Skip to content

Commit 1aa9de9

Browse files
JasonPowrJasonPowr
committed
fix: refactor
1 parent 1b75c93 commit 1aa9de9

21 files changed

+136
-82
lines changed

‎internal/controller/tsa/actions/generate_signer.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ func (g generateSigner) Handle(ctx context.Context, instance *v1alpha1.Timestamp
220220
return g.StatusUpdate(ctx, instance)
221221
}
222222

223-
func (g generateSigner) handleSignerKeys(instance *v1alpha1.TimestampAuthority, config *tsaUtils.TsaCertChainConfig) (*tsaUtils.TsaCertChainConfig, error) {
223+
func (g generateSigner) handleSignerKeys(instance *v1alpha1.TimestampAuthority, config *tsaUtils.TsaCertChainConfig) (*tsaUtils.TsaCertChainConfig, error) { //nolint:gocyclo
224224
if instance.Spec.Signer.File != nil {
225225
if instance.Spec.Signer.File.PrivateKeyRef != nil {
226226
key, err := kubernetes.GetSecretData(g.Client, instance.Namespace, instance.Spec.Signer.File.PrivateKeyRef)

‎internal/controller/tsa/actions/generate_signer_test.go‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"github.com/securesign/operator/internal/constants"
1111
"github.com/securesign/operator/internal/labels"
1212
cryptoutil "github.com/securesign/operator/internal/utils/crypto"
13+
fipsTest "github.com/securesign/operator/internal/utils/crypto/test"
1314
"github.com/securesign/operator/internal/utils/kubernetes"
1415
"github.com/securesign/operator/test/e2e/support"
1516
"github.com/securesign/operator/test/e2e/support/tas/tsa"
@@ -189,7 +190,7 @@ func Test_SignerHandle(t *testing.T) {
189190
},
190191
}
191192

192-
secret := tsa.CreateSecrets(instance.Namespace, "tsa-test-secret", elliptic.P256())
193+
secret := tsa.CreateSecrets(instance.Namespace, "tsa-test-secret")
193194
return common.TsaTestSetup(instance, t, nil, NewGenerateSignerAction(), secret)
194195
},
195196
testCase: func(g Gomega, a action.Action[*rhtasv1alpha1.TimestampAuthority], client client.WithWatch, instance *rhtasv1alpha1.TimestampAuthority) bool {
@@ -236,10 +237,7 @@ func Test_SignerHandle(t *testing.T) {
236237
},
237238
},
238239
}
239-
_, priv, _, err := support.CreateCertificates(elliptic.P224(), true)
240-
if err != nil {
241-
t.Fatalf("failed to create test certificates: %v", err)
242-
}
240+
priv := fipsTest.GenerateECPrivateKeyPEM(t, elliptic.P224())
243241
secret := &v1.Secret{
244242
ObjectMeta: metav1.ObjectMeta{
245243
Name: "tsa-invalid-secret",
@@ -295,7 +293,7 @@ func Test_SignerHandle(t *testing.T) {
295293
},
296294
},
297295
}
298-
secret := tsa.CreateSecrets(instance.Namespace, "tsa-test-secret", elliptic.P256())
296+
secret := tsa.CreateSecrets(instance.Namespace, "tsa-test-secret")
299297
return common.TsaTestSetup(instance, t, nil, NewGenerateSignerAction(), secret)
300298
},
301299
testCase: func(g Gomega, a action.Action[*rhtasv1alpha1.TimestampAuthority], client client.WithWatch, instance *rhtasv1alpha1.TimestampAuthority) bool {
@@ -366,8 +364,8 @@ func Test_SignerHandle(t *testing.T) {
366364
},
367365
}
368366

369-
secret := tsa.CreateSecrets(instance.Namespace, "tsa-test-secret", elliptic.P256())
370-
old := tsa.CreateSecrets(instance.Namespace, "old", elliptic.P256())
367+
secret := tsa.CreateSecrets(instance.Namespace, "tsa-test-secret")
368+
old := tsa.CreateSecrets(instance.Namespace, "old")
371369
old.Annotations = generateSecretAnnotations(*instance.Status.Signer)
372370
return common.TsaTestSetup(instance, t, nil, NewGenerateSignerAction(), secret, old)
373371
},
@@ -435,7 +433,7 @@ func Test_SignerHandle(t *testing.T) {
435433
},
436434
}
437435

