There are end-to-end tests for Kubernetes sidecars with Conjur Enterprise and follower outside OpenShift

[izgeri]

Overview

CI automation is required to perform E2E testing of the deployment of authenticator sidecars using Conjur Enterprise with followers outside of the OpenShift cluster in which the authenticator sidecars are deployed.

This task will use the E2E scripting that is created in Issue #239, and expanded to support deployment on OpenShift clusters with Issue #248, to deploy the authenticators and a sample sidecar application. The scripts will assume that there is an OpenShift 4.6 cluster available to deploy authenticators and a sample application.

A "front-end" script will need to be included to spin up a Conjur Enterprise cluster with followers outside of the OpenShift cluster. This scripting will be the same as what is required for Issue #244.

TBD

• Which sidecar flows will run? ~ Since E2E flows for all of the authenticator sidecar/init container types is already covered in Issue #242 (E2E using Conjur OSS), it may be sufficient to test one type of authenticator sidecar/init container here. (The assumption here is that if one authenticator sidecar/init container type can authenticate with a given configuration, the others "should" work in that they should be fairly agnostic of the endpoints they're using for authentication???) ~

Run all configurations for now to get things tested in OpenShift quickly. We will cut down on the test matrix as a separate effort.

Dependencies

• Issue #228 (cluster prep Helm chart)
• Issue #237 (Namespace prep Helm chart)
• Issue #238 (sample application deployment Helm chart)
• Issue #239 (Reusable script for deploying applications and authenticators)
• Issue #247 (Add Secrets Provider support to sample application deployment Helm chart)
• Issue #248 (Add OpenShift support to reusable script for deploying applications and authenticators)

DoD

• [ ] CI is able to spin up a Conjur cluster with follower(s) outside of the OpenShift cluster
• [ ] CI is able to successfully run the E2E authenticator / application test script

[izgeri]

As in #242, is #247 really required for this? we can test e2e using authn-k8s client sidecar

[jtuttle]

Regarding the TBD in the issue description: it's probably quickest to include all sidecars to get things tested on OpenShift for now. We may need a follow up story to cut down to a sparse matrix that still gives us the coverage we need. It may be better to tackle this after we've implemented the full testing matrix.