103 lines
2.9 KiB
Shell
103 lines
2.9 KiB
Shell
# Cases for ./granter-login.nix. Each case sets the stub's answers, runs the
|
|
# rendered login under `set -e` as a unit's script does, then compares its exit
|
|
# status, what it printed to stderr and the token it left exported to children.
|
|
set -uo pipefail
|
|
|
|
failures=0
|
|
count=0
|
|
|
|
fail() {
|
|
echo "FAILED: $case: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
# setup <description>
|
|
setup() {
|
|
case=$1
|
|
count=$((count + 1))
|
|
dir=$(mktemp -d)
|
|
export FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_COUNT=$dir/count FAKE_BAO_LOGIN=ok FAKE_BAO_STATUS_RC=0
|
|
unset FAKE_BAO_LOGIN_FIRST
|
|
: >"$FAKE_BAO_LOG"
|
|
login=$LOGIN
|
|
}
|
|
|
|
# run — the login, then the token it exported. Sets $rc, $got, and $dir/err.
|
|
run() {
|
|
got=$(
|
|
(
|
|
set -e
|
|
PATH="$FAKE_BAO_BIN:$PATH"
|
|
unset BAO_TOKEN
|
|
# shellcheck source=/dev/null
|
|
. "$login"
|
|
env | sed -n "s/^BAO_TOKEN=//p"
|
|
) 2>"$dir/err"
|
|
)
|
|
rc=$?
|
|
}
|
|
|
|
# expect <status> <token>
|
|
expect() {
|
|
if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err")"; fi
|
|
if [ "$got" != "$2" ]; then fail "token '$got', wanted '$2'"; fi
|
|
}
|
|
|
|
err_has() {
|
|
if ! grep -qF -- "$1" "$dir/err"; then fail "stderr lacks '$1': $(cat "$dir/err")"; fi
|
|
}
|
|
|
|
err_lacks() {
|
|
if grep -qF -- "$1" "$dir/err"; then fail "stderr has '$1': $(cat "$dir/err")"; fi
|
|
}
|
|
|
|
setup "a successful login exports the token and prints nothing"
|
|
run
|
|
expect 0 s.fake
|
|
if [ -s "$dir/err" ]; then fail "printed: $(cat "$dir/err")"; fi
|
|
|
|
setup "a standby store fails the login with its own error, does not blame the role, and the next attempt succeeds"
|
|
export FAKE_BAO_LOGIN_FIRST=standby
|
|
run
|
|
expect 1 ""
|
|
err_has "local node not active but active cluster node not found"
|
|
err_has "login failed without a refused certificate"
|
|
err_lacks "role is not set up"
|
|
err_lacks "one-time step"
|
|
run
|
|
expect 0 s.fake
|
|
|
|
setup "an unknown role names the role and the setup steps, then bao's error"
|
|
export FAKE_BAO_LOGIN=no-role
|
|
run
|
|
expect 1 ""
|
|
err_has "refused the granter's certificate (CN bao-granter): the bao-granter role is not set up."
|
|
err_has "one-time step, as root on this host"
|
|
err_has " bao policy write bao-bootstrap /etc/bootstrap.hcl"
|
|
err_has "invalid certificate or no client certificate supplied"
|
|
err_lacks "swarm-bao-granter-role writes that role"
|
|
|
|
setup "a certificate no role accepts is a missing role too"
|
|
export FAKE_BAO_LOGIN=no-chain-match
|
|
run
|
|
expect 1 ""
|
|
err_has "the bao-granter role is not set up."
|
|
err_has "no chain matching all constraints"
|
|
|
|
setup "a unit with a bootstrap token also points at the unit that writes the role"
|
|
export FAKE_BAO_LOGIN=no-role
|
|
login=$LOGIN_WITH_TOKEN
|
|
run
|
|
expect 1 ""
|
|
err_has "swarm-bao-granter-role writes that role"
|
|
|
|
setup "a sealed store is reported as sealed or unreachable, with bao's error"
|
|
export FAKE_BAO_LOGIN=sealed FAKE_BAO_STATUS_RC=2
|
|
run
|
|
expect 1 ""
|
|
err_has "the store is sealed or unreachable; retrying."
|
|
err_has "Vault is sealed"
|
|
err_lacks "role is not set up"
|
|
|
|
echo "granter-login: $count cases, $failures failures"
|
|
[ "$failures" = 0 ]
|