438-
old := tsa.CreateSecrets(instance.Namespace, "old", elliptic.P256())
436+
old := tsa.CreateSecrets(instance.Namespace, "old")
439437
old.Annotations = generateSecretAnnotations(*instance.Status.Signer)
440438
return common.TsaTestSetup(instance, t, nil, NewGenerateSignerAction(), old)
441439
},
@@ -479,7 +477,7 @@ func Test_SignerHandle(t *testing.T) {
479477
},
480478
}
481479

482-
secret := tsa.CreateSecrets(instance.Namespace, "secret", elliptic.P256())
480+
secret := tsa.CreateSecrets(instance.Namespace, "secret")
483481
secret.Annotations = generateSecretAnnotations(instance.Spec.Signer)
484482
secret.Labels = map[string]string{TSACertCALabel: "fake"}
485483
return common.TsaTestSetup(instance, t, nil, NewGenerateSignerAction(), secret)

‎internal/controller/tsa/tsa_hot_update_test.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ limitations under the License.
1818

1919
import (
2020
"context"
21-
"crypto/elliptic"
2221
"time"
2322

2423
"github.com/securesign/operator/internal/constants"
@@ -188,7 +187,7 @@ var _ = Describe("Timestamp Authority hot update", func() {
188187
}).Should(Equal(constants.Pending))
189188

190189
By("Creating new certificate chain and signer keys")
191-
secret := tsa.CreateSecrets(Namespace, "tsa-test-secret", elliptic.P256())
190+
secret := tsa.CreateSecrets(Namespace, "tsa-test-secret")
192191
Expect(suite.Client().Create(context.TODO(), secret)).NotTo(HaveOccurred())
193192

194193
By("Status field changed for cert chain")

‎test/e2e/fips/ctlog_signer_test.go‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,13 @@ package fips
44

55
import (
66
"crypto/elliptic"
7+
"testing"
78

89
. "github.com/onsi/ginkgo/v2"
910
. "github.com/onsi/gomega"
1011
"github.com/securesign/operator/api/v1alpha1"
1112
ctlogactions "github.com/securesign/operator/internal/controller/ctlog/actions"
13+
fipsTest "github.com/securesign/operator/internal/utils/crypto/test"
1214
"github.com/securesign/operator/test/e2e/support"
1315
"github.com/securesign/operator/test/e2e/support/steps"
1416
"github.com/securesign/operator/test/e2e/support/tas/ctlog"
@@ -18,6 +20,7 @@ import (
1820
"github.com/securesign/operator/test/e2e/support/tas/tsa"
1921
v1 "k8s.io/api/core/v1"
2022
"k8s.io/apimachinery/pkg/api/meta"
23+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2124
"k8s.io/apimachinery/pkg/types"
2225
)
2326

@@ -80,11 +83,11 @@ var _ = Describe("Securesign FIPS - ctlog signer test", Ordered, func() {
8083

8184
Describe("Reject non-FIPS ctlog key then accept FIPS-compliant key", func() {
8285
BeforeAll(func(ctx SpecContext) {
83-
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret", elliptic.P224()))).To(Succeed())
84-
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-tuf-secret", elliptic.P256()))).To(Succeed())
85-
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret", elliptic.P256()))).To(Succeed())
86-
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret", elliptic.P256()))).To(Succeed())
87-
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret", elliptic.P256()))).To(Succeed())
86+
Expect(cli.Create(ctx, createCustomCtlogSecret(namespace.Name, "my-ctlog-secret"))).To(Succeed())
87+
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-tuf-secret"))).To(Succeed())
88+
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret"))).To(Succeed())
89+
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret"))).To(Succeed())
90+
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret"))).To(Succeed())
8891
Expect(cli.Create(ctx, s)).To(Succeed())
8992
})
9093

