Add kuttl tests for enabling TLS on HA dbcluster

tests/kuttl/common/errors_cleanup_ovn.yaml

@@ -65,14 +65,12 @@ kind: Pod
 metadata:
   labels:
     service: ovsdbserver-nb
-  name: ovsdbserver-nb-0
 ---
 apiVersion: v1
 kind: Pod
 metadata:
   labels:
     service: ovsdbserver-sb
-  name: ovsdbserver-sb-0
 ---
 apiVersion: v1
 kind: Pod
@@ -97,27 +95,9 @@ kind: Service
 metadata:
   labels:
     service: ovsdbserver-nb
-  name: ovsdbserver-nb
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    service: ovsdbserver-nb
-    statefulset.kubernetes.io/pod-name: ovsdbserver-nb-0
-  name: ovsdbserver-nb-0
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    service: ovsdbserver-sb
-  name: ovsdbserver-sb
 ---
 apiVersion: v1
 kind: Service
 metadata:
   labels:
     service: ovsdbserver-sb
-    statefulset.kubernetes.io/pod-name: ovsdbserver-sb-0
-  name: ovsdbserver-sb-0

tests/kuttl/tests/ovn_tls_enable/00-assert.yaml

@@ -0,0 +1 @@
+../../common/assert_tls_certs.yaml

tests/kuttl/tests/ovn_tls_enable/00-tls_ca_bundle.yaml

@@ -0,0 +1 @@
+../../common/tls_ca_bundle.yaml

tests/kuttl/tests/ovn_tls_enable/00-tls_certs.yaml

@@ -0,0 +1 @@
+../../common/tls_certs.yaml

tests/kuttl/tests/ovn_tls_enable/01-assert.yaml

@@ -0,0 +1,42 @@
+apiVersion: ovn.openstack.org/v1beta1
+kind: OVNDBCluster
+metadata:
+  name: ovndbcluster-nb-sample
+spec:
+  replicas: 3
+status:
+  readyCount: 3
+---
+apiVersion: ovn.openstack.org/v1beta1
+kind: OVNDBCluster
+metadata:
+  name: ovndbcluster-sb-sample
+spec:
+  replicas: 3
+status:
+  readyCount: 3
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+commands:
+  # check the DB uri scheme is tcp
+  - script: |
+      template='{{.status.internalDbAddress}}{{"\n"}}'
+      regex="tcp:.*"
+      dbUri=$(oc get -n $NAMESPACE OVNDBCluster ovndbcluster-sb-sample -o go-template="$template")
+      matches=$(echo "$dbUri" | sed -e "s?$regex??")
+      if [[ -n "$matches" ]]; then
+        exit 1
+      fi
+  # Check ovn connect is ptcp
+  - script: |
+      sb_pod=$(oc get pod -n $NAMESPACE -l service=ovsdbserver-sb -o name|head -1)
+      oc rsh -n $NAMESPACE ${sb_pod} ovn-sbctl --no-leader-only  get-connection | grep -q ptcp && exit 0
+      exit 1
+  # Check we have 3 servers using tcp
+  - script: |
+      sb_pod=$(oc get pod -n $NAMESPACE -l service=ovsdbserver-sb -o name|head -1)
+      if [ $( oc rsh -n $NAMESPACE ${sb_pod} ovs-appctl -t /tmp/ovnsb_db.ctl cluster/status OVN_Southbound | sed -e '1,/Servers:/d' | grep 'at tcp:' | wc -l) -ne 3 ]; then
+        exit 1
+      fi
+      exit 0

tests/kuttl/tests/ovn_tls_enable/01-deploy-ovn.yaml

@@ -0,0 +1,6 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      cp ../../../../config/samples/ovn_* deploy/
+      oc kustomize deploy | oc apply -n $NAMESPACE -f -

