red-hat-data-services · liswang89 · Oct 31, 2024
diff --git a/ods_ci/build/Dockerfile_interop b/ods_ci/build/Dockerfile_interop
@@ -0,0 +1,49 @@
+FROM quay.io/centos/centos:stream9
+
+# Use this build arg to set any default test script arguments
+ENV RUN_SCRIPT_ARGS=${RUN_SCRIPT_ARGS}
+ENV ROBOT_EXTRA_ARGS=''
+ENV SET_ENVIRONMENT=0
+ENV RETURN_PW=0
+ENV OC_HOST=${OC_HOST}
+ENV RUN_FROM_CONTAINER=1
+ENV SE_BROWSER_PATH=/usr/bin/chromium-browser
+ARG OC_VERSION=4.13
+ARG OC_CHANNEL=stable
+ARG PYTHON_VERSION=3.11
+
+ENV ODS_VENV="/ods_venv" \
+    HOME="/ods_venv" \
+    PATH="ods_venv/bin:${PATH}" \
+    AM_I_IN_CONTAINER="Yes" \
+    PYTHONUNBUFFERED="True"
+
+WORKDIR /ods_venv
+
+COPY . ${ODS_VENV}
+COPY ods_ci/test-variables.yml.example ${ODS_VENV}/ods_ci/test-variables.yml
+
+RUN dnf install epel-release -y &&\
+    dnf -y update &&\
+    dnf install -y jq git unzip chromium chromedriver httpd-tools gcc \
+                   python3 python3-devel python3-distro python-pip python${PYTHON_VERSION} python${PYTHON_VERSION}-devel &&\
+    dnf clean all && rm -rf /var/cache/yum &&\
+    curl --proto "=https" -L https://github.com/mikefarah/yq/releases/download/v4.34.1/yq_linux_amd64 -o /usr/bin/yq &&\
+    chmod +x /usr/bin/yq &&\
+    curl --proto "=https" -L https://mirror.openshift.com/pub/openshift-v$(echo ${OC_VERSION} | cut -d'.' -f 1)/x86_64/clients/ocp/${OC_CHANNEL}-${OC_VERSION}/openshift-client-linux.tar.gz -o ${HOME}/oc_client.tar.gz && \
+    tar xvf ${HOME}/oc_client.tar.gz -C /usr/local/bin/ && \
+    rm -rf ${HOME}/oc_client.tar.gz && rm /usr/local/bin/README.md && chmod 755 /usr/local/bin/oc && oc version --client && \
+    curl --proto "=https" -L https://github.com/openshift-online/ocm-cli/releases/download/v0.1.62/ocm-linux-amd64 -o ${HOME}/ocm && \
+    mv ${HOME}/ocm /usr/local/bin/ && chmod 755 /usr/local/bin/ocm && ocm version
+
+RUN alternatives --install /usr/local/bin/python3 python3 /usr/bin/python${PYTHON_VERSION} 1
+RUN python3 --version
+RUN curl -sSL https://install.python-poetry.org | python3 -
+ENV PATH="${PATH}:${HOME}/.local/bin"
+RUN poetry install
+
+RUN chgrp -R 0 ${ODS_VENV} && \
+    chmod -R g+rwX ${ODS_VENV}
+
+USER 1001
+WORKDIR ${ODS_VENV}/ods_ci
diff --git a/ods_ci/build/htpasswd/htpasswd_installation.sh b/ods_ci/build/htpasswd/htpasswd_installation.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+HTPASSWD_PATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+
+cd $HTPASSWD_PATH
+
+touch users.txt
+function generate_htpasswd_user(){
+for i in {1..20}
+  do
+    htpasswd -b -B users.txt $1$i $2 
+  done
+}
+
+generate_htpasswd_user htpasswd-$RAND-admin $TEST_PASSWD
+generate_htpasswd_user htpasswd-$RAND-user $TEST_PASSWD
+generate_htpasswd_user htpasswd-$RAND-noaccess $TEST_PASSWD
+htpasswd -b -B users.txt htpasswd-$RAND-cluster-admin-user $TEST_ADMIN_PASSWD
+
+function generate_special_user(){
+declare -a StringArray=("." "^" "$" "*" "+" "?" "(" ")" "[" "]" "{" "}" "\\" "|" "@" ";" "<" ">")
+for char in "${StringArray[@]}"; 
+  do
+    htpasswd -b -B users.txt $1$char $2 
+  done
+}
+
+generate_special_user htpasswd-$RAND-special $TEST_PASSWD
+
+oc create secret generic htpasswd-secret --from-file=htpasswd=$HTPASSWD_PATH/users.txt -n openshift-config || echo "htpasswd secret exists"
+rm $HTPASSWD_PATH/users.txt
diff --git a/ods_ci/build/install_idp_interop.sh b/ods_ci/build/install_idp_interop.sh
@@ -0,0 +1,187 @@
+#!/bin/bash
+
+PROVIDER_PATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+OAUTH_LDAP_JSON="$(cat $PROVIDER_PATH/ldap/oauth-ldap.idp.json)"
+TEST_VARIABLES_FILE="test-variables.yml"
+
+RAND="interop-$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 4)"
+TEST_PASSWD="rhods-$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 4)"
+TEST_ADMIN_PASSWD="rhods-$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 6)"