@@ -120,3 +123,18 @@ var _ = Describe("Securesign FIPS - ctlog signer test", Ordered, func() {
120123
})
121124
})
122125
})
126+
127+
func createCustomCtlogSecret(ns string, name string) *v1.Secret {
128+
private := fipsTest.GenerateECPrivateKeyPEM(&testing.T{}, elliptic.P224())
129+
public := fipsTest.GenerateECPublicKeyPEM(&testing.T{}, elliptic.P224())
130+
return &v1.Secret{
131+
ObjectMeta: metav1.ObjectMeta{
132+
Name: name,
133+
Namespace: ns,
134+
},
135+
Data: map[string][]byte{
136+
"private": private,
137+
"public": public,
138+
},
139+
}
140+
}

‎test/e2e/fips/fulcio_cert_test.go‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ package fips
44

55
import (
66
"crypto/elliptic"
7+
"testing"
78

89
. "github.com/onsi/ginkgo/v2"
910
. "github.com/onsi/gomega"
1011
"github.com/securesign/operator/api/v1alpha1"
1112
"github.com/securesign/operator/internal/constants"
1213
fulcioactions "github.com/securesign/operator/internal/controller/fulcio/actions"
14+
fipsTest "github.com/securesign/operator/internal/utils/crypto/test"
1315
"github.com/securesign/operator/test/e2e/support"
1416
"github.com/securesign/operator/test/e2e/support/steps"
1517
"github.com/securesign/operator/test/e2e/support/tas/ctlog"
@@ -19,6 +21,7 @@ import (
1921
"github.com/securesign/operator/test/e2e/support/tas/tsa"
2022
v1 "k8s.io/api/core/v1"
2123
"k8s.io/apimachinery/pkg/api/meta"
24+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2225
"k8s.io/apimachinery/pkg/types"
2326
)
2427

@@ -81,11 +84,11 @@ var _ = Describe("Securesign FIPS - fulcio cert test", Ordered, func() {
8184

8285
Describe("Reject non-FIPS fulcio key and cert then accept FIPS-compliant key and cert", func() {
8386
BeforeAll(func(ctx SpecContext) {
84-
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret", elliptic.P256()))).To(Succeed())
85-
Expect(cli.Create(ctx, fulciohelpers.CreateSecret(namespace.Name, "my-fulcio-secret", elliptic.P224()))).To(Succeed())
86-
Expect(cli.Create(ctx, fulciohelpers.CreateSecret(namespace.Name, "my-fulcio-tuf-secret", elliptic.P256()))).To(Succeed())
87-
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret", elliptic.P256()))).To(Succeed())
88-
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret", elliptic.P256()))).To(Succeed())
87+
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret"))).To(Succeed())
88+
Expect(cli.Create(ctx, createCustomFulcioSecret(namespace.Name, "my-fulcio-secret"))).To(Succeed())
89+
Expect(cli.Create(ctx, fulciohelpers.CreateSecret(namespace.Name, "my-fulcio-tuf-secret"))).To(Succeed())
90+
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret"))).To(Succeed())
91+
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret"))).To(Succeed())
8992
Expect(cli.Create(ctx, s)).To(Succeed())
9093
})
9194

@@ -132,3 +135,20 @@ var _ = Describe("Securesign FIPS - fulcio cert test", Ordered, func() {
132135
})
133136

134137
})
138+
139+
func createCustomFulcioSecret(ns, name string) *v1.Secret {
140+
priv := fipsTest.GenerateECPrivateKeyPEM(&testing.T{}, elliptic.P224())
141+
cert := fipsTest.GenerateECCertificatePEM(&testing.T{}, elliptic.P224())
142+
143+
return &v1.Secret{
144+
ObjectMeta: metav1.ObjectMeta{
145+
Name: name,
146+
Namespace: ns,
147+
},
148+
Data: map[string][]byte{
149+
"password": []byte(support.CertPassword),
150+
"private": priv,
151+
"cert": cert,
152+
},
153+
}
154+
}

