diff --git a/test/integration/suites/evict-agent/04-ban-agent b/test/integration/suites/evict-agent/04-ban-agent index 5bf2276269..1aba534254 100755 --- a/test/integration/suites/evict-agent/04-ban-agent +++ b/test/integration/suites/evict-agent/04-ban-agent @@ -2,21 +2,21 @@ log-debug "banning agent..." -docker compose exec -T spire-server \ - /opt/spire/bin/spire-server agent ban \ - -spiffeID "spiffe://domain.test/spire/agent/x509pop/$(fingerprint conf/agent/agent.crt.pem)" - -# Check at most 30 times (with one second in between) that the agent has -# successfully banned +# Attempt at most 30 times (with one second in between) to ban the agent MAXCHECKS=30 CHECKINTERVAL=1 +spiffe_id="spiffe://domain.test/spire/agent/x509pop/$(fingerprint conf/agent/agent.crt.pem)" for ((i=1;i<=MAXCHECKS;i++)); do - log-info "checking for agent is shutting down ($i of $MAXCHECKS max)..." - docker compose logs spire-agent - if docker compose logs spire-agent | grep "Agent is banned: removing SVID and shutting down"; then + log-info "attempting to ban agent ${spiffe_id} ($i of $MAXCHECKS max)..." + + docker compose exec -T spire-server \ + /opt/spire/bin/spire-server agent ban \ + -spiffeID "${spiffe_id}" + docker compose logs spire-server + if docker compose logs spire-server | grep "Agent banned"; then exit 0 fi sleep "${CHECKINTERVAL}" done -fail-now "timed out waiting for agent to shutdown" +fail-now "timed out waiting for successful ban" diff --git a/test/integration/suites/evict-agent/05-agent-is-banned b/test/integration/suites/evict-agent/05-agent-is-banned new file mode 100755 index 0000000000..da9a22e828 --- /dev/null +++ b/test/integration/suites/evict-agent/05-agent-is-banned @@ -0,0 +1,16 @@ +#!/bin/bash + +# Check at most 30 times (with one second in between) that the agent has +# been successfully banned +MAXCHECKS=30 +CHECKINTERVAL=1 +for ((i=1;i<=MAXCHECKS;i++)); do + log-info "checking for agent is shutting down due to being banned ($i of $MAXCHECKS max)..." + docker compose logs spire-agent + if docker compose logs spire-agent | grep "Agent is banned: removing SVID and shutting down"; then + exit 0 + fi + sleep "${CHECKINTERVAL}" +done + +fail-now "timed out waiting for agent to shutdown" diff --git a/test/integration/suites/evict-agent/05-agent-failed-to-start b/test/integration/suites/evict-agent/06-agent-failed-to-start similarity index 94% rename from test/integration/suites/evict-agent/05-agent-failed-to-start rename to test/integration/suites/evict-agent/06-agent-failed-to-start index 8116e35744..9a4132c7e2 100755 --- a/test/integration/suites/evict-agent/05-agent-failed-to-start +++ b/test/integration/suites/evict-agent/06-agent-failed-to-start @@ -3,7 +3,7 @@ log-debug "starting agent again..." docker-up spire-agent -# Check at most 30 times (with one second in between) that the agent is not able to get new +# Check at most 30 times (with one second in between) that the agent is not able to get new # workload entries. MAXCHECKS=30 CHECKINTERVAL=1 diff --git a/test/integration/suites/evict-agent/06-delete-agent b/test/integration/suites/evict-agent/06-delete-agent deleted file mode 100755 index 29fbe58c4e..0000000000 --- a/test/integration/suites/evict-agent/06-delete-agent +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -log-debug "deleting agent to enable reattestation..." - -docker compose exec -T spire-server \ - /opt/spire/bin/spire-server agent evict \ - -spiffeID "spiffe://domain.test/spire/agent/x509pop/$(fingerprint conf/agent/agent.crt.pem)" diff --git a/test/integration/suites/evict-agent/07-evict-agent b/test/integration/suites/evict-agent/07-evict-agent new file mode 100755 index 0000000000..8d63703f95 --- /dev/null +++ b/test/integration/suites/evict-agent/07-evict-agent @@ -0,0 +1,20 @@ +#!/bin/bash + +log-debug "evicting (deleting) agent to re-enable attestation..." + +# Check at most 30 times (with one second in between) that we can evict the agent +MAXCHECKS=30 +CHECKINTERVAL=1 +spiffe_id="spiffe://domain.test/spire/agent/x509pop/$(fingerprint conf/agent/agent.crt.pem)" +for ((i=1;i<=MAXCHECKS;i++)); do + log-info "attempting to evict agent ${spiffe_id} ($i of $MAXCHECKS max)..." + + docker compose exec -T spire-server \ + /opt/spire/bin/spire-server agent evict \ + -spiffeID ${spiffe_id} + docker compose logs spire-server + if docker compose logs spire-server | grep "Agent deleted"; then + exit 0 + fi + sleep "${CHECKINTERVAL}" +done diff --git a/test/integration/suites/evict-agent/08-agent-reattest-attempt b/test/integration/suites/evict-agent/08-agent-reattest-attempt new file mode 100755 index 0000000000..1ecb0dce9d --- /dev/null +++ b/test/integration/suites/evict-agent/08-agent-reattest-attempt @@ -0,0 +1,20 @@ +#!