Skip to content

Commit f37caf5

Browse files
obochan-rhobochan-rh
committed
update more operators for test
1 parent 6b9f14f commit f37caf5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1164
-0
lines changed

‎tests/dast/Dockerfile

+3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ RUN mkdir -p /tmp/go/bin $GOCACHE \
1717

1818
# Install dependencies required by test cases and debugging
1919
RUN apt-get update && apt-get install -y jq vim libreadline-dev
20+
RUN apt-get -y install podman
21+
22+
2023

2124
# Install Chainsaw e2e testing tool
2225
RUN go install github.com/kyverno/chainsaw@v0.2.0

‎tests/dast/rapid-lca/README.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
This is an example to run the oobtkube script contained in the RapiDAST container image, using podman. It is testing the RODOO operator, using the RODOO CR example shown in the `oobt_test_data/cr_example.yaml`. Replacing the content with another CR example allows to use this example to test another Operator.
2+
3+
See [How it works](https://docs.google.com/document/d/1mcBiSnmackxl3DnoT2zo8XhwWl02lX6Qu1pcYNpO7l0/edit#heading=h.tdyh8uoylg1e) for more information on how oobtkube works.
4+
5+
DISCLAIMER: This example is provided for reference only. The implementation of how to invoke the RapiDAST scan and oobtkube should be determined and carried out by the ENG team responsible for the integration to suit the test environment or pipeline.
6+
7+
## Preparation
8+
9+
1. It requires an OpenShift cluster where the operator to be tested is running.
10+
2. Copy your kubeconfig file to `kubeconfig` file into the `oobt_test_data` directory.
11+
3. (optional, for testing another Operator) Replace the content of `oobt_test_data/cr_example.yaml` with another CR config example to test the Operator.
12+
13+
14+
## Run
15+
```
16+
$ python3 test_oobt.py
17+
```
18+
The test duration is set to 120 seconds. See `-d 120` in `oobt_test_data/v5-none-oobt-template.yaml`. It can be changed.
19+
20+
No logs during running is shown. If you want to see logs, find your pod that has been created and see the logs `podman logs -f <id>`.
21+
Once the test is complete, a SARIF result file will be stored in the 'results' directory. Where there is no vulnerability found, it will be just '{}'.
22+

‎tests/dast/rapid-lca/oobt_test_data/cr_example.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: operator.openshift.io/v1
2+
kind: RunOnceDurationOverride
3+
metadata:
4+
name: cluster
5+
spec:
6+
runOnceDurationOverride:
7+
spec:
8+
activeDeadlineSeconds: 3600

‎tests/dast/rapid-lca/oobt_test_data/v5-none-oobt-template.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
config:
2+
configVersion: 5
3+
4+
# `application` contains data related to the application, not to the scans.
5+
application:
6+
shortName: "oobttest"
7+
8+
scanners:
9+
generic_oobt:
10+
# results:
11+
# An absolute path to file or directory where results are stored on the host.
12+
# if it is "*stdout" or unspecified, the command's standard output will be selected
13+
# When container.type is 'podman', this needs to be used along with the container.volumes configuration below
14+
# If the result needs to be sent to DefectDojo, this must be a SARIF format file
15+
results: "/tmp/oobtkube.sarif.json" # if None or "*stdout", the command's standard output is selected
16+
# toolDir: scanners/generic/tools
17+
#inline: "python3 oobtkube.py -d 120 -p <port> -i <ipaddr> -f /test/oobt_test_data/cr_example.yaml -o /tmp/oobtkube.sarif.json"
18+
19+
generic_trivy:
20+
inline: "trivy k8s --kubeconfig=/home/rapidast/.kube/config -n iopenshift-operator-lifecycle-manager pod --severity=HIGH,CRITICAL --scanners=misconfig --report all --format json"

