Skip to content

Commit 06294a4

Browse files
author
tkong
committed
Address the review comments
1 parent 0d2dd0f commit 06294a4

2 files changed

Lines changed: 141 additions & 41 deletions

File tree

‎test/e2e/splunk_forwarder_operator_tests.go‎

Lines changed: 39 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
152152
ginkgo.By("creating a SplunkForwarder CR with test configuration")
153153
sf := makeSplunkforwarderWithIndex(
154154
crName,
155+
operatorNamespace,
155156
"/var/log/test.log",
156157
"test_index",
157158
"_json",
@@ -217,7 +218,13 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
217218
testSourcetype := "linux_audit"
218219

219220
ginkgo.By("creating a SplunkForwarder CR with specific input configuration")
220-
sf := makeSplunkforwarderWithIndex(crName, testPath, testIndex, testSourcetype)
221+
sf := makeSplunkforwarderWithIndex(
222+
crName,
223+
operatorNamespace,
224+
testPath,
225+
testIndex,
226+
testSourcetype,
227+
)
221228
sf.Spec.ClusterID = clusterID
222229
Expect(k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)).To(Succeed())
223230

@@ -284,15 +291,15 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
284291
})
285292

286293
ginkgo.It("admin should be able to create and delete SplunkForwarders CR", func(ctx context.Context) {
287-
sf := makeMinimalSplunkforwarder(testSplunkForwarder)
294+
sf := makeMinimalSplunkforwarder(testSplunkForwarder, operatorNamespace)
288295
err := k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)
289296
Expect(err).NotTo(HaveOccurred())
290297
err = k8s.WithNamespace(operatorNamespace).Delete(ctx, &sf)
291298
Expect(err).NotTo(HaveOccurred())
292299
})
293300

294301
ginkgo.It("dedicated admin should not be able to manage SplunkForwarders CR", func(ctx context.Context) {
295-
dsf := makeMinimalSplunkforwarder(dedicatedAdminSplunkForwarder)
302+
dsf := makeMinimalSplunkforwarder(dedicatedAdminSplunkForwarder, operatorNamespace)
296303
impersonatedResourceClient, _ := k8s.Impersonate("test-user@redhat.com", "dedicated-admins")
297304
Expect(sfv1alpha1.AddToScheme(impersonatedResourceClient.GetScheme())).Should(BeNil(), "unable to register sfv1alpha1 api scheme")
298305
err := impersonatedResourceClient.WithNamespace(operatorNamespace).Create(ctx, &dsf)
@@ -303,7 +310,13 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
303310
crName := "test-reconcile-update"
304311

305312
ginkgo.By("creating initial SplunkForwarder CR")
306-
sf := makeSplunkforwarderWithIndex(crName, "/var/log/initial.log", "initial_index", "_json")
313+
sf := makeSplunkforwarderWithIndex(
314+
crName,
315+
operatorNamespace,
316+
"/var/log/initial.log",
317+
"initial_index",
318+
"_json",
319+
)
307320
Expect(k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)).To(Succeed())
308321

309322
defer func() {
@@ -368,7 +381,13 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
368381
crName := "test-hec-connectivity"
369382

370383
ginkgo.By("creating SplunkForwarder CR for HEC mode")
371-
sf := makeSplunkforwarderWithIndex(crName, "/var/log/hec-test.log", "hec_index", "_json")
384+
sf := makeSplunkforwarderWithIndex(
385+
crName,
386+
operatorNamespace,
387+
"/var/log/hec-test.log",
388+
"hec_index",
389+
"_json",
390+
)
372391
Expect(k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)).To(Succeed())
373392

374393
defer func() {
@@ -514,7 +533,7 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
514533
Expect(k8s.Delete(ctx, &authSecret)).To(Succeed())
515534

516535
ginkgo.By("creating SplunkForwarder CR without auth secret present")
517-
sf := makeMinimalSplunkforwarder(crName)
536+
sf := makeMinimalSplunkforwarder(crName, operatorNamespace)
518537
sf.Spec.SplunkInputs[0].Path = "/var/log/test.log"
519538
err = k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)
520539

@@ -546,7 +565,13 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
546565
crName := "test-retry-logic"
547566

548567
ginkgo.By("creating SplunkForwarder CR")
549-
sf := makeSplunkforwarderWithIndex(crName, "/var/log/retry.log", "retry_index", "_json")
568+
sf := makeSplunkforwarderWithIndex(
569+
crName,
570+
operatorNamespace,
571+
"/var/log/retry.log",
572+
"retry_index",
573+
"_json",
574+
)
550575
Expect(k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)).To(Succeed())
551576

552577
defer func() {
@@ -601,7 +626,13 @@ var _ = ginkgo.Describe("Splunk Forwarder Operator", ginkgo.Ordered, func() {
601626
crName := "test-deletion-cleanup"
602627

