Skip to content

Commit 1a13048

Browse files
Karthik-K-NKarthik-K-N
committed
Test changes
1 parent ef4ac8f commit 1a13048

File tree

9 files changed

+94
-48
lines changed

9 files changed

+94
-48
lines changed

‎controlplane/kubeadm/internal/cluster_test.go‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ package internal
1818

1919
import (
2020
"context"
21+
"crypto"
2122
"crypto/rand"
22-
"crypto/rsa"
2323
"crypto/x509"
2424
"crypto/x509/pkix"
2525
"fmt"
@@ -90,10 +90,15 @@ func TestGetWorkloadCluster(t *testing.T) {
9090
}()
9191

9292
// Create an etcd secret with valid certs
93-
key, err := certs.NewPrivateKey()
93+
key, err := certs.NewPrivateKey("")
9494
g.Expect(err).ToNot(HaveOccurred())
95+
9596
cert, err := getTestCACert(key)
9697
g.Expect(err).ToNot(HaveOccurred())
98+
99+
encodedKey, err := certs.EncodePrivateKeyPEM(key)
100+
g.Expect(err).ToNot(HaveOccurred())
101+
97102
etcdSecret := &corev1.Secret{
98103
ObjectMeta: metav1.ObjectMeta{
99104
Name: "my-cluster-etcd",
@@ -104,7 +109,7 @@ func TestGetWorkloadCluster(t *testing.T) {
104109
},
105110
Data: map[string][]byte{
106111
secret.TLSCrtDataName: certs.EncodeCertPEM(cert),
107-
secret.TLSKeyDataName: certs.EncodePrivateKeyPEM(key),
112+
secret.TLSKeyDataName: encodedKey,
108113
},
109114
}
110115
emptyCrtEtcdSecret := etcdSecret.DeepCopy()
@@ -249,7 +254,7 @@ func TestGetWorkloadCluster(t *testing.T) {
249254
})
250255
g.Expect(err).ToNot(HaveOccurred())
251256

252-
workloadCluster, err := m.GetWorkloadCluster(ctx, tt.clusterKey)
257+
workloadCluster, err := m.GetWorkloadCluster(ctx, tt.clusterKey, "")
253258
if tt.expectErr {
254259
g.Expect(err).To(HaveOccurred())
255260
g.Expect(workloadCluster).To(BeNil())
@@ -261,7 +266,7 @@ func TestGetWorkloadCluster(t *testing.T) {
261266
}
262267
}
263268

264-
func getTestCACert(key *rsa.PrivateKey) (*x509.Certificate, error) {
269+
func getTestCACert(key crypto.Signer) (*x509.Certificate, error) {
265270
cfg := certs.Config{
266271
CommonName: "kubernetes",
267272
}

‎controlplane/kubeadm/internal/controllers/controller_test.go‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ package controllers
1818

1919
import (
2020
"context"
21+
"crypto"
2122
"crypto/rand"
22-
"crypto/rsa"
2323
"crypto/x509"
2424
"crypto/x509/pkix"
2525
"fmt"
@@ -813,11 +813,16 @@ func TestKubeadmControlPlaneReconciler_ensureOwnerReferences(t *testing.T) {
813813
cluster.Spec.ControlPlaneEndpoint.Port = 6443
814814
cluster.Status.Initialization.InfrastructureProvisioned = ptr.To(true)
815815
kcp.Spec.Version = "v1.21.0"
816-
key, err := certs.NewPrivateKey()
816+
817+
key, err := certs.NewPrivateKey("")
817818
g.Expect(err).ToNot(HaveOccurred())
819+
818820
crt, err := getTestCACert(key)
819821
g.Expect(err).ToNot(HaveOccurred())
820822

823+
encodedKey, err := certs.EncodePrivateKeyPEM(key)
824+
g.Expect(err).ToNot(HaveOccurred())
825+
821826
clusterSecret := &corev1.Secret{
822827
// The Secret's Type is used by KCP to determine whether it is user-provided.
823828
// clusterv1.ClusterSecretType signals that the Secret is CAPI-provided.
@@ -831,7 +836,7 @@ func TestKubeadmControlPlaneReconciler_ensureOwnerReferences(t *testing.T) {
831836
},
832837
Data: map[string][]byte{
833838
secret.TLSCrtDataName: certs.EncodeCertPEM(crt),
834-
secret.TLSKeyDataName: certs.EncodePrivateKeyPEM(key),
839+
secret.TLSKeyDataName: encodedKey,
835840
},
836841
}
837842

