e2e: fix baremetal test matrix; improve naming

.github/workflows/e2e_kubernetes.yaml → .github/workflows/e2e_aks.yaml

@@ -1,4 +1,4 @@
-name: e2e Kubenernetes tests
+name: e2e test AKS
 
 on:
  workflow_dispatch:
@@ -27,7 +27,7 @@ jobs:
  matrix:
  test_name: [servicemesh, openssl, policy, workloadsecret]
  fail-fast: false
-
+ name: ${{ matrix.test_name }}
  runs-on: ubuntu-22.04
  permissions:
  contents: read

.github/workflows/e2e_openssl_baremetal.yml → .github/workflows/e2e_baremetal.yml

@@ -1,4 +1,4 @@
-name: e2e test openssl baremetal
+name: e2e test baremetal
 
 on:
  workflow_dispatch:
@@ -22,10 +22,10 @@ jobs:
  test:
  strategy:
  matrix:
- test_name: [servicemesh, openssl, policy, workloadsecret]
  tee: [SNP, TDX]
+ test_name: [servicemesh, openssl, workloadsecret]
  fail-fast: false
-
+ name: "${{ matrix.tee }} / ${{ matrix.test_name }}"
  runs-on:
  labels: ${{ matrix.tee }}
  permissions:
@@ -47,11 +47,11 @@ jobs:
  EOF
  - name: Build and prepare deployments
  run: |
- just coordinator initializer openssl port-forwarder node-installer K3s-QEMU-${{ matrix.tee }}
+ just coordinator initializer openssl port-forwarder service-mesh-proxy node-installer K3s-QEMU-${{ matrix.tee }}
  - name: E2E Test
  run: |
  nix run .#scripts.get-logs workspace/e2e.namespace &
- nix shell .#contrast.e2e --command openssl.test -test.v \
+ nix shell .#contrast.e2e --command ${{ matrix.test_name }}.test -test.v \
  --image-replacements workspace/just.containerlookup \
  --namespace-file workspace/e2e.namespace \
  --platform K3s-QEMU-${{ matrix.tee }} \

e2e/getdents/getdents_test.go

@@ -73,7 +73,7 @@ func TestGetDEnts(t *testing.T) {
  t.Run("call find on large folder", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(30*time.Second))
  defer cancel()
 
  require.NoError(ct.Kubeclient.WaitFor(ctx, kubeclient.Deployment{}, ct.Namespace, getdent))

