status-im
/
consul
mirror of https://github.com/status-im/consul.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

ca: test that original certs from secondary still verify 

There's a chance this could flake if the secondary hasn't received the
update yet, but running this test many times doesn't show any flakes
yet.
This commit is contained in:
Daniel Nephin 2022-02-17 18:45:08 -05:00
parent 6b679aa9d4
commit 6021105dfc
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
agent/consul/leader_connect_ca_test.go
View File

@ -766,6 +766,7 @@ func TestCAManager_Initialize_Vault_WithExternalTrustedCA(t *testing.T) {
} }
}) })
var origLeafSecondary string
runStep(t, "start secondary DC", func(t *testing.T) { runStep(t, "start secondary DC", func(t *testing.T) {
joinWAN(t, serverDC2, serverDC1) joinWAN(t, serverDC2, serverDC1)
testrpc.WaitForActiveCARoot(t, serverDC2.RPC, "dc2", nil) testrpc.WaitForActiveCARoot(t, serverDC2.RPC, "dc2", nil)
@ -778,6 +779,7 @@ func TestCAManager_Initialize_Vault_WithExternalTrustedCA(t *testing.T) {
leafPEM := getLeafCert(t, codec, roots.TrustDomain, "dc2") leafPEM := getLeafCert(t, codec, roots.TrustDomain, "dc2")
verifyLeafCert(t, roots.Roots[0], leafPEM) verifyLeafCert(t, roots.Roots[0], leafPEM)
origLeafSecondary = leafPEM
}) })
runStep(t, "renew leaf signing CA in primary", func(t *testing.T) { runStep(t, "renew leaf signing CA in primary", func(t *testing.T) {
@ -850,6 +852,13 @@ func TestCAManager_Initialize_Vault_WithExternalTrustedCA(t *testing.T) {
// original certs from old root cert should still verify // original certs from old root cert should still verify
verifyLeafCertWithRoots(t, roots, origLeaf) verifyLeafCertWithRoots(t, roots, origLeaf)
// original certs from secondary should still verify
rootsSecondary := structs.IndexedCARoots{}
r := &structs.DCSpecificRequest{Datacenter: "dc2"}
err = msgpackrpc.CallWithCodec(codec, "ConnectCA.Roots", r, &rootsSecondary)
require.NoError(t, err)
verifyLeafCertWithRoots(t, rootsSecondary, origLeafSecondary)
}) })
runStep(t, "rotate to a different external root", func(t *testing.T) { runStep(t, "rotate to a different external root", func(t *testing.T) {
@ -885,6 +894,13 @@ func TestCAManager_Initialize_Vault_WithExternalTrustedCA(t *testing.T) {
// original certs from old root cert should still verify // original certs from old root cert should still verify
verifyLeafCertWithRoots(t, roots, origLeaf) verifyLeafCertWithRoots(t, roots, origLeaf)
// original certs from secondary should still verify
rootsSecondary := structs.IndexedCARoots{}
r := &structs.DCSpecificRequest{Datacenter: "dc2"}
err = msgpackrpc.CallWithCodec(codec, "ConnectCA.Roots", r, &rootsSecondary)
require.NoError(t, err)
verifyLeafCertWithRoots(t, rootsSecondary, origLeafSecondary)
}) })
} }