Skip to content

Commit 5db3adb

Browse files
filipcirtogfilipcirtog
committed
tests: refactoring+improvements
1 parent c0a80c1 commit 5db3adb

12 files changed

+637
-9
lines changed

‎.evergreen-tasks.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -720,6 +720,16 @@ tasks:
720720
commands:
721721
- func: "e2e_test"
722722

723+
- name: e2e_replica_set_ldap_switch_project
724+
tags: [ "patch-run" ]
725+
commands:
726+
- func: "e2e_test"
727+
728+
- name: e2e_sharded_cluster_ldap_switch_project
729+
tags: [ "patch-run" ]
730+
commands:
731+
- func: "e2e_test"
732+
723733
# TODO: not used in any variant
724734
- name: e2e_replica_set_scram_x509_internal_cluster
725735
tags: [ "patch-run" ]

‎.evergreen.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -719,6 +719,8 @@ task_groups:
719719
- e2e_replica_set_scram_sha_256_switch_project
720720
- e2e_replica_set_scram_sha_1_switch_project
721721
- e2e_replica_set_x509_switch_project
722+
- e2e_replica_set_ldap_switch_project
723+
- e2e_sharded_cluster_ldap_switch_project
722724
# e2e_auth_transitions_task_group
723725
- e2e_replica_set_scram_sha_and_x509
724726
- e2e_replica_set_x509_to_scram_transition

‎controllers/om/automation_config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,7 +439,7 @@ func (ac *AutomationConfig) EnsureKeyFileContents() error {
439439
// AuthSecretName for a given mdbName (`mdbName`) returns the name of
440440
// the secret associated with it.
441441
func AuthSecretName(mdbName string) string {
442-
return fmt.Sprintf("%s-agent-auth-secre", mdbName)
442+
return fmt.Sprintf("%s-agent-auth-secret", mdbName)
443443
}
444444

445445
// EnsurePassword makes sure that there is an Automation Agent password

‎docker/mongodb-kubernetes-tests/tests/authentication/fixtures/switch-project/replica-set-ldap-switch-project.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
apiVersion: mongodb.com/v1
3+
kind: MongoDB
4+
metadata:
5+
name: replica-set-ldap-switch-project
6+
spec:
7+
type: ReplicaSet
8+
members: 3
9+
version: 4.4.0-ent
10+
11+
opsManager:
12+
configMapRef:
13+
name: my-project
14+
credentials: my-credentials
15+
16+
security:
17+
authentication:
18+
agents:
19+
mode: "SCRAM"
20+
enabled: true
21+
# Enabled LDAP and SCRAM Authentication Mode
22+
modes: ["LDAP", "SCRAM"]
23+
ldap:
24+
servers: "<filled-by-test>"
25+
transportSecurity: "<filled-by-test>"
26+
bindQueryUser: "<filled-by-test>"
27+
bindQueryPasswordSecretRef:
28+
name: "<filled-by-test>"
29+

‎docker/mongodb-kubernetes-tests/tests/authentication/fixtures/switch-project/sharded-cluster-ldap-switch-project.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
apiVersion: mongodb.com/v1
3+
kind: MongoDB
4+
metadata:
5+
name: sharded-cluster-ldap-switch-project
6+
spec:
7+
type: ShardedCluster
8+
9+
shardCount: 1
10+
mongodsPerShardCount: 1
11+
mongosCount: 1
12+
configServerCount: 1
13+
14+
version: 4.4.0-ent
15+
16+
opsManager:
17+
configMapRef:
18+
name: my-project
19+
credentials: my-credentials
20+
21+
security:
22+
authentication:
23+
enabled: true
24+
# Enabled LDAP Authentication Mode
25+
modes: ["LDAP"]
26+
ldap:
27+
servers: "<ldap-servers>"
28+
transportSecurity: "tls"
29+
# Specify the LDAP Distinguished Name to which
30+
# MongoDB binds when connecting to the LDAP server
31+
bindQueryUser: "cn=admin,dc=example,dc=org"
32+
bindQueryPasswordSecretRef:
33+
name: "<secret-name>"

