Skip to content

Commit a3c6ed0

Browse files
committed
feat(test): add integration tests
Integration tests for trustee_quadlet and secret_registration_server. Signed-off-by: Li Tian <litian@redhat.com>
1 parent e3ec608 commit a3c6ed0

30 files changed

Lines changed: 193 additions & 101 deletions

.ansible-lint

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,6 @@ exclude_paths:
2121
- .markdownlint.yaml
2222
- examples/roles/
2323
mock_roles:
24-
- linux-system-roles.trustee_server
24+
- linux-system-roles.trustee_attestation_server
2525
supported_ansible_also:
2626
- "2.14.0"

README.md

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
# trustee_server
1+
# trustee_attestation_server
22

3-
[![ansible-lint.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-lint.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-lint.yml) [![ansible-test.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-test.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/ansible-test.yml) [![codespell.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/codespell.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/codespell.yml) [![markdownlint.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/markdownlint.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/markdownlint.yml) [![qemu-kvm-integration-tests.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/qemu-kvm-integration-tests.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/qemu-kvm-integration-tests.yml) [![shellcheck.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/shellcheck.yml) [![tft.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft.yml) [![tft_citest_bad.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft_citest_bad.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/tft_citest_bad.yml) [![woke.yml](https://github.com/linux-system-roles/trustee_server/actions/workflows/woke.yml/badge.svg)](https://github.com/linux-system-roles/trustee_server/actions/workflows/woke.yml)
3+
[![ansible-lint.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/ansible-lint.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/ansible-lint.yml) [![ansible-test.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/ansible-test.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/ansible-test.yml) [![codespell.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/codespell.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/codespell.yml) [![markdownlint.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/markdownlint.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/markdownlint.yml) [![qemu-kvm-integration-tests.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/qemu-kvm-integration-tests.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/qemu-kvm-integration-tests.yml) [![shellcheck.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/shellcheck.yml) [![tft.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/tft.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/tft.yml) [![tft_citest_bad.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/tft_citest_bad.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/tft_citest_bad.yml) [![woke.yml](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/woke.yml/badge.svg)](https://github.com/linux-system-roles/trustee_attestation_server/actions/workflows/woke.yml)
44

5-
![trustee_server](https://github.com/linux-system-roles/trustee_server/workflows/tox/badge.svg)
5+
![trustee_attestation_server](https://github.com/linux-system-roles/trustee_attestation_server/workflows/tox/badge.svg)
66

7-
An Ansible role that deploys [Trustee](https://confidentialcontainers.org/docs/attestation/) server components for confidential computing. Trustee provides attestation and secret delivery services (KBS, Attestation Service) for workloads running in Trusted Execution Environments (TEEs).
7+
An Ansible role that deploys [Trustee](https://confidentialcontainers.org/docs/attestation/) server components for confidential computing. Trustee provides attestation and secret delivery services (KBS, AS, RVPS) for workloads running in Trusted Execution Environments (TEEs).
88