603628
ginkgo.By("creating SplunkForwarder CR")
604-
sf := makeSplunkforwarderWithIndex(crName, "/var/log/cleanup.log", "cleanup_index", "_json")
629+
sf := makeSplunkforwarderWithIndex(
630+
crName,
631+
operatorNamespace,
632+
"/var/log/cleanup.log",
633+
"cleanup_index",
634+
"_json",
635+
)
605636
Expect(k8s.WithNamespace(operatorNamespace).Create(ctx, &sf)).To(Succeed())
606637

607638
ginkgo.By("waiting for resources to be created")

test/e2e/test_helpers.go renamed to test/e2e/utils.go

Lines changed: 102 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,14 @@ package osde2etests
55

66
import (
77
"context"
8+
"crypto/rand"
9+
"crypto/rsa"
10+
"crypto/x509"
11+
"crypto/x509/pkix"
12+
"encoding/pem"
813
"fmt"
14+
"math/big"
15+
"time"
916

1017
securityv1 "github.com/openshift/api/security/v1"
1118
corev1 "k8s.io/api/core/v1"
@@ -19,11 +26,11 @@ import (
1926
)
2027

2128
// Create test splunkforwarder CR definition
22-
func makeMinimalSplunkforwarder(name string) sfv1alpha1.SplunkForwarder {
29+
func makeMinimalSplunkforwarder(name string, namespace string) sfv1alpha1.SplunkForwarder {
2330
return sfv1alpha1.SplunkForwarder{
2431
ObjectMeta: metav1.ObjectMeta{
2532
Name: name,
26-
Namespace: operatorNamespace,
33+
Namespace: namespace,
2734
},
2835
Spec: sfv1alpha1.SplunkForwarderSpec{
2936
SplunkLicenseAccepted: true,
@@ -38,11 +45,11 @@ func makeMinimalSplunkforwarder(name string) sfv1alpha1.SplunkForwarder {
3845
}
3946

4047
// makeSplunkforwarderWithIndex creates a test SplunkForwarder CR with custom index settings
41-
func makeSplunkforwarderWithIndex(name, path, index, sourcetype string) sfv1alpha1.SplunkForwarder {
48+
func makeSplunkforwarderWithIndex(name, namespace, path, index, sourcetype string) sfv1alpha1.SplunkForwarder {
4249
return sfv1alpha1.SplunkForwarder{
4350
ObjectMeta: metav1.ObjectMeta{
4451
Name: name,
45-
Namespace: operatorNamespace,
52+
Namespace: namespace,
4653
},
4754
Spec: sfv1alpha1.SplunkForwarderSpec{
4855
SplunkLicenseAccepted: true,
@@ -144,35 +151,90 @@ func cleanupTestSecrets(ctx context.Context, k8s *openshift.Client, namespace st
144151
k8s.Delete(ctx, hecSecret)
145152
}
146153

147-
// generateSelfSignedCACert returns a PEM-encoded self-signed CA cert for testing
148-
// This is a minimal test certificate - sufficient for testing secret mounting
154+
// generateSelfSignedCACert dynamically generates a PEM-encoded self-signed CA certificate
155+
// using Go's crypto packages for realistic testing
149156
func generateSelfSignedCACert() string {
150-
return `-----BEGIN CERTIFICATE-----
151-
MIIDXTCCAkWgAwIBAgIJAKJ0qJxKLhpOMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
152-
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
153-
aWRnaXRzIFB0eSBMdGQwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjBF
154-
MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
155-
ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
156-
CgKCAQEAtIb8nPQXLq6F0mGxMz6pqGm6QC7hUdXQQEH+Vv8nqNGdF2P4IxHLqY3v
157-
8cTqvCXMQvJn4mGrDFVPZqXMtHxFHI+cKXkQ9BVJdUPxP6fqMq7TI4Cv3kMhz9M3
158-
-----END CERTIFICATE-----`
157+
// Generate RSA private key
158+
privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
159+
if err != nil {
160+
panic(fmt.Sprintf("failed to generate CA private key: %v", err))
161+
}
162+
163+
// Create certificate template
164+
template := x509.Certificate{
165+
SerialNumber: big.NewInt(1),
166+
Subject: pkix.Name{
167+
Organization: []string{"Splunk E2E Test CA"},
168+
Country: []string{"US"},
169+
CommonName: "Splunk Test CA",
170+
},
171+
NotBefore: time.Now(),
172+
NotAfter: time.Now().Add(30 * 24 * time.Hour), // Valid for 1 month
173+
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
174+
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
175+
BasicConstraintsValid: true,
176+
IsCA: true,
177+
}
178+
179+
// Create self-signed certificate
180+
certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
181+
if err != nil {
182+
panic(fmt.Sprintf("failed to create CA certificate: %v", err))
183+
}
184+
185+
// Encode certificate to PEM
186+
certPEM := pem.EncodeToMemory(&pem.Block{
187+
Type: "CERTIFICATE",
188+
Bytes: certDER,
189+
})
190+
191+
return string(certPEM)
159192
}
160193

