ms2k
bf028161ae
OIDC validation, principal mapping, remora:v1 roles, and current-authz filtering with kind acceptance on Keycloak and ZITADEL.
50 lines
1.3 KiB
Shell
Executable file
50 lines
1.3 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
source "$ROOT/tests/kind/lib.sh"
|
|
|
|
USER_KUBECONFIG_BEFORE="$(user_kubeconfig_digest)"
|
|
SUCCEEDED=false
|
|
OWNS_FIXTURE=false
|
|
|
|
cleanup() {
|
|
local status=$?
|
|
trap - EXIT INT TERM
|
|
if [[ "${REMORA_TESTBED_RETAIN:-0}" = 1 ]] && [[ "$SUCCEEDED" != true ]]; then
|
|
printf 'retained kubeconfig: %s\n' "$KUBECONFIG_PATH"
|
|
printf 'retained context: %s\n' "$CONTEXT"
|
|
exit "$status"
|
|
fi
|
|
if [[ "$OWNS_FIXTURE" = true ]]; then
|
|
destroy_fixture || status=1
|
|
fi
|
|
if [[ "$(user_kubeconfig_digest)" != "$USER_KUBECONFIG_BEFORE" ]]; then
|
|
printf 'user kubeconfig changed unexpectedly\n' >&2
|
|
status=1
|
|
fi
|
|
exit "$status"
|
|
}
|
|
|
|
trap cleanup EXIT
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
|
|
acquire_fixture_lock
|
|
REMORA_REAL_NERDCTL="$(command -v nerdctl)"
|
|
export REMORA_REAL_NERDCTL
|
|
"$REMORA_REAL_NERDCTL" --namespace default build \
|
|
--file "$ROOT/Dockerfile.test" \
|
|
--target kind-identity-runner \
|
|
--tag remora-kind-identity:local \
|
|
"$ROOT"
|
|
OWNS_FIXTURE=true
|
|
setup_fixture durable oidc
|
|
load_local_image remora-kind-identity:local
|
|
run_job_matrix \
|
|
identity-authz \
|
|
"$TESTBED/identity-job.yaml.in" \
|
|
remora-kind-identity:local \
|
|
durable oidc
|
|
SUCCEEDED=true
|
|
printf 'identity and target authorization package test Job passed\n'
|