+
+export RAND
+export TEST_PASSWD
+export TEST_ADMIN_PASSWD
+
+install_htpasswd_identity_provider(){
+
+# Test if any oauth identityProviders exists. If not, initialize the identityProvider list
+CURRENT_IDP_LIST=$(oc get oauth cluster -o json | jq -e '.spec.identityProviders')
+if [[ -z "${CURRENT_IDP_LIST}" ]] || [[  "${CURRENT_IDP_LIST}" == "null" ]]; then
+  echo 'No oauth identityProvider exists. Initializing oauth .spec.identityProviders = []'
+  oc patch oauth cluster --type json -p '[{"op": "add", "path": "/spec/identityProviders", "value": []}]'
+fi
+
+$PROVIDER_PATH/htpasswd/htpasswd_installation.sh
+# Patch in the HTPASSWD identityProviders
+oc patch oauth cluster --type json -p '[{"op": "add", "path": "/spec/identityProviders/-", "value": {"name":"htpasswd-cluster-admin","mappingMethod":"claim","type":"HTPasswd","htpasswd":{"fileData":{"name":"htpasswd-secret"}}}}]'
+}
+
+install_ldap_identity_provider(){
+
+# Test if any oauth identityProviders exists. If not, initialize the identityProvider list
+CURRENT_IDP_LIST=$(oc get oauth cluster -o json | jq -e '.spec.identityProviders')
+if [[ -z "${CURRENT_IDP_LIST}" ]] || [[  "${CURRENT_IDP_LIST}" == "null" ]]; then
+  echo 'No oauth identityProvider exists. Initializing oauth .spec.identityProviders = []'
+  oc patch oauth cluster --type json -p '[{"op": "add", "path": "/spec/identityProviders", "value": []}]'
+fi
+
+# Patch in the LDAP identityProviders
+oc patch oauth cluster --type json -p '[{"op": "add", "path": "/spec/identityProviders/-", "value": '"$OAUTH_LDAP_JSON"'}]'
+
+$PROVIDER_PATH/ldap/ldap_installation.sh
+}
+
+add_groups_users() {
+# create groups
+oc adm groups new rhods-admins
+oc adm groups new rhods-users
+oc adm groups new rhods-noaccess
+oc adm groups new dedicated-admins
+# add users to groups
+function add_users_to_groups(){
+for i in {1..20}
+  do
+    oc adm groups add-users $1 $2$i 
+  done
+}
+add_users_to_groups rhods-admins htpasswd-$RAND-admin
+add_users_to_groups rhods-users htpasswd-$RAND-user
+add_users_to_groups rhods-noaccess htpasswd-$RAND-noaccess
+add_users_to_groups rhods-admins ldap-$RAND-admin
+add_users_to_groups dedicated-admins ldap-$RAND-admin
+add_users_to_groups rhods-users ldap-$RAND-user
+add_users_to_groups rhods-noaccess ldap-$RAND-noaccess
+oc adm groups add-users dedicated-admins htpasswd-$RAND-cluster-admin-user
+
+function add_special_users_to_groups(){
+declare -a StringArray=("." "^" "$" "*" "+" "?" "(" ")" "[" "]" "{" "}" "|" "@" ";" "<" ">")
+for char in "${StringArray[@]}"; 
+  do
+    oc adm groups add-users $1 $2$char 
+  done
+}
+add_special_users_to_groups rhods-users htpasswd-$RAND-special
+add_special_users_to_groups rhods-users ldap-$RAND-special
+
+oc adm groups add-users rhods-admins kubeadmin
+oc adm groups add-users jupyterhub-users kubeadmin
+oc adm policy add-cluster-role-to-group view rhods-admins
+oc adm policy add-cluster-role-to-group cluster-admin dedicated-admins
+
+oc describe oauth.config.openshift.io/cluster
+}
+
+function htpasswd_installation(){
+  chk_htpasswd=1
+
+  while read -r line; do
+
+    if [[ $line == *"cluster-admin"* ]]; then
+        echo -e "\033[0;33m Htpasswd Identity provider is installed. Skipping installation \033[0m"
+        chk_htpasswd=0
+        break
+    fi
+  done < <(oc get oauth -o yaml)
+
+  if [[ $chk_htpasswd == 1 ]]; then
+    install_htpasswd_identity_provider
+  fi
+}
+
+function ldap_installation(){
+  chk_ldap=1
+  while read -r line; do
+    if [[ $line == *"ldap-provider-qe"* ]]; then
+	    echo -e "\033[0;33m LDAP Identity provider is installed. Skipping installation \033[0m"
+	    chk_ldap=0
+        break
+    fi
+  done < <(oc get oauth -o yaml)
+  if [[ $chk_ldap == 1 ]]; then
+    install_ldap_identity_provider
+  fi
+}
+
+function update_test_config(){
+    echo "Update test config file..."
