acceptance-tests

.github/dependabot.yml

@@ -22,3 +22,14 @@ updates:
     prefix: "dep"
   labels:
     - run-ci
+- package-ecosystem: gomod
+  directory: /acceptance-tests
+  schedule:
+    interval: weekly
+    day: "monday"
+    time: "09:00"
+    timezone: "Europe/Berlin"
+  commit-message:
+    prefix: "dep"
+  labels:
+    - run-ci

.gitignore

@@ -26,6 +26,7 @@ package.json
 # Releases/tarballs
 .final_builds/jobs/**/*.tgz
 .final_builds/packages/**/*.tgz
+ci/scripts/stemcell/*.tgz
 pcap-server.tgz
 releases/*.tgz
 releases/**/*.tgz

acceptance-tests/README.md

@@ -0,0 +1,101 @@
+# Acceptance Tests
+
+## Requirements
+
+* Docker installed locally
+* A matching Jammy stemcell tgz downloaded to `ci/scripts/stemcell`
+    * Get it from https://bosh.io/stemcells/bosh-warden-boshlite-ubuntu-jammy-go_agent
+
+## Running
+
+```shell
+cd acceptance-tests
+./run-local.sh
+```
+
+### Running on Docker for Mac
+
+The BOSH Docker CPI requires cgroups v1 to be active. Docker for Mac since 4.3.x uses cgroups v2 by default.
+
+v1 can be restored with the flag `deprecatedCgroupv1` to `true` in `~/Library/Group Containers/group.com.docker/settings.json`.
+
+A convenience script that does this for you is below.
+
+**WARNING:** This will restart your Docker Desktop!
+
+```shell
+docker_restart_with_cgroupsv1() {
+    SETTINGS=~/Library/Group\ Containers/group.com.docker/settings.json
+
+    if ! command -v jq >/dev/null || ! command -v sponge; then
+        echo "Requires jq and sponge. Consider installing via:"
+        echo "   brew install jq moreutils"
+        return
+    fi
+
+    cgroupsV1Enabled=$(jq '.deprecatedCgroupv1' "$SETTINGS")
+    if [ "$cgroupsV1Enabled" = "true" ]; then
+        echo "deprecatedCgroupv1 is already set to 'true'. Acceptance tests should work."
+    else
+        echo "Stopping Docker to set the config flag deprecatedCgroupv1 = true in $SETTINGS"
+
+        while docker ps -q 2>/dev/null; do
+            launchctl stop $(launchctl list | grep docker.docker | awk '{print $3}')
+            osascript -e 'quit app "Docker"'
+            echo "Waiting for Docker daemon to stop responding."
+            sleep 1
+        done
+        echo 'Setting "deprecatedCgroupv1" to true.'
+
+        # Add the needed cgroup config to docker settings.json
+        # sponge is needed because we're updating the same file in place
+        echo '{"deprecatedCgroupv1": true}' |
+            jq -s '.[0] * .[1]' "$SETTINGS" - |
+            sponge "$SETTINGS"
+        # Restart docker desktop
+        echo "Restarting Docker"
+        open --background -a Docker
+
+        while ! docker ps -q 2>/dev/null; do
+            echo "Waiting for Docker daemon to be back up again. Sleeping 1s."
+            sleep 1
+        done
+    fi
+
+    docker info | grep "Cgroup"
+}
+
+docker_restart_with_cgroupsv1
+```
+
+The output at the end should be:
+```plain
+ Cgroup Driver: cgroupfs
+ Cgroup Version: 1
+```
+
+### Focussed Tests
+
+If you want to run only a specific part of the suite, you can use [focussed specs](https://onsi.github.io/ginkgo/#focused-specs)
+
+The easiest way is to just provide the name of the tests you want to run as a command line argument like so:
+
+```shell
+./run-local.sh "description of the test to run"
+```
+
+The argument is passed as a regular expression that will match all `Describe`, `Context` or `It` closure descriptions in the suite.
+So, e.g. if you want to run all tests that use mTLS, you can run:
+
+```shell
+./run-local.sh mTLS
+```
+
+However, if you want to run exactly one specific test, make sure you pass the exact description of the matching `It` closure:
+
+```shell
+./run-local.sh "Correctly terminates mTLS requests"
+```
+
+Alternatively, you add an `F` to your `Describe`, `Context` or `It` closures.
+Don't forget to do a local commit before running the tests, else BOSH will fail to produce a release. The git repo must be clean before running the tests.

