There are end-to-end tests for Kubernetes sidecars with Conjur Enterprise and follower(s) in Kubernetes

[izgeri]

Overview

CI automation is required to perform E2E testing of the deployment of Kubernetes authenticator sidecars
using Conjur Enterprise with followers in the same Kubernetes cluster as the authenticator sidecars.

This task will use the E2E scripting that is created in Issue #239 to do the "backend" work of deploying the authenticators and a sample sidecar application.

However, scripts will need to be added to add a "front-end" installation of Conjur Enterprise with followers in the Kubernetes cluster (to be done before calling the scripts developed for Issue #239). This can probably be based on dap-intro scripts to deploy a Conjur enterprise instance in Jenkins with followers in the Kubernetes cluster.

TBD

• Which clusters does this need to run in?
  The Conjur followers, authenticator containers, and applications need to run in a "Kubernetes cluster".
  This can probably be either:
  • Jenkins+GKE, or...
  • Github Actions + KinD
    although this may depend upon easily those types of clusters integrate
    with the dap-intro scripts specifically considering how followers can be created in that cluster.
• Which sidecar flows will run?
  Since E2E flows for all of the authenticator sidecar/init container types is already covered in
  Issue There are end-to-end tests for Kubernetes sidecars with Conjur OSS in Kubernetes #242 (E2E using Conjur OSS), it may be sufficient to test one type of authenticator
  sidecar/init container here. (The assumption here is that if one authenticator sidecar/init
  container type can authenticate with a given configuration, the others "should" work in
  that they should be fairly agnostic of the endpoints they're using for authentication???)
• Is there prep work that needs to happen in dap-intro to get this working?
  e.g. install/configure k8s follower from dap-intro? Make leader cluster available on a high port
  in dap-intro so that it will be accessible from the cluster?)

Dependencies

• Issue There is a helm test for the cluster prep helm chart #228 (cluster prep Helm chart)
• Issue There is a helm test for the namespace prep helm chart #237 (Namespace prep Helm chart)
• Issue There is a helm chart for deploying a sample app with a Conjur sidecar #238 (sample application deployment Helm chart)
• Issue There are reusable scripts for development environments and automated testing #239 (Reusable script for deploying applications and authenticators)
• Issue Deployment scripts include support for Secrets Provider init and standalone app containers #247 (Add Secrets Provider support to sample application deployment Helm chart)

DoD

• CI is able to spin up a Conjur cluster with follower(s) inside the Kubernetes cluster
• CI is able to successfully run the E2E authenticator / application test script

[izgeri]

As in #242 - is #247 really required for this? the e2e tests could run with authn-k8s sidecar to start