+
+    AWS_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/.awscred"
+    AWS_ACCESS_KEY_ID=$(cat $AWS_SHARED_CREDENTIALS_FILE | grep aws_access_key_id | tr -d ' ' | cut -d '=' -f 2)
+    AWS_SECRET_ACCESS_KEY=$(cat $AWS_SHARED_CREDENTIALS_FILE | grep aws_secret_access_key | tr -d ' ' | cut -d '=' -f 2)
+
+    LDAP_USER_ADMIN1=ldap-$RAND-admin"1"
+    LDAP_USER_ADMIN2=ldap-$RAND-admin"2"
+    LDAP_USER_USER2=ldap-$RAND-user"2"
+    LDAP_USER_USER9=ldap-$RAND-user"9"
+    HTTP_CLUSTER_ADMIN=htpasswd-$RAND-cluster-admin-user
+
+    export LDAP_USER_ADMIN1
+    export LDAP_USER_ADMIN2
+    export LDAP_USER_USER2
+    export LDAP_USER_USER9
+    export HTTP_CLUSTER_ADMIN
+    export AWS_ACCESS_KEY_ID
+    export AWS_SECRET_ACCESS_KEY
+
+    yq -i '.OCP_ADMIN_USER.AUTH_TYPE="htpasswd-cluster-admin"' $TEST_VARIABLES_FILE
+    yq -i '.OCP_ADMIN_USER.USERNAME=env(HTTP_CLUSTER_ADMIN)' $TEST_VARIABLES_FILE
+    yq -i '.OCP_ADMIN_USER.PASSWORD=env(TEST_ADMIN_PASSWD)' $TEST_VARIABLES_FILE
+
+    yq -i '.TEST_USER.AUTH_TYPE="ldap-provider-qe"' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER.USERNAME=env(LDAP_USER_ADMIN1)' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER.PASSWORD=env(TEST_PASSWD)' $TEST_VARIABLES_FILE
+
+    yq -i '.TEST_USER_2.AUTH_TYPE="ldap-provider-qe"' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER_2.USERNAME=env(LDAP_USER_ADMIN2)' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER_2.PASSWORD=env(TEST_PASSWD)' $TEST_VARIABLES_FILE
+
+    yq -i '.TEST_USER_3.AUTH_TYPE="ldap-provider-qe"' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER_3.USERNAME=env(LDAP_USER_USER2)' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER_3.PASSWORD=env(TEST_PASSWD)' $TEST_VARIABLES_FILE
+
+    yq -i '.TEST_USER_4.AUTH_TYPE="ldap-provider-qe"' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER_4.USERNAME=env(LDAP_USER_USER9)' $TEST_VARIABLES_FILE
+    yq -i '.TEST_USER_4.PASSWORD=env(TEST_PASSWD)' $TEST_VARIABLES_FILE
+
+    yq -i '.OCP_API_URL=env(OC_HOST)' $TEST_VARIABLES_FILE
+    yq -i '.OCP_CONSOLE_URL=env(OCP_CONSOLE)' $TEST_VARIABLES_FILE
+    yq -i '.ODH_DASHBOARD_URL=env(RHODS_DASHBOARD)' $TEST_VARIABLES_FILE
+    yq -i '.BROWSER.NAME="firefox"' $TEST_VARIABLES_FILE
+    yq -i '.S3.AWS_ACCESS_KEY_ID=env(AWS_ACCESS_KEY_ID)' $TEST_VARIABLES_FILE
+    yq -i '.S3.AWS_SECRET_ACCESS_KEY=env(AWS_SECRET_ACCESS_KEY)' $TEST_VARIABLES_FILE
+
+    echo "OCP Console URL set to: $OCP_CONSOLE"
+    echo "RHODS API Server URL set to: $OC_HOST"
+    echo "RHODS Dashboard URL set to: $RHODS_DASHBOARD"
+}
+
+htpasswd_installation
+ldap_installation
+add_groups_users
+update_test_config
+sleep 120
+
+echo "Performing oc login using username and password"
+
+echo "USER: $LDAP_USER_ADMIN1"
+echo "PASS: $TEST_PASSWD"
+oc login "$OC_HOST" --username $LDAP_USER_ADMIN1 --password $TEST_PASSWD --insecure-skip-tls-verify=true || true
+echo "login as cluster admin"
+oc login "$OC_HOST" --username $HTTP_CLUSTER_ADMIN --password $TEST_ADMIN_PASSWD --insecure-skip-tls-verify=true
+retVal=$?