@@ -4108,7 +4113,7 @@ func newCluster(namespacedName *types.NamespacedName) *clusterv1.Cluster {
41084113
}
41094114
}
41104115

4111-
func getTestCACert(key *rsa.PrivateKey) (*x509.Certificate, error) {
4116+
func getTestCACert(key crypto.Signer) (*x509.Certificate, error) {
41124117
cfg := certs.Config{
41134118
CommonName: "kubernetes",
41144119
}

‎controlplane/kubeadm/internal/controllers/fakes_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func (f *fakeManagementCluster) List(ctx context.Context, list client.ObjectList
4949
return f.Reader.List(ctx, list, opts...)
5050
}
5151

52-
func (f *fakeManagementCluster) GetWorkloadCluster(_ context.Context, _ client.ObjectKey) (internal.WorkloadCluster, error) {
52+
func (f *fakeManagementCluster) GetWorkloadCluster(_ context.Context, _ client.ObjectKey, _ bootstrapv1.EncryptionAlgorithmType) (internal.WorkloadCluster, error) {
5353
return f.Workload, f.WorkloadErr
5454
}
5555

‎test/infrastructure/docker/internal/controllers/backends/inmemory/inmemorymachine_controller_test.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ package inmemory
1818

1919
import (
2020
"context"
21+
"crypto"
2122
cryptorand "crypto/rand"
22-
"crypto/rsa"
2323
"crypto/x509"
2424
"crypto/x509/pkix"
2525
"fmt"
@@ -763,6 +763,9 @@ func createCASecret(t *testing.T, cluster *clusterv1.Cluster, purpose secretutil
763763
cert, key, err := newCertificateAuthority()
764764
g.Expect(err).ToNot(HaveOccurred())
765765

766+
encodedKey, err := certs.EncodePrivateKeyPEM(key)
767+
g.Expect(err).ToNot(HaveOccurred())
768+
766769
return &corev1.Secret{
767770
ObjectMeta: metav1.ObjectMeta{
768771
Namespace: cluster.Namespace,
@@ -772,7 +775,7 @@ func createCASecret(t *testing.T, cluster *clusterv1.Cluster, purpose secretutil
772775
},
773776
},
774777
Data: map[string][]byte{
775-
secretutil.TLSKeyDataName: certs.EncodePrivateKeyPEM(key),
778+
secretutil.TLSKeyDataName: encodedKey,
776779
secretutil.TLSCrtDataName: certs.EncodeCertPEM(cert),
777780
},
778781
Type: clusterv1.ClusterSecretType,
@@ -782,8 +785,8 @@ func createCASecret(t *testing.T, cluster *clusterv1.Cluster, purpose secretutil
782785
// TODO: make this public functions in server/certs.go or in a new util package.
783786

784787
// newCertificateAuthority creates new certificate and private key for the certificate authority.
785-
func newCertificateAuthority() (*x509.Certificate, *rsa.PrivateKey, error) {
786-
key, err := certs.NewPrivateKey()
788+
func newCertificateAuthority() (*x509.Certificate, crypto.Signer, error) {
789+
key, err := certs.NewPrivateKey("")
787790
if err != nil {
788791
return nil, nil, err
789792
}
@@ -797,7 +800,7 @@ func newCertificateAuthority() (*x509.Certificate, *rsa.PrivateKey, error) {
797800
}
798801

799802
// newSelfSignedCACert creates a CA certificate.
800-
func newSelfSignedCACert(key *rsa.PrivateKey) (*x509.Certificate, error) {
803+
func newSelfSignedCACert(key crypto.Signer) (*x509.Certificate, error) {
801804
cfg := certs.Config{
802805
CommonName: "kubernetes",
803806
}

‎test/infrastructure/inmemory/pkg/server/certs.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ limitations under the License.
1717
package server
1818

1919
import (
20-
"crypto/rsa"
20+
"crypto"
2121
"crypto/x509"
2222
"net"
2323

@@ -26,19 +26,19 @@ import (
2626
"sigs.k8s.io/cluster-api/util/certs"
2727
)
2828

