Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce TLS Integration #20

Merged
merged 3 commits into from
Oct 6, 2023
Merged

Enforce TLS Integration #20

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
18680c3
Enforce TLS Integration
dariofaccin Sep 29, 2023
c3860c5
Add relation NRF TLS relation in setup
DanielArndt Oct 4, 2023
9422ced
Address comment: remove method for creating certificates relation
dariofaccin Oct 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,11 @@ A Charmed Operator for SD-Core's Unified Data Repository (UDR) component.
juju deploy mongodb-k8s --trust --channel=5/edge
juju deploy sdcore-nrf --trust --channel=edge
juju deploy sdcore-udr --trust --channel=edge
juju deploy self-signed-certificates --channel=beta
juju integrate mongodb-k8s sdcore-nrf
juju integrate mongodb-k8s sdcore-udr:database
juju integrate sdcore-nrf:certificates self-signed-certificates:certificates
juju integrate sdcore-nrf sdcore-udr:fiveg_nrf
```

## Optional

```bash
juju deploy self-signed-certificates --channel=edge
juju integrate sdcore-udr:certificates self-signed-certificates:certificates
```

Expand Down
10 changes: 7 additions & 3 deletions src/charm.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ def _configure_udr(self, event: EventBase) -> None:
Args:
event: Juju event
"""
for relation in ["database", "fiveg_nrf"]:
for relation in ["database", "fiveg_nrf", "certificates"]:
if not self._relation_created(relation):
self.unit.status = BlockedStatus(
f"Waiting for the `{relation}` relation to be created"
Expand All @@ -116,6 +116,10 @@ def _configure_udr(self, event: EventBase) -> None:
self.unit.status = WaitingStatus("Waiting for pod IP address to be available")
event.defer()
return
if not self._certificate_is_stored():
self.unit.status = WaitingStatus("Waiting for certificates to be stored")
event.defer()
return
self._generate_udr_config_file()
self._configure_udr_service()
self.unit.status = ActiveStatus()
Expand Down Expand Up @@ -143,7 +147,7 @@ def _on_certificates_relation_broken(self, event: EventBase) -> None:
self._delete_private_key()
self._delete_csr()
self._delete_certificate()
self._configure_udr(event)
self.unit.status = BlockedStatus("Waiting for certificates relation")

def _on_certificates_relation_joined(self, event: EventBase) -> None:
"""Generates CSR and requests new certificate."""
Expand Down Expand Up @@ -274,7 +278,7 @@ def _generate_udr_config_file(self) -> None:
default_database_name=DEFAULT_DATABASE_NAME,
default_database_url=self._get_database_data()["uris"].split(",")[0],
nrf_url=self._nrf.nrf_url,
scheme="https" if self._certificate_is_stored() else "http",
scheme="https",
)
if not self._config_file_content_matches(content=content):
self._push_udr_config_file_to_workload(content=content)
Expand Down
28 changes: 27 additions & 1 deletion tests/integration/test_integration.py
View file
Open in desktop
dariofaccin marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ async def _deploy_tls_provider(ops_test: OpsTest):
await ops_test.model.deploy( # type: ignore[union-attr]
TLS_PROVIDER_CHARM_NAME,
application_name=TLS_PROVIDER_CHARM_NAME,
channel="edge",
channel="beta",
)

@staticmethod
Expand Down Expand Up @@ -83,6 +83,9 @@ async def test_relate_and_wait_for_idle(
await ops_test.model.add_relation( # type: ignore[union-attr]
relation1=f"{APPLICATION_NAME}:fiveg_nrf", relation2=NRF_APPLICATION_NAME
)
await ops_test.model.add_relation( # type: ignore[union-attr]
relation1=f"{NRF_APPLICATION_NAME}:certificates", relation2=TLS_PROVIDER_CHARM_NAME
)
await ops_test.model.add_relation( # type: ignore[union-attr]
relation1=f"{APPLICATION_NAME}:certificates",
relation2=f"{TLS_PROVIDER_CHARM_NAME}:certificates",
Expand Down Expand Up @@ -110,4 +113,27 @@ async def test_restore_nrf_and_wait_for_active_status(
relation1=f"{NRF_APPLICATION_NAME}:database", relation2=DB_APPLICATION_NAME
)
await ops_test.model.add_relation(relation1=APPLICATION_NAME, relation2=NRF_APPLICATION_NAME) # type: ignore[union-attr] # noqa: E501
await ops_test.model.add_relation(relation1=TLS_PROVIDER_CHARM_NAME, relation2=NRF_APPLICATION_NAME) # type: ignore[union-attr] # noqa: E501
await ops_test.model.wait_for_idle(apps=[APPLICATION_NAME], status="active", timeout=300) # type: ignore[union-attr] # noqa: E501

@pytest.mark.abort_on_fail
async def test_remove_tls_and_wait_for_blocked_status(
self, ops_test: OpsTest, build_and_deploy_charm
):
await ops_test.model.remove_application(TLS_PROVIDER_CHARM_NAME, block_until_done=True) # type: ignore[union-attr] # noqa: E501
await ops_test.model.wait_for_idle(apps=[APPLICATION_NAME], status="blocked", timeout=60) # type: ignore[union-attr] # noqa: E501

@pytest.mark.abort_on_fail
async def test_restore_tls_and_wait_for_active_status(
self, ops_test: OpsTest, build_and_deploy_charm
):
await ops_test.model.deploy( # type: ignore[union-attr]
TLS_PROVIDER_CHARM_NAME,
application_name=TLS_PROVIDER_CHARM_NAME,
channel="beta",
trust=True,
)
await ops_test.model.add_relation( # type: ignore[union-attr]
relation1=APPLICATION_NAME, relation2=TLS_PROVIDER_CHARM_NAME
)
await ops_test.model.wait_for_idle(apps=[APPLICATION_NAME], status="active", timeout=1000) # type: ignore[union-attr] # noqa: E501
2 changes: 1 addition & 1 deletion tests/unit/resources/expected_udrcfg.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ info:

configuration:
sbi: # Service-based interface information
scheme: http
scheme: https
registerIPv4: 1.2.3.4
bindingIPv4: 0.0.0.0
port: 29504
Expand Down
