test: Test snapshots in S3

tests/templates/kuttl/ldap/30-test-opensearch.yaml

@@ -22,6 +22,10 @@ spec:
             # required for pip install
             - name: HOME
               value: /stackable
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
           volumeMounts:
             - name: script
               mountPath: /stackable/scripts
@@ -68,9 +72,12 @@ metadata:
   name: test-opensearch
 data:
   test.py: |
+    import os
     from opensearchpy import OpenSearch
 
-    host = 'opensearch'
+    namespace = os.environ['NAMESPACE']
+
+    host = f'opensearch.{namespace}.svc.cluster.local'
     port = 9200
     auth = ('integrationtest', 'integrationtest')
     ca_certs_path = '/stackable/tls/ca.crt'
@@ -81,8 +88,6 @@ data:
         http_auth = auth,
         use_ssl = True,
         verify_certs = True,
-        ssl_assert_hostname = False,
-        ssl_show_warn = False,
         ca_certs = ca_certs_path
     )
 

tests/templates/kuttl/metrics/20-install-opensearch.yaml.j2

@@ -27,7 +27,7 @@ spec:
             storage:
               data:
                 capacity: 100Mi
-          listenerClass: external-stable
+          listenerClass: external-unstable
         replicas: 3
     configOverrides:
       opensearch.yml:

tests/templates/kuttl/opensearch-dashboards/10-install-opensearch.yaml.j2

@@ -23,7 +23,7 @@ spec:
     roleGroups:
       default:
         config:
-          listenerClass: external-stable
+          listenerClass: external-unstable
         replicas: 1
         podOverrides:
           spec:

tests/templates/kuttl/smoke/10-assert.yaml.j2

@@ -869,7 +869,7 @@ metadata:
     kind: OpenSearchCluster
     name: opensearch
 spec:
-  className: external-stable
+  className: external-unstable
   extraPodSelectorLabels: {}
   ports:
   - name: http

tests/templates/kuttl/smoke/10-install-opensearch.yaml.j2

@@ -29,7 +29,7 @@ spec:
             storage:
               data:
                 capacity: 100Mi
-          listenerClass: external-stable
+          listenerClass: external-unstable
         replicas: 3
         podOverrides:
           spec:

tests/templates/kuttl/smoke/20-test-opensearch.yaml

@@ -22,6 +22,10 @@ spec:
             # required for pip install
             - name: HOME
               value: /stackable
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
           volumeMounts:
             - name: script
               mountPath: /stackable/scripts
@@ -70,9 +74,12 @@ data:
   test.py: |
     # https://docs.opensearch.org/docs/latest/clients/python-low-level/#sample-program
 
+    import os
     from opensearchpy import OpenSearch
 
-    host = 'opensearch'
+    namespace = os.environ['NAMESPACE']
+
+    host = f'opensearch.{namespace}.svc.cluster.local'
     port = 9200
     auth = ('admin', 'AJVFsGJBbpT6mChn') # For testing only. Don't store credentials in code.
     ca_certs_path = '/stackable/tls/ca.crt'
@@ -84,8 +91,6 @@ data:
         http_auth = auth,
         use_ssl = True,
         verify_certs = True,
-        ssl_assert_hostname = False,
-        ssl_show_warn = False,
         ca_certs = ca_certs_path
     )
 

tests/templates/kuttl/snapshot-s3/00-patch-ns.yaml

@@ -0,0 +1,15 @@
+# see https://github.com/stackabletech/issues/issues/566
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      kubectl patch namespace $NAMESPACE --patch='
+        {
+          "metadata": {
+            "labels": {
+              "pod-security.kubernetes.io/enforce": "privileged"
+            }
+          }
+        }'
+    timeout: 120

tests/templates/kuttl/snapshot-s3/01-rbac.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test-service-account
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: test-role
+rules:
+  - apiGroups:
+      - security.openshift.io
+    resources:
+      - securitycontextconstraints
+    resourceNames:
+      - privileged
+    verbs:
+      - use
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: test-role-binding
+subjects:
+  - kind: ServiceAccount
+    name: test-service-account
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: test-role

tests/templates/kuttl/snapshot-s3/02-assert.yaml.j2

@@ -0,0 +1,10 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vector-aggregator-discovery
+{% endif %}

tests/templates/kuttl/snapshot-s3/02-install-vector-aggregator-discovery-config-map.yaml.j2

@@ -0,0 +1,9 @@
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vector-aggregator-discovery
+data:
+  ADDRESS: {{ lookup('env', 'VECTOR_AGGREGATOR') }}
+{% endif %}

tests/templates/kuttl/snapshot-s3/10-assert.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials

tests/templates/kuttl/snapshot-s3/10-install-s3-credentials-secret.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-credentials
+stringData:
+  s3.client.default.access_key: opensearchAccessKey
+  s3.client.default.secret_key: opensearchSecretKey

tests/templates/kuttl/snapshot-s3/11-assert.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 600
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minio
+status:
+  readyReplicas: 1
+  replicas: 1

tests/templates/kuttl/snapshot-s3/11-install-minio.yaml.j2

@@ -0,0 +1,10 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: >-
+      helm install minio oci://registry-1.docker.io/bitnamicharts/minio
+      --version 17.0.21
+      --values 11_minio-values.yaml
+      --namespace $NAMESPACE
+    timeout: 240

tests/templates/kuttl/snapshot-s3/11_minio-values.yaml.j2

@@ -0,0 +1,60 @@
+---
+global:
+  security:
+    allowInsecureImages: true
+
+image:
+  repository: bitnamilegacy/minio
+
+defaultInitContainers:
+  volumePermissions:
+    image:
+      repository: bitnamilegacy/os-shell
+
+console:
+  image:
+    repository: bitnamilegacy/minio-object-browser
+
+persistence:
+  enabled: false # "false" means, that an emptyDir is used instead of a persistentVolumeClaim
+  size: 64Mi
+
+provisioning:
+  enabled: true
+  buckets:
+    - name: opensearch
+  users:
+    - username: integrationtest
+      password: integrationtest
+      policies:
+        - readwrite
+        - consoleAdmin
+        - diagnostics
+  extraCommands:
+    - >-
+      mc admin user svcacct add
+      --access-key "$(cat /tmp/s3-credentials/s3.client.default.access_key)"
+      --secret-key "$(cat /tmp/s3-credentials/s3.client.default.secret_key)"
+      provisioning integrationtest
+  extraVolumeMounts:
+    - name: s3-credentials
+      mountPath: /tmp/s3-credentials
+  extraVolumes:
+    - name: s3-credentials
+      secret:
+        secretName: s3-credentials
+  resources:
+    requests:
+      memory: 1Gi
+      cpu: 512m
+    limits:
+      memory: 1Gi
+      cpu: "1"
+
+resources:
+  requests:
+    memory: 1Gi
+    cpu: 512m
+  limits:
+    memory: 1Gi
+    cpu: "1"

tests/templates/kuttl/snapshot-s3/20-assert.yaml.j2

@@ -0,0 +1,12 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 600
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: opensearch-nodes-default
+status:
+  readyReplicas: 1
+  replicas: 1