in swarm. Also, fix some CLI command confusions: 1. If the --external-ca flag is provided, require a --ca-cert flag as well, otherwise the external CA is set but the CA certificate is actually rotated to an internal cert 2. If a --ca-cert flag is provided, require a --ca-key or --external-ca flag be provided as well, otherwise either the server will say that the request is invalid, or if there was previously an external CA corresponding to the cert, it will succeed. While that works, it's better to require the user to explicitly set all the parameters of the new desired root CA. This also changes the `swarm update` function to set the external CA's CACert field, which while not strictly necessary, makes the CA list more explicit. Signed-off-by: Ying Li <ying.li@docker.com>
186 lines
5.5 KiB
Go
186 lines
5.5 KiB
Go
package swarm
|
|
|
|
import (
|
|
"fmt"
|
|
"io/ioutil"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/docker/cli/internal/test"
|
|
"github.com/docker/docker/api/types"
|
|
"github.com/docker/docker/api/types/swarm"
|
|
"github.com/pkg/errors"
|
|
|
|
// Import builders to get the builder function as package function
|
|
. "github.com/docker/cli/internal/test/builders"
|
|
"gotest.tools/assert"
|
|
"gotest.tools/golden"
|
|
)
|
|
|
|
func TestSwarmUpdateErrors(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
args []string
|
|
flags map[string]string
|
|
swarmInspectFunc func() (swarm.Swarm, error)
|
|
swarmUpdateFunc func(swarm swarm.Spec, flags swarm.UpdateFlags) error
|
|
swarmGetUnlockKeyFunc func() (types.SwarmUnlockKeyResponse, error)
|
|
expectedError string
|
|
}{
|
|
{
|
|
name: "too-many-args",
|
|
args: []string{"foo"},
|
|
expectedError: "accepts no arguments",
|
|
},
|
|
{
|
|
name: "swarm-inspect-error",
|
|
flags: map[string]string{
|
|
flagTaskHistoryLimit: "10",
|
|
},
|
|
swarmInspectFunc: func() (swarm.Swarm, error) {
|
|
return swarm.Swarm{}, errors.Errorf("error inspecting the swarm")
|
|
},
|
|
expectedError: "error inspecting the swarm",
|
|
},
|
|
{
|
|
name: "swarm-update-error",
|
|
flags: map[string]string{
|
|
flagTaskHistoryLimit: "10",
|
|
},
|
|
swarmUpdateFunc: func(swarm swarm.Spec, flags swarm.UpdateFlags) error {
|
|
return errors.Errorf("error updating the swarm")
|
|
},
|
|
expectedError: "error updating the swarm",
|
|
},
|
|
{
|
|
name: "swarm-unlockkey-error",
|
|
flags: map[string]string{
|
|
flagAutolock: "true",
|
|
},
|
|
swarmInspectFunc: func() (swarm.Swarm, error) {
|
|
return *Swarm(), nil
|
|
},
|
|
swarmGetUnlockKeyFunc: func() (types.SwarmUnlockKeyResponse, error) {
|
|
return types.SwarmUnlockKeyResponse{}, errors.Errorf("error getting unlock key")
|
|
},
|
|
expectedError: "error getting unlock key",
|
|
},
|
|
}
|
|
for _, tc := range testCases {
|
|
cmd := newUpdateCommand(
|
|
test.NewFakeCli(&fakeClient{
|
|
swarmInspectFunc: tc.swarmInspectFunc,
|
|
swarmUpdateFunc: tc.swarmUpdateFunc,
|
|
swarmGetUnlockKeyFunc: tc.swarmGetUnlockKeyFunc,
|
|
}))
|
|
cmd.SetArgs(tc.args)
|
|
for key, value := range tc.flags {
|
|
cmd.Flags().Set(key, value)
|
|
}
|
|
cmd.SetOutput(ioutil.Discard)
|
|
assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
|
|
}
|
|
}
|
|
|
|
