From 95d13c80ccd48e3b765247934fe073473d3c193d Mon Sep 17 00:00:00 2001 From: Chad Crum Date: Mon, 14 Sep 2026 18:32:58 -0400 Subject: [PATCH] refactor(deploy): externalize compose credentials and subsystem test secrets (FLPATH-4806) Move deploy and subsystem test credentials into gitignored .env files and update Compose, subsystem tests, and documentation to use the shared configuration. Gate Keycloak behind AUTH=true, keep compose and Helm realm artifacts intentionally separate for the companion Helm change, and fix the auth subsystem setup to use the configured PostgreSQL credentials. https://redhat.atlassian.net/browse/FLPATH-4806 Signed-off-by: Chad Crum --- .env.example | 8 -- Makefile | 23 +++- README.md | 11 +- deploy/.env.example | 80 ++++++------- deploy/RUN.md | 126 +++++++++++---------- deploy/compose.yaml | 44 +++---- deploy/keycloak/realm-export.json | 4 +- make/auth.mk | 6 +- test/subsystem/.env.example | 13 +++ test/subsystem/auth/docker-compose.yaml | 45 +++----- test/subsystem/auth/helpers_test.go | 8 +- test/subsystem/auth/suite_test.go | 15 ++- test/subsystem/catalog/docker-compose.yaml | 11 +- test/subsystem/policy/docker-compose.yaml | 11 +- test/subsystem/sp/docker-compose.yaml | 11 +- 15 files changed, 216 insertions(+), 200 deletions(-) delete mode 100644 .env.example create mode 100644 test/subsystem/.env.example diff --git a/.env.example b/.env.example deleted file mode 100644 index 85eae5f..0000000 --- a/.env.example +++ /dev/null @@ -1,8 +0,0 @@ -# Optional: copy to .env and set for local overrides or non-default credentials. -# Used by deploy/compose.yaml and test/subsystem/*/docker-compose.yaml. -# Defaults are for local dev and subsystem tests only. -# POSTGRES_USER=admin -# POSTGRES_PASSWORD=adminpass -# -# For the full platform stack (UI, service providers, image version pins), -# see deploy/.env.example. diff --git a/Makefile b/Makefile index 718fc1e..cf897a3 100644 --- a/Makefile +++ b/Makefile @@ -13,9 +13,12 @@ $(error No supported container engine found. Please install podman or docker, or endif COMPOSE_FILE := deploy/compose.yaml +COMPOSE_ENV_FILE := deploy/.env +COMPOSE_DEPLOY := $(COMPOSE) --env-file $(COMPOSE_ENV_FILE) -f $(COMPOSE_FILE) COMPOSE_PROJECT_NAME ?= control-plane COMPOSE_NETWORK := $(COMPOSE_PROJECT_NAME)_default -PROFILES ?= providers +PROFILES ?= +AUTH ?= COMPOSE ?= $(shell command -v podman-compose >/dev/null 2>&1 && echo podman-compose || \ (command -v docker-compose >/dev/null 2>&1 && echo docker-compose || \ @@ -54,12 +57,14 @@ run-dev: go run ./cmd/$(BINARY_NAME) # Platform stack: Postgres, NATS, control-plane, and dcm-ui (see deploy/compose.yaml). +# Optional: AUTH=true to also start Keycloak (uncomment auth vars in deploy/.env first). compose-up: - $(COMPOSE) -f $(COMPOSE_FILE) up -d --build + $(COMPOSE_DEPLOY) $(if $(filter true,$(AUTH)),--profile auth,) up -d --build # Platform stack with optional service providers (see deploy/RUN.md). +# Optional: AUTH=true to also start Keycloak. compose-up-with-providers: - $(COMPOSE) -f $(COMPOSE_FILE) --profile $(PROFILES) up -d --build + $(COMPOSE_DEPLOY) $(if $(filter true,$(AUTH)),--profile auth,) --profile $(or $(PROFILES),providers) up -d --build # Tear down the compose stack. Kind (or other externals) joined to the compose # network block "compose down" from removing it — disconnect them first. @@ -80,8 +85,8 @@ compose-down: fi; \ fi; \ done; \ - COMPOSE_PROJECT_NAME=deploy $(COMPOSE) -f $(COMPOSE_FILE) down -v --remove-orphans 2>/dev/null || true; \ - $(COMPOSE) -f $(COMPOSE_FILE) down -v --remove-orphans; \ + COMPOSE_PROJECT_NAME=deploy $(COMPOSE_DEPLOY) down -v --remove-orphans 2>/dev/null || true; \ + $(COMPOSE_DEPLOY) down -v --remove-orphans; \ for network in deploy_default $(COMPOSE_NETWORK); do \ if [ "$(CONTAINER_ENGINE)" = podman ]; then \ podman network rm -f "$$network" 2>/dev/null || true; \ @@ -107,6 +112,12 @@ GOLANGCI_LINT_VERSION ?= v2.12.2 GINKGO := go run github.com/onsi/ginkgo/v2/ginkgo GINKGO_FLAGS := -r --randomize-all --fail-on-pending +# Subsystem compose stacks read credentials from gitignored test/subsystem/.env. +subsystem-env: + @test -f test/subsystem/.env || cp test/subsystem/.env.example test/subsystem/.env + +auth-subsystem-test-up catalog-subsystem-test-up policy-subsystem-test-up sp-subsystem-test-up: subsystem-env + lint: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run ./... @@ -117,5 +128,5 @@ tidy: go mod tidy .PHONY: build build-gitops run run-dev compose-up compose-up-with-providers compose-down image-build \ - clean fmt vet lint test test-catalog test-placement test-policy test-sp test-gitops tidy \ + clean fmt vet lint test test-catalog test-placement test-policy test-sp test-gitops tidy subsystem-env \ helm-chart-sync helm-chart-verify-sync helm-chart-verify-admin-subject helm-chart-verify helm-chart-verify-schema helm-chart-lint helm-chart-template helm-chart-check diff --git a/README.md b/README.md index 96d51c5..9caa0f7 100644 --- a/README.md +++ b/README.md @@ -36,17 +36,20 @@ Run the monolith (pick one): |---------|---------------|----------|------------| | `make run` | host | SQLite at `/tmp/control-plane.db` | NATS disabled | | `make run-dev` | host | Postgres (`DB_*` defaults) | Postgres + NATS running locally | -| `make compose-up` | containers | Postgres in compose | also starts