‎tests/dast/rapid-lca/test_oobt.py

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
import os
2+
import subprocess
3+
import random
4+
5+
import subprocess
6+
import re
7+
8+
9+
RAPIDAST_IMAGE = "quay.io/redhatproductsecurity/rapidast:2.5.0"
10+
def get_vpn_ip_address():
11+
try:
12+
ip_output = subprocess.check_output(['ip', 'addr']).decode('utf-8')
13+
# Use regular expression to extract IP addresses
14+
ip_addresses = re.findall(r'10.64.\d+\.\d+', ip_output)
15+
16+
# Currently return the first IP address
17+
# TODO: fix if there are multiple IP addresses and it causes an issue
18+
19+
return ip_addresses[0]
20+
except subprocess.CalledProcessError as e:
21+
return f"Error: {e}"
22+
23+
def test_oobt_basic():
24+
# 1. place kubeconfig in the TEST_DATA_DIR directory
25+
26+
TEST_DATA_DIR = "oobt_test_data"
27+
RAPIDAST_CFG_FILE = "v5-none-oobt-template.yaml"
28+
29+
port = random.randint(10000, 30000)
30+
ipaddr = get_vpn_ip_address()
31+
32+
# create a rapidast config
33+
sed_cmd = f"sed 's/-p <port> -i <ipaddr>/-p {port} -i {ipaddr}/' {TEST_DATA_DIR}/{RAPIDAST_CFG_FILE} > rapidast_runtime_cfg.yaml"
34+
os.system(sed_cmd)
35+
36+
# prep for testing
37+
os.system(f"chmod 666 {TEST_DATA_DIR}/kubeconfig")
38+
if not os.path.exists("results"):
39+
os.makedirs("results")
40+
os.system("podman unshare chown 1000 results")
41+
42+
# Run the command and capture stdout
43+
command = f"podman run -it --rm -v ./{TEST_DATA_DIR}/kubeconfig:/home/rapidast/.kube/config:Z -v ./results:/opt/rapidast/results:Z -v $PWD:/test:Z -p {port}:{port} {RAPIDAST_IMAGE} rapidast.py --config /test/rapidast_runtime_cfg.yaml"
44+
print(command)
45+
46+
process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
47+
stdout, stderr = process.communicate()
48+
# print(stdout)
49+
print("test completed. See the results directory")
50+
51+
if __name__ == "__main__":
52+
test_oobt_basic()

‎tests/dast/rapid-nrop/00-assert.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: project.openshift.io/v1
2+
kind: Project
3+
metadata:
4+
labels:
5+
kubernetes.io/metadata.name: rapidast-nrop
6+
pod-security.kubernetes.io/audit: privileged
7+
pod-security.kubernetes.io/enforce: privileged
8+
pod-security.kubernetes.io/warn: privileged
9+
security.openshift.io/scc.podSecurityLabelSync: "false"
10+
name: rapidast-nrop
11+
spec:
12+
finalizers:
13+
- kubernetes
14+
status:
15+
phase: Active

‎tests/dast/rapid-nrop/00-create-project.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: rapidast-nrop
5+
labels:
6+
security.openshift.io/scc.podSecurityLabelSync: "false"
7+
pod-security.kubernetes.io/enforce: "privileged"
8+
pod-security.kubernetes.io/audit: "privileged"
9+
pod-security.kubernetes.io/warn: "privileged"

‎tests/dast/rapid-nrop/01-assert.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: privileged-sa
5+
namespace: rapidast-nrop
6+
7+
---
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: ClusterRoleBinding
10+
metadata:
11+
name: rapidast-nrop-binding
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: system:openshift:scc:privileged
16+
subjects:
17+
- kind: ServiceAccount
18+
name: privileged-sa
19+
namespace: rapidast-nrop
20+
21+
---
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
kind: ClusterRoleBinding
24+
metadata:
25+
name: rapidast-nrop-cluster-admin
26+
roleRef:
27+
apiGroup: rbac.authorization.k8s.io
28+
kind: ClusterRole
29+
name: cluster-admin
30+
subjects:
31+
- kind: ServiceAccount
32+
name: privileged-sa
33+
namespace: rapidast-nrop

‎tests/dast/rapid-nrop/01-create-sa.yaml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: privileged-sa
5+
namespace: rapidast-nrop
6+
7+
---
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: ClusterRoleBinding
10+
metadata:
11+
name: rapidast-nrop-binding
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: system:openshift:scc:privileged
16+
subjects:
17+
- kind: ServiceAccount
18+
name: privileged-sa
19+
namespace: rapidast-nrop
20+
21+
---
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
kind: ClusterRoleBinding
24+
metadata:
25+
name: rapidast-nrop-cluster-admin
26+
roleRef:
27+
apiGroup: rbac.authorization.k8s.io
28+
kind: ClusterRole
29+
name: cluster-admin
30+
subjects:
31+
- kind: ServiceAccount
32+
name: privileged-sa
33+
namespace: rapidast-nrop

