There are end-to-end tests for Kubernetes sidecars with Conjur Enterprise and follower outside Kubernetes

[izgeri]

Overview

CI automation is required to perform E2E testing of the deployment of Kubernetes authenticator sidecars using Conjur Enterprise with followers outside of the Kubernetes cluster in which the authenticator sidecars are deployed.

This task will use the E2E scripting that is created in Issue #239 to do the "backend" work of deploying the authenticators and a sample sidecar application.

However, scripts will need to be added to add a "front-end" installation of Conjur Enterprise with followers outside of the Kubernetes cluster (to be done before calling the scripts developed for Issue #239). This can probably be based on dap-intro scripts to deploy a Conjur enterprise instance in Jenkins with followers outside of the Kubernetes cluster.

TBD

• Which clusters does this need to run in? The Conjur followers, authenticator containers, and applications need to run in a "Kubernetes cluster". This can probably be either:
  • Jenkins+GKE, or...
  • Github Actions + KinD although this may depend upon easily those types of clusters integrate with the dap-intro scripts.
• Which sidecar flows will run? Since E2E flows for all of the authenticator sidecar/init container types is already covered in Issue #242 (E2E using Conjur OSS), it may be sufficient to test one type of authenticator sidecar/init container here. (The assumption here is that if one authenticator sidecar/init container type can authenticate with a given configuration, the others "should" work in that they should be fairly agnostic of the endpoints they're using for authentication???)

Dependencies

• Issue #228 (cluster prep Helm chart)
• Issue #237 (Namespace prep Helm chart)
• Issue #238 (sample application deployment Helm chart)
• Issue #239 (Reusable script for deploying applications and authenticators)
• Issue #247 (Add Secrets Provider support to sample application deployment Helm chart)

DoD

• [x] CI is able to spin up a Conjur cluster with follower(s) outside of the Kubernetes cluster
• [x] CI is able to successfully run the E2E authenticator / application test script

[izgeri]

As in #242, is #247 required for this? we can get the e2e flow running with authn-k8s sidecar first