NATS, Keycloak, control-plane, and dcm-ui | +| `make compose-up` | containers | Postgres in compose | also starts NATS, control-plane, and dcm-ui (no Keycloak) | ```bash make run # SQLite, no containers +cp deploy/.env.example deploy/.env make compose-up # platform stack in containers +make compose-up AUTH=true # same + Keycloak when auth is enabled in .env make compose-down # stop stack and remove volumes ``` -Compose uses `POSTGRES_USER` and `POSTGRES_PASSWORD` (defaults in compose -are for local dev only). Override via environment or a `.env` file; see -`deploy/.env.example`. +Compose credentials live in `deploy/.env` (copy from `deploy/.env.example`). Keycloak +uses the `auth` compose profile — `make compose-up AUTH=true` after uncommenting the auth block +in `.env`. With providers: `make compose-up-with-providers PROFILES=kubevirt AUTH=true`. +Subsystem tests use the shared `test/subsystem/.env.example` file. Policy evaluation and placement provisioning run in-process in the monolith (`EvaluationService`, `PlacementService` via local clients). There is no public diff --git a/deploy/.env.example b/deploy/.env.example index c47d017..6a133b9 100644 --- a/deploy/.env.example +++ b/deploy/.env.example @@ -1,57 +1,59 @@ -# Optional: copy to .env in the repo root and set for local overrides. -# Used by deploy/compose.yaml. Defaults (admin / adminpass) are for local dev only. -# POSTGRES_USER=admin -# POSTGRES_PASSWORD=adminpass - -# --- Authentication --- -# Auth is disabled by default. Set AUTH_DISABLED=false to enable. -# DCM_ADMIN_SUBJECT is required when auth is enabled (must match a Keycloak user id). -# AUTH_DISABLED=true +# Copy to deploy/.env before starting the stack (see deploy/RUN.md). +# Lab defaults below — keep in sync with kubectl Secret blocks in RUN.md / deploy/helm/dcm/README.md. + +# === Required (default stack: postgres, nats, control-plane, dcm-ui) === +POSTGRES_USER=admin +POSTGRES_PASSWORD=adminpass +DB_USER=admin +DB_PASS=adminpass +DB_PASSWORD=adminpass + +# === Enable authentication (make compose-up AUTH=true) === +# KEYCLOAK_ADMIN=admin +# KEYCLOAK_ADMIN_PASSWORD=admin +# DCM_DEV_USER_PASSWORD=admin +# AUTH_PROXY_SECRET=dcm-dev-proxy-secret +# AUTH_DISABLED=false # AUTH_ISSUER_URL=http://keycloak:8080/realms/dcm # AUTH_JWT_AUDIENCE=dcm-api -# AUTH_PROXY_SECRET=dcm-dev-proxy-secret -# AUTH_CACHE_TTL=60s # DCM_ADMIN_SUBJECT=56deb662-4820-5d83-b828-f4beb11a5fa7 -# KEYCLOAK_ADMIN_PASSWORD=admin -# DCM_DEV_USER_PASSWORD=admin + +# === Optional knobs (image versions, SP profiles, ...) === +# CONTROL_PLANE_VERSION=main +# KUBEVIRT_SERVICE_PROVIDER_VERSION=main +# K8S_CONTAINER_SERVICE_PROVIDER_VERSION=main +# K8S_STORAGE_SERVICE_PROVIDER_VERSION=main +# ACM_CLUSTER_SERVICE_PROVIDER_VERSION=main +# THREE_TIER_DEMO_SERVICE_PROVIDER_VERSION=main +# DCM_UI_VERSION=main + +# ACM cluster service provider (profile: acm-cluster) +# ACM_CLUSTER_SP_PULL_SECRET= +# ACM_CLUSTER_SP_NAME=acm-cluster-sp +# ACM_CLUSTER_SP_BASE_DOMAIN=apps.example.com +# ACM_CLUSTER_SP_NAMESPACE=default +# ACM_CLUSTER_SP_KUBECONFIG=~/.kube/config +# ACM_CLUSTER_SP_DEFAULT_INFRA_ENV= +# ACM_CLUSTER_SP_AGENT_NAMESPACE= +# See compose.override.example.yaml for OpenShift route exposure on three-tier SP # K8s container service provider (profile: k8s-container) -# K8S_CONTAINER_SP_KUBECONFIG=/path/to/kubeconfig # K8S_CONTAINER_SP_NAMESPACE=default +# K8S_CONTAINER_SP_KUBECONFIG=~/.kube/config # K8S_CONTAINER_SP_NAME=k8s-container-provider # K8S_CONTAINER_SP_EXTERNAL_SVC_TYPE=NodePort # K8s storage service provider (profile: storage) -# K8S_STORAGE_SP_KUBECONFIG=/path/to/kubeconfig # K8S_STORAGE_SP_NAMESPACE=default +# K8S_STORAGE_SP_KUBECONFIG=~/.kube/config # K8S_STORAGE_SP_NAME=k8s-storage-provider # K8S_STORAGE_SP_DEFAULT_STORAGE_CLASS= # K8S_STORAGE_SP_DEFAULT_ACCESS_MODE=ReadWriteOnce # Three-tier demo app service provider (profile: three-tier) -# Same kubeconfig + cluster namespace as k8s-container (K8S_CONTAINER_SP_* above). # THREE_TIER_SP_NAME=three-tier-provider -# ACM cluster service provider (profile: acm-cluster) -# Supports two platforms: KubeVirt (default) and BareMetal. -# Both enabled by default (SP_ENABLED_PLATFORMS=kubevirt,baremetal). -# ACM_CLUSTER_SP_NAME=acm-cluster-sp -# ACM_CLUSTER_SP_BASE_DOMAIN=apps.example.com -# ACM_CLUSTER_SP_PULL_SECRET= -# BareMetal platform only — not used by KubeVirt: -# ACM_CLUSTER_SP_DEFAULT_INFRA_ENV=my-infra-env -# ACM_CLUSTER_SP_AGENT_NAMESPACE=my-agent-namespace - -# --- Service image versions --- -# Pin specific versions instead of "main". Valid values: -# main - most recent main build (default) -# v0.0.1 - final release (from git tag) -# v0.0.1-rc.3 - release candidate (from release branch) -# abc1234 - specific commit build (for local testing only) -# CONTROL_PLANE_VERSION=main -# KUBEVIRT_SERVICE_PROVIDER_VERSION=main -# K8S_CONTAINER_SERVICE_PROVIDER_VERSION=main -# K8S_STORAGE_SERVICE_PROVIDER_VERSION=main -# ACM_CLUSTER_SERVICE_PROVIDER_VERSION=main -# THREE_TIER_DEMO_SERVICE_PROVIDER_VERSION=main -# DCM_UI_VERSION=main +# KubeVirt service provider (profile: kubevirt) +# KUBEVIRT_KUBECONFIG=~/.kube/config +# KUBEVIRT_PROVIDER_NAME=kubevirt-service-provider +# KUBERNETES_NAMESPACE=default diff --git a/deploy/RUN.md b/deploy/RUN.md index d410671..bf2aebe 100644 --- a/deploy/RUN.md +++ b/deploy/RUN.md @@ -9,17 +9,27 @@ ## Quick start -Start the core platform (postgres, nats, keycloak, control-plane, and dcm-ui): +Start the core platform (postgres, nats, control-plane, and dcm-ui): ```bash +cp deploy/.env.example deploy/.env make compose-up ``` +`deploy/.env` holds database credentials and optional auth settings. Lab defaults are in +`deploy/.env.example`; copy and edit before first start. + +`make compose-up` and `docker compose --env-file deploy/.env -f deploy/compose.yaml up` are +equivalent; the Makefile target is a thin wrapper around Compose. + The control-plane API is at `http://localhost:8080`. DCM UI is at `http://localhost:7007`. -Authentication is **disabled by default** (`AUTH_DISABLED=true`). See +Authentication is **disabled by default** (`AUTH_DISABLED=true`). Keycloak is behind the +`auth` compose profile and does not start with `make compose-up`. See [Authentication](#authentication) for enabling it and current limitations. +`dcm login` requires Keycloak — use `make compose-up AUTH=true` after enabling auth in `.env`. + ## CLI configuration The [DCM CLI](https://github.com/dcm-project/cli) uses the same control-plane URL by default @@ -37,22 +47,19 @@ Service providers are behind compose profiles and do not start by default. ### KubeVirt service provider -To include the `kubevirt-service-provider`, set the required environment variables and -activate the `kubevirt` profile: +To include the `kubevirt-service-provider`, activate the `kubevirt` profile. Each provider +mounts a host kubeconfig at `/kubeconfig` (default `~/.kube/config`; override with +`KUBEVIRT_KUBECONFIG` in `deploy/.env` or the shell). ```bash -export KUBERNETES_NAMESPACE=vms -export KUBEVIRT_KUBECONFIG="/path/to/kubeconfig" make compose-up-with-providers PROFILES=kubevirt ``` ### K8s container service provider -To include the `k8s-container-service-provider`, set the required environment variables and -activate the `k8s-container` profile: +To include the `k8s-container-service-provider`, activate the `k8s-container` profile: ```bash -export K8S_CONTAINER_SP_KUBECONFIG="/path/to/kubeconfig" make compose-up-with-providers PROFILES=k8s-container ``` @@ -67,11 +74,9 @@ export K8S_CONTAINER_SP_EXTERNAL_SVC_TYPE=LoadBalancer ### K8s storage service provider -To include the `k8s-storage-service-provider`, set the required environment variables and -activate the `storage` profile: +To include the `k8s-storage-service-provider`, activate the `storage` profile: ```bash -export K8S_STORAGE_SP_KUBECONFIG="/path/to/kubeconfig" make compose-up-with-providers PROFILES=storage ``` @@ -86,12 +91,12 @@ export K8S_STORAGE_SP_DEFAULT_ACCESS_MODE=ReadWriteOnce ### ACM cluster service provider -To include the `acm-cluster-service-provider`, set the required environment variables and -activate the `acm-cluster` profile: +To include the `acm-cluster-service-provider`, set `ACM_CLUSTER_SP_PULL_SECRET` in +`deploy/.env` (base64-encoded `.dockerconfigjson`) and activate the `acm-cluster` profile: ```bash -export ACM_CLUSTER_SP_KUBECONFIG="/path/to/kubeconfig" -export ACM_CLUSTER_SP_PULL_SECRET="" +# In deploy/.env: +# ACM_CLUSTER_SP_PULL_SECRET= make compose-up-with-providers PROFILES=acm-cluster ``` @@ -112,11 +117,9 @@ export ACM_CLUSTER_SP_AGENT_NAMESPACE="my-agent-namespace" ### Three-tier demo app service provider -To include the `three-tier-demo-service-provider`, set the required environment variables and -activate the `three-tier` profile: +To include the `three-tier-demo-service-provider`, activate the `three-tier` profile: ```bash -export K8S_CONTAINER_SP_KUBECONFIG="/path/to/kubeconfig" make compose-up-with-providers PROFILES=three-tier ``` @@ -134,20 +137,15 @@ export K8S_CONTAINER_SP_NAMESPACE=default ### All providers -To start all providers at once, set the required environment variables and run: +To start all providers at once, run: ```bash -export KUBEVIRT_KUBECONFIG="/path/to/kubeconfig" -export K8S_CONTAINER_SP_KUBECONFIG="/path/to/kubeconfig" -export K8S_STORAGE_SP_KUBECONFIG="/path/to/kubeconfig" -export ACM_CLUSTER_SP_KUBECONFIG="/path/to/kubeconfig" -export ACM_CLUSTER_SP_PULL_SECRET="" -# BareMetal only: -export ACM_CLUSTER_SP_DEFAULT_INFRA_ENV="my-infra-env" -export ACM_CLUSTER_SP_AGENT_NAMESPACE="my-agent-namespace" make compose-up-with-providers ``` +If the `acm-cluster` provider is included, set `ACM_CLUSTER_SP_PULL_SECRET` in +`deploy/.env` first. + This defaults to the `providers` Compose profile (all service providers, including the three-tier demo SP). To start a single provider instead, pass `PROFILES=`: @@ -161,10 +159,10 @@ make compose-up-with-providers PROFILES=three-tier ## Authentication -The compose stack includes [Keycloak](https://www.keycloak.org/) (`:8180`) as the identity -provider. The control-plane validates JWT bearer tokens directly against Keycloak's -JWKS endpoint using OIDC discovery (no external auth proxy required). A proxy-header -fallback path (`X-Auth-Proxy-Secret` + `X-Forwarded-User`) is also supported. +Keycloak (`:8180`) is the identity provider when the `auth` compose profile is active. +The control-plane validates JWT bearer tokens directly against Keycloak's JWKS endpoint +using OIDC discovery (no external auth proxy required). A proxy-header fallback path +(`X-Auth-Proxy-Secret` + `X-Forwarded-User`) is also supported. Authentication is disabled by