From 993ee8582b563145ff979811cc47f4bdb8939794 Mon Sep 17 00:00:00 2001
From: kfox1111 <Kevin.Fox@pnnl.gov>
Date: Wed, 20 Mar 2024 14:12:48 -0700
Subject: [PATCH] Change production example to be an integration test (#237)

* Change production example to be an integration test

The documentation is a better example then the test now. Separate the
two.

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix job name reference

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix job name reference

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Update postgresql example

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Update mysql example

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Update nested and mysql

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix typo

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Add support for integration tests in the tests/integration dir

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix split issue and typo

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix split issue

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Try folding example your values into bash so that its not laying around in an fs for a user to accidently use.

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix test

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix test

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix test

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix test

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix test

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Fix test

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

* Cleanup

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>

---------

Signed-off-by: Kevin Fox <Kevin.Fox@pnnl.gov>
Signed-off-by: kfox1111 <Kevin.Fox@pnnl.gov>
Co-authored-by: Faisal Memon <fymemon@yahoo.com>
---
 .github/tests/common.sh                       | 20 ++++++
 .github/workflows/helm-chart-ci.yaml          |  2 +-
 examples/external-mysql/README.md             | 10 ++-
 examples/external-mysql/run-tests.sh          |  2 +-
 examples/external-postgresql/README.md        | 10 ++-
 examples/external-postgresql/run-tests.sh     |  4 +-
 .../values-node-pod-antiaffinity.yaml         |  0
 examples/nested/run-tests.sh                  |  2 +-
 examples/production/README.md                 | 66 -------------------
 examples/production/example-your-values.yaml  | 22 -------
 examples/production/values.yaml               |  4 --
 .../integration}/production/run-tests.sh      |  8 +--
 ...federation-https-spiffe-ingress-nginx.yaml |  0
 ...se-federation-https-web-ingress-nginx.yaml |  0
 ...oidc-discovery-provider-ingress-nginx.yaml |  0
 ...ues-expose-spire-server-ingress-nginx.yaml |  0
 16 files changed, 36 insertions(+), 114 deletions(-)
 rename examples/{production => misc}/values-node-pod-antiaffinity.yaml (100%)
 delete mode 100644 examples/production/README.md
 delete mode 100644 examples/production/example-your-values.yaml
 delete mode 100644 examples/production/values.yaml
 rename {examples => tests/integration}/production/run-tests.sh (95%)
 rename {examples => tests/integration}/production/values-expose-federation-https-spiffe-ingress-nginx.yaml (100%)
 rename {examples => tests/integration}/production/values-expose-federation-https-web-ingress-nginx.yaml (100%)
 rename {examples => tests/integration}/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml (100%)
 rename {examples => tests/integration}/production/values-expose-spire-server-ingress-nginx.yaml (100%)

diff --git a/.github/tests/common.sh b/.github/tests/common.sh
index 6cb4f6e02..3211e3863 100755
--- a/.github/tests/common.sh
+++ b/.github/tests/common.sh
@@ -70,3 +70,23 @@ $(helm ls -A | sed 's/\t/ | /g' | sed 's/^/| /' | sed 's/$/ |/' | sed '/^| NAME.
 
 EOF
 }
+
+# Used just for testing. You should provide your own values as described in the install instructions.
+common_test_your_values () {
+cat > /tmp/$$.example-your-values.yaml <<EOF
+global:
+  spire:
+    recommendations:
+      enabled: true
+    clusterName: production
+    trustDomain: production.other
+    caSubject:
+      country: US
+      organization: Production
+      commonName: production.other
+EOF
+echo "/tmp/$$.example-your-values.yaml"
+}
+
+COMMON_TEST_YOUR_VALUES="$(common_test_your_values)"
+export COMMON_TEST_YOUR_VALUES
diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml
index d4e349227..08758b471 100644
--- a/.github/workflows/helm-chart-ci.yaml
+++ b/.github/workflows/helm-chart-ci.yaml
@@ -343,4 +343,4 @@ jobs:
           verbosity: 1
 
