diff options
| -rw-r--r-- | deployment/noheat/README | 36 | ||||
| -rw-r--r--[l---------] | deployment/noheat/README.rst | 37 | ||||
| -rw-r--r-- | deployment/noheat/infra-openstack/HACKING | 30 | ||||
| -rw-r--r--[l---------] | deployment/noheat/infra-openstack/HACKING.rst | 31 | ||||
| -rw-r--r-- | deployment/noheat/infra-openstack/README | 34 | ||||
| -rw-r--r--[l---------] | deployment/noheat/infra-openstack/README.rst | 35 | ||||
| -rw-r--r-- | deployment/noheat/infra-openstack/vagrant/test/README | 31 | ||||
| -rw-r--r--[l---------] | deployment/noheat/infra-openstack/vagrant/test/README.rst | 32 | ||||
| -rw-r--r-- | test/security/k8s/README | 45 | ||||
| -rw-r--r--[l---------] | test/security/k8s/README.rst | 46 | ||||
| -rw-r--r-- | test/security/sslendpoints/README | 135 | ||||
| -rw-r--r--[l---------] | test/security/sslendpoints/README.rst | 136 |
12 files changed, 311 insertions, 317 deletions
diff --git a/deployment/noheat/README b/deployment/noheat/README deleted file mode 100644 index 287dc9f9a..000000000 --- a/deployment/noheat/README +++ /dev/null @@ -1,36 +0,0 @@ -================================ - ONAP on Openstack without Heat -================================ - -Ansible roles and sample playbooks for automatic deployments for system testing and continuous -integration test flows. These will orchestrate Openstack virtual machines setup for a Kubernetes -cluster, a Rancher Kubernetes Engine (RKE) deployment, a DevStack deployment and an ONAP deployment. - -They will be used in Service Mesh lab. - -Prerequisites -------------- - -Infrastructure -~~~~~~~~~~~~~~ - -- OpenStack cloud (no Heat support required) - -Configuration -~~~~~~~~~~~~~ - -- OpenStack ``clouds.yaml`` file - -Dependencies -~~~~~~~~~~~~ - -- Ansible: tested on 2.9.9 (using Python 3.5.2) -- openstacksdk_: tested on 0.46.0 (using Python 3.5.2) - -.. _openstacksdk: https://pypi.org/project/openstacksdk - - -Expected output ---------------- - -Ephemeral (disposable) ONAP instance. diff --git a/deployment/noheat/README.rst b/deployment/noheat/README.rst index 100b93820..287dc9f9a 120000..100644 --- a/deployment/noheat/README.rst +++ b/deployment/noheat/README.rst @@ -1 +1,36 @@ -README
\ No newline at end of file +================================ + ONAP on Openstack without Heat +================================ + +Ansible roles and sample playbooks for automatic deployments for system testing and continuous +integration test flows. These will orchestrate Openstack virtual machines setup for a Kubernetes +cluster, a Rancher Kubernetes Engine (RKE) deployment, a DevStack deployment and an ONAP deployment. + +They will be used in Service Mesh lab. + +Prerequisites +------------- + +Infrastructure +~~~~~~~~~~~~~~ + +- OpenStack cloud (no Heat support required) + +Configuration +~~~~~~~~~~~~~ + +- OpenStack ``clouds.yaml`` file + +Dependencies +~~~~~~~~~~~~ + +- Ansible: tested on 2.9.9 (using Python 3.5.2) +- openstacksdk_: tested on 0.46.0 (using Python 3.5.2) + +.. _openstacksdk: https://pypi.org/project/openstacksdk + + +Expected output +--------------- + +Ephemeral (disposable) ONAP instance. diff --git a/deployment/noheat/infra-openstack/HACKING b/deployment/noheat/infra-openstack/HACKING deleted file mode 100644 index dcdc2062e..000000000 --- a/deployment/noheat/infra-openstack/HACKING +++ /dev/null @@ -1,30 +0,0 @@ -========================= - Development environment -========================= - -This environment focuses on interactions with OpenStack (here: DevStack) instance. Changes can be -made from host machine but additional guest ("operator") is provided for developers' convenience. - -Environment on "operator" machine is already set up and can be accessed by: - -.. code-block:: shell - - $ vagrant ssh operator - -Provided ``clouds.yaml`` file differs slightly from the one that can be obtained with following -steps: - -#. Open OpenStack dashboard (http://localhost:8080 forwarded from "devstack" machine) -#. Navigate to ``Project``, then ``API Access`` on the left panel -#. Select ``Download OpenStack RC File``, then ``OpenStack clouds.yaml File`` on the right side - -Summary of changes: - -- Added password from ``local.conf`` file (used in DevStack instance setup) -- Removed ``project_id`` which might change on a new DevStack instance -- Replaced ``auth_url`` based on machine's dynamic IP with the static private address -- Added ``project_domain_name`` needed to run Ansible playbooks - -Installed Python package ``python-openstackclient`` includes key package ``openstacksdk`` as -a dependency and provides additional CLI tools. Tool ``pip`` for Python 3 was used for installing -these packages. diff --git a/deployment/noheat/infra-openstack/HACKING.rst b/deployment/noheat/infra-openstack/HACKING.rst index 3f7568eb2..dcdc2062e 120000..100644 --- a/deployment/noheat/infra-openstack/HACKING.rst +++ b/deployment/noheat/infra-openstack/HACKING.rst @@ -1 +1,30 @@ -HACKING
\ No newline at end of file +========================= + Development environment +========================= + +This environment focuses on interactions with OpenStack (here: DevStack) instance. Changes can be +made from host machine but additional guest ("operator") is provided for developers' convenience. + +Environment on "operator" machine is already set up and can be accessed by: + +.. code-block:: shell + + $ vagrant ssh operator + +Provided ``clouds.yaml`` file differs slightly from the one that can be obtained with following +steps: + +#. Open OpenStack dashboard (http://localhost:8080 forwarded from "devstack" machine) +#. Navigate to ``Project``, then ``API Access`` on the left panel +#. Select ``Download OpenStack RC File``, then ``OpenStack clouds.yaml File`` on the right side + +Summary of changes: + +- Added password from ``local.conf`` file (used in DevStack instance setup) +- Removed ``project_id`` which might change on a new DevStack instance +- Replaced ``auth_url`` based on machine's dynamic IP with the static private address +- Added ``project_domain_name`` needed to run Ansible playbooks + +Installed Python package ``python-openstackclient`` includes key package ``openstacksdk`` as +a dependency and provides additional CLI tools. Tool ``pip`` for Python 3 was used for installing +these packages. diff --git a/deployment/noheat/infra-openstack/README b/deployment/noheat/infra-openstack/README deleted file mode 100644 index cb7cb9320..000000000 --- a/deployment/noheat/infra-openstack/README +++ /dev/null @@ -1,34 +0,0 @@ -================================================== - Cloud infrastructure: OpenStack virtual machines -================================================== - -Ansible roles and sample playbooks for creating virtual machines on OpenStack without Heat support. - -They will be used to create virtual machines hosting Service Mesh lab cluster. - -Prerequisites -------------- - -Infrastructure -~~~~~~~~~~~~~~ - -- OpenStack cloud (no Heat support required) - -Configuration -~~~~~~~~~~~~~ - -- OpenStack ``clouds.yaml`` file - -Dependencies -~~~~~~~~~~~~ - -- Ansible: tested on 2.9.9 (using Python 3.5.2) -- openstacksdk_: tested on 0.46.0 (using Python 3.5.2) - -.. _openstacksdk: https://pypi.org/project/openstacksdk - - -Expected output ---------------- - -Ephemeral (disposable) OpenStack virtual machines for a Kubernetes cluster. diff --git a/deployment/noheat/infra-openstack/README.rst b/deployment/noheat/infra-openstack/README.rst index 100b93820..cb7cb9320 120000..100644 --- a/deployment/noheat/infra-openstack/README.rst +++ b/deployment/noheat/infra-openstack/README.rst @@ -1 +1,34 @@ -README