161-
// generateSelfSignedServerCert returns a PEM-encoded server cert for testing
194+
// generateSelfSignedServerCert dynamically generates a PEM-encoded server certificate
195+
// with both certificate and private key for Splunk mTLS authentication
162196
func generateSelfSignedServerCert() string {
163-
return `-----BEGIN CERTIFICATE-----
164-
MIIDXTCCAkWgAwIBAgIJAKJ0qJxKLhpPMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
165-
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
166-
aWRnaXRzIFB0eSBMdGQwHhcNMjQwMTAxMDAwMDAwWhcNMjUwMTAxMDAwMDAwWjBF
167-
MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
168-
ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
169-
CgKCAQEAtIb8nPQXLq6F0mGxMz6pqGm6QC7hUdXQQEH+Vv8nqNGdF2P4IxHLqY3v
170-
-----END CERTIFICATE-----
171-
-----BEGIN PRIVATE KEY-----
172-
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC0hvy89Bcur4XS
173-
YbEzPqmoabpALuFR1dBAQf5W/yeo0Z0XY/gjEcupje/xxOq8JcxC8mfiYasMVU9m
174-
pcy0fEUcj5wpeRD0FUl1Q/E/p+oyrtMjgK/eQyHP0zc=
175-
-----END PRIVATE KEY-----`
197+
// Generate RSA private key
198+
privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
199+
if err != nil {
200+
panic(fmt.Sprintf("failed to generate server private key: %v", err))
201+
}
202+
203+
// Create certificate template
204+
template := x509.Certificate{
205+
SerialNumber: big.NewInt(2),
206+
Subject: pkix.Name{
207+
Organization: []string{"Splunk E2E Test Server"},
208+
Country: []string{"US"},
209+
CommonName: "splunk-forwarder-test.example.com",
210+
},
211+
NotBefore: time.Now(),
212+
NotAfter: time.Now().Add(30 * 24 * time.Hour), // Valid for 1 month
213+
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
214+
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
215+
DNSNames: []string{"splunk-forwarder-test.example.com", "localhost"},
216+
}
217+
218+
// Create self-signed certificate (in production, this would be signed by CA)
219+
certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
220+
if err != nil {
221+
panic(fmt.Sprintf("failed to create server certificate: %v", err))
222+
}
223+
224+
// Encode certificate to PEM
225+
certPEM := pem.EncodeToMemory(&pem.Block{
226+
Type: "CERTIFICATE",
227+
Bytes: certDER,
228+
})
229+
230+
// Encode private key to PEM
231+
privateKeyPEM := pem.EncodeToMemory(&pem.Block{
232+
Type: "RSA PRIVATE KEY",
233+
Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
234+
})
235+
236+
// Return combined certificate and private key
237+
return string(certPEM) + string(privateKeyPEM)
176238
}
177239

178240
// generateMTLSOutputsConf returns outputs.conf content for mTLS mode
@@ -181,7 +243,7 @@ func generateMTLSOutputsConf() string {
181243
defaultGroup = default-autolb-group
182244
183245
[tcpout:default-autolb-group]
184-
server = splunk.example.com:9997
246+
server = splunk-forwarder-test.example.com:9997
185247
clientCert = $SPLUNK_HOME/etc/apps/splunkauth/default/server.pem
186248
sslCertPath = $SPLUNK_HOME/etc/apps/splunkauth/default/server.pem
187249
sslRootCAPath = $SPLUNK_HOME/etc/apps/splunkauth/default/cacert.pem
@@ -190,11 +252,18 @@ sslVerifyServerCert = false`
190252
}
191253

192254
// generateHECOutputsConf returns outputs.conf content for HEC mode
255+
// with a realistic HEC token format (UUID) for testing
193256
func generateHECOutputsConf() string {
194257
return `[http]
195-
httpEventCollectorToken = test-hec-token-12345
196-
uri = http://mock-hec-server:8088
197-
disabled = 0`
258+
httpEventCollectorToken = 12345678-1234-5678-1234-567812345678
259+
uri = https://splunk-hec.example.com:8088/services/collector/event
260+
disabled = 0
261+
useACK = true
262+
token = 12345678-1234-5678-1234-567812345678
263+
264+
[tcpout]
265+
defaultGroup = nothing
266+
disabled = true`
198267
}
199268

200269
// generateLimitsConf returns limits.conf content for testing

0 commit comments

Comments
 (0)