       - name: Install and test example
-        run: examples/production/run-tests.sh -u
+        run: tests/integration/production/run-tests.sh -u
diff --git a/examples/external-mysql/README.md b/examples/external-mysql/README.md
index 8a6864ccf..9c9d96805 100644
--- a/examples/external-mysql/README.md
+++ b/examples/external-mysql/README.md
@@ -10,13 +10,11 @@ If manually deploying for testing, you can safely put the password into an envir
 source ../bin/readpw.sh
 ```
 
-Next, edit values.yaml with your settings. Check it into your git repo if using one.
+Follow the instructions as described at https://artifacthub.io/packages/helm/spiffe/spire, and copy in the settings from
+examples/external-mysql/values.yaml into your values file.
 
-Then, deploy the chart pointing at your mysql instance like so:
+You can add the password at install runtime like so:
 
 ```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-mysql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
+helm upgrade --install --namespace spire-mgmt spire spire -f your-values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" --repo https://spiffe.github.io/helm-charts-hardened/
 ```
-
-See the [production example](../production) for production recommendations.
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh
index 0f41ea87c..6f3bd7a3a 100755
--- a/examples/external-mysql/run-tests.sh
+++ b/examples/external-mysql/run-tests.sh
@@ -54,6 +54,6 @@ helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO
   --wait
 
 helm upgrade --install --namespace "spire-server" \
-  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
+  --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
   --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
 helm test --namespace "spire-server" spire
diff --git a/examples/external-postgresql/README.md b/examples/external-postgresql/README.md
index d4710fbee..3e4edf436 100644
--- a/examples/external-postgresql/README.md
+++ b/examples/external-postgresql/README.md
@@ -10,14 +10,12 @@ If manually deploying for testing, you can safely put the password into an envir
 source ../bin/readpw.sh
 ```
 
-Next, edit values.yaml with your settings. Check it into your git repo if using one.
+Follow the instructions as described at https://artifacthub.io/packages/helm/spiffe/spire, and copy in the settings from
+examples/external-postgresql/values.yaml into your values file.
 
-Then, deploy the chart pointing at your postgresql instance like so:
+You can add the password at install runtime like so:
 
 ```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/external-postgresql/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}"
+helm upgrade --install --namespace spire-mgmt spire spire -f your-values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" --repo https://spiffe.github.io/helm-charts-hardened/
 
 ```
-
-See the [production example](../production) for production recommendations.
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh
index 3a93f68ef..fe9ba70dd 100755
--- a/examples/external-postgresql/run-tests.sh
+++ b/examples/external-postgresql/run-tests.sh
@@ -50,10 +50,10 @@ kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restrict
 
 helm upgrade --install postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
   --namespace spire-server \
-  --values "${DEPS}/postgresql.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml" \
+  --values "${DEPS}/postgresql.yaml" \
   --wait
 
 helm upgrade --install --namespace "spire-server" \
-  --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
+  --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
   --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
 helm test --namespace "spire-server" spire
diff --git a/examples/production/values-node-pod-antiaffinity.yaml b/examples/misc/values-node-pod-antiaffinity.yaml
similarity index 100%
rename from examples/production/values-node-pod-antiaffinity.yaml
rename to examples/misc/values-node-pod-antiaffinity.yaml
diff --git a/examples/nested/run-tests.sh b/examples/nested/run-tests.sh
index 8fd5fe43e..ee0dbe549 100755
--- a/examples/nested/run-tests.sh
+++ b/examples/nested/run-tests.sh
@@ -55,7 +55,7 @@ helm upgrade --install --create-namespace spire charts/spire \
   --values "${DEPS}/spire-root-server-values.yaml" \
   --wait
 
-helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \
+helm upgrade --install --create-namespace --namespace spire-server --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
   --wait spire charts/spire
 helm test --namespace spire-server spire
 