e2e/internal/contrasttest/contrasttest.go

@@ -11,6 +11,7 @@ import (
  "crypto/rand"
  "crypto/x509"
  "encoding/hex"
+ "encoding/json"
  "fmt"
  "io"
  "os"
@@ -24,6 +25,7 @@ import (
  "github.com/edgelesssys/contrast/e2e/internal/kubeclient"
  "github.com/edgelesssys/contrast/internal/kubeapi"
  "github.com/edgelesssys/contrast/internal/kuberesource"
+ "github.com/edgelesssys/contrast/internal/manifest"
  "github.com/edgelesssys/contrast/internal/platforms"
  ksync "github.com/katexochen/sync/api/client"
  "github.com/spf13/cobra"
@@ -172,6 +174,45 @@ func (ct *ContrastTest) Generate(t *testing.T) {
  require.NoError(err)
  require.NotEmpty(hash, "expected apply to fill coordinator policy hash")
  ct.coordinatorPolicyHash = string(hash)
+
+ ct.patchReferenceValues(t, ct.Platform)
+}
+
+// patchReferenceValues modifies the manifest to contain multiple reference values for testing
+// cases with multiple validators, as well as filling in bare-metal SNP-specific values.
+func (ct *ContrastTest) patchReferenceValues(t *testing.T, platform platforms.Platform) {
+ manifestBytes, err := os.ReadFile(ct.WorkDir + "/manifest.json")
+ require.NoError(t, err)
+ var m manifest.Manifest
+ require.NoError(t, json.Unmarshal(manifestBytes, &m))
+
+ switch platform {
+ case platforms.AKSCloudHypervisorSNP:
+ // Duplicate the reference values to test multiple validators by having at least 2.
+ m.ReferenceValues.SNP = append(m.ReferenceValues.SNP, m.ReferenceValues.SNP[len(m.ReferenceValues.SNP)-1])
+
+ // Make the last set of reference values invalid by changing the SVNs.
+ m.ReferenceValues.SNP[len(m.ReferenceValues.SNP)-1].MinimumTCB = manifest.SNPTCB{
+ BootloaderVersion: toPtr(manifest.SVN(255)),
+ TEEVersion: toPtr(manifest.SVN(255)),
+ SNPVersion: toPtr(manifest.SVN(255)),
+ MicrocodeVersion: toPtr(manifest.SVN(255)),
+ }
+ case platforms.K3sQEMUSNP:
+ // The generate command doesn't fill in all required fields when
+ // generating a manifest for baremetal SNP. Do that now.
+ for i, snp := range m.ReferenceValues.SNP {
+ snp.MinimumTCB.BootloaderVersion = toPtr(manifest.SVN(0))
+ snp.MinimumTCB.TEEVersion = toPtr(manifest.SVN(0))
+ snp.MinimumTCB.SNPVersion = toPtr(manifest.SVN(0))
+ snp.MinimumTCB.MicrocodeVersion = toPtr(manifest.SVN(0))
+ m.ReferenceValues.SNP[i] = snp
+ }
+ }
+
+ manifestBytes, err = json.Marshal(m)
+ require.NoError(t, err)
+ require.NoError(t, os.WriteFile(ct.WorkDir+"/manifest.json", manifestBytes, 0o644))
 }
 
 // Apply the generated resources to the Kubernetes test environment.
@@ -301,6 +342,19 @@ func (ct *ContrastTest) runAgainstCoordinator(ctx context.Context, cmd *cobra.Co
  })
 }
 
+// FactorPlatformTimeout returns a timeout that is adjusted for the platform.
+// Baseline is AKS.
+func (ct *ContrastTest) FactorPlatformTimeout(timeout time.Duration) time.Duration {
+ switch ct.Platform {
+ case platforms.AKSCloudHypervisorSNP: // AKS defined is the baseline
+ return timeout
+ case platforms.K3sQEMUSNP, platforms.K3sQEMUTDX, platforms.RKE2QEMUTDX:
+ return 2 * timeout
+ default:
+ return timeout
+ }
+}
+
 func makeNamespace(t *testing.T) string {
  buf := make([]byte, 4)
  re := regexp.MustCompile("[a-z0-9-]+")
@@ -310,3 +364,7 @@ func makeNamespace(t *testing.T) string {
 
  return strings.Join(append(re.FindAllString(strings.ToLower(t.Name()), -1), hex.EncodeToString(buf)), "-")
 }
+
+func toPtr[T any](t T) *T {
+ return &t
+}

e2e/openssl/openssl_test.go

@@ -61,16 +61,14 @@ func TestOpenSSL(t *testing.T) {
  ct.Init(t, resources)
  require.True(t, t.Run("generate", ct.Generate), "contrast generate needs to succeed for subsequent tests")
 
- patchReferenceValues(t, platform, ct)
-
  require.True(t, t.Run("apply", ct.Apply), "Kubernetes resources need to be applied for subsequent tests")
 
  require.True(t, t.Run("set", ct.Set), "contrast set needs to succeed for subsequent tests")
 
  require.True(t, t.Run("contrast verify", ct.Verify), "contrast verify needs to succeed for subsequent tests")
 