default (`AUTH_DISABLED=true`). When enabled, the CLI (`dcm login` / bearer token) and direct JWT API calls work; service providers do not @@ -173,11 +171,17 @@ forward authentication headers yet, so SP ↔ control-plane traffic may fail. To enable authentication (Compose): ```bash -AUTH_DISABLED=false AUTH_ISSUER_URL=http://keycloak:8080/realms/dcm make compose-up +cp deploy/.env.example deploy/.env +# Uncomment the "Enable authentication" block in deploy/.env +make compose-up AUTH=true ``` -For Helm chart installs, see [helm/dcm/README.md](helm/dcm/README.md#authentication) -(`auth.enabled=true`). +Auth credentials live only in `deploy/.env` (see `deploy/.env.example`). Keycloak does +not start with `make compose-up`; pass `AUTH=true` when auth is enabled in `.env`. +With service providers: `make compose-up-with-providers PROFILES=kubevirt AUTH=true`. + +For Helm chart installs, create the `dcm-auth` Secret and set `auth.enabled=true` — see +[helm/dcm/README.md](helm/dcm/README.md#authentication). > **Warning:** Service providers do not forward authentication headers yet, so enabling > auth can break SP workflows. The CLI (`dcm login` / bearer token) and direct API @@ -190,14 +194,18 @@ When enabled, the control-plane authenticates requests via two paths (tried in o The `/api/v1alpha1/health` endpoint is always unauthenticated. -Pre-configured credentials (local dev only): +Pre-configured lab credentials (set in `deploy/.env.example`): | Service | URL | Username | Password | |---|---|---|---| -| Keycloak admin console | `http://localhost:8180` | `admin` | `admin` | -| DCM user (Keycloak) | — | `dcm-admin` | `admin` | - -The Keycloak realm is imported from `deploy/keycloak/realm-export.json` and includes +| Keycloak admin console | `http://localhost:8180` | `admin` | `admin` (`KEYCLOAK_ADMIN_PASSWORD`) | +| DCM user (Keycloak) | — | `dcm-admin` | `admin` (`DCM_DEV_USER_PASSWORD`) | + +The Keycloak realm is imported from `deploy/keycloak/realm-export.json` at container +start. The `dcm-admin` password is resolved from the `DCM_DEV_USER_PASSWORD` environment +variable via Keycloak's native import placeholders (`start-dev --import-realm`). +Prefer simple lab passwords; values with +`"`, `\`, or `$` may break native placeholder substitution. The realm includes two clients: `dcm-proxy` (confidential, for service-to-service access) and `dcm-cli` (public, for the DCM CLI device auth grant flow). @@ -236,10 +244,10 @@ Check health endpoint through DCM UI: curl http://localhost:7007/api/dcm/health ``` -When authentication is enabled, verify Keycloak is ready: +When authentication is enabled (`make compose-up AUTH=true`), verify Keycloak is ready: ```bash -podman compose -f deploy/compose.yaml exec keycloak curl -sf http://localhost:9000/health/ready | jq . +podman compose -f deploy/compose.yaml --profile auth exec keycloak curl -sf http://localhost:9000/health/ready | jq . ``` ## Stopping services @@ -255,35 +263,37 @@ the compose network (see [k8s-container-sp-kind.md](docs/k8s-container-sp-kind.m ## Configuration +Database, auth, and ACM pull-secret credentials are defined in `deploy/.env.example` +(copy to `deploy/.env`). The table below lists non-secret knobs and provider settings. + | Variable | Default | Description | | ------------------------------------------ | --------------------------- | ----------------------------------------------------------------------------------------------------------- | -| `AUTH_DISABLED` | `true` | Disable authentication (default `true`; see [Authentication](#authentication)) | -| `AUTH_ISSUER_URL` | _(empty)_ | OIDC issuer URL for JWT validation (e.g. `http://keycloak:8080/realms/dcm`). Empty = JWT path disabled. | -| `AUTH_JWT_AUDIENCE` | _(empty)_ | Expected `aud` claim in JWT tokens. Empty = audience check skipped. | -| `AUTH_PROXY_SECRET` | `dcm-dev-proxy-secret` | Shared secret for proxy-header fallback auth path | +| `AUTH_DISABLED` | `true` | Disable authentication (see [Authentication](#authentication); set in `.env`) | +| `AUTH_ISSUER_URL` | _(empty)_ | OIDC issuer URL for JWT validation (e.g. `http://keycloak:8080/realms/dcm`) | +| `AUTH_JWT_AUDIENCE` | `dcm-api` | Expected `aud` claim in JWT tokens | +| `AUTH_PROXY_SECRET` | _(in `.env.example`) | Shared secret for proxy-header fallback auth path | | `AUTH_CACHE_TTL` | `60s` | TTL for the actor resolution cache | -| `DCM_ADMIN_SUBJECT` | `56deb662-...` _(see below)_ | Keycloak subject UUID for the bootstrap admin actor (required when auth enabled) | -| `KEYCLOAK_ADMIN_PASSWORD` | `admin` | Keycloak admin console password | -| `DCM_DEV_USER_PASSWORD` | `admin` | Password for the `dcm-admin` dev user in Keycloak | -| `POSTGRES_USER` | `admin` | PostgreSQL username | -| `POSTGRES_PASSWORD` | `adminpass` | PostgreSQL password | +| `DCM_ADMIN_SUBJECT` | `56deb662-...