29-
var key *rsa.PrivateKey
29+
var key crypto.Signer
3030

3131
func init() {
3232
// Create a private key only once, since this is a slow operation and it is ok
3333
// to reuse it for all the certificates in a test provider.
3434
var err error
35-
key, err = certs.NewPrivateKey()
35+
key, err = certs.NewPrivateKey("")
3636
if err != nil {
3737
panic(errors.Wrap(err, "unable to create private key").Error())
3838
}
3939
}
4040

41-
func newCertAndKey(caCert *x509.Certificate, caKey *rsa.PrivateKey, config *certs.Config) (*x509.Certificate, *rsa.PrivateKey, error) {
41+
func newCertAndKey(caCert *x509.Certificate, caKey crypto.Signer, config *certs.Config) (*x509.Certificate, crypto.Signer, error) {
4242
cert, err := config.NewSignedCert(key, caCert, caKey)
4343
if err != nil {
4444
return nil, nil, errors.Wrap(err, "unable to create certificate")

‎test/infrastructure/inmemory/pkg/server/listener.go‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ limitations under the License.
1717
package server
1818

1919
import (
20-
"crypto/rsa"
20+
"crypto"
2121
"crypto/tls"
2222
"crypto/x509"
2323
"fmt"
@@ -45,11 +45,11 @@ type WorkloadClusterListener struct {
4545

4646
apiServers sets.Set[string]
4747
apiServerCaCertificate *x509.Certificate
48-
apiServerCaKey *rsa.PrivateKey
48+
apiServerCaKey crypto.Signer
4949
apiServerServingCertificate *tls.Certificate
5050

5151
adminCertificate *x509.Certificate
52-
adminKey *rsa.PrivateKey
52+
adminKey crypto.Signer
5353

5454
etcdMembers sets.Set[string]
5555
etcdServingCertificates map[string]*tls.Certificate
@@ -84,6 +84,11 @@ func (s *WorkloadClusterListener) HostPort() string {
8484

8585
// RESTConfig returns the rest config for a WorkloadClusterListener.
8686
func (s *WorkloadClusterListener) RESTConfig() (*rest.Config, error) {
87+
encodedKey, err := certs.EncodePrivateKeyPEM(s.adminKey)
88+
if err != nil {
89+
return nil, err
90+
}
91+
8792
kubeConfig := clientcmdapi.Config{
8893
Clusters: map[string]*clientcmdapi.Cluster{
8994
"in-memory": {
@@ -95,7 +100,7 @@ func (s *WorkloadClusterListener) RESTConfig() (*rest.Config, error) {
95100
"in-memory": {
96101
Username: "in-memory",
97102
ClientCertificateData: certs.EncodeCertPEM(s.adminCertificate), // TODO: convert to PEM
98-
ClientKeyData: certs.EncodePrivateKeyPEM(s.adminKey), // TODO: convert to PEM
103+
ClientKeyData: encodedKey, // TODO: convert to PEM
99104
},
100105
},
101106
Contexts: map[string]*clientcmdapi.Context{

‎test/infrastructure/inmemory/pkg/server/mux.go‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ package server
1818

1919
import (
2020
"context"
21-
"crypto/rsa"
21+
"crypto"
2222
"crypto/tls"
2323
"crypto/x509"
2424
"fmt"
@@ -387,7 +387,7 @@ func (m *WorkloadClustersMux) WorkloadClusterByResourceGroup(resouceGroup string
387387
// AddAPIServer mimics adding an API server instance behind the WorkloadClusterListener.
388388
// When the first API server instance is added the serving certificates and the admin certificate
389389
// for tests are generated, and the listener is started.
390-
func (m *WorkloadClustersMux) AddAPIServer(wclName, podName string, caCert *x509.Certificate, caKey *rsa.PrivateKey) error {
390+
func (m *WorkloadClustersMux) AddAPIServer(wclName, podName string, caCert *x509.Certificate, caKey crypto.Signer) error {
391391
// Start server
392392
// Note: It is important that we unlock once the server is started. Because otherwise the server
393393
// doesn't work yet as GetCertificate (which is required for the tls handshake) also requires the lock.
@@ -420,7 +420,12 @@ func (m *WorkloadClustersMux) AddAPIServer(wclName, podName string, caCert *x509
420420
return errors.Wrapf(err, "failed to create serving certificate for API server %s", podName)
421421
}
422422