‎docker/mongodb-kubernetes-tests/tests/authentication/fixtures/switch-project/sharded-cluster-scram-sha-256-switch-project.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,3 @@ spec:
2121
authentication:
2222
enabled: true
2323
modes: ["SCRAM"]
24-
25-

‎docker/mongodb-kubernetes-tests/tests/authentication/replica_set_ldap_switch_project.py‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
import tempfile
2+
from typing import List
3+
4+
import pytest
5+
from kubetester import (
6+
create_or_update_configmap,
7+
create_secret,
8+
find_fixture,
9+
random_k8s_name,
10+
read_configmap,
11+
)
12+
from kubetester.certs import create_mongodb_tls_certs, create_x509_user_cert
13+
from kubetester.kubetester import KubernetesTester
14+
from kubetester.ldap import LDAP_AUTHENTICATION_MECHANISM, LDAPUser, OpenLDAP
15+
from kubetester.mongodb import MongoDB
16+
from kubetester.mongodb_user import MongoDBUser, Role, generic_user
17+
from kubetester.phase import Phase
18+
19+
MDB_RESOURCE_NAME = "replica-set-ldap-switch-project"
20+
MDB_FIXTURE_NAME = MDB_RESOURCE_NAME
21+
22+
CONFIG_MAP_KEYS = {
23+
"BASE_URL": "baseUrl",
24+
"PROJECT_NAME": "projectName",
25+
"ORG_ID": "orgId",
26+
}
27+
28+
29+
@pytest.fixture(scope="module")
30+
def project_name_prefix(namespace: str) -> str:
31+
"""
32+
Generates a random Kubernetes project name prefix based on the namespace.
33+
34+
Ensures test isolation in a multi-namespace test environment.
35+
"""
36+
return random_k8s_name(f"{namespace}-project-")
37+
38+
39+
@pytest.fixture(scope="module")
40+
def server_certs(namespace: str, issuer: str):
41+
create_mongodb_tls_certs(issuer, namespace, MDB_RESOURCE_NAME, "certs-" + MDB_RESOURCE_NAME + "-cert")
42+
return "certs"
43+
44+
45+
@pytest.fixture(scope="module")
46+
def replica_set(
47+
openldap: OpenLDAP,
48+
issuer_ca_configmap: str,
49+
ldap_mongodb_agent_user: LDAPUser,
50+
server_certs: str,
51+
namespace: str,
52+
) -> MongoDB:
53+
resource = MongoDB.from_yaml(find_fixture(f"switch-project/{MDB_FIXTURE_NAME}.yaml"), namespace=namespace)
54+
55+
secret_name = "bind-query-password"
56+
create_secret(namespace, secret_name, {"password": openldap.admin_password})
57+
ac_secret_name = "automation-config-password"
58+
create_secret(
59+
namespace,
60+
ac_secret_name,
61+
{"automationConfigPassword": ldap_mongodb_agent_user.password},
62+
)
63+
64+
resource["spec"]["security"] = {
65+
"tls": {
66+
"enabled": True,
67+
"ca": issuer_ca_configmap,
68+
},
69+
"certsSecretPrefix": server_certs,
70+
"authentication": {
71+
"enabled": True,
72+
"modes": ["LDAP", "SCRAM", "X509"],
73+
"ldap": {
74+
"servers": [openldap.servers],
75+
"bindQueryUser": "cn=admin,dc=example,dc=org",
76+
"bindQueryPasswordSecretRef": {"name": secret_name},
77+
},
78+
"agents": {
79+
"mode": "LDAP",
80+
"automationPasswordSecretRef": {
81+
"name": ac_secret_name,
82+
"key": "automationConfigPassword",
83+
},
84+
"automationUserName": ldap_mongodb_agent_user.uid,
85+
},
86+
},
87+
}
88+
89+
return resource
90+
91+
92+
@pytest.fixture(scope="module")
93+
def user_ldap(replica_set: MongoDB, namespace: str, ldap_mongodb_users: List[LDAPUser]) -> MongoDBUser:
94+
mongodb_user = ldap_mongodb_users[0]
95+
user = generic_user(
96+
namespace,
97+
username=mongodb_user.username,
98+
db="$external",
99+
password=mongodb_user.password,
100+
mongodb_resource=replica_set,
101+
)
102+
user.add_roles(
103+
[
104+
Role(db="admin", role="clusterAdmin"),
105+
Role(db="admin", role="readWriteAnyDatabase"),
106+
Role(db="admin", role="dbAdminAnyDatabase"),
107+
]
108+
)
109+
110+
return user.create()
111+
112+
113+
@pytest.mark.e2e_replica_set_ldap_switch_project
114+
class TestReplicaSetLDAPProjectSwitch(KubernetesTester):
115+
116+
def test_create_replica_set(self, replica_set: MongoDB, ldap_mongodb_users: List[LDAPUser]):
117+
replica_set.update()
118+
replica_set.assert_reaches_phase(Phase.Running, timeout=600)
119+
120+
def test_create_ldap_user(self, replica_set: MongoDB, user_ldap: MongoDBUser):
121+
user_ldap.assert_reaches_phase(Phase.Updated)
122+
123+
tester = replica_set.get_automation_config_tester()
124+
tester.assert_authentication_mechanism_enabled(LDAP_AUTHENTICATION_MECHANISM, active_auth_mechanism=True)
125+
tester.assert_expected_users(1)
126+
127+
def test_new_mdb_users_are_created_and_can_authenticate(
128+
self, replica_set: MongoDB, user_ldap: MongoDBUser, ca_path: str
129+
):
130+
tester = replica_set.tester()
131+
132+
tester.assert_ldap_authentication(
133+
username=user_ldap["spec"]["username"],
134+
password=user_ldap.password,
135+
tls_ca_file=ca_path,
136+
attempts=10,
137+
)
138+
139+
def test_switch_replica_set_project(
140+
self, replica_set: MongoDB, namespace: str, project_name_prefix: str, user_ldap: MongoDBUser
141+
):
142+
"""
143+
Modify the replica set to switch its Ops Manager reference to a new project and verify lifecycle.
144+
"""
145+
original_configmap = read_configmap(namespace=namespace, name="my-project")
146+
new_project_name = f"{project_name_prefix}-second"
147+
new_project_configmap = create_or_update_configmap(
148+
namespace=namespace,
149+
name=new_project_name,
150+
data={
151+
CONFIG_MAP_KEYS["BASE_URL"]: original_configmap[CONFIG_MAP_KEYS["BASE_URL"]],
152+
CONFIG_MAP_KEYS["PROJECT_NAME"]: new_project_name,
153+
CONFIG_MAP_KEYS["ORG_ID"]: original_configmap[CONFIG_MAP_KEYS["ORG_ID"]],
154+
},
155+
)
156+
157+
replica_set.load()
158+
replica_set["spec"]["opsManager"]["configMapRef"]["name"] = new_project_configmap
159+
replica_set.update()
160+
161+
replica_set.assert_reaches_phase(Phase.Running, timeout=600)
162+
163+
def test_ops_manager_state_correctly_updated_in_moved_cluster(self, replica_set: MongoDB, user_ldap: MongoDBUser, ca_path: str):
164+
tester = replica_set.get_automation_config_tester()
165+
tester.assert_authentication_mechanism_enabled(LDAP_AUTHENTICATION_MECHANISM, active_auth_mechanism=True)
166+
# tester.assert_expected_users(1)
167+
168+
# tester = replica_set.tester()
169+
# tester.assert_ldap_authentication(
170+
# username=user_ldap["spec"]["username"],
171+
# password=user_ldap.password,
172+
# tls_ca_file=ca_path,
173+
# attempts=10,
174+
# )

‎docker/mongodb-kubernetes-tests/tests/authentication/replica_set_scram_sha_1_switch_project.py‎

