Test upsteam container images #429

ansasaki · 2023-08-04T14:59:36Z

Add a helper function to pull images from a registry.
Add a test plan to test upstream container images
Use --entrypoint to override the container entrypoint and allow passing arguments to the commands inside the container in limeconRun
Allow passing the agent working directory in limeconRunAgent
Add a Dockerfile for the revocation webhook in keylime_ipv6_multihost test
Avoid the need for python inside the container in keylime_ipv6_multihost by replacing python payload script with shell script

Library/test-helpers/lib.sh

plans/upstream-keylime-containers.fmf

kkaarreell · 2023-08-10T05:58:43Z

I am wondering what's behind those test failure, seems like there was an issue with agent start. Unfortunately, logging for containers is not currently ideal.

EDIT: seems there is in fact something in logs

error: unexpected argument 'keylime_agent' found

Usage: sudo RUST_LOG=keylime_agent=trace ./target/debug/keylime_agent

For more information, try '--help'.

ansasaki · 2023-08-10T10:05:33Z

I am wondering what's behind those test failure, seems like there was an issue with agent start. Unfortunately, logging for containers is not currently ideal.

EDIT: seems there is in fact something in logs
error: unexpected argument 'keylime_agent' found

Usage: sudo RUST_LOG=keylime_agent=trace ./target/debug/keylime_agent

For more information, try '--help'.

I already fixed this locally. For images that already have an entrypoint set, you need to override it, otherwise the trailing commands are provided as arguments.

But I hit another issue: the upstream agent container image does not create an internal keylime user, making it impossible to drop privileges. Either we run as root or we add a keylime user there.

I think it is better to add the keylime user there for now. I'll create a PR and ask for review.

ansasaki · 2023-08-11T15:28:57Z

Added the keylime user via keylime/rust-keylime#635

container/functional/keylime_ipv6_multihost/test.sh

container/functional/keylime_ipv6_multihost/payload-script/local_action_modify_payload.sh

container/functional/keylime_ipv6_multihost/test.sh

ansasaki · 2023-08-21T15:37:59Z

/packit retest

kkaarreell · 2023-08-21T20:52:40Z

I am trying to address C9S failure in #450.
Please rebase.

kkaarreell · 2023-08-21T20:58:00Z

container/functional/keylime_agent_container-basic-attestation/test.sh

@@ -8,6 +8,8 @@

 [ -n "$AGENT_DOCKERFILE" ] || AGENT_DOCKERFILE=Dockerfile.upstream.c9s

+[ -n "$REGISTRY" ] || REGISTRY=quay.io


Should we make images configurable through envvars as well?

Now I can see we do configure it through envvars, it's just not clearly visible in the test. What about adding a comment to the top?

I'll try to make it clear.

container/functional/keylime_ipv6_multihost/payload-script/local_action_modify_payload.sh

kkaarreell

Thank you for the update. Looks good, I would just consider adding a comment to a test mentioning which images can be defined using envvars from the outside.

kkaarreell · 2023-08-21T21:05:38Z

@Koncpa please take a look at it as it introduces some new functions and concepts.

Koncpa · 2023-08-22T06:44:29Z

@Koncpa please take a look at it as it introduces some new functions and concepts.

Sure, I'll take a look.

Library/test-helpers/lib.sh

This makes it possible to run using the same command line regardless of the image having an entrypoint set or not. Also, allow passing arguments to the command inside the container Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

The helper function limeconPullImage will pull an image from a remote registry and optionally tag it with a name and tag locally. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Koncpa · 2023-08-22T07:56:05Z

Just one nitpick, but otherwise LGTM! Thank you.

Enable container tests to run against images obtained from registries instead of built locally. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Modify containers test plan to test using images from upstream registry for the verifier, registrar, and agent. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

If a Dockerfile for any component is provided via environment variable, check if it exists and, only if not found, try to find in limeLibraryDir. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Use --entrypoint to override the image entrypoint in case it has an entrypoint set. The agent needs the certificate directory to be accessible by the internal 'keylime' user in order to drop privileges inside the container. For this, it is necessary for the files owner uid to match the internal 'keylime' uid. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

The agent will store data in /var/lib/keylime which needs to be accessible by the unprivileged user in the container. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Replace the python payload action with a shell payload action to avoid the need for python inside the agent container. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Use a separate container for the revocation webhook. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

github-advanced-security bot found potential problems Aug 4, 2023

View reviewed changes

Library/test-helpers/lib.sh Fixed Show fixed Hide fixed

ansasaki force-pushed the test-images branch 4 times, most recently from d41e660 to 8375ac2 Compare August 9, 2023 10:12

kkaarreell reviewed Aug 10, 2023

View reviewed changes

plans/upstream-keylime-containers.fmf Outdated Show resolved Hide resolved

kkaarreell reviewed Aug 10, 2023

View reviewed changes

plans/upstream-keylime-containers.fmf Outdated Show resolved Hide resolved

kkaarreell reviewed Aug 10, 2023

View reviewed changes

plans/upstream-keylime-containers.fmf Outdated Show resolved Hide resolved

ansasaki force-pushed the test-images branch 2 times, most recently from b3bbb62 to 1ec2ec1 Compare August 10, 2023 17:10

