Skip to content

Commit ab88302

Browse files
meln5674meln5674
committed
tls: move remotesystem cert generation into bats setup
Signed-off-by: Andrew Melnick <[email protected]>
1 parent 76ab333 commit ab88302

File tree

7 files changed

+194
-204
lines changed

7 files changed

+194
-204
lines changed

‎Makefile‎

Lines changed: 6 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -708,52 +708,22 @@ localmachine:
708708
@echo /define.gitCommit=$(GIT_COMMIT)
709709
$(MAKE) ginkgo-run GINKGO_PARALLEL=n TAGS="$(REMOTETAGS)" GINKGO_FLAKE_ATTEMPTS=0 FOCUS_FILE=$(FOCUS_FILE) GINKGOWHAT=pkg/machine/e2e/.
710710

711-
REMOTESYSTEM_TCP_PORT ?= 8080
712-
REMOTESYSTEM_TLS_CA_CRT ?= $(CURDIR)/bin/remotesystem.ca.crt.pem
713-
REMOTESYSTEM_TLS_CA_KEY ?= $(CURDIR)/bin/remotesystem.ca.key.pem
714-
REMOTESYSTEM_TLS_SERVER_CRT ?= $(CURDIR)/bin/remotesystem.server.crt.pem
715-
REMOTESYSTEM_TLS_SERVER_KEY ?= $(CURDIR)/bin/remotesystem.server.key.pem
716-
REMOTESYSTEM_TLS_CLIENT_CRT ?= $(CURDIR)/bin/remotesystem.client.crt.pem
717-
REMOTESYSTEM_TLS_CLIENT_KEY ?= $(CURDIR)/bin/remotesystem.client.key.pem
718-
REMOTESYSTEM_TLS_BOGUS_CRT ?= $(CURDIR)/bin/remotesystem.bogus.crt.pem
719-
REMOTESYSTEM_TLS_BOGUS_KEY ?= $(CURDIR)/bin/remotesystem.bogus.key.pem
720-
721-
export \
722-
REMOTESYSTEM_TCP_PORT \
723-
REMOTESYSTEM_TLS_CA_KEY \
724-
REMOTESYSTEM_TLS_CA_CRT \
725-
REMOTESYSTEM_TLS_SERVER_CRT \
726-
REMOTESYSTEM_TLS_SERVER_KEY \
727-
REMOTESYSTEM_TLS_CLIENT_CRT \
728-
REMOTESYSTEM_TLS_CLIENT_KEY \
729-
REMOTESYSTEM_TLS_BOGUS_CRT \
730-
REMOTESYSTEM_TLS_BOGUS_KEY
731-
732-
$(REMOTESYSTEM_TLS_CA_CRT) $(REMOTESYSTEM_TLS_CA_KEY) \
733-
$(REMOTESYSTEM_TLS_CLIENT_CRT) $(REMOTESYSTEM_TLS_CLIENT_KEY) \
734-
$(REMOTESYSTEM_TLS_SERVER_CRT) $(REMOTESYSTEM_TLS_SERVER_KEY) \
735-
$(REMOTESYSTEM_TLS_BOGUS_CRT) $(REMOTESYSTEM_TLS_BOGUS_KEY) \
736-
&:
737-
source hack/remotesystem.env ; remotesystem-gen-tls
738-
739711
.PHONY: localsystem
740-
localsystem: $(REMOTESYSTEM_TLS_CA_CRT) $(REMOTESYSTEM_TLS_SERVER_CRT) $(REMOTESYSTEM_TLS_CLIENT_CRT) $(REMOTESYSTEM_TLS_BOGUS_CRT)
712+
localsystem:
741713
# Wipe existing config, database, and cache: start with clean slate.
742714
$(RM) -rf ${HOME}/.local/share/containers ${HOME}/.config/containers
743715
PODMAN=$(CURDIR)/bin/podman QUADLET=$(CURDIR)/bin/quadlet bats -T --filter-tags '!ci:parallel' test/system/
744716
PODMAN=$(CURDIR)/bin/podman QUADLET=$(CURDIR)/bin/quadlet bats -T --filter-tags ci:parallel -j $$(nproc) test/system/
745717

746718

747719
.PHONY: remotesystem
748-
remotesystem: $(REMOTESYSTEM_TLS_CA_CRT) $(REMOTESYSTEM_TLS_SERVER_CRT) $(REMOTESYSTEM_TLS_CLIENT_CRT) $(REMOTESYSTEM_TLS_BOGUS_CRT)
720+
remotesystem:
749721
# Wipe existing config, database, and cache: start with clean slate.
750722
$(RM) -rf ${HOME}/.local/share/containers ${HOME}/.config/containers
751-
source hack/remotesystem.env ; \
752-
set -x ; \
753-
remotesystem-ensure-timeout-cmd $@ || exit ; \
754-
remotesystem-podman-service $(REMOTESYSTEM_TRANSPORT) $(PODMAN_SERVER_LOG) && \
755-
remotesystem-wait-podman-service $(REMOTESYSTEM_TRANSPORT) && \
756-
remotesystem-bats $(REMOTESYSTEM_TRANSPORT) $(CURDIR)/bin/podman-remote
723+
PODMAN=$(CURDIR)/bin/podman-remote QUADLET=$(CURDIR)/bin/quadlet \
724+
bats -T --filter-tags '!ci:parallel' test/system/
725+
PODMAN=$(CURDIR)/bin/podman-remote QUADLET=$(CURDIR)/bin/quadlet \
726+
bats -T --filter-tags ci:parallel -j $$(nproc) test/system/
757727

758728
.PHONY: localapiv2-bash
759729
localapiv2-bash:

‎hack/remotesystem.env‎

Lines changed: 0 additions & 136 deletions
This file was deleted.