  t.Run("check coordinator metrics endpoint", func(t *testing.T) {
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  require := require.New(t)
@@ -95,7 +93,7 @@ func TestOpenSSL(t *testing.T) {
  "root CA cert": ct.RootCACert(),
  } {
  t.Run("go dial frontend with "+cert, func(t *testing.T) {
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  require := require.New(t)
@@ -117,7 +115,7 @@ func TestOpenSSL(t *testing.T) {
  // This test verifies that the certificates minted by the coordinator are accepted by OpenSSL in server and client mode.
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  c := kubeclient.NewForTest(t)
@@ -138,7 +136,7 @@ func TestOpenSSL(t *testing.T) {
  t.Run(fmt.Sprintf("certificate rotation and %s restart", deploymentToRestart), func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  c := kubeclient.NewForTest(t)
@@ -197,7 +195,7 @@ func TestOpenSSL(t *testing.T) {
  t.Run("coordinator recovery", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute) // Already long timeout, not using ct.FactorPlatformTimeout.
  defer cancel()
 
  c := kubeclient.NewForTest(t)
@@ -260,44 +258,3 @@ func opensslConnectCmd(addr, caCert string) string {
  `openssl s_client -connect %s -verify_return_error -x509_strict -CAfile /contrast/tls-config/%s -cert /contrast/tls-config/certChain.pem -key /contrast/tls-config/key.pem </dev/null`,
  addr, caCert)
 }
-
-func toPtr[T any](t T) *T {
- return &t
-}
-
-// patchReferenceValues modifies the manifest to contain multiple reference values for testing
-// cases with multiple validators, as well as filling in bare-metal SNP-specific values.
-func patchReferenceValues(t *testing.T, platform platforms.Platform, ct *contrasttest.ContrastTest) {
- manifestBytes, err := os.ReadFile(ct.WorkDir + "/manifest.json")
- require.NoError(t, err)
- var m manifest.Manifest
- require.NoError(t, json.Unmarshal(manifestBytes, &m))
-
- switch platform {
- case platforms.AKSCloudHypervisorSNP:
- // Duplicate the reference values to test multiple validators by having at least 2.
- m.ReferenceValues.SNP = append(m.ReferenceValues.SNP, m.ReferenceValues.SNP[len(m.ReferenceValues.SNP)-1])
-
- // Make the last set of reference values invalid by changing the SVNs.
- m.ReferenceValues.SNP[len(m.ReferenceValues.SNP)-1].MinimumTCB = manifest.SNPTCB{
- BootloaderVersion: toPtr(manifest.SVN(255)),
- TEEVersion: toPtr(manifest.SVN(255)),
- SNPVersion: toPtr(manifest.SVN(255)),
- MicrocodeVersion: toPtr(manifest.SVN(255)),
- }
- case platforms.K3sQEMUSNP:
- // The generate command doesn't fill in all required fields when
- // generating a manifest for baremetal SNP. Do that now.
- for i, snp := range m.ReferenceValues.SNP {
- snp.MinimumTCB.BootloaderVersion = toPtr(manifest.SVN(0))
- snp.MinimumTCB.TEEVersion = toPtr(manifest.SVN(0))
- snp.MinimumTCB.SNPVersion = toPtr(manifest.SVN(0))
- snp.MinimumTCB.MicrocodeVersion = toPtr(manifest.SVN(0))
- m.ReferenceValues.SNP[i] = snp
- }
- }
-
- manifestBytes, err = json.Marshal(m)
- require.NoError(t, err)
- require.NoError(t, os.WriteFile(ct.WorkDir+"/manifest.json", manifestBytes, 0o644))
-}

e2e/policy/policy_test.go

@@ -68,7 +68,7 @@ func TestPolicy(t *testing.T) {
  t.Run("pod cannot join after it was removed from the manifest", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  c := kubeclient.NewForTest(t)

e2e/regression/regression_test.go

@@ -60,8 +60,6 @@ func TestRegression(t *testing.T) {
  require := require.New(t)
 
  c := kubeclient.NewForTest(t)
- ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
- defer cancel()
 
  yaml, err := os.ReadFile(yamlDir + file.Name())
  require.NoError(err)
@@ -82,8 +80,7 @@ func TestRegression(t *testing.T) {
 
  t.Cleanup(func() {
  // delete the deployment
- ctx = context.Background()
- require.NoError(ct.Kubeclient.Client.AppsV1().Deployments(ct.Namespace).Delete(ctx, deploymentName, metav1.DeleteOptions{}))
+ require.NoError(ct.Kubeclient.Client.AppsV1().Deployments(ct.Namespace).Delete(context.Background(), deploymentName, metav1.DeleteOptions{}))
  })
 
