Skip to content

Commit d10ca8d

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #4479 from agullon/USHIFT-2596
USHIFT-2596: improve TLS config cipher RF test cases
2 parents 580634c + 1e7061d commit d10ca8d

File tree

3 files changed

+86
-38
lines changed

3 files changed

+86
-38
lines changed

‎test/resources/microshift-config.resource

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,13 @@ Clear Lvmd Config
122122
... sudo=True return_rc=True return_stderr=True return_stdout=False
123123
Log ${stderr}
124124
Should Be Equal As Integers 0 ${rc}
125+
126+
Show Config
127+
[Documentation] Run microshift show-config with ${mode}
128+
[Arguments] ${mode}
129+
${output} ${rc}= Execute Command
130+
... microshift show-config --mode ${mode}
131+
... sudo=True return_rc=True
132+
Should Be Equal As Integers 0 ${rc}
133+
${yaml_data}= Yaml Parse ${output}
134+
RETURN ${yaml_data}

‎test/suites/standard1/show-config.robot

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,3 @@ Teardown
6464
[Documentation] Test suite teardown
6565
Remove Drop In MicroShift Config 10-etcd
6666
Logout MicroShift Host
67-
68-
Show Config
69-
[Documentation] Run microshift show-config with ${mode}
70-
[Arguments] ${mode}
71-
${output} ${rc}= Execute Command
72-
... microshift show-config --mode ${mode}
73-
... sudo=True return_rc=True
74-
Should Be Equal As Integers 0 ${rc}
75-
${yaml_data}= Yaml Parse ${output}
76-
RETURN ${yaml_data}

‎test/suites/standard2/configuration.robot

Lines changed: 76 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -48,16 +48,17 @@ ${LVMS_CSI_SNAPSHOT_DISABLED} SEPARATOR=\n
4848
... storage:
4949
... \ \ driver: "none"
5050
... \ \ optionalCsiComponents: [ none ]
51-
${TLS_13_MIN_VERSION} SEPARATOR=\n
52-
... apiServer:
53-
... \ \ tls:
54-
... \ \ \ \ minVersion: VersionTLS13
5551
${TLS_12_CUSTOM_CIPHER} SEPARATOR=\n
5652
... apiServer:
5753
... \ \ tls:
5854
... \ \ \ \ cipherSuites:
59-
... \ \ \ \ - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
55+
... \ \ \ \ - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
6056
... \ \ \ \ minVersion: VersionTLS12
57+
${TLS_13_MIN_VERSION} SEPARATOR=\n
58+
... apiServer:
59+
... \ \ tls:
60+
... \ \ \ \ minVersion: VersionTLS13
61+
${APISERVER_ETCD_CLIENT_CERT} /var/lib/microshift/certs/etcd-signer/apiserver-etcd-client
6162

6263

6364
*** Test Cases ***
@@ -142,37 +143,52 @@ Deploy MicroShift Without CSI Snapshotter
142143
... Remove Storage Drop In Config
143144
... Restart MicroShift
144145

145-
Custom TLS 1_3 configuration
146-
[Documentation] Configure API server to use TLS 1.3 and verify only that
147-
... version works
148-
[Setup] Setup TLS Configuration ${TLS_13_MIN_VERSION}
146+
Custom TLS 1_2 configuration
147+
[Documentation] Configure a custom cipher suite using TLSv1.2 as min version and verify it is used
148+
[Setup] Setup TLS Configuration ${TLS_12_CUSTOM_CIPHER}
149+
150+
${config}= Show Config effective
151+
Should Be Equal ${config.apiServer.tls.minVersion} VersionTLS12
152+
Length Should Be ${config.apiServer.tls.cipherSuites} 2
153+
Should Contain ${config.apiServer.tls.cipherSuites} TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
154+
Should Contain ${config.apiServer.tls.cipherSuites} TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
149155

150-
${rc}= Execute Command
151-
... openssl s_client -connect ${USHIFT_HOST}:6443 -tls1_3 <<< "Q"
152-
... sudo=True return_stdout=False return_stderr=False return_rc=True
153-
Should Be Equal As Integers ${rc} 0
156+
# on TLSv1.2, openssl ciphers string codes (defined by IANA) does not excatly match openshift ones
157+
# custom cipher defined for this test
158+
Check TLS Endpoints 0 TLSv1.2 ECDHE-RSA-CHACHA20-POLY1305 # TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
159+
Check TLS Endpoints 1 TLSv1.3 ECDHE-RSA-CHACHA20-POLY1305 # TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
154160

155-
${rc}= Execute Command
156-
... openssl s_client -connect ${USHIFT_HOST}:6443 -tls1_2
157-
... sudo=True return_stdout=False return_stderr=False return_rc=True
158-
Should Not Be Equal As Integers ${rc} 0
161+
# mandatory cipher needed for internal enpoints (i.e. etcd), set if not defined by the user
162+
Check TLS Endpoints 0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 # TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
163+
Check TLS Endpoints 1 TLSv1.3 ECDHE-RSA-AES128-GCM-SHA256 # TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
164+
165+
# when TLSv1.2 is set as min version, TLSv1.3 must also work
166+
Check TLS Endpoints 1 TLSv1.2 TLS_AES_128_GCM_SHA256
167+
Check TLS Endpoints 0 TLSv1.3 TLS_AES_128_GCM_SHA256
159168

