Skip to content

Commit a81c464

Browse files
simonbairdsimonbaird
committed
Add acceptance test for new params task
Ref: https://redhat.atlassian.net/browse/EC-1695
1 parent 658ecb3 commit a81c464

2 files changed

Lines changed: 185 additions & 0 deletions

File tree

‎features/__snapshots__/task_validate_image.snap‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,3 +453,70 @@ true
453453
"TEST_OUTPUT": "{\"timestamp\":\"${TIMESTAMP}\",\"namespace\":\"\",\"successes\":5,\"failures\":0,\"warnings\":0,\"result\":\"SUCCESS\"}\n"
454454
}
455455
---
456+
457+
[Collect keyless signing parameters from ConfigMap:collect-signing-params - 1]
458+
Reading ConfigMap konflux-info/cluster-config
459+
ConfigMap found, extracting keyless signing parameters
460+
results.keylessSigningEnabled: true
461+
results.defaultOIDCIssuer: https://kubernetes.default.svc.cluster.local
462+
results.rekorExternalUrl: https://rekor.example.com
463+
results.fulcioExternalUrl: https://fulcio.example.com
464+
results.tufExternalUrl: https://tuf.example.com
465+
results.buildIdentity: https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller
466+
results.buildIdentityRegexp: ^https://konflux-ci.dev/.*$
467+
468+
---
469+
470+
[Collect keyless signing parameters from ConfigMap with keyless signing disabled:collect-signing-params - 1]
471+
Reading ConfigMap konflux-info/cluster-config-2
472+
ConfigMap found, extracting keyless signing parameters
473+
enableKeylessSigning is not set, using default empty values
474+
results.keylessSigningEnabled: false
475+
results.defaultOIDCIssuer:
476+
results.rekorExternalUrl:
477+
results.fulcioExternalUrl:
478+
results.tufExternalUrl:
479+
results.buildIdentity:
480+
results.buildIdentityRegexp:
481+
482+
---
483+
484+
[Collect keyless signing parameters when there is a malformed ConfigMap:collect-signing-params - 1]
485+
Reading ConfigMap konflux-info/cluster-config-3
486+
ConfigMap found, extracting keyless signing parameters
487+
enableKeylessSigning is not set, using default empty values
488+
results.keylessSigningEnabled: false
489+
results.defaultOIDCIssuer:
490+
results.rekorExternalUrl:
491+
results.fulcioExternalUrl:
492+
results.tufExternalUrl:
493+
results.buildIdentity:
494+
results.buildIdentityRegexp:
495+
496+
---
497+
498+
[Collect keyless signing parameters when the ConfigMap does not exist:collect-signing-params - 1]
499+
Reading ConfigMap konflux-info/doesnt-exist-config
500+
ConfigMap not found, using default empty values
501+
results.keylessSigningEnabled: false
502+
results.defaultOIDCIssuer:
503+
results.rekorExternalUrl:
504+
results.fulcioExternalUrl:
505+
results.tufExternalUrl:
506+
results.buildIdentity:
507+
results.buildIdentityRegexp:
508+
509+
---
510+
511+
[Collect keyless signing parameters when the namespace does not exist:collect-signing-params - 1]
512+
Reading ConfigMap doesnt-exist-namespace/whatever
513+
ConfigMap not found, using default empty values
514+
results.keylessSigningEnabled: false
515+
results.defaultOIDCIssuer:
516+
results.rekorExternalUrl:
517+
results.fulcioExternalUrl:
518+
results.tufExternalUrl:
519+
results.buildIdentity:
520+
results.buildIdentityRegexp:
521+
522+
---