‎tests/dast/rapid-nrop/02-assert.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: rapidast-configmap
5+
namespace: rapidast-nrop

‎tests/dast/rapid-nrop/02-create-rapidast-config.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: ./create_rapidast_configmap.sh

‎tests/dast/rapid-nrop/03-assert.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: rapidast-job
5+
namespace: rapidast-nrop
6+
status:
7+
succeeded: 1

‎tests/dast/rapid-nrop/03-rapidast-job.yaml

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: rapidast-pvc
6+
namespace: rapidast-nrop
7+
spec:
8+
accessModes:
9+
- ReadWriteOnce
10+
resources:
11+
requests:
12+
storage: 1Gi
13+
volumeMode: Filesystem
14+
15+
---
16+
apiVersion: batch/v1
17+
kind: Job
18+
metadata:
19+
name: rapidast-job
20+
namespace: rapidast-nrop
21+
spec:
22+
backoffLimit: 3
23+
completionMode: NonIndexed
24+
completions: 1
25+
parallelism: 1
26+
suspend: false
27+
template:
28+
metadata:
29+
labels:
30+
job-name: rapidast-job
31+
name: rapidast-job
32+
spec:
33+
serviceAccount: privileged-sa
34+
serviceAccountName: privileged-sa
35+
containers:
36+
- command:
37+
- sh
38+
- -c
39+
- rapidast.py --log-level debug --config
40+
/helm/config/rapidastconfig.yaml && find /opt/rapidast/results/nrop
41+
-name zap-report.json -exec cat {} \;
42+
image: quay.io/redhatproductsecurity/rapidast:latest
43+
imagePullPolicy: Always
44+
name: rapidast-chart
45+
resources: {}
46+
securityContext:
47+
privileged: true
48+
terminationMessagePath: /dev/termination-log
49+
terminationMessagePolicy: File
50+
volumeMounts:
51+
- mountPath: /helm/config
52+
name: config-volume
53+
- mountPath: /opt/rapidast/results/
54+
name: results-volume
55+
dnsPolicy: ClusterFirst
56+
restartPolicy: Never
57+
schedulerName: default-scheduler
58+
terminationGracePeriodSeconds: 30
59+
volumes:
60+
- configMap:
61+
defaultMode: 420
62+
name: rapidast-configmap
63+
name: config-volume
64+
- name: results-volume
65+
persistentVolumeClaim: null
66+
claimName: rapidast-pvc

‎tests/dast/rapid-nrop/04-assert.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 180
4+
commands:
5+
- script: ./tests/e2e-rh-sdl/rapidast-nrop/results.sh

‎tests/dast/rapid-nrop/chainsaw-test.yaml

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
apiVersion: chainsaw.kyverno.io/v1alpha1
2+
kind: Test
3+
metadata:
4+
creationTimestamp: null
5+
name: rapidast-nrop
6+
spec:
7+
steps:
8+
- name: step-00
9+
try:
10+
- apply:
11+
file: 00-create-project.yaml
12+
- assert:
13+
file: 00-assert.yaml
14+
- name: step-01
15+
try:
16+
- apply:
17+
file: 01-create-sa.yaml
18+
- assert:
19+
file: 01-assert.yaml
20+
- name: step-02
21+
try:
22+
- script:
23+
timeout: 30s
24+
content: ./create_rapidast_configmap.sh
25+
- assert:
26+
file: 02-assert.yaml
27+
- name: step-03
28+
try:
29+
- apply:
30+
file: 03-rapidast-job.yaml
31+
- assert:
32+
file: 03-assert.yaml
33+
- name: step-04
34+
try:
35+
- script:
36+
timeout: 6m
37+
content: ./results.sh
38+
finally:
39+
- command:
40+
timeout: 1m
41+
entrypoint: oc
42+
args:
43+
- -n
44+
- rapidast-nrop
45+
- delete
46+
- pod
47+
- rapiterm-nrop
48+
- command:
49+
timeout: 1m
50+
entrypoint: oc
51+
args:
52+
- -n
53+
- rapidast-nrop
54+
- delete
55+
- pod
56+
- --selector=batch.kubernetes.io/job-name=rapidast-job

0 commit comments

Comments
 (0)