tests/kuttl/tests/ovn_tls_enable/02-assert.yaml

@@ -0,0 +1,42 @@
+apiVersion: ovn.openstack.org/v1beta1
+kind: OVNDBCluster
+metadata:
+  name: ovndbcluster-nb-sample
+spec:
+  replicas: 3
+status:
+  readyCount: 3
+---
+apiVersion: ovn.openstack.org/v1beta1
+kind: OVNDBCluster
+metadata:
+  name: ovndbcluster-sb-sample
+spec:
+  replicas: 3
+status:
+  readyCount: 3
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+commands:
+  # check the DB uri scheme is ssl
+  - script: |
+      template='{{.status.internalDbAddress}}{{"\n"}}'
+      regex="ssl:.*"
+      dbUri=$(oc get -n $NAMESPACE OVNDBCluster ovndbcluster-sb-sample -o go-template="$template")
+      matches=$(echo "$dbUri" | sed -e "s?$regex??")
+      if [[ -n "$matches" ]]; then
+        exit 1
+      fi
+  # Check ovn connect is pssl
+  - script: |
+      sb_pod=$(oc get pod -n $NAMESPACE -l service=ovsdbserver-sb -o name|head -1)
+      oc rsh -n $NAMESPACE ${sb_pod} ovn-sbctl --no-leader-only  get-connection | grep -q pssl && exit 0
+      exit 1
+  # Check we have 3 servers using ssl
+  - script: |
+      sb_pod=$(oc get pod -n $NAMESPACE -l service=ovsdbserver-sb -o name|head -1)
+      if [ $( oc rsh -n $NAMESPACE ${sb_pod} ovs-appctl -t /tmp/ovnsb_db.ctl cluster/status OVN_Southbound | sed -e '1,/Servers:/d' | grep 'at ssl:' | wc -l) -ne 3 ]; then
+        exit 1
+      fi
+      exit 0

tests/kuttl/tests/ovn_tls_enable/02-enable-tls.yaml

@@ -0,0 +1,6 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |
+      cp ../../../../config/samples/ovn_* enable_tls/
+      oc kustomize enable_tls | oc apply -n $NAMESPACE -f -

tests/kuttl/tests/ovn_tls_enable/03-cleanup.yaml

@@ -0,0 +1 @@
+../../common/cleanup-ovn.yaml

tests/kuttl/tests/ovn_tls_enable/03-errors.yaml

@@ -0,0 +1 @@
+../../common/errors_cleanup_ovn.yaml

tests/kuttl/tests/ovn_tls_enable/deploy/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ovn_v1beta1_ovndbcluster.yaml
+patches:
+- patch: |-
+    - op: add
+      path: /spec/replicas
+      value: 3
+  target:
+    kind: OVNDBCluster

tests/kuttl/tests/ovn_tls_enable/enable_tls/kustomization.yaml

@@ -0,0 +1,41 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ovn_v1beta1_ovnnorthd.yaml
+- ovn_v1beta1_ovndbcluster.yaml
+- ovn_v1beta1_ovncontroller.yaml
+patches:
+- patch: |-
+    - op: add
+      path: /spec/tls
+      value:
+        caBundleSecretName: combined-ca-bundle
+        secretName: cert-ovsdbserver-nb-svc
+  target:
+    kind: OVNDBCluster
+    name: ovndbcluster-nb-sample
+- patch: |-
+    - op: add
+      path: /spec/tls
+      value:
+        caBundleSecretName: combined-ca-bundle
+        secretName: cert-ovsdbserver-sb-svc
+  target:
+    kind: OVNDBCluster
+    name: ovndbcluster-sb-sample
+- patch: |-
+    - op: add
+      path: /spec/tls
+      value:
+        caBundleSecretName: combined-ca-bundle
+        secretName: cert-ovnnorthd-svc
+  target:
+    kind: OVNNorthd
+- patch: |-
+    - op: add
+      path: /spec/tls
+      value:
+        caBundleSecretName: combined-ca-bundle
+        secretName: cert-ovncontroller-svc
+  target:
+    kind: OVNController