423-
certificate, err := tls.X509KeyPair(certs.EncodeCertPEM(cert), certs.EncodePrivateKeyPEM(key))
423+
encodedKey, err := certs.EncodePrivateKeyPEM(key)
424+
if err != nil {
425+
return errors.Wrapf(err, "failed to encode private key for API server %s", podName)
426+
}
427+
428+
certificate, err := tls.X509KeyPair(certs.EncodeCertPEM(cert), encodedKey)
424429
if err != nil {
425430
return errors.Wrapf(err, "failed to create X509KeyPair for API server %s", podName)
426431
}
@@ -533,7 +538,7 @@ func (m *WorkloadClustersMux) HasAPIServer(wclName, podName string) bool {
533538
// AddEtcdMember mimics adding an etcd Member behind the WorkloadClusterListener;
534539
// every etcd member gets a dedicated serving certificate, so it will be possible to serve port forward requests
535540
// to a specific etcd pod/member.
536-
func (m *WorkloadClustersMux) AddEtcdMember(wclName, podName string, caCert *x509.Certificate, caKey *rsa.PrivateKey) error {
541+
func (m *WorkloadClustersMux) AddEtcdMember(wclName, podName string, caCert *x509.Certificate, caKey crypto.Signer) error {
537542
m.lock.Lock()
538543
defer m.lock.Unlock()
539544

@@ -552,7 +557,12 @@ func (m *WorkloadClustersMux) AddEtcdMember(wclName, podName string, caCert *x50
552557
return errors.Wrapf(err, "failed to create serving certificate for etcd member %s", podName)
553558
}
554559

555-
certificate, err := tls.X509KeyPair(certs.EncodeCertPEM(cert), certs.EncodePrivateKeyPEM(key))
560+
encodedKey, err := certs.EncodePrivateKeyPEM(key)
561+
if err != nil {
562+
return err
563+
}
564+
565+
certificate, err := tls.X509KeyPair(certs.EncodeCertPEM(cert), encodedKey)
556566
if err != nil {
557567
return errors.Wrapf(err, "failed to create X509KeyPair for etcd member %s", podName)
558568
}

‎test/infrastructure/inmemory/pkg/server/mux_test.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ package server
1818

1919
import (
2020
"context"
21+
"crypto"
2122
cryptorand "crypto/rand"
22-
"crypto/rsa"
2323
"crypto/tls"
2424
"crypto/x509"
2525
"crypto/x509/pkix"
@@ -351,7 +351,10 @@ func TestAPI_PortForward(t *testing.T) {
351351
cert, key, err := newCertAndKey(etcdCert, etcdKey, config)
352352
g.Expect(err).ToNot(HaveOccurred())
353353

354-
clientCert, err := tls.X509KeyPair(certs.EncodeCertPEM(cert), certs.EncodePrivateKeyPEM(key))
354+
encodedKey, err := certs.EncodePrivateKeyPEM(key)
355+
g.Expect(err).ToNot(HaveOccurred())
356+
357+
clientCert, err := tls.X509KeyPair(certs.EncodeCertPEM(cert), encodedKey)
355358
g.Expect(err).ToNot(HaveOccurred())
356359

357360
p2 := inmemoryproxy.Proxy{
@@ -533,8 +536,8 @@ func setupWorkloadClusterListener(g Gomega, ports CustomPorts) (*WorkloadCluster
533536
}
534537

535538
// newCertificateAuthority creates new certificate and private key for the certificate authority.
536-
func newCertificateAuthority() (*x509.Certificate, *rsa.PrivateKey, error) {
537-
key, err := certs.NewPrivateKey()
539+
func newCertificateAuthority() (*x509.Certificate, crypto.Signer, error) {
540+
key, err := certs.NewPrivateKey("")
538541
if err != nil {
539542
return nil, nil, err
540543
}
@@ -548,7 +551,7 @@ func newCertificateAuthority() (*x509.Certificate, *rsa.PrivateKey, error) {
548551
}
549552

550553
// newSelfSignedCACert creates a CA certificate.
551-
func newSelfSignedCACert(key *rsa.PrivateKey) (*x509.Certificate, error) {
554+
func newSelfSignedCACert(key crypto.Signer) (*x509.Certificate, error) {
552555
cfg := certs.Config{
553556
CommonName: "kubernetes",
554557
}

0 commit comments

Comments
 (0)