Examples with OpenSslCertManager io.strimzi.certs.OpenSslCertManager used on opensource projects

Example 16 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi by strimzi.

the class CruiseControlReconcilerTest method reconcileEnabledCruiseControl.

@Test
public void reconcileEnabledCruiseControl(VertxTestContext context) {
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    DeploymentOperator mockDepOps = supplier.deploymentOperations;
    SecretOperator mockSecretOps = supplier.secretOperations;
    ServiceAccountOperator mockSaOps = supplier.serviceAccountOperations;
    ServiceOperator mockServiceOps = supplier.serviceOperations;
    NetworkPolicyOperator mockNetPolicyOps = supplier.networkPolicyOperator;
    ConfigMapOperator mockCmOps = supplier.configMapOperations;
    ArgumentCaptor<ServiceAccount> saCaptor = ArgumentCaptor.forClass(ServiceAccount.class);
    when(mockSaOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.serviceAccountName(NAME)), saCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Secret> secretCaptor = ArgumentCaptor.forClass(Secret.class);
    when(mockSecretOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.secretName(NAME)), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockSecretOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.apiSecretName(NAME)), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Service> serviceCaptor = ArgumentCaptor.forClass(Service.class);
    when(mockServiceOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.serviceName(NAME)), serviceCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<NetworkPolicy> netPolicyCaptor = ArgumentCaptor.forClass(NetworkPolicy.class);
    when(mockNetPolicyOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.networkPolicyName(NAME)), netPolicyCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<ConfigMap> cmCaptor = ArgumentCaptor.forClass(ConfigMap.class);
    when(mockCmOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.logAndMetricsConfigMapName(NAME)), cmCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Deployment> depCaptor = ArgumentCaptor.forClass(Deployment.class);
    when(mockDepOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), depCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockDepOps.waitForObserved(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    when(mockDepOps.readiness(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    Kafka kafka = new KafkaBuilder(ResourceUtils.createKafka(NAMESPACE, NAME, 3, "foo", 120, 30)).editSpec().withCruiseControl(cruiseControlSpec).endSpec().build();
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), NAME, ResourceUtils.createInitialCaCertSecret(NAMESPACE, NAME, AbstractModel.clusterCaCertSecretName(NAME), MockCertManager.clusterCaCert(), MockCertManager.clusterCaCertStore(), "123456"), ResourceUtils.createInitialCaKeySecret(NAMESPACE, NAME, AbstractModel.clusterCaKeySecretName(NAME), MockCertManager.clusterCaKey()));
    CruiseControlReconciler rcnclr = new CruiseControlReconciler(Reconciliation.DUMMY_RECONCILIATION, ResourceUtils.dummyClusterOperatorConfig(), supplier, kafka, VERSIONS, kafka.getSpec().getKafka().getStorage(), clusterCa);
    Checkpoint async = context.checkpoint();
    rcnclr.reconcile(false, null, null, Date::new).onComplete(context.succeeding(v -> context.verify(() -> {
        assertThat(saCaptor.getAllValues().size(), is(1));
        assertThat(saCaptor.getValue(), is(notNullValue()));
        assertThat(secretCaptor.getAllValues().size(), is(2));
        assertThat(secretCaptor.getAllValues().get(0), is(notNullValue()));
        assertThat(secretCaptor.getAllValues().get(1), is(notNullValue()));
        assertThat(serviceCaptor.getAllValues().size(), is(1));
        assertThat(serviceCaptor.getValue(), is(notNullValue()));
        assertThat(netPolicyCaptor.getAllValues().size(), is(1));
        assertThat(netPolicyCaptor.getValue(), is(notNullValue()));
        assertThat(cmCaptor.getAllValues().size(), is(1));
        assertThat(cmCaptor.getValue(), is(notNullValue()));
        assertThat(depCaptor.getAllValues().size(), is(1));
        assertThat(depCaptor.getValue(), is(notNullValue()));
        async.flag();
    })));
}

Example 17 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi by strimzi.

the class ZookeeperClusterTest method generateCertificatesSecret.

private Secret generateCertificatesSecret() {
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), cluster, null, null);
    clusterCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    return zc.generateCertificatesSecret(clusterCa, true);
}

Example 18 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class ClusterCaTest method testIsExpiringCertificate.

@ParallelTest
public void testIsExpiringCertificate() {
    // simulate certificate creation at following time, with expire at 365 days later (by default) and renewal days at 30 (by default)
    String instantExpected = "2022-03-30T09:00:00Z";
    Clock clock = Clock.fixed(Instant.parse(instantExpected), UTC);
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(clock), new PasswordGenerator(10, "a", "a"), cluster, null, null);
    clusterCa.setClock(clock);
    clusterCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    // check certificate expiration out of the renewal period, certificate is not expiring
    instantExpected = "2023-02-15T09:00:00Z";
    clock = Clock.fixed(Instant.parse(instantExpected), UTC);
    clusterCa.setClock(clock);
    assertThat(clusterCa.isExpiring(clusterCa.caCertSecret(), Ca.CA_CRT), is(false));
    // check certificate expiration within the renewal period, certificate is expiring
    instantExpected = "2023-03-15T09:00:00Z";
    clock = Clock.fixed(Instant.parse(instantExpected), UTC);
    clusterCa.setClock(clock);
    assertThat(clusterCa.isExpiring(clusterCa.caCertSecret(), Ca.CA_CRT), is(true));
}

Example 19 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class ClusterCaTest method testRemoveOldCertificate.

@ParallelTest
public void testRemoveOldCertificate() {
    // simulate certificate creation at following time, with expire at 365 days later (by default)
    String instantExpected = "2022-03-23T09:00:00Z";
    Clock clock = Clock.fixed(Instant.parse(instantExpected), UTC);
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(clock), new PasswordGenerator(10, "a", "a"), cluster, null, null);
    clusterCa.setClock(clock);
    clusterCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    assertThat(clusterCa.caCertSecret().getData().size(), is(3));
    // force key replacement so certificate renewal ...
    Secret caKeySecretWithReplaceAnno = new SecretBuilder(clusterCa.caKeySecret()).editMetadata().addToAnnotations(Ca.ANNO_STRIMZI_IO_FORCE_REPLACE, "true").endMetadata().build();
    // ... simulated at the following time, with expire at 365 days later (by default)
    instantExpected = "2022-03-23T11:00:00Z";
    clock = Clock.fixed(Instant.parse(instantExpected), UTC);
    clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(clock), new PasswordGenerator(10, "a", "a"), cluster, clusterCa.caCertSecret(), caKeySecretWithReplaceAnno);
    clusterCa.setClock(clock);
    clusterCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    assertThat(clusterCa.caCertSecret().getData().size(), is(4));
    assertThat(clusterCa.caCertSecret().getData().containsKey("ca-2023-03-23T09-00-00Z.crt"), is(true));
    clusterCa.maybeDeleteOldCerts();
    assertThat(clusterCa.caCertSecret().getData().size(), is(3));
    assertThat(clusterCa.caCertSecret().getData().containsKey("ca-2023-03-23T09-00-00Z.crt"), is(false));
}

Example 20 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class ZookeeperClusterTest method generateCertificatesSecret.

private Secret generateCertificatesSecret() {
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), cluster, null, null);
    clusterCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    return zc.generateCertificatesSecret(clusterCa, true);
}