  // generate, set, deploy and verify the new policy
@@ -92,6 +89,8 @@ func TestRegression(t *testing.T) {
  require.True(t.Run("set", ct.Set), "contrast set needs to succeed for subsequent tests")
  require.True(t.Run("verify", ct.Verify), "contrast verify needs to succeed for subsequent tests")
 
+ ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute) // Already long timeout, not using ct.FactorPlatformTimeout.
+ defer cancel()
  require.NoError(c.WaitFor(ctx, kubeclient.Deployment{}, ct.Namespace, deploymentName))
  })
  }

e2e/servicemesh/servicemesh_test.go

@@ -62,7 +62,7 @@ func TestIngressEgress(t *testing.T) {
  require.True(t, t.Run("deployments become available", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  require.NoError(ct.Kubeclient.WaitFor(ctx, kubeclient.Deployment{}, ct.Namespace, "vote-bot"))
@@ -79,7 +79,7 @@ func TestIngressEgress(t *testing.T) {
  t.Run("go dial web with ca "+certFile, func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  require.NoError(ct.Kubeclient.WithForwardedPort(ctx, ct.Namespace, "port-forwarder-web-svc", "443", func(addr string) error {
@@ -103,7 +103,7 @@ func TestIngressEgress(t *testing.T) {
  t.Run("client certificates are required if not explicitly disabled", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  c := kubeclient.NewForTest(t)
@@ -133,7 +133,7 @@ func TestIngressEgress(t *testing.T) {
  t.Run("admin interface is available", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  c := kubeclient.NewForTest(t)

e2e/workloadsecret/workloadsecret_test.go

@@ -61,7 +61,7 @@ func TestWorkloadSecrets(t *testing.T) {
  require.True(t, t.Run("deployments become available", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(1*time.Minute))
  defer cancel()
 
  require.NoError(ct.Kubeclient.WaitFor(ctx, kubeclient.Deployment{}, ct.Namespace, "vote-bot"))
@@ -74,7 +74,7 @@ func TestWorkloadSecrets(t *testing.T) {
  require.True(t, t.Run("scale web deployment to 2 pods", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(30*time.Second))
  defer cancel()
 
  require.NoError(ct.Kubeclient.ScaleDeployment(ctx, ct.Namespace, "web", 2))
@@ -86,7 +86,7 @@ func TestWorkloadSecrets(t *testing.T) {
  t.Run("workload secret seed exists", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(30*time.Second))
  defer cancel()
 
  webPods, err = ct.Kubeclient.PodsFromDeployment(ctx, ct.Namespace, "web")
@@ -104,7 +104,7 @@ func TestWorkloadSecrets(t *testing.T) {
  t.Run("workload secret seed is the same between pods in the same deployment", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(30*time.Second))
  defer cancel()
 
  stdout, stderr, err := ct.Kubeclient.Exec(ctx, ct.Namespace, webPods[1].Name, []string{"/bin/sh", "-c", "cat /contrast/secrets/workload-secret-seed"})
@@ -120,7 +120,7 @@ func TestWorkloadSecrets(t *testing.T) {
  t.Run("workload secret seeds differ between deployments by default", func(t *testing.T) {
  require := require.New(t)
 
- ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ ctx, cancel := context.WithTimeout(context.Background(), ct.FactorPlatformTimeout(30*time.Second))
  defer cancel()
 
  emojiPods, err := ct.Kubeclient.PodsFromDeployment(ctx, ct.Namespace, "emoji")