Lines changed: 58 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
11
import pytest
2-
from kubetester import create_or_update_configmap, random_k8s_name, read_configmap
2+
from kubetester import (
3+
create_or_update_configmap,
4+
create_or_update_secret,
5+
random_k8s_name,
6+
read_configmap,
7+
)
38
from kubetester.kubetester import KubernetesTester
49
from kubetester.kubetester import fixture as load_fixture
510
from kubetester.mongodb import MongoDB
11+
from kubetester.mongodb_user import MongoDBUser
612
from kubetester.mongotester import ReplicaSetTester
713
from kubetester.phase import Phase
814

@@ -44,6 +50,10 @@ class TestReplicaSetCreationAndProjectSwitch(KubernetesTester):
4450
E2E test suite for replica set creation, user connectivity with SCRAM-SHA-1 authentication and switching Ops Manager project reference.
4551
"""
4652

53+
PASSWORD_SECRET_NAME = "mms-user-1-password"
54+
USER_PASSWORD = "my-password"
55+
USER_NAME = "mms-user-1"
56+
4757
def test_create_replica_set(self, custom_mdb_version: str, replica_set: MongoDB):
4858
"""
4959
Test replica set creation ensuring resources are applied correctly and set reaches Running phase.
@@ -68,6 +78,40 @@ def test_ops_manager_state_correctly_updated_in_initial_replica_set(self, replic
6878
tester.assert_authentication_enabled(2)
6979
tester.assert_expected_users(0)
7080

81+
def test_create_secret(self):
82+
print(f"creating password for MongoDBUser {self.USER_NAME} in secret/{self.PASSWORD_SECRET_NAME} ")
83+
84+
create_or_update_secret(
85+
KubernetesTester.get_namespace(),
86+
self.PASSWORD_SECRET_NAME,
87+
{
88+
"password": self.USER_PASSWORD,
89+
},
90+
)
91+
92+
def test_create_user(self, namespace: str):
93+
mdb = MongoDBUser.from_yaml(
94+
load_fixture("scram-sha-user.yaml"),
95+
namespace=namespace,
96+
)
97+
mdb["spec"]["mongodbResourceRef"]["name"] = MDB_RESOURCE_NAME
98+
99+
mdb.update()
100+
mdb.assert_reaches_phase(Phase.Updated, timeout=150)
101+
102+
def test_ops_manager_state_with_users_correctly_updated(self, replica_set: MongoDB):
103+
expected_roles = {
104+
("admin", "clusterAdmin"),
105+
("admin", "userAdminAnyDatabase"),
106+
("admin", "readWrite"),
107+
("admin", "userAdminAnyDatabase"),
108+
}
109+
110+
tester = replica_set.get_automation_config_tester()
111+
tester.assert_has_user(self.USER_NAME)
112+
tester.assert_user_has_roles(self.USER_NAME, expected_roles)
113+
tester.assert_expected_users(1)
114+
71115
def test_switch_replica_set_project(
72116
self, custom_mdb_version: str, replica_set: MongoDB, namespace: str, project_name_prefix: str
73117
):
@@ -107,4 +151,16 @@ def test_ops_manager_state_correctly_updated_in_moved_replica_set(self, replica_
107151
tester.assert_authentication_mechanism_enabled("MONGODB-CR")
108152
tester.assert_authoritative_set(True)
109153
tester.assert_authentication_enabled(2)
110-
tester.assert_expected_users(0)
154+
155+
def test_ops_manager_state_with_users_correctly_updated_after_switch(self, replica_set: MongoDB):
156+
expected_roles = {
157+
("admin", "clusterAdmin"),
158+
("admin", "userAdminAnyDatabase"),
159+
("admin", "readWrite"),
160+
("admin", "userAdminAnyDatabase"),
161+
}
162+
163+
tester = replica_set.get_automation_config_tester()
164+
tester.assert_has_user(self.USER_NAME)
165+
tester.assert_user_has_roles(self.USER_NAME, expected_roles)
166+
tester.assert_expected_users(1)

0 commit comments

Comments
 (0)