search

cyberark / secrets-provider-for-k8s

Cyberark secrets provider for k8s
Apache License 2.0
26 stars 11 forks source link

Test automation for DAP & OSS for GKE/K8s design #44

Closed sigalsax closed 4 years ago

sigalsax commented 4 years ago

The following is a design in order run OSS/DAP testing for Secrets provider for K8s in GKE. This design will be changing with the progression of the task and definitely open for feedback and insights

  1. Using the oss-by-default-oss-by-default tag from the kubernetes-conjur-deploy repo and use that tagged commit to run the tests
  2. I will be using the k8s-conjur-demo as an example of how to configure the repo to extend configuration to GKE
  3. Add proper GKE configurations in order to deploy DAP/OSS in GKE
  4. Roles and rolebindings apiVerisons will be updated according to what is supported GKE (from v1 -> rbac.authorization.k8s.io/v1 for example)
  5. Configure scripts so that according to the flag received (—dap/oss), the proper test environment will deployed on GKE.

Current obstacles Problem: During the Configuring Master pod stage, the container is terminated with a code 137. I am not sure what changed between the deployment from yesterday and today except for the reverting of the commit Solution: In response to this error:

sigalsax commented 4 years ago

A couple of issues I faced along the way and how they were fixed:

  1. I was getting the following unknown authority error:

    oc login -s https://openshift-311.itci.conjur.net:8443/console/catalog
The server uses a certificate signed by an unknown authority.
You can bypass the certificate check, but any data you send to the server could be intercepted by others.
Use insecure connections? (y/n):

    and had to add the following to my ~/zrshrc in order to switch between oc clusters because ci oc clusters don't have real certs https://conjurhq.slack.com/archives/CBTETAE20/p1560528004464300

  2. With gke and openshift, I needed to specify what I wanted K8s to communicate with. If you run kubectl cluster-info and see openshift, run kubectl config use-context gke_conjur-gke-dev_us-central1-a-test-cluster1 and run kubectl cluster-info again to ensure K8s is pointing to gke

sigalsax commented 4 years ago

closed as this was merged