enable more conformance tests

Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>

conformance/framework/helper/validation/certificates/certificates.go

@@ -114,6 +114,23 @@ func ExpectCertificateOrganizationToMatch(certificate *cmapi.Certificate, secret
  }
 
  expectedOrganization := pki.OrganizationForCertificate(certificate)
+ if certificate.Spec.LiteralSubject != "" {
+ sequence, err := pki.UnmarshalSubjectStringToRDNSequence(certificate.Spec.LiteralSubject)
+ if err != nil {
+ return err
+ }
+
+ for _, rdns := range sequence {
+ for _, atv := range rdns {
+ if atv.Type.Equal(pki.OIDConstants.Organization) {
+ if str, ok := atv.Value.(string); ok {
+ expectedOrganization = append(expectedOrganization, str)
+ }
+ }
+ }
+ }
+ }
+
  if !util.EqualUnsorted(cert.Subject.Organization, expectedOrganization) {
  return fmt.Errorf("Expected certificate valid for O %v, but got a certificate valid for O %v", expectedOrganization, cert.Subject.Organization)
  }

conformance/framework/helper/validation/certificatesigningrequests/certificatesigningrequests.go

@@ -323,21 +323,13 @@ func ExpectValidBasicConstraints(csr *certificatesv1.CertificateSigningRequest,
  return err
  }
 
- markedIsCA := false
- if csr.Annotations[experimentalapi.CertificateSigningRequestIsCAAnnotationKey] == "true" {
- markedIsCA = true
- }
+ markedIsCA := csr.Annotations[experimentalapi.CertificateSigningRequestIsCAAnnotationKey] == "true"
 
  if cert.IsCA != markedIsCA {
  return fmt.Errorf("requested certificate does not match expected IsCA, exp=%t got=%t",
  markedIsCA, cert.IsCA)
  }
 
- hasCertSign := (cert.KeyUsage & x509.KeyUsageCertSign) == x509.KeyUsageCertSign
- if hasCertSign != markedIsCA {
- return fmt.Errorf("Expected certificate to have KeyUsageCertSign=%t, but got=%t", markedIsCA, hasCertSign)
- }
-
  return nil
 }
 

go.mod

@@ -15,11 +15,12 @@ require (
  k8s.io/apiextensions-apiserver v0.27.3
  k8s.io/apimachinery v0.27.3
  k8s.io/client-go v0.27.3
+ k8s.io/component-base v0.27.3
  k8s.io/klog/v2 v2.100.1
- k8s.io/kube-aggregator v0.27.1
+ k8s.io/kube-aggregator v0.27.2
  k8s.io/utils v0.0.0-20230505201702-9f6742963106
  sigs.k8s.io/controller-runtime v0.15.0
- sigs.k8s.io/gateway-api v0.6.2
+ sigs.k8s.io/gateway-api v0.7.0
 )
 
 require (
@@ -82,10 +83,7 @@ require (
  gopkg.in/inf.v0 v0.9.1 // indirect
  gopkg.in/yaml.v2 v2.4.0 // indirect
  gopkg.in/yaml.v3 v3.0.1 // indirect
- k8s.io/component-base v0.27.3 // indirect
- k8s.io/kube-aggregator v0.27.2 // indirect
  k8s.io/kube-openapi v0.0.0-20230515203736-54b630e78af5 // indirect
- sigs.k8s.io/gateway-api v0.7.0 // indirect
  sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
  sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
  sigs.k8s.io/yaml v1.3.0 // indirect

internal/testsetups/simple/controller/signer.go

@@ -82,8 +82,7 @@ func (Signer) Sign(ctx context.Context, cr signer.CertificateRequestObject, issu
  NotBefore: time.Now(),
  NotAfter: time.Now().Add(time.Hour * 24 * 180),
 
- KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
- ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+ KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
  BasicConstraintsValid: true,
  }
 

internal/testsetups/simple/e2e/conformance/conformance.go

@@ -26,12 +26,7 @@ var _ = framework.ConformanceDescribe("Certificates", func() {
  kubeClients := testresource.KubeClients(t, ctx)
 
  unsupportedFeatures := featureset.NewFeatureSet(
- featureset.DurationFeature,
- featureset.KeyUsagesFeature,
  featureset.SaveCAToSecret,
- featureset.Ed25519FeatureSet,
- featureset.IssueCAFeature,
- featureset.LiteralSubjectFeature,
  )
 
  issuerBuilder := newIssuerBuilder("SimpleIssuer")
@@ -59,12 +54,7 @@ var _ = framework.ConformanceDescribe("CertificateSigningRequests", func() {
  kubeClients := testresource.KubeClients(t, ctx)
 
  unsupportedFeatures := featureset.NewFeatureSet(
- featureset.DurationFeature,
- featureset.KeyUsagesFeature,
  featureset.SaveCAToSecret,
- featureset.Ed25519FeatureSet,
- featureset.IssueCAFeature,
- featureset.LiteralSubjectFeature,
  )
 
  clusterIssuerBuilder := newIssuerBuilder("SimpleClusterIssuer")
@@ -87,35 +77,18 @@ var _ = framework.ConformanceDescribe("CertificateSigningRequests", func() {
  }).Define()
 })
 
+/*
 var _ = framework.ConformanceDescribe("RBAC", func() {
  t := &mockTest{}
  ctx := testresource.EnsureTestDependencies(t, context.TODO(), testresource.EndToEndTest)
  kubeClients := testresource.KubeClients(t, ctx)
 
- unsupportedFeatures := featureset.NewFeatureSet(
- featureset.DurationFeature,
- featureset.KeyUsagesFeature,
- featureset.SaveCAToSecret,
- featureset.Ed25519FeatureSet,
- featureset.IssueCAFeature,
- featureset.LiteralSubjectFeature,
- )
+ kubeConfig := rest.CopyConfig(kubeClients.Rest)
+ kubeConfig.Impersonate.UserName = "system:serviceaccount:my-namespace:simple-issuer-controller-manager"
+ kubeConfig.Impersonate.Groups = []string{"system:authenticated"}
 
- issuerBuilder := newIssuerBuilder("SimpleIssuer")
- (&certificates.Suite{
- KubeClientConfig: kubeClients.Rest,
- Name: "External Issuer",
- CreateIssuerFunc: issuerBuilder.create,
- DeleteIssuerFunc: issuerBuilder.delete,
- UnsupportedFeatures: unsupportedFeatures,
- }).Define()
-
- clusterIssuerBuilder := newIssuerBuilder("SimpleClusterIssuer")
- (&certificates.Suite{
- KubeClientConfig: kubeClients.Rest,
- Name: "External ClusterIssuer",
- CreateIssuerFunc: clusterIssuerBuilder.create,
- DeleteIssuerFunc: clusterIssuerBuilder.delete,
- UnsupportedFeatures: unsupportedFeatures,
+ (&rbac.Suite{
+ KubeClientConfig: kubeConfig,
  }).Define()
 })
+*/

make/e2e-setup.mk

@@ -78,7 +78,8 @@ e2e-setup-cert-manager: | kind-cluster images $(NEEDS_HELM) $(NEEDS_KUBECTL)
  --namespace cert-manager \
  --repo https://charts.jetstack.io \
  --set installCRDs=true \
- --set featureGates=ServerSideApply=true \
+ --set featureGates="ServerSideApply=true\,LiteralCertificateSubject=true" \
+ --set webhook.featureGates="ServerSideApply=true\,LiteralCertificateSubject=true" \
  --set image.repository=$(quay.io/jetstack/cert-manager-controller.REPO) \
  --set image.tag=$(quay.io/jetstack/cert-manager-controller.TAG) \
  --set image.pullPolicy=Never \