func TestSwarmUpdate(t *testing.T) {
|
|
swarmInfo := Swarm()
|
|
swarmInfo.ClusterInfo.TLSInfo.TrustRoot = "trustroot"
|
|
|
|
testCases := []struct {
|
|
name string
|
|
args []string
|
|
flags map[string]string
|
|
swarmInspectFunc func() (swarm.Swarm, error)
|
|
swarmUpdateFunc func(swarm swarm.Spec, flags swarm.UpdateFlags) error
|
|
swarmGetUnlockKeyFunc func() (types.SwarmUnlockKeyResponse, error)
|
|
}{
|
|
{
|
|
name: "noargs",
|
|
},
|
|
{
|
|
name: "all-flags-quiet",
|
|
flags: map[string]string{
|
|
flagTaskHistoryLimit: "10",
|
|
flagDispatcherHeartbeat: "10s",
|
|
flagCertExpiry: "20s",
|
|
flagExternalCA: "protocol=cfssl,url=https://example.com.",
|
|
flagMaxSnapshots: "10",
|
|
flagSnapshotInterval: "100",
|
|
flagAutolock: "true",
|
|
flagQuiet: "true",
|
|
},
|
|
swarmInspectFunc: func() (swarm.Swarm, error) {
|
|
return *swarmInfo, nil
|
|
},
|
|
swarmUpdateFunc: func(swarm swarm.Spec, flags swarm.UpdateFlags) error {
|
|
if *swarm.Orchestration.TaskHistoryRetentionLimit != 10 {
|
|
return errors.Errorf("historyLimit not correctly set")
|
|
}
|
|
heartbeatDuration, err := time.ParseDuration("10s")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if swarm.Dispatcher.HeartbeatPeriod != heartbeatDuration {
|
|
return errors.Errorf("heartbeatPeriodLimit not correctly set")
|
|
}
|
|
certExpiryDuration, err := time.ParseDuration("20s")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if swarm.CAConfig.NodeCertExpiry != certExpiryDuration {
|
|
return errors.Errorf("certExpiry not correctly set")
|
|
}
|
|
if len(swarm.CAConfig.ExternalCAs) != 1 || swarm.CAConfig.ExternalCAs[0].CACert != "trustroot" {
|
|
return errors.Errorf("externalCA not correctly set")
|
|
}
|
|
if *swarm.Raft.KeepOldSnapshots != 10 {
|
|
return errors.Errorf("keepOldSnapshots not correctly set")
|
|
}
|
|
if swarm.Raft.SnapshotInterval != 100 {
|
|
return errors.Errorf("snapshotInterval not correctly set")
|
|
}
|
|
if !swarm.EncryptionConfig.AutoLockManagers {
|
|
return errors.Errorf("autolock not correctly set")
|
|
}
|
|
return nil
|
|
},
|
|
},
|
|
{
|
|
name: "autolock-unlock-key",
|
|
flags: map[string]string{
|
|
flagTaskHistoryLimit: "10",
|
|
flagAutolock: "true",
|
|
},
|
|
swarmUpdateFunc: func(swarm swarm.Spec, flags swarm.UpdateFlags) error {
|
|
if *swarm.Orchestration.TaskHistoryRetentionLimit != 10 {
|
|
return errors.Errorf("historyLimit not correctly set")
|
|
}
|
|
return nil
|
|
},
|
|
swarmInspectFunc: func() (swarm.Swarm, error) {
|
|
return *Swarm(), nil
|
|
},
|
|
swarmGetUnlockKeyFunc: func() (types.SwarmUnlockKeyResponse, error) {
|
|
return types.SwarmUnlockKeyResponse{
|
|
UnlockKey: "unlock-key",
|
|
}, nil
|
|
},
|
|
},
|
|
}
|
|
for _, tc := range testCases {
|
|
cli := test.NewFakeCli(&fakeClient{
|
|
swarmInspectFunc: tc.swarmInspectFunc,
|
|
swarmUpdateFunc: tc.swarmUpdateFunc,
|
|
swarmGetUnlockKeyFunc: tc.swarmGetUnlockKeyFunc,
|
|
})
|
|
cmd := newUpdateCommand(cli)
|
|
cmd.SetArgs(tc.args)
|
|
for key, value := range tc.flags {
|
|
cmd.Flags().Set(key, value)
|
|
}
|
|
cmd.SetOutput(cli.OutBuffer())
|
|
assert.NilError(t, cmd.Execute())
|
|
golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("update-%s.golden", tc.name))
|
|
}
|
|
}
|