99
## Features
1010

@@ -22,27 +22,21 @@ An Ansible role that deploys [Trustee](https://confidentialcontainers.org/docs/a
2222
ansible-galaxy collection install -r meta/collection-requirements.yml
2323
```
2424

25-
### Managed node
26-
27-
- Fedora or RHEL 9+
28-
- Podman
29-
- Python 3
30-
3125
## Example Playbook
3226

3327
```yaml
3428
- name: Deploy Trustee Server
3529
hosts: all
3630
vars:
37-
trustee_server_trustee: true
38-
trustee_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
39-
trustee_server_quadlet_repo_path: "quadlet"
40-
trustee_server_quadlet_repo_branch: "main"
41-
trustee_server_quadlet_install_dir: "/etc/containers/systemd"
42-
trustee_server_secret_registration_server_enabled: true
43-
trustee_server_secret_registration_listen_port: 8081
31+
trustee_attestation_server_trustee: true
32+
trustee_attestation_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
33+
trustee_attestation_server_quadlet_repo_path: "quadlet"
34+
trustee_attestation_server_quadlet_repo_branch: "main"
35+
trustee_attestation_server_quadlet_install_dir: "/etc/containers/systemd"
36+
trustee_attestation_server_secret_registration_enabled: true
37+
trustee_attestation_server_secret_registration_listen_port: 8081
4438
roles:
45-
- linux-system-roles.trustee_server
39+
- linux-system-roles.trustee_attestation_server
4640
```
4741
4842
More examples are in the [`examples/`](examples) directory.
@@ -52,9 +46,9 @@ More examples are in the [`examples/`](examples) directory.
5246
When enabled, the role:
5347

5448
1. Downloads the Podman Quadlets from designated repo
55-
2. Generates all required certficates of Trustee server components
49+
2. Generates all required certificates of Trustee server components
5650
3. Add KBS port 8080 to firewalld
57-
3. Enables the services by default
51+
4. Enables the services by default
5852

5953
Note that KBS listens on port 8080 which may require additional network security allowance depending on your environment.
6054

contributing.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Contributing to the trustee_server Linux System Role
1+
# Contributing to the trustee_attestation_server Linux System Role
22

33
## Where to start
44

@@ -12,12 +12,12 @@ This has all of the common information that all role developers need:
1212
* How to create git commits and submit pull requests
1313

1414
**Bugs and needed implementations** are listed on
15-
[Github Issues](https://github.com/linux-system-roles/trustee_server/issues).
15+
[Github Issues](https://github.com/linux-system-roles/trustee_attestation_server/issues).
1616
Issues labeled with
17-
[**help wanted**](https://github.com/linux-system-roles/trustee_server/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
17+
[**help wanted**](https://github.com/linux-system-roles/trustee_attestation_server/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
1818
are likely to be suitable for new contributors!
1919

20-
**Code** is managed on [Github](https://github.com/linux-system-roles/trustee_server), using
20+
**Code** is managed on [Github](https://github.com/linux-system-roles/trustee_attestation_server), using
2121
[Pull Requests](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/about-pull-requests).
2222

2323
## Running CI Tests Locally

defaults/main.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@
44
# This file also serves as a documentation for such a variables.
55

66
# Trustee Server Components Quadlet repository configuration
7-
trustee_server_trustee: true
8-
trustee_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
9-
trustee_server_quadlet_repo_path: "quadlet"
10-
trustee_server_quadlet_repo_branch: "main"
11-
trustee_server_quadlet_install_dir: "/etc/containers/systemd"
7+
trustee_attestation_server_trustee: true
8+
trustee_attestation_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
9+
trustee_attestation_server_quadlet_repo_path: "quadlet"
10+
trustee_attestation_server_quadlet_repo_branch: "main"
11+
trustee_attestation_server_quadlet_install_dir: "/etc/containers/systemd"
1212

1313
# Secret registration server service configuration
14-
trustee_server_secret_registration_server_enabled: false
15-
trustee_server_secret_registration_listen_port: 8081
14+
trustee_attestation_server_secret_registration_enabled: false
15+
trustee_attestation_server_secret_registration_listen_port: 8081

examples/simple.yml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@
33
- name: Deploy Trustee Server Components using Podman Quadlets from GitHub repository
44
hosts: all
55
vars:
6-
trustee_server_trustee: true
7-
trustee_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