` | Keycloak subject UUID for the bootstrap admin actor (required when auth enabled) | +| `POSTGRES_USER` / `POSTGRES_PASSWORD` | _(in `.env.example`) | PostgreSQL credentials (also `DB_USER`, `DB_PASS`, `DB_PASSWORD`) | +| `KEYCLOAK_ADMIN_PASSWORD` | _(in `.env.example`) | Keycloak admin console password | +| `DCM_DEV_USER_PASSWORD` | _(in `.env.example`) | Password for the `dcm-admin` dev user in Keycloak | | `KUBERNETES_NAMESPACE` | `default` | Kubernetes namespace for KubeVirt VMs | -| `KUBEVIRT_KUBECONFIG` | `~/.kube/config` | Path to kubeconfig on the host | +| `KUBEVIRT_KUBECONFIG` | `~/.kube/config` | Host path to kubeconfig for the kubevirt-service-provider | | `KUBEVIRT_PROVIDER_NAME` | `kubevirt-service-provider` | Provider name and Compose service `container_name` | -| `K8S_CONTAINER_SP_KUBECONFIG` | `~/.kube/config` | Path to kubeconfig on the host for the k8s-container-service-provider | +| `K8S_CONTAINER_SP_KUBECONFIG` | `~/.kube/config` | Host path to kubeconfig for the k8s-container and three-tier service providers | | `K8S_CONTAINER_SP_NAMESPACE` | `default` | Kubernetes namespace for k8s containers | | `K8S_CONTAINER_SP_NAME` | `k8s-container-provider` | Provider name for the k8s-container-service-provider | | `K8S_CONTAINER_SP_EXTERNAL_SVC_TYPE` | `NodePort` | Kubernetes Service type for external ports (`NodePort` or `LoadBalancer`) | -| `K8S_STORAGE_SP_KUBECONFIG` | `~/.kube/config` | Path to kubeconfig on the host for the k8s-storage-service-provider | +| `K8S_STORAGE_SP_KUBECONFIG` | `~/.kube/config` | Host path to kubeconfig for the k8s-storage-service-provider | | `K8S_STORAGE_SP_NAMESPACE` | `default` | Kubernetes namespace used by the k8s-storage-service-provider | | `K8S_STORAGE_SP_NAME` | `k8s-storage-provider` | Provider name for the k8s-storage-service-provider | | `K8S_STORAGE_SP_DEFAULT_STORAGE_CLASS` | _(empty)_ | Optional fallback StorageClass when request hints do not set one | | `K8S_STORAGE_SP_DEFAULT_ACCESS_MODE` | `ReadWriteOnce` | Optional fallback access mode when request hints do not set one | -| `ACM_CLUSTER_SP_KUBECONFIG` | `~/.kube/config` | Path to kubeconfig on the host for the acm-cluster-service-provider | +| `ACM_CLUSTER_SP_KUBECONFIG` | `~/.kube/config` | Host path to kubeconfig for the acm-cluster-service-provider | | `ACM_CLUSTER_SP_NAMESPACE` | `default` | Kubernetes namespace for ACM hosted clusters | | `ACM_CLUSTER_SP_NAME` | `acm-cluster-sp` | Provider name for the acm-cluster-service-provider | | `ACM_CLUSTER_SP_BASE_DOMAIN` | _(none)_ | Base DNS domain for hosted clusters; can be overridden per-request via `provider_hints.acm.base_domain` | -| `ACM_CLUSTER_SP_PULL_SECRET` | _(required)_ | Base64-encoded dockerconfigjson pull secret for ACM hosted clusters | +| `ACM_CLUSTER_SP_PULL_SECRET` | _(in `.env`) | Base64-encoded dockerconfigjson pull secret for ACM hosted clusters (required for `acm-cluster` profile) | | `ACM_CLUSTER_SP_DEFAULT_INFRA_ENV` | _(none)_ | **BareMetal only.** Default InfraEnv name; can be overridden per-request via `provider_hints.acm.infra_env` | | `ACM_CLUSTER_SP_AGENT_NAMESPACE` | _(none)_ | **BareMetal only.** Namespace where Agent resources are located | | `CONTROL_PLANE_VERSION` | `main` | Image tag for control-plane monolith | @@ -299,4 +309,6 @@ See [Image versions](../README.md#image-versions) in the README for available ta ## Kubernetes / OpenShift -See [helm/dcm/README.md](helm/dcm/README.md). +See [helm/dcm/README.md](helm/dcm/README.md). Create Kubernetes Secrets before install +(`dcm-db` always; `dcm-auth` when `auth.enabled=true`; `dcm-acm-pull-secret` when ACM SP +is enabled). Lab `kubectl create secret` examples are in the Helm README. diff --git a/deploy/compose.yaml b/deploy/compose.yaml index 1877580..f34762a 100644 --- a/deploy/compose.yaml +++ b/deploy/compose.yaml @@ -3,36 +3,30 @@ # Image version: defaults to :main. Pin with CONTROL_PLANE_VERSION in .env. # Local dev: `make compose-up` builds control-plane from the repo Containerfile. # -# Credentials: set POSTGRES_USER and POSTGRES_PASSWORD in the environment or in -# a .env file (see deploy/.env.example). Defaults are for local dev only. +# Credentials: copy deploy/.env.example to deploy/.env before starting (see deploy/RUN.md). +# Keycloak uses profile "auth" — pass AUTH=true to make compose-up / compose-up-with-providers. x-db-common: &db-common DB_TYPE: pgsql DB_HOST: postgres DB_PORT: "5432" - DB_USER: ${POSTGRES_USER:-admin} - DB_PASS: ${POSTGRES_PASSWORD:-adminpass} - DB_PASSWORD: ${POSTGRES_PASSWORD:-adminpass} x-dcm-registration-url: &dcm-registration-url "http://control-plane:8080/api/v1alpha1" services: keycloak: - image: quay.io/keycloak/keycloak:26.0 - entrypoint: ["/bin/sh", "-c"] - command: - - "mkdir -p /opt/keycloak/data/import && content=$$(cat /opt/keycloak/data/realm-template.json) && printf '%s' \"$${content//REPLACE_DCM_DEV_PASSWORD/$$DCM_DEV_USER_PASSWORD}\" > /opt/keycloak/data/import/realm-export.json && exec /opt/keycloak/bin/kc.sh start-dev --import-realm" + profiles: ["auth"] + image: quay.io/keycloak/keycloak:26.0.1 + command: ["start-dev", "--import-realm"] + env_file: .env environment: KC_HEALTH_ENABLED: "true" KC_HOSTNAME: "http://keycloak:8080" KC_HOSTNAME_STRICT: "false" - KEYCLOAK_ADMIN: admin - KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin} - DCM_DEV_USER_PASSWORD: ${DCM_DEV_USER_PASSWORD:-admin} ports: - "8180:8080" volumes: - - ./keycloak/realm-export.json:/opt/keycloak/data/realm-template.json:ro,z + - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro,z healthcheck: test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/9000 && echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep -q '\"status\": \"UP\"'"] interval: 10s @@ -42,17 +36,16 @@ services: postgres: image: docker.io/library/postgres:16-alpine + env_file: .env environment: POSTGRES_DB: postgres - POSTGRES_USER: ${POSTGRES_USER:-admin} - POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-adminpass} ports: - "5432:5432" volumes: - postgres_data:/var/lib/postgresql/data - ./postgres-init:/docker-entrypoint-initdb.d:ro,z healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-admin} -d postgres"] + test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d postgres"] interval: 5s timeout: 5s retries: 5 @@ -71,17 +64,16 @@ services: dockerfile: Containerfile image: quay.io/dcm-project/control-plane:${CONTROL_PLANE_VERSION:-main} pull_policy: always + restart: on-failure + env_file: .env environment: <<: *db-common BIND_ADDRESS: ":8080" DB_NAME: control-plane LOG_LEVEL: info NATS_URL: "nats://nats:4222" - DCM_ADMIN_SUBJECT: ${DCM_ADMIN_SUBJECT:-56deb662-4820-5d83-b828-f4beb11a5fa7} + # Compose interpolates this on the host; make compose-up passes --env-file deploy/.env. AUTH_DISABLED: ${AUTH_DISABLED:-true} - AUTH_PROXY_SECRET: ${AUTH_PROXY_SECRET:-dcm-dev-proxy-secret} - AUTH_ISSUER_URL: ${AUTH_ISSUER_URL:-} - AUTH_JWT_AUDIENCE: ${AUTH_JWT_AUDIENCE:-} ports: - "8080:8080" depends_on: @@ -89,8 +81,6 @@ services: condition: service_healthy nats: condition: service_started - keycloak: - condition: service_healthy kubevirt-service-provider: container_name: ${KUBEVIRT_PROVIDER_NAME:-kubevirt-service-provider} @@ -136,16 +126,17 @@ services: profiles: ["providers", "acm-cluster"] image: quay.io/dcm-project/acm-cluster-service-provider:${ACM_CLUSTER_SERVICE_PROVIDER_VERSION:-main} pull_policy: always + env_file: .env environment: SP_NAME: ${ACM_CLUSTER_SP_NAME:-acm-cluster-sp} SP_ENDPOINT: "http://acm-cluster-service-provider:8080" DCM_REGISTRATION_URL: *dcm-registration-url SP_NATS_URL: "nats://nats:4222" SP_CLUSTER_NAMESPACE: ${ACM_CLUSTER_SP_NAMESPACE:-default} - SP_BASE_DOMAIN: ${ACM_CLUSTER_SP_BASE_DOMAIN} - SP_PULL_SECRET: ${ACM_CLUSTER_SP_PULL_SECRET} - SP_DEFAULT_INFRA_ENV: ${ACM_CLUSTER_SP_DEFAULT_INFRA_ENV} - SP_AGENT_NAMESPACE: ${ACM_CLUSTER_SP_AGENT_NAMESPACE} + SP_BASE_DOMAIN: ${ACM_CLUSTER_SP_BASE_DOMAIN:-} + SP_PULL_SECRET: ${ACM_CLUSTER_SP_PULL_SECRET:-} + SP_DEFAULT_INFRA_ENV: ${ACM_CLUSTER_SP_DEFAULT_INFRA_ENV:-} + SP_AGENT_NAMESPACE: ${ACM_CLUSTER_SP_AGENT_NAMESPACE:-} KUBECONFIG: /kubeconfig expose: - "8080" @@ -197,6 +188,7 @@ services: profiles: ["providers", "three-tier"] image: quay.io/dcm-project/three-tier-app-demo-service-provider:${THREE_TIER_DEMO_SERVICE_PROVIDER_VERSION:-main} pull_policy: always + env_file: .env environment: <<: *db-common DB_NAME: three-tier-sp diff --git a/deploy/keycloak/realm-export.json b/deploy/keycloak/realm-export.json index df358db..ae2b684 100644 --- a/deploy/keycloak/realm-export.json +++ b/deploy/keycloak/realm-export.json @@ -12,7 +12,7 @@ "enabled": true, "protocol": "openid-connect", "publicClient": false, - "secret": "dcm-proxy-secret", + "secret": "${AUTH_PROXY_SECRET}", "directAccessGrantsEnabled": true, "serviceAccountsEnabled": true, "standardFlowEnabled": false, @@ -70,7 +70,7 @@ "credentials": [ { "type": "password", - "value": "REPLACE_DCM_DEV_PASSWORD", + "value": "${DCM_DEV_USER_PASSWORD}", "temporary": false } ] diff --git a/make/auth.mk b/make/auth.mk index 2d782d0..2e692b1 100644 --- a/make/auth.mk +++ b/make/auth.mk @@ -1,7 +1,7 @@ # Auth domain (subsystem tests). AUTH_DOMAIN := auth -AUTH_COMPOSE = COMPOSE_PROJECT_NAME=auth-subsystem $(COMPOSE) -f test/subsystem/$(AUTH_DOMAIN)/docker-compose.yaml +AUTH_COMPOSE = COMPOSE_PROJECT_NAME=auth-subsystem $(COMPOSE) --env-file test/subsystem/.env -f test/subsystem/$(AUTH_DOMAIN)/docker-compose.yaml auth-subsystem-test-up: $(AUTH_COMPOSE) up -d --build @@ -9,7 +9,7 @@ auth-subsystem-test-up: auth-subsystem-test-down: $(AUTH_COMPOSE) down -v -auth-subsystem-test: - $(GINKGO) $(GINKGO_FLAGS) -tags=subsystem ./test/subsystem/$(AUTH_DOMAIN) +auth-subsystem-test: subsystem-env + set -a && . test/subsystem/.env && set +a && $(GINKGO) $(GINKGO_FLAGS) -tags=subsystem ./test/subsystem/$(AUTH_DOMAIN) .PHONY: auth-subsystem-test-up auth-subsystem-test-down auth-subsystem-test diff --git a/test/subsystem/.env.example b/test/subsystem/.env.example new file mode 100644 index 0000000..993fdf9 --- /dev/null +++ b/test/subsystem/.env.example @@ -0,0 +1,13 @@ +# Copy to test/subsystem/.env before any make *-subsystem-test-up. +POSTGRESQL_USER=test_user +POSTGRESQL_PASSWORD=test_password +POSTGRESQL_ADMIN_PASSWORD=test_admin_password +DB_USER=test_user +DB_PASSWORD=test_password +KEYCLOAK_ADMIN=admin +KEYCLOAK_ADMIN_PASSWORD=admin +DCM_DEV_USER_PASSWORD=admin +AUTH_PROXY_SECRET=test-proxy-secret +AUTH_ISSUER_URL=http://keycloak:8080/realms/dcm +AUTH_JWT_AUDIENCE=dcm-api +DCM_ADMIN_SUBJECT=56deb662-4820-5d83-b828-f4beb11a5fa7 diff --git a/test/subsystem/auth/docker-compose.yaml b/test/subsystem/auth/docker-compose.yaml index 1093052..93ffa5d 100644 --- a/test/subsystem/auth/docker-compose.yaml +++ b/test/subsystem/auth/docker-compose.yaml @@ -1,20 +1,17 @@ -# Auth subsystem test stack. Runs with AUTH_DISABLED=false to exercise -# the full authentication middleware, JIT provisioning, and OIDC flow. +# Auth subsystem test stack. Shared env: test/subsystem/.env (see .env.example). services: postgres: image: quay.io/sclorg/postgresql-16-c9s:latest + env_file: ../.env environment: POSTGRESQL_DATABASE: auth_test - POSTGRESQL_USER: ${POSTGRES_USER:-test_user} - POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD:-test_password} - POSTGRESQL_ADMIN_PASSWORD: ${POSTGRES_PASSWORD:-test_password} ports: - "25432:5432" volumes: - postgres_data:/var/lib/pgsql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-test_user} -d auth_test"] + test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRESQL_USER\" -d auth_test"] interval: 5s timeout: 5s retries: 5 @@ -24,33 +21,30 @@ services: # actor already seeded into auth_test by the main control-plane service. db-init-noadmin: image: quay.io/sclorg/postgresql-16-c9s:latest + env_file: ../.env entrypoint: ["/bin/sh", "-c"] command: - > - PGPASSWORD=${POSTGRES_PASSWORD:-test_password} psql -h postgres -U postgres -tc + PGPASSWORD=$${POSTGRESQL_ADMIN_PASSWORD} psql -h postgres -U postgres -d postgres -tc "SELECT 1 FROM pg_database WHERE datname = 'auth_test_noadmin'" | grep -q 1 || - PGPASSWORD=${POSTGRES_PASSWORD:-test_password} psql -h postgres -U postgres -c - "CREATE DATABASE auth_test_noadmin OWNER ${POSTGRES_USER:-test_user}" + PGPASSWORD=$${POSTGRESQL_ADMIN_PASSWORD} psql -h postgres -U postgres -d postgres -c + "CREATE DATABASE auth_test_noadmin OWNER $${POSTGRESQL_USER}" depends_on: postgres: condition: service_healthy keycloak: - image: quay.io/keycloak/keycloak:26.0 - entrypoint: ["/bin/sh", "-c"] - command: - - "mkdir -p /opt/keycloak/data/import && content=$$(cat /opt/keycloak/data/realm-template.json) && printf '%s' \"$${content//REPLACE_DCM_DEV_PASSWORD/$$DCM_DEV_USER_PASSWORD}\" > /opt/keycloak/data/import/realm-export.json && exec /opt/keycloak/bin/kc.sh start-dev --import-realm" + image: quay.io/keycloak/keycloak:26.0.1 + command: ["start-dev", "--import-realm"] + env_file: ../.env environment: KC_HEALTH_ENABLED: "true" KC_HOSTNAME: "http://keycloak:8080" KC_HOSTNAME_STRICT: "false" - KEYCLOAK_ADMIN: admin - KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin} - DCM_DEV_USER_PASSWORD: ${DCM_DEV_USER_PASSWORD:-admin} ports: - "28180:8080" volumes: - - ../../../deploy/keycloak/realm-export.json:/opt/keycloak/data/realm-template.json:ro,z + - ../../../deploy/keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro,z healthcheck: test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/9000 && echo -e 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | grep -q '\"status\": \"UP\"'"] interval: 10s @@ -63,21 +57,16 @@ services: context: ../../.. dockerfile: Containerfile image: auth-subsystem-control-plane:latest + env_file: ../.env environment: BIND_ADDRESS: "0.0.0.0:8080" DB_TYPE: pgsql DB_HOST: postgres DB_PORT: "5432" DB_NAME: auth_test - DB_USER: ${POSTGRES_USER:-test_user} - DB_PASSWORD: ${POSTGRES_PASSWORD:-test_password} NATS_DISABLED: "true" AUTH_DISABLED: "false" - AUTH_PROXY_SECRET: "test-proxy-secret" - AUTH_ISSUER_URL: "http://keycloak:8080/realms/dcm" - AUTH_JWT_AUDIENCE: "dcm-api" AUTH_CACHE_TTL: "2s" - DCM_ADMIN_SUBJECT: "56deb662-4820-5d83-b828-f4beb11a5fa7" LOG_LEVEL: debug ports: - "28080:8080" @@ -110,11 +99,11 @@ services: DB_HOST: postgres DB_PORT: "5432" DB_NAME: auth_test - DB_USER: ${POSTGRES_USER:-test_user} - DB_PASSWORD: ${POSTGRES_PASSWORD:-test_password} + DB_USER: ${POSTGRESQL_USER:-test_user} + DB_PASSWORD: ${POSTGRESQL_PASSWORD:-test_password} NATS_DISABLED: "true" AUTH_DISABLED: "false" - AUTH_PROXY_SECRET: "test-proxy-secret" + AUTH_PROXY_SECRET: ${AUTH_PROXY_SECRET:-test-proxy-secret} DCM_ADMIN_SUBJECT: "56deb662-4820-5d83-b828-f4beb11a5fa7" LOG_LEVEL: debug ports: @@ -145,8 +134,8 @@ services: DB_HOST: postgres DB_PORT: "5432" DB_NAME: auth_test_noadmin - DB_USER: ${POSTGRES_USER:-test_user} - DB_PASSWORD: ${POSTGRES_PASSWORD:-test_password} + DB_USER: ${POSTGRESQL_USER:-test_user} + DB_PASSWORD: ${POSTGRESQL_PASSWORD:-test_password} NATS_DISABLED: "true" AUTH_DISABLED: "true" DCM_ADMIN_SUBJECT: "" diff --git a/test/subsystem/auth/helpers_test.go b/test/subsystem/auth/helpers_test.go index 8fc5e5a..6a04944 100644 --- a/test/subsystem/auth/helpers_test.go +++ b/test/subsystem/auth/helpers_test.go @@ -24,8 +24,8 @@ func getKeycloakAdminToken() string { resp, err := httpClient.PostForm(tokenURL, url.Values{ "grant_type": {"password"}, "client_id": {"admin-cli"}, - "username": {"admin"}, - "password": {"admin"}, + "username": {envOrDefault("KEYCLOAK_ADMIN", "admin")}, + "password": {envOrDefault("KEYCLOAK_ADMIN_PASSWORD", "admin")}, }) Expect(err).NotTo(HaveOccurred()) defer resp.Body.Close() @@ -87,7 +87,7 @@ func getUserToken(username, password string) string { resp, err := httpClient.PostForm(tokenURL, url.Values{ "grant_type": {"password"}, "client_id": {"dcm-proxy"}, - "client_secret": {"dcm-proxy-secret"}, + "client_secret": {proxySecret}, "username": {username}, "password": {password}, }) @@ -229,7 +229,7 @@ func getServiceAccountToken() string { resp, err := httpClient.PostForm(tokenURL, url.Values{ "grant_type": {"client_credentials"}, "client_id": {"dcm-proxy"}, - "client_secret": {"dcm-proxy-secret"}, + "client_secret": {proxySecret}, }) Expect(err).NotTo(HaveOccurred()) defer resp.Body.Close() diff --git a/test/subsystem/auth/suite_test.go b/test/subsystem/auth/suite_test.go index fb303b6..45220ed 100644 --- a/test/subsystem/auth/suite_test.go +++ b/test/subsystem/auth/suite_test.go @@ -6,6 +6,7 @@ import ( "database/sql" "fmt" "net/http" + "net/url" "os" "testing" "time" @@ -42,8 +43,8 @@ var _ = BeforeSuite(func() { keycloakURL = envOrDefault("KEYCLOAK_URL", "http://localhost:28180") proxySecret = envOrDefault("AUTH_PROXY_SECRET", "test-proxy-secret") adminSubject = envOrDefault("DCM_ADMIN_SUBJECT", "56deb662-4820-5d83-b828-f4beb11a5fa7") - dbConnStr = envOrDefault("DB_CONN_STR", "postgres://test_user:test_password@localhost:25432/auth_test?sslmode=disable") - dbNoAdminStr = envOrDefault("DB_NOADMIN_CONN_STR", "postgres://test_user:test_password@localhost:25432/auth_test_noadmin?sslmode=disable") + dbConnStr = envOrDefault("DB_CONN_STR", defaultDBConnStr("auth_test")) + dbNoAdminStr = envOrDefault("DB_NOADMIN_CONN_STR", defaultDBConnStr("auth_test_noadmin")) var err error db, err = sql.Open("pgx", dbConnStr) @@ -87,3 +88,13 @@ func envOrDefault(key, defaultVal string) string { } return defaultVal } + +func defaultDBConnStr(database string) string { + user := envOrDefault("POSTGRESQL_USER", "test_user") + pass := envOrDefault("POSTGRESQL_PASSWORD", "test_password") + return fmt.Sprintf( + "postgres://%s@localhost:25432/%s?sslmode=disable", + url.UserPassword(user, pass).String(), + database, + ) +} diff --git a/test/subsystem/catalog/docker-compose.yaml b/test/subsystem/catalog/docker-compose.yaml index f4aac56..b9fd428 100644 --- a/test/subsystem/catalog/docker-compose.yaml +++ b/test/subsystem/catalog/docker-compose.yaml @@ -1,19 +1,17 @@ -# Catalog subsystem test stack. Credentials: set POSTGRES_USER and -# POSTGRES_PASSWORD in the environment or in a .env file (see ../../../.env.example). +# Catalog subsystem test stack. Shared env: test/subsystem/.env (see .env.example). services: postgres: image: quay.io/sclorg/postgresql-16-c9s:latest + env_file: ../.env environment: POSTGRESQL_DATABASE: catalog_manager_test - POSTGRESQL_USER: ${POSTGRES_USER:-test_user} - POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD:-test_password} ports: - "5432:5432" volumes: - postgres_data:/var/lib/pgsql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-test_user} -d catalog_manager_test"] + test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRESQL_USER\" -d catalog_manager_test"] interval: 5s timeout: 5s retries: 5 @@ -32,14 +30,13 @@ services: build: context: ../../.. dockerfile: Containerfile + env_file: ../.env environment: BIND_ADDRESS: "0.0.0.0:8080" DB_TYPE: pgsql DB_HOST: postgres DB_PORT: "5432" DB_NAME: catalog_manager_test - DB_USER: ${POSTGRES_USER:-test_user} - DB_PASSWORD: ${POSTGRES_PASSWORD:-test_password} PLACEMENT_MANAGER_URL: "http://placement-manager:8080" NATS_DISABLED: "true" AUTH_DISABLED: "true" diff --git a/test/subsystem/policy/docker-compose.yaml b/test/subsystem/policy/docker-compose.yaml index 195639d..ae9c1b3 100644 --- a/test/subsystem/policy/docker-compose.yaml +++ b/test/subsystem/policy/docker-compose.yaml @@ -1,19 +1,17 @@ -# Policy subsystem test stack. Credentials: set POSTGRES_USER and -# POSTGRES_PASSWORD in the environment or in a .env file (see ../../../.env.example). +# Policy subsystem test stack. Shared env: test/subsystem/.env (see .env.example). services: postgres: image: quay.io/sclorg/postgresql-16-c9s:latest + env_file: ../.env environment: POSTGRESQL_DATABASE: policy_manager_test - POSTGRESQL_USER: ${POSTGRES_USER:-test_user} - POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD:-test_password} ports: - "5432:5432" volumes: - postgres_data:/var/lib/pgsql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-test_user} -d policy_manager_test"] + test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRESQL_USER\" -d policy_manager_test"] interval: 5s timeout: 5s retries: 5 @@ -25,14 +23,13 @@ services: depends_on: postgres: condition: service_healthy + env_file: ../.env environment: BIND_ADDRESS: "0.0.0.0:8080" DB_TYPE: pgsql DB_HOST: postgres DB_PORT: "5432" DB_NAME: policy_manager_test - DB_USER: ${POSTGRES_USER:-test_user} - DB_PASSWORD: ${POSTGRES_PASSWORD:-test_password} LOG_LEVEL: debug NATS_DISABLED: "true" AUTH_DISABLED: "true" diff --git a/test/subsystem/sp/docker-compose.yaml b/test/subsystem/sp/docker-compose.yaml index ac9081d..358527e 100644 --- a/test/subsystem/sp/docker-compose.yaml +++ b/test/subsystem/sp/docker-compose.yaml @@ -1,19 +1,17 @@ -# SP subsystem test stack. Credentials: set POSTGRES_USER and POSTGRES_PASSWORD -# in the environment or in a .env file (see ../../../.env.example). +# SP subsystem test stack. Shared env: test/subsystem/.env (see .env.example). services: postgres: image: quay.io/sclorg/postgresql-16-c9s:latest + env_file: ../.env environment: POSTGRESQL_DATABASE: service-provider - POSTGRESQL_USER: ${POSTGRES_USER:-admin} - POSTGRESQL_PASSWORD: ${POSTGRES_PASSWORD:-adminpass} ports: - "5432:5432" volumes: - postgres_data:/var/lib/pgsql/data healthcheck: - test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-admin} -d service-provider"] + test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRESQL_USER\" -d service-provider"] interval: 5s timeout: 5s retries: 5 @@ -46,14 +44,13 @@ services: build: context: ../../.. dockerfile: Containerfile + env_file: ../.env environment: BIND_ADDRESS: ":8080" DB_TYPE: pgsql DB_HOST: postgres DB_PORT: "5432" DB_NAME: service-provider - DB_USER: ${POSTGRES_USER:-admin} - DB_PASSWORD: ${POSTGRES_PASSWORD:-adminpass} NATS_URL: "nats://nats:4222" AUTH_DISABLED: "true" DCM_ADMIN_SUBJECT: "test-admin-sub"