\ No newline at end of file +================================================== + Cloud infrastructure: OpenStack virtual machines +================================================== + +Ansible roles and sample playbooks for creating virtual machines on OpenStack without Heat support. + +They will be used to create virtual machines hosting Service Mesh lab cluster. + +Prerequisites +------------- + +Infrastructure +~~~~~~~~~~~~~~ + +- OpenStack cloud (no Heat support required) + +Configuration +~~~~~~~~~~~~~ + +- OpenStack ``clouds.yaml`` file + +Dependencies +~~~~~~~~~~~~ + +- Ansible: tested on 2.9.9 (using Python 3.5.2) +- openstacksdk_: tested on 0.46.0 (using Python 3.5.2) + +.. _openstacksdk: https://pypi.org/project/openstacksdk + + +Expected output +--------------- + +Ephemeral (disposable) OpenStack virtual machines for a Kubernetes cluster. diff --git a/deployment/noheat/infra-openstack/vagrant/test/README b/deployment/noheat/infra-openstack/vagrant/test/README deleted file mode 100644 index 03d9ea101..000000000 --- a/deployment/noheat/infra-openstack/vagrant/test/README +++ /dev/null @@ -1,31 +0,0 @@ -============================== - Vagrant: simple test harness -============================== - -Use ``make`` and ``git diff`` for a simple test harness for Vagrant-based environment. - -Prerequisites -------------- - -Dependencies -~~~~~~~~~~~~ - -- make: tested on 4.1 -- git: tested on 2.17.1 - - -Running -------- - -Command -~~~~~~~ - -.. code-block:: shell - - $ make test - - -Credit ------- - -This is based on https://chrismorgan.info/blog/make-and-git-diff-test-harness blog post. diff --git a/deployment/noheat/infra-openstack/vagrant/test/README.rst b/deployment/noheat/infra-openstack/vagrant/test/README.rst index 100b93820..03d9ea101 120000..100644 --- a/deployment/noheat/infra-openstack/vagrant/test/README.rst +++ b/deployment/noheat/infra-openstack/vagrant/test/README.rst @@ -1 +1,31 @@ -README
\ No newline at end of file +============================== + Vagrant: simple test harness +============================== + +Use ``make`` and ``git diff`` for a simple test harness for Vagrant-based environment. + +Prerequisites +------------- + +Dependencies +~~~~~~~~~~~~ + +- make: tested on 4.1 +- git: tested on 2.17.1 + + +Running +------- + +Command +~~~~~~~ + +.. code-block:: shell + + $ make test + + +Credit +------ + +This is based on https://chrismorgan.info/blog/make-and-git-diff-test-harness blog post. diff --git a/test/security/k8s/README b/test/security/k8s/README deleted file mode 100644 index b9e2dd5d2..000000000 --- a/test/security/k8s/README +++ /dev/null @@ -1,45 +0,0 @@ -############################## -K8s secure configuration check -############################## - -Utility for checking if Kubernetes cluster configuration follows security recommendations. - -*************** -Getting started -*************** - -Prerequisites -============= - -Build ------ - -- make -- go_ - -.. _go: https://golang.org/doc/install - -Test ----- - -- Ginkgo_ - -.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo - -Running -======= - -Calling:: - - make run - -will build and run configuration check executable. It is the default target. - -Testing -======= - -Calling:: - - make test - -will run tests. diff --git a/test/security/k8s/README.rst b/test/security/k8s/README.rst index 100b93820..b9e2dd5d2 120000..100644 --- a/test/security/k8s/README.rst +++ b/test/security/k8s/README.rst @@ -1 +1,45 @@ -README
\ No newline at end of file +############################## +K8s secure configuration check +############################## + +Utility for checking if Kubernetes cluster configuration follows security recommendations. + +*************** +Getting started +*************** + +Prerequisites +============= + +Build +----- + +- make +- go_ + +.. _go: https://golang.org/doc/install + +Test +---- + +- Ginkgo_ + +.