160169
[Teardown] Run Keywords
161170
... Remove TLS Drop In Config
162171
... Restart MicroShift
163172

164-
Custom TLS 1_2 configuration
165-
[Documentation] Configure a custom cipher suite using TLS 1.2 and verify
166-
... it is used
167-
[Setup] Setup TLS Configuration ${TLS_12_CUSTOM_CIPHER}
173+
Custom TLS 1_3 configuration
174+
[Documentation] Configure API server to use TLSv1.3 as min version and verify only that version works
175+
... TLSv1.2 must fail and cipher suites for TLSv1.3 can not be config by the user, always 3 are enabled.
176+
[Setup] Setup TLS Configuration ${TLS_13_MIN_VERSION}
168177

169-
${rc}= Execute Command
170-
... openssl s_client -connect ${USHIFT_HOST}:6443 -tls1_2 <<< "Q" 2>/dev/null | grep "Cipher is ECDHE-RSA-AES128-GCM-SHA256"
171-
... sudo=True
172-
... return_stdout=False
173-
... return_stderr=False
174-
... return_rc=True
175-
Should Be Equal As Integers ${rc} 0
178+
${config}= Show Config effective
179+
Should Be Equal ${config.apiServer.tls.minVersion} VersionTLS13
180+
Length Should Be ${config.apiServer.tls.cipherSuites} 3
181+
Should Contain ${config.apiServer.tls.cipherSuites} TLS_AES_128_GCM_SHA256
182+
Should Contain ${config.apiServer.tls.cipherSuites} TLS_AES_256_GCM_SHA384
183+
Should Contain ${config.apiServer.tls.cipherSuites} TLS_CHACHA20_POLY1305_SHA256
184+
185+
# checking the 3 ciphers available for TLSv1.3 on openshift
186+
Check TLS Endpoints 1 TLSv1.2 TLS_AES_128_GCM_SHA256
187+
Check TLS Endpoints 0 TLSv1.3 TLS_AES_128_GCM_SHA256
188+
Check TLS Endpoints 1 TLSv1.2 TLS_AES_256_GCM_SHA384
189+
Check TLS Endpoints 0 TLSv1.3 TLS_AES_256_GCM_SHA384
190+
Check TLS Endpoints 1 TLSv1.2 TLS_CHACHA20_POLY1305_SHA256
191+
Check TLS Endpoints 0 TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
176192

177193
[Teardown] Run Keywords
178194
... Remove TLS Drop In Config
@@ -255,3 +271,35 @@ LVMS Is Deployed
255271
CSI Snapshot Controller Is Deployed
256272
[Documentation] Wait for CSI snapshot controller to be deployed
257273
Named Deployment Should Be Available csi-snapshot-controller kube-system 120s
274+
275+
Openssl Connect Command
276+
[Documentation] Run Openssl Connect Command in the remote server
277+
[Arguments] ${host_and_port} ${args}
278+
${stdout} ${rc}= Execute Command
279+
... openssl s_client -connect ${host_and_port} ${args} <<< "Q"
280+
... sudo=True return_stdout=True return_stderr=False return_rc=True
281+
RETURN ${stdout} ${rc}
282+
283+
Check TLS Endpoints
284+
[Documentation] Run Openssl Connect Command to check k8s internal endpoints
285+
[Arguments] ${return_code} ${tls_version} ${cipher}
286+
IF "${tls_version}" == "TLSv1.2"
287+
Set Test Variable ${TLS_AND_CIPHER_ARGS} -tls1_2 -cipher ${cipher}
288+
ELSE IF "${tls_version}" == "TLSv1.3"
289+
Set Test Variable ${TLS_AND_CIPHER_ARGS} -tls1_3 -ciphersuites ${cipher}
290+
END
291+
292+
# api server, kubelet, kube controller manager and kube scheduler endpoint ports
293+
FOR ${port} IN 6443 10250 10257 10259
294+
${stdout} ${rc}= Openssl Connect Command ${USHIFT_HOST}:${port} ${TLS_AND_CIPHER_ARGS}
295+
Should Be Equal As Integers ${return_code} ${rc}
296+
IF "${rc}" == "0"
297+
Should Contain ${stdout} ${tls_version}, Cipher is ${cipher}
298+
END
299+
END
300+
301+
# etcd endpoint, need to use cert and key because etcd requires mTLS
302+
Set Test Variable ${CERT_ARG} -cert ${APISERVER_ETCD_CLIENT_CERT}/client.crt
303+
Set Test Variable ${KEY_ARG} -key ${APISERVER_ETCD_CLIENT_CERT}/client.key
304+
${stdout} ${rc}= Openssl Connect Command localhost:2379 ${TLS_AND_CIPHER_ARGS} ${CERT_ARG} ${KEY_ARG}
305+
Should Be Equal As Integers ${return_code} ${rc}

0 commit comments

Comments
 (0)