‎test/e2e/fips/rekor_signer_test.go‎

Lines changed: 23 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ package fips
44

55
import (
66
"crypto/elliptic"
7+
"testing"
78

89
. "github.com/onsi/ginkgo/v2"
910
. "github.com/onsi/gomega"
1011
"github.com/securesign/operator/api/v1alpha1"
1112
"github.com/securesign/operator/internal/constants"
1213
rekoractions "github.com/securesign/operator/internal/controller/rekor/actions"
14+
fipsTest "github.com/securesign/operator/internal/utils/crypto/test"
1315
"github.com/securesign/operator/test/e2e/support"
1416
"github.com/securesign/operator/test/e2e/support/steps"
1517
"github.com/securesign/operator/test/e2e/support/tas/ctlog"
@@ -19,6 +21,7 @@ import (
1921
"github.com/securesign/operator/test/e2e/support/tas/tsa"
2022
v1 "k8s.io/api/core/v1"
2123
"k8s.io/apimachinery/pkg/api/meta"
24+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2225
"k8s.io/apimachinery/pkg/types"
2326
)
2427

@@ -82,11 +85,11 @@ var _ = Describe("Securesign FIPS - rekor signer test", Ordered, func() {
8285

8386
Describe("Reject non-FIPS Rekor private key then accept FIPS-compliant key", func() {
8487
BeforeAll(func(ctx SpecContext) {
85-
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret", elliptic.P256()))).To(Succeed())
86-
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret", elliptic.P256()))).To(Succeed())
87-
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret", elliptic.P224()))).To(Succeed())
88-
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-tuf-rekor-secret", elliptic.P256()))).To(Succeed())
89-
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret", elliptic.P256()))).To(Succeed())
88+
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret"))).To(Succeed())
89+
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret"))).To(Succeed())
90+
Expect(cli.Create(ctx, createCustomRekorSecret(namespace.Name, "my-rekor-secret"))).To(Succeed())
91+
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-tuf-rekor-secret"))).To(Succeed())
92+
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret"))).To(Succeed())
9093
Expect(cli.Create(ctx, s)).To(Succeed())
9194
})
9295

@@ -121,3 +124,18 @@ var _ = Describe("Securesign FIPS - rekor signer test", Ordered, func() {
121124
})
122125

123126
})
127+
128+
func createCustomRekorSecret(ns string, name string) *v1.Secret {
129+
private := fipsTest.GenerateECPrivateKeyPEM(&testing.T{}, elliptic.P224())
130+
public := fipsTest.GenerateECPublicKeyPEM(&testing.T{}, elliptic.P224())
131+
return &v1.Secret{
132+
ObjectMeta: metav1.ObjectMeta{
133+
Name: name,
134+
Namespace: ns,
135+
},
136+
Data: map[string][]byte{
137+
"private": private,
138+
"public": public,
139+
},
140+
}
141+
}

‎test/e2e/fips/tsa_cert_chain_test.go‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ package fips
44

55
import (
66
"crypto/elliptic"
7+
"testing"
78

89
. "github.com/onsi/ginkgo/v2"
910
. "github.com/onsi/gomega"
1011
"github.com/securesign/operator/api/v1alpha1"
1112
"github.com/securesign/operator/internal/constants"
1213
tsaactions "github.com/securesign/operator/internal/controller/tsa/actions"
14+
fipsTest "github.com/securesign/operator/internal/utils/crypto/test"
1315
"github.com/securesign/operator/test/e2e/support"
1416
"github.com/securesign/operator/test/e2e/support/steps"
1517
"github.com/securesign/operator/test/e2e/support/tas/ctlog"
@@ -19,6 +21,7 @@ import (
1921
"github.com/securesign/operator/test/e2e/support/tas/tsa"
2022
v1 "k8s.io/api/core/v1"
2123
"k8s.io/apimachinery/pkg/api/meta"
24+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2225
"k8s.io/apimachinery/pkg/types"
2326
)
2427

@@ -82,11 +85,11 @@ var _ = Describe("Securesign FIPS - TSA Cert chain", Ordered, func() {
8285