59 changes: 57 additions & 2 deletions tests/unit/test_charm.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,16 @@ def _database_is_available(self):
},
)

def _create_certificates_relation(self) -> int:
patriciareinoso marked this conversation as resolved.
Show resolved Hide resolved
"""Creates certificates relation.

Returns:
int: relation id.
"""
return self.harness.add_relation(
relation_name="certificates", remote_app="tls-certificates-operator"
)

def test_given_database_relation_not_created_when_pebble_ready_then_status_is_blocked(self):
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self.harness.container_pebble_ready("udr")
Expand All @@ -71,6 +81,17 @@ def test_given_fiveg_nrf_relation_not_created_when_pebble_ready_then_status_is_b
BlockedStatus("Waiting for the `fiveg_nrf` relation to be created"),
)

def test_given_certificates_relation_not_created_when_pebble_ready_then_status_is_blocked(
self,
):
self.harness.add_relation(relation_name="database", remote_app="some_db_app")
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status,
BlockedStatus("Waiting for the `certificates` relation to be created"),
)

@patch("charm.check_output")
@patch("ops.model.Container.exists")
@patch("charms.sdcore_nrf.v0.fiveg_nrf.NRFRequires.nrf_url", new_callable=PropertyMock)
Expand Down Expand Up @@ -100,6 +121,7 @@ def test_given_relations_created_but_database_not_available_when_pebble_ready_th
):
self.harness.add_relation(relation_name="database", remote_app="some_db_app")
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status,
Expand All @@ -113,6 +135,7 @@ def test_give_database_info_not_available_when_pebble_ready_then_status_is_waiti
patched_is_resource_created.return_value = True
self.harness.add_relation(relation_name="database", remote_app="some_db_app")
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status,
Expand All @@ -126,6 +149,7 @@ def test_given_nrf_data_not_available_when_pebble_ready_then_status_is_waiting(
patched_is_resource_created.return_value = True
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status, WaitingStatus("Waiting for the NRF to be available")
Expand All @@ -140,11 +164,35 @@ def test_given_relations_created_and_database_available_and_nrf_available_but_st
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status, WaitingStatus("Waiting for the storage to be attached")
)

@patch("charm.check_output")
@patch("ops.Container.push")
@patch("charms.sdcore_nrf.v0.fiveg_nrf.NRFRequires.nrf_url", new_callable=PropertyMock)
@patch("charms.data_platform_libs.v0.data_interfaces.DatabaseRequires.is_resource_created")
def test_given_relations_created_and_database_available_and_nrf_available_but_certificate_not_stored_when_pebble_ready_then_then_status_is_waiting( # noqa: E501
self,
patched_is_resource_created,
patched_nrf_url,
_,
patched_check_output,
):
patched_check_output.return_value = "1.2.3.4".encode()
patched_is_resource_created.return_value = True
self.harness.charm._storage_is_attached = Mock(return_value=True)
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status, WaitingStatus("Waiting for certificates to be stored")
)

@patch("ops.model.Container.push")
@patch("charm.check_output")
@patch("ops.model.Container.exists")
Expand All @@ -158,12 +206,13 @@ def test_given_udr_operator_ready_to_be_configured_when_pebble_ready_then_config
patched_check_output,
patched_push,
):
patched_exists.side_effect = [True, False]
patched_exists.side_effect = [True, True, True, False]
patched_check_output.return_value = "1.2.3.4".encode()
patched_is_resource_created.return_value = True
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()

self.harness.container_pebble_ready("udr")

Expand All @@ -190,13 +239,14 @@ def test_given_udr_config_is_different_from_the_newly_generated_config_when_pebb
patched_pull,
patched_push,
):
patched_exists.side_effect = [True, False]
patched_exists.side_effect = [True, True, True, False]
patched_check_output.return_value = "1.2.3.4".encode()
patched_pull.return_value = StringIO("Dummy content")
patched_is_resource_created.return_value = True
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()

self.harness.container_pebble_ready("udr")

Expand Down Expand Up @@ -259,6 +309,7 @@ def test_given_udr_service_already_configured_and_udr_config_is_different_from_t
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()
self.harness.set_can_connect(container="udr", val=True)
self._container.add_layer("udr", TEST_PEBBLE_LAYER, combine=True)

Expand Down Expand Up @@ -314,6 +365,7 @@ def test_given_udr_config_is_pushed_when_pebble_ready_then_udr_service_is_config
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()

self.harness.container_pebble_ready("udr")

Expand All @@ -339,6 +391,7 @@ def test_given_udr_config_is_pushed_when_pebble_ready_then_udr_service_is_restar
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
patched_restart.assert_called_once_with("udr")

Expand All @@ -359,6 +412,7 @@ def test_given_udr_config_is_pushed_when_pebble_ready_then_status_is_active(
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()
self.harness.container_pebble_ready("udr")
self.assertEqual(
self.harness.model.unit.status,
Expand All @@ -382,6 +436,7 @@ def test_given_ip_not_available_when_pebble_ready_then_status_is_waiting(
patched_nrf_url.return_value = "http://nrf:8081"
self.harness.add_relation(relation_name="fiveg_nrf", remote_app="some_nrf_app")
self._database_is_available()
self._create_certificates_relation()

self.harness.container_pebble_ready("udr")

Expand Down
Loading