diff --git a/examples/production/README.md b/examples/production/README.md
deleted file mode 100644
index e2c04e310..000000000
--- a/examples/production/README.md
+++ /dev/null
@@ -1,66 +0,0 @@
-# Recommended production setup
-
-To install Spire with the least privileges possible we deploy spire across 2 namespaces.
-
-```shell
-kubectl create namespace "spire-system"
-kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace "spire-server"
-kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted
-```
-
-Update the `example-your-values.yaml` file with your values, then:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire \
-  -f examples/production/values.yaml -f examples/production/example-your-values.yaml --render-subchart-notes
-```
-
-If your using ingress-nginx and want to expose the spiffe oidc discovery provider outside the
-cluster, add the following to the end of the helm upgrade example:
-
-```shell
--f examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
-```
-
-If you want to expose your spire-server outside of Kubernetes and are using ingress-nginx, add following values file when running `helm template/install/upgrade`.
-
-```shell
--f examples/production/values-expose-spire-server-ingress-nginx.yaml
-```
-
-For example:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-spire-server-ingress-nginx.yaml
-```
-
-If you want to expose your federation endpoint outside of Kubernetes and are using ingress-nginx
-you have two options as described here:
-[github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md#52-endpoint-profiles)
-
-If you chose profile https_web, use:
-
-```shell
--f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
-```
-
-For example:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-web-ingress-nginx.yaml
-```
-
-If you chose profile https_spiffe, use:
-
-```shell
--f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
-```
-
-For example:
-
-```shell
-helm upgrade --install --namespace spire-server spire charts/spire -f examples/production/values.yaml -f examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
-```
-
-See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml
deleted file mode 100644
index 7c3a830e9..000000000
--- a/examples/production/example-your-values.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-global:
-  spire:
-    clusterName: production
-    trustDomain: production.other
-
-spire-server:
-  ca_subject:
-    country: US
-    organization: Production
-    common_name: production.other
-
-#  ingress:
-#    host: spire-server
-#  federation:
-#     ingress:
-#       host: spire-server-federation
-#       tlsSecret: tls-cert
-
-# spiffe-oidc-discovery-provider:
-#   ingress:
-#     host: oidc-discovery
-#     tlsSecret: tls-cert
diff --git a/examples/production/values.yaml b/examples/production/values.yaml
deleted file mode 100644
index c5ce8bd45..000000000
--- a/examples/production/values.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-global:
-  spire:
-    recommendations:
-      enabled: true
diff --git a/examples/production/run-tests.sh b/tests/integration/production/run-tests.sh
similarity index 95%
rename from examples/production/run-tests.sh
rename to tests/integration/production/run-tests.sh
index bd67728c7..8cf3adb99 100755
--- a/examples/production/run-tests.sh
+++ b/tests/integration/production/run-tests.sh
@@ -7,11 +7,11 @@ UPGRADE_REPO=https://spiffe.github.io/helm-charts-hardened
 
 SCRIPT="$(readlink -f "$0")"
 SCRIPTPATH="$(dirname "${SCRIPT}")"
-TESTDIR="${SCRIPTPATH}/../../.github/tests"
+TESTDIR="${SCRIPTPATH}/../../../.github/tests"
 DEPS="${TESTDIR}/dependencies"
 
 # shellcheck source=/dev/null
-source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
+source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh"
 # shellcheck source=/dev/null
 source "${TESTDIR}/common.sh"
 
@@ -122,7 +122,7 @@ install_and_test() {
   # shellcheck disable=SC2086
   "${helm_install[@]}" spire "$1" \
     --namespace "${ns}" \
-    --values "${SCRIPTPATH}/values.yaml" \
+    --values "${COMMON_TEST_YOUR_VALUES}" \
     --values "${SCRIPTPATH}/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml" \
     --values "${SCRIPTPATH}/values-expose-spire-server-ingress-nginx.yaml" \
     --values "${SCRIPTPATH}/values-expose-federation-https-web-ingress-nginx.yaml" \
@@ -130,8 +130,6 @@ install_and_test() {
     --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
     --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
     --set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
-    --values "${SCRIPTPATH}/example-your-values.yaml" \
-    $2 \
     --wait
 
     helm test --namespace "${ns}" spire
diff --git a/examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml b/tests/integration/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
similarity index 100%
rename from examples/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
rename to tests/integration/production/values-expose-federation-https-spiffe-ingress-nginx.yaml
diff --git a/examples/production/values-expose-federation-https-web-ingress-nginx.yaml b/tests/integration/production/values-expose-federation-https-web-ingress-nginx.yaml
similarity index 100%
rename from examples/production/values-expose-federation-https-web-ingress-nginx.yaml
rename to tests/integration/production/values-expose-federation-https-web-ingress-nginx.yaml
diff --git a/examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml b/tests/integration/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
similarity index 100%
rename from examples/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
rename to tests/integration/production/values-expose-spiffe-oidc-discovery-provider-ingress-nginx.yaml
diff --git a/examples/production/values-expose-spire-server-ingress-nginx.yaml b/tests/integration/production/values-expose-spire-server-ingress-nginx.yaml
similarity index 100%
rename from examples/production/values-expose-spire-server-ingress-nginx.yaml
rename to tests/integration/production/values-expose-spire-server-ingress-nginx.yaml