8386
Describe("Reject non-FIPS TSA Cert chain and key then accept FIPS-compliant key", func() {
8487
BeforeAll(func(ctx SpecContext) {
85-
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret", elliptic.P256()))).To(Succeed())
86-
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret", elliptic.P256()))).To(Succeed())
87-
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret", elliptic.P256()))).To(Succeed())
88-
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tuf-tsa-secret", elliptic.P256()))).To(Succeed())
89-
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret", elliptic.P224()))).To(Succeed())
88+
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret"))).To(Succeed())
89+
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret"))).To(Succeed())
90+
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret"))).To(Succeed())
91+
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tuf-tsa-secret"))).To(Succeed())
92+
Expect(cli.Create(ctx, createCustomTsaSecret(namespace.Name, "test-tsa-secret"))).To(Succeed())
9093
Expect(cli.Create(ctx, s)).To(Succeed())
9194
})
9295

@@ -133,3 +136,20 @@ var _ = Describe("Securesign FIPS - TSA Cert chain", Ordered, func() {
133136
})
134137
})
135138
})
139+
140+
func createCustomTsaSecret(ns, name string) *v1.Secret {
141+
leafPriv := fipsTest.GenerateECPrivateKeyPEM(&testing.T{}, elliptic.P224())
142+
chain := fipsTest.GenerateECCertificatePEM(&testing.T{}, elliptic.P256())
143+
144+
return &v1.Secret{
145+
ObjectMeta: metav1.ObjectMeta{
146+
Name: name,
147+
Namespace: ns,
148+
},
149+
Data: map[string][]byte{
150+
"leafPrivateKey": leafPriv,
151+
"leafPrivateKeyPassword": []byte(support.CertPassword),
152+
"certificateChain": chain,
153+
},
154+
}
155+
}

‎test/e2e/fulcio_key_rotation_test.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
package e2e
44

55
import (
6-
"crypto/elliptic"
76
"os"
87
"os/exec"
98
"path/filepath"
@@ -85,7 +84,7 @@ var _ = Describe("Fulcio cert rotation test", Ordered, func() {
8584

8685
It("Update fulcio cert", func(ctx SpecContext) {
8786
secretName := "new-fulcio-cert"
88-
newCert = fulcio.CreateSecret(namespace.Name, secretName, elliptic.P256())
87+
newCert = fulcio.CreateSecret(namespace.Name, secretName)
8988
Expect(cli.Create(ctx, newCert)).To(Succeed())
9089

9190
Eventually(func(g Gomega) error {

‎test/e2e/key_autodiscovery_test.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33
package e2e
44

55
import (
6-
"crypto/elliptic"
7-
86
"github.com/securesign/operator/internal/utils/kubernetes"
97
"github.com/securesign/operator/test/e2e/support/steps"
108
"github.com/securesign/operator/test/e2e/support/tas/securesign"
@@ -47,10 +45,10 @@ var _ = Describe("Securesign key autodiscovery test", Ordered, func() {
4745

4846
Describe("Install with provided certificates", func() {
4947
BeforeAll(func(ctx SpecContext) {
50-
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret", elliptic.P256()))).To(Succeed())
51-
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret", elliptic.P256()))).To(Succeed())
52-
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret", elliptic.P256()))).To(Succeed())
53-
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret", elliptic.P256()))).To(Succeed())
48+
Expect(cli.Create(ctx, ctlog.CreateSecret(namespace.Name, "my-ctlog-secret"))).To(Succeed())
49+
Expect(cli.Create(ctx, fulcio.CreateSecret(namespace.Name, "my-fulcio-secret"))).To(Succeed())
50+
Expect(cli.Create(ctx, rekor.CreateSecret(namespace.Name, "my-rekor-secret"))).To(Succeed())
51+
Expect(cli.Create(ctx, tsa.CreateSecrets(namespace.Name, "test-tsa-secret"))).To(Succeed())
5452
Expect(cli.Create(ctx, s)).To(Succeed())
5553
})
5654

0 commit comments

Comments
 (0)