From 63a643b77f302d95a6f107496908ae16ac21e6c9 Mon Sep 17 00:00:00 2001 From: stevenhorsman Date: Tue, 24 Sep 2024 17:12:39 +0100 Subject: [PATCH] test/e2e: Test should fail if we error during set-up We have had an issue where the secret key setting wasn't working and throwing errors and we just ignored it. To help with debugging we should be responding to errors rather than just ignoring them. Signed-off-by: stevenhorsman --- src/cloud-api-adaptor/test/e2e/azure_test.go | 14 ++++- src/cloud-api-adaptor/test/e2e/docker_test.go | 20 +++++-- .../test/e2e/libvirt_test.go | 55 +++++++++++++++---- 3 files changed, 72 insertions(+), 17 deletions(-) diff --git a/src/cloud-api-adaptor/test/e2e/azure_test.go b/src/cloud-api-adaptor/test/e2e/azure_test.go index bca57f7ee..fdf0b1f26 100644 --- a/src/cloud-api-adaptor/test/e2e/azure_test.go +++ b/src/cloud-api-adaptor/test/e2e/azure_test.go @@ -135,6 +135,9 @@ func TestKbsKeyRelease(t *testing.T) { testSecret := envconf.RandomName("coco-pp-e2e-secret", 25) resourcePath := "caa/workload_key/test_key.bin" err := keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) + if err != nil { + t.Fatalf("SetSecret failed with: %v", err) + } DoTestKbsKeyRelease(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) } @@ -146,7 +149,11 @@ func TestRemoteAttestation(t *testing.T) { } else if keyBrokerService == nil { t.Skip("Skipping because KBS config is missing") } else { - kbsEndpoint, _ = keyBrokerService.GetCachedKbsEndpoint() + var err error + kbsEndpoint, err = keyBrokerService.GetCachedKbsEndpoint() + if err != nil { + t.Fatalf("GetCachedKbsEndpoint failed with: %v", err) + } } DoTestRemoteAttestation(t, testEnv, assert, kbsEndpoint) } @@ -156,7 +163,10 @@ func TestTrusteeOperatorKeyReleaseForSpecificKey(t *testing.T) { t.Skip("Skipping kbs related test as Trustee Operator is not deployed") } t.Parallel() - kbsEndpoint, _ := keyBrokerService.GetCachedKbsEndpoint() + kbsEndpoint, err := keyBrokerService.GetCachedKbsEndpoint() + if err != nil { + t.Fatalf("GetCachedKbsEndpoint failed with: %v", err) + } DoTestKbsKeyRelease(t, testEnv, assert, kbsEndpoint, "default/kbsres1/key1", "res1val1") } diff --git a/src/cloud-api-adaptor/test/e2e/docker_test.go b/src/cloud-api-adaptor/test/e2e/docker_test.go index f43ab86ec..25124f5b0 100644 --- a/src/cloud-api-adaptor/test/e2e/docker_test.go +++ b/src/cloud-api-adaptor/test/e2e/docker_test.go @@ -105,13 +105,25 @@ func TestDockerKbsKeyRelease(t *testing.T) { } testSecret := envconf.RandomName("coco-pp-e2e-secret", 25) resourcePath := "caa/workload_key/test_key.bin" - keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) - keyBrokerService.EnableKbsCustomizedResourcePolicy("deny_all.rego") - kbsEndpoint, _ := keyBrokerService.GetCachedKbsEndpoint() + err := keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) + if err != nil { + t.Fatalf("SetSecret failed with: %v", err) + } + err = keyBrokerService.EnableKbsCustomizedResourcePolicy("deny_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedResourcePolicy failed with: %v", err) + } + kbsEndpoint, err := keyBrokerService.GetCachedKbsEndpoint() + if err != nil { + t.Fatalf("GetCachedKbsEndpoint failed with: %v", err) + } assert := DockerAssert{} t.Parallel() DoTestKbsKeyReleaseForFailure(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) - keyBrokerService.EnableKbsCustomizedResourcePolicy("allow_all.rego") + err = keyBrokerService.EnableKbsCustomizedResourcePolicy("allow_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedResourcePolicy failed with: %v", err) + } DoTestKbsKeyRelease(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) } diff --git a/src/cloud-api-adaptor/test/e2e/libvirt_test.go b/src/cloud-api-adaptor/test/e2e/libvirt_test.go