acceptance-tests/acceptance_tests_suite_test.go

@@ -0,0 +1,50 @@
+package acceptance_tests
+
+import (
+	"encoding/json"
+	"fmt"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"testing"
+)
+
+func TestAcceptanceTests(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "AcceptanceTests Suite")
+}
+
+var _ = SynchronizedBeforeSuite(func() []byte {
+	// Load config once, and pass to other
+	// threads as JSON-encoded byte array
+	var err error
+	config, err = loadConfig()
+	Expect(err).NotTo(HaveOccurred(), "loading common config")
+
+	// Deploy pcap-api deployment
+	deployPcap(
+		baseManifestVars{
+			deploymentName: deploymentNameForTestNode(),
+		},
+		[]string{},
+		map[string]interface{}{},
+		true,
+	)
+
+	configBytes, err := json.Marshal(&config)
+	Expect(err).NotTo(HaveOccurred())
+
+	return configBytes
+}, func(configBytes []byte) {
+	// populate thread-local variable `config` in each thread
+	err := json.Unmarshal(configBytes, &config)
+	Expect(err).NotTo(HaveOccurred())
+})
+
+var _ = SynchronizedAfterSuite(func() {
+	// Clean up deployments on each thread
+	deleteDeployment(deploymentNameForTestNode())
+}, func() {})
+
+func deploymentNameForTestNode() string {
+	return fmt.Sprintf("pcap-%d", GinkgoParallelProcess())
+}

acceptance-tests/basic_pcap_test.go

@@ -0,0 +1,68 @@
+package acceptance_tests
+
+import (
+	"fmt"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/gexec"
+	"net/http"
+	"os"
+	"os/exec"
+	"time"
+)
+
+var _ = Describe("Pcap Deployment", func() {
+	It("Deploys and Captures Traffic Successfully", func() {
+
+		info, _ := deployPcap(
+			baseManifestVars{
+				deploymentName: deploymentNameForTestNode(),
+			},
+			[]string{},
+			map[string]interface{}{},
+			true,
+		)
+
+		By("Logging on to BOSH director to get a refresh token")
+		login(config.BoshClient, config.BoshClientSecret)
+
+		pcapBoshCliFile, err := os.CreateTemp("", "pcap-bosh-cli-*")
+		Expect(err).NotTo(HaveOccurred())
+		pcapBoshCli := pcapBoshCliFile.Name()
+
+		By("Downloading remote pcap-bosh-cli-linux-amd64 to " + pcapBoshCli)
+		err = downloadFile(info, "/var/vcap/packages/pcap-api/bin/cli/build/pcap-bosh-cli-linux-amd64", pcapBoshCliFile, 0755)
+		Expect(err).NotTo(HaveOccurred())
+		err = pcapBoshCliFile.Close()
+		Expect(err).NotTo(HaveOccurred())
+
+		pcapFile := fmt.Sprintf("%s-capture.pcap", pcapBoshCli)
+		By("Starting capture of traffic on pcap-agent instance to file " + pcapFile)
+		cmdPcap := exec.Command(
+			pcapBoshCli,
+			"-d", deploymentNameForTestNode(),
+			"-g", "pcap-agent",
+			"-o", pcapFile,
+			"-u", fmt.Sprintf("http://%s:8080/", info.PcapAPIPublicIP), //TODO: make URL configurable in tests
+			"-v")
+		sessionPcap, err := gexec.Start(cmdPcap, GinkgoWriter, GinkgoWriter)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Calling apache on pcap-agent instance to produce some traffic")
+		for request := 1; request <= 10; request++ {
+			time.Sleep(time.Second)
+			response, err := http.Get(fmt.Sprintf("http://%s:80/", info.PcapAgentPublicIP))
+			Expect(err).NotTo(HaveOccurred())
+			Expect(response.StatusCode).To(Equal(200))
+		}
+
+		By("Stopping capture after curl has finished")
+		sessionPcap.Interrupt()
+		Eventually(sessionPcap, time.Minute, time.Second).Should(gexec.Exit())
+
+		By("Checking that the capture has produced a valid pcap file")
+		pcapFileStat, err := os.Stat(pcapFile)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(pcapFileStat.Size()).To(BeNumerically(">", 24)) // 24 bytes == pcap header only
+	})
+})