‎test/system/272-system-connection.bats‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,9 @@ $c2[ ]\+tcp://localhost:54321[ ]\+true[ ]\+true" \
392392
if [[ "${REMOTESYSTEM_TRANSPORT}" =~ tcp|tls|mtls ]]; then
393393
run_podman_remote --remote info --format '{{.Host.RemoteSocket.Path}}'
394394
assert "$output" =~ "tcp://localhost:${REMOTESYSTEM_TCP_PORT}"
395+
elif [[ "${REMOTESYSTEM_TRANSPORT}" =~ unix ]]; then
396+
run_podman_remote --remote info --format '{{.Host.RemoteSocket.Path}}'
397+
assert "$output" =~ "unix://${REMOTESYSTEM_UNIX_SOCK}"
395398
else
396399
# This only works in upstream CI, where we run with a nonstandard socket.
397400
# In gating we use the default /run/...

‎test/system/273-remote-spot-check.bats‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ function setup() {
1414

1515
function teardown() {
1616
# Ignore exit status: this is just a backup stop in case tests failed
17-
run systemctl stop "$SERVICE_NAME"
17+
run systemctl-user stop "$SERVICE_NAME"
1818
rm -f $PODMAN_TMPDIR/myunix.sock
1919

2020
basic_teardown
@@ -25,7 +25,7 @@ function teardown() {
2525

2626
URL=unix:$PODMAN_TMPDIR/myunix.sock
2727

28-
systemd-run --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0
28+
systemd-run-user --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0
2929
wait_for_file $PODMAN_TMPDIR/myunix.sock
3030

3131
# Variable works
@@ -44,7 +44,7 @@ function teardown() {
4444
run --rm -i $IMAGE /bin/sh -c 'echo -n foo; sleep 0.1; echo -n bar; sleep 0.1; echo -n baz'
4545
is "$output" foobarbaz
4646

47-
systemctl stop $SERVICE_NAME
47+
systemctl-user stop $SERVICE_NAME
4848
rm -f $PODMAN_TMPDIR/myunix.sock
4949
}
5050

@@ -54,7 +54,7 @@ function teardown() {
5454
port=$(random_free_port)
5555
URL=tcp://127.0.0.1:$port
5656

57-
systemd-run --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0
57+
systemd-run-user --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0
5858
wait_for_port 127.0.0.1 $port
5959

6060
# Variable works
@@ -73,7 +73,7 @@ function teardown() {
7373
run --rm -i $IMAGE /bin/sh -c 'echo -n foo; sleep 0.1; echo -n bar; sleep 0.1; echo -n baz'
7474
is "$output" foobarbaz
7575

76-
systemctl stop $SERVICE_NAME
76+
systemctl-user stop $SERVICE_NAME
7777
}
7878

7979
@test "tls remote" {
@@ -82,7 +82,7 @@ function teardown() {
8282
port=$(random_free_port)
8383
URL=tcp://127.0.0.1:$port
8484

85-
systemd-run --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0 \
85+
systemd-run-user --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0 \
8686
--tls-key="${REMOTESYSTEM_TLS_SERVER_KEY}" \
8787
--tls-cert="${REMOTESYSTEM_TLS_SERVER_CRT}"
8888
wait_for_port 127.0.0.1 $port
@@ -106,7 +106,7 @@ function teardown() {
106106
run --rm -i $IMAGE /bin/sh -c 'echo -n foo; sleep 0.1; echo -n bar; sleep 0.1; echo -n baz'
107107
is "$output" foobarbaz
108108

109-
systemctl stop $SERVICE_NAME
109+
systemctl-user stop $SERVICE_NAME
110110
}
111111

112112
@test "mtls remote" {
@@ -115,7 +115,7 @@ function teardown() {
115115
port=$(random_free_port)
116116
URL=tcp://127.0.0.1:$port
117117

118-
systemd-run --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0 \
118+
systemd-run-user --unit=$SERVICE_NAME ${PODMAN%%-remote*} system service $URL --time=0 \
119119
--tls-client-ca="${REMOTESYSTEM_TLS_CA_CRT}" \
120120
--tls-key="${REMOTESYSTEM_TLS_SERVER_KEY}" \
121121
--tls-cert="${REMOTESYSTEM_TLS_SERVER_CRT}"
@@ -146,5 +146,5 @@ function teardown() {
146146
run --rm -i $IMAGE /bin/sh -c 'echo -n foo; sleep 0.1; echo -n bar; sleep 0.1; echo -n baz'
147147
is "$output" foobarbaz
148148

149-
systemctl stop $SERVICE_NAME
149+
systemctl-user stop $SERVICE_NAME
150150
}

‎test/system/850-compose.bats‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,12 @@ EOF
6363
url="${PODMAN##*--url }"
6464
url="${url%% *}"
6565
op='='
66-
elif [[ "${REMOTESYSTEM_TRANSPORT}" =~ tcp|tls|mtls ]]; then
66+
elif is_remote && [[ "${REMOTESYSTEM_TRANSPORT}" =~ tcp|tls|mtls ]]; then
6767
url="tcp://localhost:${REMOTESYSTEM_TCP_PORT}"
6868
op='='
69+
elif is_remote && [[ "${REMOTESYSTEM_TRANSPORT}" =~ unix ]]; then
70+
url="unix://${REMOTESYSTEM_UNIX_SOCK}"
71+
op='='
6972
fi
7073
# podman-remote test might run with --url so unset this because the socket will be used otherwise
7174
CONTAINERS_CONF_OVERRIDE=$compose_conf run_podman compose env

0 commit comments

Comments
 (0)