index 682669bad..d4b64d217 100644 --- a/src/cloud-api-adaptor/test/e2e/libvirt_test.go +++ b/src/cloud-api-adaptor/test/e2e/libvirt_test.go @@ -141,10 +141,22 @@ func TestLibvirtSealedSecret(t *testing.T) { testSecret := envconf.RandomName("coco-pp-e2e-secret", 25) resourcePath := "caa/workload_key/test_key.bin" - _ = keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) - _ = keyBrokerService.EnableKbsCustomizedResourcePolicy("allow_all.rego") - _ = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_all.rego") - kbsEndpoint, _ := keyBrokerService.GetCachedKbsEndpoint() + err := keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) + if err != nil { + t.Fatalf("SetSecret failed with: %v", err) + } + err = keyBrokerService.EnableKbsCustomizedResourcePolicy("allow_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedResourcePolicy failed with: %v", err) + } + err = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedAttestationPolicy failed with: %v", err) + } + kbsEndpoint, err := keyBrokerService.GetCachedKbsEndpoint() + if err != nil { + t.Fatalf("GetCachedKbsEndpoint failed with: %v", err) + } assert := LibvirtAssert{} DoTestSealedSecret(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) } @@ -156,10 +168,22 @@ func TestLibvirtKbsKeyRelease(t *testing.T) { testSecret := envconf.RandomName("coco-pp-e2e-secret", 25) resourcePath := "caa/workload_key/test_key.bin" - _ = keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) - _ = keyBrokerService.EnableKbsCustomizedResourcePolicy("allow_all.rego") - _ = keyBrokerService.EnableKbsCustomizedAttestationPolicy("deny_all.rego") - kbsEndpoint, _ := keyBrokerService.GetCachedKbsEndpoint() + err := keyBrokerService.SetSecret(resourcePath, []byte(testSecret)) + if err != nil { + t.Fatalf("SetSecret failed with: %v", err) + } + err = keyBrokerService.EnableKbsCustomizedResourcePolicy("allow_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedResourcePolicy failed with: %v", err) + } + err = keyBrokerService.EnableKbsCustomizedAttestationPolicy("deny_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedAttestationPolicy failed with: %v", err) + } + kbsEndpoint, err := keyBrokerService.GetCachedKbsEndpoint() + if err != nil { + t.Fatalf("GetCachedKbsEndpoint failed with: %v", err) + } assert := LibvirtAssert{} t.Parallel() DoTestKbsKeyReleaseForFailure(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) @@ -167,13 +191,22 @@ func TestLibvirtKbsKeyRelease(t *testing.T) { t.Log("KBS with ibmse cases") // the allow_*_.rego file is created by follow document // https://github.com/confidential-containers/trustee/blob/main/deps/verifier/src/se/README.md#set-attestation-policy - _ = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_with_wrong_image_tag.rego") + err = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_with_wrong_image_tag.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedAttestationPolicy failed with: %v", err) + } DoTestKbsKeyReleaseForFailure(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) - _ = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_with_correct_claims.rego") + err = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_with_correct_claims.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedAttestationPolicy failed with: %v", err) + } DoTestKbsKeyRelease(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) } else { t.Log("KBS normal cases") - _ = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_all.rego") + err = keyBrokerService.EnableKbsCustomizedAttestationPolicy("allow_all.rego") + if err != nil { + t.Fatalf("EnableKbsCustomizedAttestationPolicy failed with: %v", err) + } DoTestKbsKeyRelease(t, testEnv, assert, kbsEndpoint, resourcePath, testSecret) } }