ansasaki force-pushed the test-images branch 10 times, most recently from 62f6ffa to 959f93e Compare August 15, 2023 17:15

github-advanced-security bot found potential problems Aug 15, 2023

View reviewed changes

container/functional/keylime_ipv6_multihost/test.sh Fixed Show fixed Hide fixed

ansasaki force-pushed the test-images branch 3 times, most recently from 4c159b9 to 00e0032 Compare August 16, 2023 12:59

github-advanced-security bot found potential problems Aug 16, 2023

View reviewed changes

ansasaki force-pushed the test-images branch 2 times, most recently from 97d014d to 5c48481 Compare August 16, 2023 14:45

ansasaki force-pushed the test-images branch 3 times, most recently from bcec874 to 5ba47f5 Compare August 21, 2023 12:33

github-advanced-security bot found potential problems Aug 21, 2023

View reviewed changes

container/functional/keylime_ipv6_multihost/test.sh Fixed Show fixed Hide fixed

ansasaki force-pushed the test-images branch from 5ba47f5 to 790dcb6 Compare August 21, 2023 13:02

ansasaki force-pushed the test-images branch from 790dcb6 to 879cf88 Compare August 21, 2023 15:50

kkaarreell reviewed Aug 21, 2023

View reviewed changes

container/functional/keylime_ipv6_multihost/payload-script/local_action_modify_payload.sh Show resolved Hide resolved

kkaarreell approved these changes Aug 21, 2023

View reviewed changes

kkaarreell requested a review from Koncpa August 21, 2023 21:05

Koncpa reviewed Aug 22, 2023

View reviewed changes

Library/test-helpers/lib.sh Outdated Show resolved Hide resolved

ansasaki added 2 commits August 22, 2023 09:44

Add helper function limeconPullImage

6d42c35

The helper function limeconPullImage will pull an image from a remote registry and optionally tag it with a name and tag locally. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

ansasaki added 8 commits August 22, 2023 09:59

Test with verifier and registrar images from registry

5116eb7

Enable container tests to run against images obtained from registries instead of built locally. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Add plan to test upstream containers

421abe5

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Test upstream agent image

317296f

Modify containers test plan to test using images from upstream registry for the verifier, registrar, and agent. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Library: Expand Dockerfile path only if not found

685e09f

If a Dockerfile for any component is provided via environment variable, check if it exists and, only if not found, try to find in limeLibraryDir. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Library: Allow passing working directory for agent container

bb58119

The agent will store data in /var/lib/keylime which needs to be accessible by the unprivileged user in the container. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Avoid the need for python inside the agent container

7dc8e00

Replace the python payload action with a shell payload action to avoid the need for python inside the agent container. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

Create container for revocation webhook.

c54cf72

Use a separate container for the revocation webhook. Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

ansasaki force-pushed the test-images branch from 879cf88 to c54cf72 Compare August 22, 2023 08:07

Fix ShellCheck finding

d317897

Signed-off-by: Anderson Toshiyuki Sasaki <[email protected]>

kkaarreell merged commit 4723530 into RedHat-SP-Security:main Aug 24, 2023
6 checks passed

ansasaki deleted the test-images branch August 24, 2023 12:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Test upsteam container images #429

Test upsteam container images #429

ansasaki commented Aug 4, 2023 •

edited

Loading

kkaarreell commented Aug 10, 2023 •

edited

Loading

ansasaki commented Aug 10, 2023

ansasaki commented Aug 11, 2023

ansasaki commented Aug 21, 2023

kkaarreell commented Aug 21, 2023 •

edited

Loading

kkaarreell Aug 21, 2023

kkaarreell Aug 21, 2023

ansasaki Aug 22, 2023

kkaarreell left a comment

kkaarreell commented Aug 21, 2023

Koncpa commented Aug 22, 2023

Koncpa commented Aug 22, 2023

		@@ -8,6 +8,8 @@

		[ -n "$AGENT_DOCKERFILE" ] \|\| AGENT_DOCKERFILE=Dockerfile.upstream.c9s

		[ -n "$REGISTRY" ] \|\| REGISTRY=quay.io

Test upsteam container images #429

Test upsteam container images #429

Conversation

ansasaki commented Aug 4, 2023 • edited Loading

kkaarreell commented Aug 10, 2023 • edited Loading

ansasaki commented Aug 10, 2023

ansasaki commented Aug 11, 2023

ansasaki commented Aug 21, 2023

kkaarreell commented Aug 21, 2023 • edited Loading

kkaarreell Aug 21, 2023

Choose a reason for hiding this comment

kkaarreell Aug 21, 2023

Choose a reason for hiding this comment

ansasaki Aug 22, 2023

Choose a reason for hiding this comment

kkaarreell left a comment

Choose a reason for hiding this comment

kkaarreell commented Aug 21, 2023

Koncpa commented Aug 22, 2023

Koncpa commented Aug 22, 2023

ansasaki commented Aug 4, 2023 •

edited

Loading

kkaarreell commented Aug 10, 2023 •

edited

Loading

kkaarreell commented Aug 21, 2023 •

edited

Loading