/bin/bash + +log-debug "agent re-attesting..." + +# Check at most 30 times (with one second in between) that the agent knows it can re-attest. +# This is not true "re-attestation" since when the agent was banned it removed its own SVID. +MAXCHECKS=30 +CHECKINTERVAL=1 +for ((i=1;i<=MAXCHECKS;i++)); do + log-info "checking for agent to get notification and try to reattest ($i of $MAXCHECKS max)..." + log-debug "starting agent again..." + docker-up spire-agent + docker compose logs spire-agent + if docker compose logs spire-agent | grep "SVID is not found. Starting node attestation"; then + exit 0 + fi + sleep "${CHECKINTERVAL}" +done + +fail-now "timed out waiting for agent to try to re-attest" diff --git a/test/integration/suites/evict-agent/08-evict-agent b/test/integration/suites/evict-agent/08-evict-agent deleted file mode 100755 index d7b5de1290..0000000000 --- a/test/integration/suites/evict-agent/08-evict-agent +++ /dev/null @@ -1,44 +0,0 @@ -#!/bin/bash - -log-debug "deleting agent..." - -# Check at most 30 times (with one second in between) that we can evict the agent, it may take a while for it to start up -MAXCHECKS=30 -CHECKINTERVAL=1 -for ((i=1;i<=MAXCHECKS;i++)); do - log-info "attempting to evict agent ($i of $MAXCHECKS max)..." - if docker compose exec -T spire-server \ - /opt/spire/bin/spire-server agent evict \ - -spiffeID "spiffe://domain.test/spire/agent/x509pop/$(fingerprint conf/agent/agent.crt.pem)"; then - exit 0 - fi - sleep "${CHECKINTERVAL}" -done - - -# Check at most 30 times (with one second in between) that the agent has to re-attest -MAXCHECKS=30 -CHECKINTERVAL=1 -for ((i=1;i<=MAXCHECKS;i++)); do - log-info "checking for agent to get notification and try to reattest ($i of $MAXCHECKS max)..." - docker compose logs spire-agent - if docker compose logs spire-agent | grep "Agent needs to re-attest; will attempt to re-attest"; then - exit 0 - fi - sleep "${CHECKINTERVAL}" -done - -# Check at most 30 times (with one second in between) that the agent has re-attested -MAXCHECKS=30 -CHECKINTERVAL=1 -for ((i=1;i<=MAXCHECKS;i++)); do - log-info "checking for agent to get notification and try to reattest ($i of $MAXCHECKS max)..." - docker compose logs spire-agent - if docker compose logs spire-agent | grep "Successfully reattested node"; then - exit 0 - fi - sleep "${CHECKINTERVAL}" -done - -fail-now "timed out waiting for agent to shut down" - diff --git a/test/integration/suites/evict-agent/09-agent-reattested b/test/integration/suites/evict-agent/09-agent-reattested new file mode 100755 index 0000000000..ed086920f0 --- /dev/null +++ b/test/integration/suites/evict-agent/09-agent-reattested @@ -0,0 +1,15 @@ +#!/bin/bash + +# Check at most 30 times (with one second in between) that the agent has re-attested +MAXCHECKS=30 +CHECKINTERVAL=1 +for ((i=1;i<=MAXCHECKS;i++)); do + log-info "checking for agent to get notification that it re-attested ($i of $MAXCHECKS max)..." + docker compose logs spire-agent + if docker compose logs spire-agent | grep "Node attestation was successful"; then + exit 0 + fi + sleep "${CHECKINTERVAL}" +done + +fail-now "timed out waiting for agent to re-attest" diff --git a/test/integration/suites/evict-agent/07-start-agent b/test/integration/suites/evict-agent/10-start-agent similarity index 83% rename from test/integration/suites/evict-agent/07-start-agent rename to test/integration/suites/evict-agent/10-start-agent index 1981d7b37e..1597a12e14 100755 --- a/test/integration/suites/evict-agent/07-start-agent +++ b/test/integration/suites/evict-agent/10-start-agent @@ -1,7 +1,9 @@ #!/bin/bash log-debug "starting agent again..." - +log-debug "bringing agent down..." +docker-down spire-agent +log-debug "starting agent again..." docker-up spire-agent # Check at most 30 times (with one second in between) that the agent is back up