unkin-agent
618e1414e4
Replace the nfpm script with .goreleaser.yaml as the single driver for the RPM, the raw release binaries the compiler initContainer fetches, archives and checksums. Add an end-to-end test that issues a certificate from a real Vault dev server over approle.
64 lines
1.9 KiB
Bash
Executable File
64 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Run the end-to-end integration test against a real Vault dev server.
|
|
#
|
|
# With CERTMANAGER_IT_VAULT_ADDR set (CI, where Woodpecker runs Vault as a
|
|
# service) the test is run directly. Otherwise a throwaway dev server is
|
|
# started with docker/podman and torn down afterwards.
|
|
#
|
|
# VAULT_ADDR is deliberately ignored: this test mounts PKI and writes policies,
|
|
# and a developer shell usually has VAULT_ADDR pointing at production.
|
|
#
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${ROOT_DIR}"
|
|
|
|
VAULT_IMAGE="${VAULT_IMAGE:-hashicorp/vault:1.21}"
|
|
CONTAINER_NAME="${CONTAINER_NAME:-certmanager-integration-vault}"
|
|
|
|
run_tests() {
|
|
env -u VAULT_ADDR -u VAULT_TOKEN \
|
|
CERTMANAGER_IT_VAULT_ADDR="${CERTMANAGER_IT_VAULT_ADDR}" \
|
|
CERTMANAGER_IT_VAULT_TOKEN="${CERTMANAGER_IT_VAULT_TOKEN}" \
|
|
go test -tags=integration -count=1 -v ./test/integration/...
|
|
}
|
|
|
|
if [ -n "${CERTMANAGER_IT_VAULT_ADDR:-}" ]; then
|
|
echo "Using the Vault dev server at ${CERTMANAGER_IT_VAULT_ADDR}"
|
|
CERTMANAGER_IT_VAULT_TOKEN="${CERTMANAGER_IT_VAULT_TOKEN:-root}"
|
|
run_tests
|
|
exit 0
|
|
fi
|
|
|
|
RUNTIME=""
|
|
for candidate in docker podman; do
|
|
if command -v "${candidate}" >/dev/null 2>&1; then
|
|
RUNTIME="${candidate}"
|
|
break
|
|
fi
|
|
done
|
|
if [ -z "${RUNTIME}" ]; then
|
|
echo "ERROR: need docker or podman to start a Vault dev server, or set VAULT_ADDR" >&2
|
|
exit 1
|
|
fi
|
|
|
|
cleanup() {
|
|
"${RUNTIME}" rm -f "${CONTAINER_NAME}" >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
cleanup
|
|
|
|
echo "Starting ${VAULT_IMAGE} dev server via ${RUNTIME}"
|
|
"${RUNTIME}" run -d --name "${CONTAINER_NAME}" \
|
|
-p 8200:8200 \
|
|
-e VAULT_DEV_ROOT_TOKEN_ID=root \
|
|
-e VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200 \
|
|
"${VAULT_IMAGE}" \
|
|
server -dev >/dev/null
|
|
|
|
# The test itself polls sys/health, so no sleep here.
|
|
CERTMANAGER_IT_VAULT_ADDR="http://127.0.0.1:8200"
|
|
CERTMANAGER_IT_VAULT_TOKEN="root"
|
|
run_tests
|