1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
package ca_test
import (
"context"
"testing"
"time"
"github.com/docker/swarmkit/api"
"github.com/docker/swarmkit/ca"
"github.com/docker/swarmkit/ca/testutils"
"github.com/docker/swarmkit/manager/state/store"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestForceRenewTLSConfig(t *testing.T) {
t.Parallel()
tc := testutils.NewTestCA(t)
defer tc.Stop()
ctx, cancel := context.WithCancel(tc.Context)
defer cancel()
// Get a new managerConfig with a TLS cert that has 15 minutes to live
nodeConfig, err := tc.WriteNewNodeConfig(ca.ManagerRole)
assert.NoError(t, err)
renewer := ca.NewTLSRenewer(nodeConfig, tc.ConnBroker, tc.Paths.RootCA)
updates := renewer.Start(ctx)
renewer.Renew()
select {
case <-time.After(10 * time.Second):
assert.Fail(t, "TestForceRenewTLSConfig timed-out")
case certUpdate := <-updates:
assert.NoError(t, certUpdate.Err)
assert.NotNil(t, certUpdate)
assert.Equal(t, certUpdate.Role, ca.ManagerRole)
}
}
func TestForceRenewExpectedRole(t *testing.T) {
t.Parallel()
tc := testutils.NewTestCA(t)
defer tc.Stop()
ctx, cancel := context.WithCancel(tc.Context)
defer cancel()
// Get a new managerConfig with a TLS cert that has 15 minutes to live
nodeConfig, err := tc.WriteNewNodeConfig(ca.ManagerRole)
assert.NoError(t, err)
go func() {
time.Sleep(750 * time.Millisecond)
err := tc.MemoryStore.Update(func(tx store.Tx) error {
node := store.GetNode(tx, nodeConfig.ClientTLSCreds.NodeID())
require.NotNil(t, node)
node.Spec.DesiredRole = api.NodeRoleWorker
node.Role = api.NodeRoleWorker
return store.UpdateNode(tx, node)
})
assert.NoError(t, err)
}()
renewer := ca.NewTLSRenewer(nodeConfig, tc.ConnBroker, tc.Paths.RootCA)
updates := renewer.Start(ctx)
renewer.SetExpectedRole(ca.WorkerRole)
renewer.Renew()
for {
select {
case <-time.After(10 * time.Second):
t.Fatal("timed out")
case certUpdate := <-updates:
assert.NoError(t, certUpdate.Err)
assert.NotNil(t, certUpdate)
if certUpdate.Role == ca.WorkerRole {
return
}
}
}
}
|