8-
trustee_server_quadlet_repo_path: "quadlet"
9-
trustee_server_quadlet_repo_branch: "main"
10-
trustee_server_quadlet_install_dir: "/etc/containers/systemd"
11-
trustee_server_secret_registration_server_enabled: false
6+
trustee_attestation_server_trustee: true
7+
trustee_attestation_server_quadlet_repo_url: "https://github.com/litian1992/trustee-quadlet-rhel.git"
8+
trustee_attestation_server_quadlet_repo_path: "quadlet"
9+
trustee_attestation_server_quadlet_repo_branch: "main"
10+
trustee_attestation_server_quadlet_install_dir: "/etc/containers/systemd"
11+
trustee_attestation_server_secret_registration_enabled: false
1212
roles:
13-
- linux-system-roles.trustee-server
13+
- linux-system-roles.trustee_attestation_server

plans/README-plans.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Introduction CI Testing Plans
22

3-
Linux System Roles CI runs [tmt](https://tmt.readthedocs.io/en/stable/index.html) test plans in [Testing farm](https://docs.testing-farm.io/Testing%20Farm/0.1/index.html) with the [tft.yml](https://github.com/linux-system-roles/trustee_server/blob/main/.github/workflows/tft.yml) GitHub workflow.
3+
Linux System Roles CI runs [tmt](https://tmt.readthedocs.io/en/stable/index.html) test plans in [Testing farm](https://docs.testing-farm.io/Testing%20Farm/0.1/index.html) with the [tft.yml](https://github.com/linux-system-roles/trustee_attestation_server/blob/main/.github/workflows/tft.yml) GitHub workflow.
44

55
The `plans/test_playbooks_parallel.fmf` plan is a test plan that runs test playbooks in parallel on multiple managed nodes.
66
`plans/test_playbooks_parallel.fmf` is generated centrally from `https://github.com/linux-system-roles/.github/`.
@@ -16,7 +16,7 @@ The `plans/test_playbooks_parallel.fmf` plan does the following steps:
1616
2. Does the required preparation on systems.
1717
3. For the given role and the given PR, runs the general test from [test.sh](https://github.com/linux-system-roles/tft-tests/blob/main/tests/general/test.sh).
1818

19-
The [tft.yml](https://github.com/linux-system-roles/trustee_server/blob/main/.github/workflows/tft.yml) workflow runs the above plan and uploads the results to our Fedora storage for public access.
19+
The [tft.yml](https://github.com/linux-system-roles/trustee_attestation_server/blob/main/.github/workflows/tft.yml) workflow runs the above plan and uploads the results to our Fedora storage for public access.
2020
This workflow uses Testing Farm's Github Action [Schedule tests on Testing Farm](https://github.com/marketplace/actions/schedule-tests-on-testing-farm).
2121

2222
## Running Tests
@@ -47,7 +47,7 @@ You can run tests locally with the `tmt try` cli or remotely in Testing Farm.
4747
$ TESTING_FARM_API_TOKEN=<your_api_token> \
4848
testing-farm request --pipeline-type="tmt-multihost" \
4949
--plan-filter="tag:playbooks_parallel" \
50-
--git-url "https://github.com/<my_user>/trustee_server" \
50+
--git-url "https://github.com/<my_user>/trustee_attestation_server" \
5151
--git-ref "<my_branch>" \
5252
--compose CentOS-Stream-9 \
5353
-e "SYSTEM_ROLES_ONLY_TESTS=tests_default.yml" \

tasks/main.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# Examples of some tasks:
77
- name: Deploy Trustee Server Components using Podman Quadlets
88
include_tasks: trustee_quadlet.yml
9-
when: trustee_server_trustee | bool
9+
when: trustee_attestation_server_trustee | bool
1010

1111
- name: Deploy Secret Registration Server Service
1212
include_tasks: secret_registration_server.yml

tasks/secret_registration_server.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66

77
- name: Ensure secret registration server dependencies are installed
88
ansible.builtin.package:
9-
name: "{{ __trustee_server_secret_registration_packages }}"
9+
name: "{{ __trustee_attestation_server_secret_registration_packages }}"
1010
state: present
11-
use: "{{ (__trustee_server_is_ostree | d(false)) |
11+
use: "{{ (__trustee_attestation_server_is_ostree | d(false)) |
1212
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
1313

1414
- name: Deploy secret registration server script
@@ -30,7 +30,7 @@
3030

3131
- name: Allow secret registration server port in firewall
3232
ansible.posix.firewalld:
33-
port: "{{ trustee_server_secret_registration_listen_port }}/tcp"
33+
port: "{{ trustee_attestation_server_secret_registration_listen_port }}/tcp"
3434
permanent: true
3535
immediate: true
3636
state: enabled

tasks/set_vars.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
- name: Ensure ansible_facts used by role
33
setup:
4-
gather_subset: "{{ __trustee_server_required_facts_subsets }}"
5-