‎features/task_validate_image.feature‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,3 +412,121 @@ Feature: Verify Enterprise Contract Tekton Tasks
412412
Then the task should succeed
413413
And the task logs for step "report-json" should match the snapshot
414414
And the task results should match the snapshot
415+
416+
Scenario: Collect keyless signing parameters from ConfigMap
417+
Given a working namespace
418+
And a namespace named "konflux-info" exists
419+
# Note: These scenarios might run in parallel so let's use a different config map
420+
# for each scenario so we don't have to worry about them clashing with each other
421+
And a ConfigMap "cluster-config" in namespace "konflux-info" with content:
422+
"""
423+
{
424+
"defaultOIDCIssuer": "https://kubernetes.default.svc.cluster.local",
425+
"rekorExternalUrl": "https://rekor.example.com",
426+
"fulcioExternalUrl": "https://fulcio.example.com",
427+
"tufExternalUrl": "https://tuf.example.com",
428+
"buildIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
429+
"buildIdentityRegexp": "^https://konflux-ci.dev/.*$",
430+
"enableKeylessSigning": "true"
431+
}
432+
"""
433+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
434+
| configMapName | cluster-config |
435+
Then the task should succeed
436+
And the task logs for step "collect-signing-params" should match the snapshot
437+
And the task result "defaultOIDCIssuer" should equal "https://kubernetes.default.svc.cluster.local"
438+
And the task result "rekorExternalUrl" should equal "https://rekor.example.com"
439+
And the task result "fulcioExternalUrl" should equal "https://fulcio.example.com"
440+
And the task result "tufExternalUrl" should equal "https://tuf.example.com"
441+
And the task result "buildIdentity" should equal "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller"
442+
And the task result "buildIdentityRegexp" should equal "^https://konflux-ci.dev/.*$"
443+
And the task result "keylessSigningEnabled" should equal "true"
444+
445+
Scenario: Collect keyless signing parameters from ConfigMap with keyless signing disabled
446+
Given a working namespace
447+
And a namespace named "konflux-info" exists
448+
# Note: These scenarios might run in parallel so let's use a different config map
449+
# for each scenario so we don't have to worry about them clashing with each other
450+
And a ConfigMap "cluster-config-2" in namespace "konflux-info" with content:
451+
"""
452+
{
453+
"defaultOIDCIssuer": "https://kubernetes.default.svc.cluster.local",
454+
"rekorExternalUrl": "https://rekor.example.com",
455+
"fulcioExternalUrl": "https://fulcio.example.com",
456+
"tufExternalUrl": "https://tuf.example.com",
457+
"buildIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
458+
"buildIdentityRegexp": "^https://konflux-ci.dev/.*$",
459+
"enableKeylessSigning": "false"
460+
}
461+
"""
462+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
463+
| configMapName | cluster-config-2 |
464+
Then the task should succeed
465+
And the task logs for step "collect-signing-params" should match the snapshot
466+
And the task result "defaultOIDCIssuer" should equal ""
467+
And the task result "rekorExternalUrl" should equal ""
468+
And the task result "fulcioExternalUrl" should equal ""
469+
And the task result "tufExternalUrl" should equal ""
470+
And the task result "buildIdentity" should equal ""
471+
And the task result "buildIdentityRegexp" should equal ""
472+
And the task result "keylessSigningEnabled" should equal "false"
473+
474+
Scenario: Collect keyless signing parameters when there is a malformed ConfigMap
475+
Given a working namespace
476+
And a namespace named "konflux-info" exists
477+
# Note: These scenarios might run in parallel so let's use a different config map
478+
# for each scenario so we don't have to worry about them clashing with each other
479+
And a ConfigMap "cluster-config-3" in namespace "konflux-info" with content:
480+
"""
481+
{"foo": "bar"}
482+
"""
483+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
484+
| configMapName | cluster-config-3 |
485+
Then the task should succeed
486+
And the task logs for step "collect-signing-params" should match the snapshot
487+
And the task result "defaultOIDCIssuer" should equal ""
488+
And the task result "rekorExternalUrl" should equal ""
489+
And the task result "fulcioExternalUrl" should equal ""
490+
And the task result "tufExternalUrl" should equal ""
491+
And the task result "buildIdentity" should equal ""
492+
And the task result "buildIdentityRegexp" should equal ""
493+
And the task result "keylessSigningEnabled" should equal "false"
494+
495+
Scenario: Collect keyless signing parameters when the ConfigMap does not exist
496+
Given a working namespace
497+
And a namespace named "konflux-info" exists
498+
# Note: These scenarios might run in parallel so let's use a different config map
499+
# for each scenario so we don't have to worry about them clashing with each other.
500+
# Creating a config map deliberately so we are sure the rbac is created. (I might
501+
# be wrong but I think it could matter if this secenario runs before any of the
502+
# others.)
503+
And a ConfigMap "cluster-config-4" in namespace "konflux-info" with content:
504+
"""
505+
{"foo": "bar"}
506+
"""
507+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
508+
| configMapNamespace | konflux-info |
509+
| configMapName | doesnt-exist-config |
510+
Then the task should succeed
511+
And the task logs for step "collect-signing-params" should match the snapshot
512+
And the task result "defaultOIDCIssuer" should equal ""
513+
And the task result "rekorExternalUrl" should equal ""
514+
And the task result "fulcioExternalUrl" should equal ""
515+
And the task result "tufExternalUrl" should equal ""
516+
And the task result "buildIdentityRegexp" should equal ""
517+
And the task result "keylessSigningEnabled" should equal "false"
518+
519+
Scenario: Collect keyless signing parameters when the namespace does not exist
520+
Given a working namespace
521+
When version 0.1 of the task named "collect-keyless-params" is run with parameters:
522+
| configMapNamespace | doesnt-exist-namespace |
523+
| configMapName | whatever |
524+
Then the task should succeed
525+
And the task logs for step "collect-signing-params" should match the snapshot
526+
And the task result "defaultOIDCIssuer" should equal ""
527+
And the task result "rekorExternalUrl" should equal ""
528+
And the task result "fulcioExternalUrl" should equal ""
529+
And the task result "tufExternalUrl" should equal ""
530+
And the task result "buildIdentity" should equal ""
531+
And the task result "buildIdentityRegexp" should equal ""
532+
And the task result "keylessSigningEnabled" should equal "false"

0 commit comments

Comments
 (0)