Release via goreleaser; test against a real Vault

Replace the nfpm script with .goreleaser.yaml as the single driver for the RPM, the raw release binaries the compiler initContainer fetches, archives and checksums. Add an end-to-end test that issues a certificate from a real Vault dev server over approle.
2026-09-19 12:12:25 +10:00
parent b9633481a5
commit 618e1414e4
11 changed files with 632 additions and 199 deletions
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-#
-# Package the (already built) certmanager binary into an RPM with nfpm,
-# bundling generated bash/zsh/fish shell completions.
-# Usage: scripts/build-rpm.sh [version]   (version defaults to $CI_COMMIT_TAG)
-#
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "${ROOT_DIR}"
-
-VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
-VERSION="${VERSION#v}" # strip a leading v
-BINARY="certmanager"
-DIST="dist"
-
-if [ ! -f "${DIST}/${BINARY}" ]; then
-  echo "ERROR: ${DIST}/${BINARY} not found; run 'make build' first" >&2
-  exit 1
-fi
-
-# Generate shell completions from the freshly built binary so they always match
-# the shipped flags.
-COMP_DIR="${DIST}/completions"
-mkdir -p "${COMP_DIR}"
-"./${DIST}/${BINARY}" completion bash >"${COMP_DIR}/${BINARY}.bash"
-"./${DIST}/${BINARY}" completion zsh >"${COMP_DIR}/_${BINARY}"
-"./${DIST}/${BINARY}" completion fish >"${COMP_DIR}/${BINARY}.fish"
-
-export PACKAGE_NAME="${BINARY}"
-export PACKAGE_VERSION="${VERSION}"
-export PACKAGE_RELEASE="1"
-export PACKAGE_ARCH="amd64"
-export PACKAGE_PLATFORM="linux"
-export PACKAGE_DESCRIPTION="Issues Vault PKI certificates for Puppet-managed nodes; drop-in replacement for the Python certmanager script"
-export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
-export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/certmanager"
-export PACKAGE_LICENSE="MIT"
-
-envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
-nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
-
-echo "Built:"
-ls -1 "${DIST}"/*.rpm
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+#
+# Run the end-to-end integration test against a real Vault dev server.
+#
+# With CERTMANAGER_IT_VAULT_ADDR set (CI, where Woodpecker runs Vault as a
+# service) the test is run directly. Otherwise a throwaway dev server is
+# started with docker/podman and torn down afterwards.
+#
+# VAULT_ADDR is deliberately ignored: this test mounts PKI and writes policies,
+# and a developer shell usually has VAULT_ADDR pointing at production.
+#
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+VAULT_IMAGE="${VAULT_IMAGE:-hashicorp/vault:1.21}"
+CONTAINER_NAME="${CONTAINER_NAME:-certmanager-integration-vault}"
+
+run_tests() {
+  env -u VAULT_ADDR -u VAULT_TOKEN \
+    CERTMANAGER_IT_VAULT_ADDR="${CERTMANAGER_IT_VAULT_ADDR}" \
+    CERTMANAGER_IT_VAULT_TOKEN="${CERTMANAGER_IT_VAULT_TOKEN}" \
+    go test -tags=integration -count=1 -v ./test/integration/...
+}
+
+if [ -n "${CERTMANAGER_IT_VAULT_ADDR:-}" ]; then
+  echo "Using the Vault dev server at ${CERTMANAGER_IT_VAULT_ADDR}"
+  CERTMANAGER_IT_VAULT_TOKEN="${CERTMANAGER_IT_VAULT_TOKEN:-root}"
+  run_tests
+  exit 0
+fi
+
+RUNTIME=""
+for candidate in docker podman; do
+  if command -v "${candidate}" >/dev/null 2>&1; then
+    RUNTIME="${candidate}"
+    break
+  fi
+done
+if [ -z "${RUNTIME}" ]; then
+  echo "ERROR: need docker or podman to start a Vault dev server, or set VAULT_ADDR" >&2
+  exit 1
+fi
+
+cleanup() {
+  "${RUNTIME}" rm -f "${CONTAINER_NAME}" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+cleanup
+
+echo "Starting ${VAULT_IMAGE} dev server via ${RUNTIME}"
+"${RUNTIME}" run -d --name "${CONTAINER_NAME}" \
+  -p 8200:8200 \
+  -e VAULT_DEV_ROOT_TOKEN_ID=root \
+  -e VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200 \
+  "${VAULT_IMAGE}" \
+  server -dev >/dev/null
+
+# The test itself polls sys/health, so no sleep here.
+CERTMANAGER_IT_VAULT_ADDR="http://127.0.0.1:8200"
+CERTMANAGER_IT_VAULT_TOKEN="root"
+run_tests