when: __trustee_server_required_facts |
4+
gather_subset: "{{ __trustee_attestation_server_required_facts_subsets }}"
5+
when: __trustee_attestation_server_required_facts |
66
difference(ansible_facts.keys() | list) | length > 0
77

88
- name: Determine if system is ostree and set flag
9-
when: not __trustee_server_is_ostree is defined
9+
when: not __trustee_attestation_server_is_ostree is defined
1010
block:
1111
- name: Check if system is ostree
1212
stat:
@@ -15,7 +15,7 @@
1515

1616
- name: Set flag to indicate system is ostree
1717
set_fact:
18-
__trustee_server_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
18+
__trustee_attestation_server_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
1919

2020
- name: Set platform/version specific variables
2121
include_vars: "{{ __vars_file }}"

tasks/trustee_quadlet.yml

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,34 +2,34 @@
22
---
33
- name: Ensure required packages are installed
44
ansible.builtin.package:
5-
name: "{{ __trustee_server_trustee_packages }}"
5+
name: "{{ __trustee_attestation_server_trustee_packages }}"
66
state: present
7-
use: "{{ (__trustee_server_is_ostree | d(false)) |
7+
use: "{{ (__trustee_attestation_server_is_ostree | d(false)) |
88
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
99

1010
- name: Ensure quadlet install directory exists
1111
ansible.builtin.file:
12-
path: "{{ trustee_server_quadlet_install_dir }}"
12+
path: "{{ trustee_attestation_server_quadlet_install_dir }}"
1313
state: directory
1414
mode: "0755"
1515

1616
- name: Create a temporary directory for the quadlet repository
1717
ansible.builtin.tempfile:
1818
state: directory
19-
register: __trustee_server_quadlet_repo_dir
19+
register: __trustee_attestation_server_quadlet_repo_dir
2020

2121
- name: Download Trustee Server quadlet files from GitHub repository
2222
ansible.builtin.git:
23-
repo: "{{ trustee_server_quadlet_repo_url }}"
24-
dest: "{{ __trustee_server_quadlet_repo_dir.path }}"
25-
version: "{{ trustee_server_quadlet_repo_branch }}"
23+
repo: "{{ trustee_attestation_server_quadlet_repo_url }}"
24+
dest: "{{ __trustee_attestation_server_quadlet_repo_dir.path }}"
25+
version: "{{ trustee_attestation_server_quadlet_repo_branch }}"
2626
depth: 1
2727
force: true
2828
register: quadlet_repo_download
2929

3030
- name: Find Trustee Server quadlet files in repository
3131
ansible.builtin.find:
32-
paths: "{{ __trustee_server_quadlet_repo_dir.path }}/{{ trustee_server_quadlet_repo_path }}"
32+
paths: "{{ __trustee_attestation_server_quadlet_repo_dir.path }}/{{ trustee_attestation_server_quadlet_repo_path }}"
3333
patterns:
3434
- "*.container"
3535
- "*.volume"
@@ -40,13 +40,13 @@
4040

4141
- name: Fail if no Trustee Server quadlet files found
4242
ansible.builtin.fail:
43-
msg: "No quadlet files found in {{ trustee_server_quadlet_repo_url }}/{{ trustee_server_quadlet_repo_path }}"
43+
msg: "No quadlet files found in {{ trustee_attestation_server_quadlet_repo_url }}/{{ trustee_attestation_server_quadlet_repo_path }}"
4444
when: quadlet_files_found.files | length == 0
4545

4646
- name: Copy Trustee Server quadlet files to install directory
4747
ansible.builtin.copy:
4848
src: "{{ item.path }}"
49-
dest: "{{ trustee_server_quadlet_install_dir }}/{{ item.path | basename }}"
49+
dest: "{{ trustee_attestation_server_quadlet_install_dir }}/{{ item.path | basename }}"
5050
mode: "0644"
5151
remote_src: true
5252
force: true
@@ -55,12 +55,12 @@
5555

5656
- name: Stat repository configs directory
5757
ansible.builtin.stat:
58-
path: "{{ __trustee_server_quadlet_repo_dir.path }}/configs"
58+
path: "{{ __trustee_attestation_server_quadlet_repo_dir.path }}/configs"
5959
register: __repo_configs_dir
6060

6161
- name: Copy Trustee Server config files to /etc/trustee/
6262
ansible.builtin.copy:
63-
src: "{{ __trustee_server_quadlet_repo_dir.path }}/configs/"
63+
src: "{{ __trustee_attestation_server_quadlet_repo_dir.path }}/configs/"
6464
dest: /etc/trustee/
6565
mode: "0644"
6666
remote_src: true
@@ -108,7 +108,7 @@
108108

109109
- name: Get the installed Trustee Server pod name
110110
ansible.builtin.find:
111-
paths: "{{ trustee_server_quadlet_install_dir }}"
111+
paths: "{{ trustee_attestation_server_quadlet_install_dir }}"
112112
patterns: "*.pod"
113113
register: __trustee_attestation_server_pod_name
114114

@@ -124,5 +124,5 @@
124124

125125
- name: Clean up temporary repository directory
126126
ansible.builtin.file:
127-
path: "{{ __trustee_server_quadlet_repo_dir.path }}"
127+
path: "{{ __trustee_attestation_server_quadlet_repo_dir.path }}"
128128
state: absent

0 commit comments

Comments
 (0)