+if [ $retVal -ne 0 ]; then
+    echo "The oc login command seems to have failed"
+    echo "Please review the content of $TEST_VARIABLES_FILE"
+    exit "$retVal"
+fi
+
diff --git a/ods_ci/build/ldap/ldap.yaml b/ods_ci/build/ldap/ldap.yaml
@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openldap
+---
+apiVersion: v1
+data:
+  adminpassword: FOO_ADMIN
+  passwords: FOO_PASSWORD
+  users: FOO_USER
+kind: Secret
+metadata:
+  name: openldap
+  namespace: openldap
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: openldap
+  namespace: openldap
+  labels:
+    app.kubernetes.io/name: openldap
+spec:
+  type: ClusterIP
+  ports:
+    - name: tcp-ldap
+      port: 1389
+      targetPort: tcp-ldap
+  selector:
+    app.kubernetes.io/name: openldap
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openldap
+  namespace: openldap
+  labels:
+    app.kubernetes.io/name: openldap
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: openldap
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: openldap
+    spec:
+      containers:
+        - name: openldap
+          image: quay.io/croberts/openldapserver@sha256:9d4ec0a31b48e165cbef6950c29a0a71a9508cee74fbca2b9df8a9b36f776be1
+          imagePullPolicy: "Always"
+          resources:
+            requests:
+              memory: "256Mi"
+            limits:
+              memory: "512Mi"
+          env:
+            - name: LDAP_ADMIN_USERNAME
+              value: "admin"
+            - name: LDAP_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: adminpassword
+                  name: openldap
+            - name: LDAP_USERS
+              valueFrom:
+                secretKeyRef:
+                  key: users
+                  name: openldap
+            - name: LDAP_PASSWORDS
+              valueFrom:
+                secretKeyRef:
+                  key: passwords
+                  name: openldap
+          ports:
+            - name: tcp-ldap
+              containerPort: 1389
diff --git a/ods_ci/build/ldap/ldap_installation.sh b/ods_ci/build/ldap/ldap_installation.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+LDAP_PATH="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+oc create secret generic ldap-bind-password --from-literal=bindPassword=adminpassword -n openshift-config || echo "ldap secret exists"
+oc create ns openldap
+
+LDAP_USERS=""
+LDAP_PASSWORDS=""
+
+function add_ldap_users(){
+for i in {1..20}
+  do
+    LDAP_USERS+="$1$i,"
+    LDAP_PASSWORDS+="${TEST_PASSWD},"
+  done
+}
+
+add_ldap_users ldap-$RAND-admin
+add_ldap_users ldap-$RAND-user
+add_ldap_users ldap-$RAND-noaccess
+
+function add_special_user(){
+declare -a StringArray=("." "^" "$" "*" "+" "?" "(" ")" "[" "]" "{" "}" "|" "@" ";" "<" ">")
+for char in "${StringArray[@]}"; 
+  do
+    LDAP_USERS+="$1$char,"
+    LDAP_PASSWORDS+="${TEST_PASSWD},"
+  done
+}
+add_special_user ldap-$RAND-special
+
+LDAP_USERS=${LDAP_USERS::-1}
+LDAP_PASSWORDS=${LDAP_PASSWORDS::-1}
+LDAP_ADMIN_PASS="adminpass-$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 6)"
+
+echo "LDAP_USERS: $LDAP_USERS"
+echo "LDAP_PASSWORDS: $LDAP_PASSWORDS"
+ENCODED_USERS=$(echo -n $LDAP_USERS | base64 -w 0)
+ENCODED_PASSWORDS=$(echo -n $LDAP_PASSWORDS | base64 -w 0)
+ENCODED_ADMINPASS=$(echo -n $LDAP_ADMIN_PASS | base64 -w 0)
+
+sed -i'' -e "s|FOO_USER|$ENCODED_USERS|g" $LDAP_PATH/ldap.yaml
+sed -i'' -e "s/FOO_PASSWORD/$ENCODED_PASSWORDS/g" $LDAP_PATH/ldap.yaml
+sed -i'' -e "s/FOO_ADMIN/$ENCODED_ADMINPASS/g" $LDAP_PATH/ldap.yaml
+
+oc apply -f $LDAP_PATH/ldap.yaml
+
+sleep 60s