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo + +Running +======= + +Calling:: + + make run + +will build and run configuration check executable. It is the default target. + +Testing +======= + +Calling:: + + make test + +will run tests. diff --git a/test/security/sslendpoints/README b/test/security/sslendpoints/README deleted file mode 100644 index 257946d88..000000000 --- a/test/security/sslendpoints/README +++ /dev/null @@ -1,135 +0,0 @@ -===================== - SSL endpoints check -===================== - -Utility for checking if all of the ports exposed outside of Kubernetes cluster -use SSL tunnels. - -Prerequisites -------------- - -Configuration -~~~~~~~~~~~~~ - -``-kubeconfig`` - Optional unless ``$HOME`` is not set. Defaults to ``$HOME/.kube/config``. - -``-xfail`` - Optional list of services with corresponding NodePorts which do not use SSL - tunnels. These ports are known as "expected failures" and will not be - checked. - -Dependencies -~~~~~~~~~~~~ - -- nmap_ - -.. _nmap: https://nmap.org/book/install.html - -Build (local) -~~~~~~~~~~~~~ - -- go_ (1.11+, tested on 1.13) - -.. _go: https://golang.org/doc/install - -Build (Docker) -~~~~~~~~~~~~~~ - -- Docker_ engine -- make (optional) - -.. _Docker: https://docs.docker.com/install - -Test -~~~~ - -- Ginkgo_ -- GolangCI-Lint_ (optional) - -.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo -.. _GolangCI-Lint: https://github.com/golangci/golangci-lint#install - -Building --------- - -Command (local) -~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ mkdir bin - $ go build -o bin/sslendpoints - -Additional ``bin`` directory and specifying ``go build`` output are used to -declutter project and maintain compatibility with Docker-based process. Running -``go build`` without parameters will create ``sslendpoints`` binary in current -directory. - -Command (Docker) -~~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ make # or commands from corresponding "make" targets - - -Running -------- - -Command (local) -~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ bin/sslendpoints [-kubeconfig KUBECONFIG] [-xfail XFAIL] - -Command (Docker) -~~~~~~~~~~~~~~~~ - -.. code-block:: shell - - $ docker run --rm --volume $KUBECONFIG:/.kube/config \ - sslendpoints-build-img /bin/sslendpoints - - $ docker run --rm --volume $KUBECONFIG:/opt/config \ - sslendpoints-build-img /bin/sslendpoints -kubeconfig /opt/config - - $ docker run --rm \ - --volume $KUBECONFIG:/opt/config \ - --volume $XFAIL:/opt/xfail \ - sslendpoints-build-img /bin/sslendpoints \ - -kubeconfig /opt/config - -xfail /opt/xfail - -Output -~~~~~~ - -.. code-block:: shell - - $ ./sslendpoints -kubeconfig ~/.kube/config.onap - 2020/03/17 10:40:29 Host 192.168.2.10 - 2020/03/17 10:40:29 PORT SERVICE - 2020/03/17 10:40:29 30203 sdnc-dgbuilder - 2020/03/17 10:40:29 30204 sdc-be - 2020/03/17 10:40:29 30207 sdc-fe - 2020/03/17 10:40:29 30220 aai-sparky-be - 2020/03/17 10:40:29 30226 message-router - 2020/03/17 10:40:29 30233 aai - 2020/03/17 10:40:29 30256 sdc-wfd-fe - 2020/03/17 10:40:29 30257 sdc-wfd-be - 2020/03/17 10:40:29 30264 sdc-dcae-fe - 2020/03/17 10:40:29 30266 sdc-dcae-dt - 2020/03/17 10:40:29 30279 aai-babel - 2020/03/17 10:40:29 30406 so-vnfm-adapter - 2020/03/17 10:40:29 There are 12 non-SSL NodePorts in the cluster - - -Testing -------- - -.. code-block:: shell - - $ go test ./... # basic - $ ginkgo -r # pretty - $ golangci-lint run # linters diff --git a/test/security/sslendpoints/README.rst b/test/security/sslendpoints/README.rst index 100b93820..257946d88 120000..100644 --- a/test/security/sslendpoints/README.rst +++ b/test/security/sslendpoints/README.rst @@ -1 +1,135 @@ -README
\ No newline at end of file +===================== + SSL endpoints check +===================== + +Utility for checking if all of the ports exposed outside of Kubernetes cluster +use SSL tunnels. + +Prerequisites +------------- + +Configuration +~~~~~~~~~~~~~ + +``-kubeconfig`` + Optional unless ``$HOME`` is not set. Defaults to ``$HOME/.kube/config``. + +``-xfail`` + Optional list of services with corresponding NodePorts which do not use SSL + tunnels. These ports are known as "expected failures" and will not be + checked. + +Dependencies +~~~~~~~~~~~~ + +- nmap_ + +.. _nmap: https://nmap.org/book/install.html + +Build (local) +~~~~~~~~~~~~~ + +- go_ (1.11+, tested on 1.13) + +.. _go: https://golang.org/doc/install + +Build (Docker) +~~~~~~~~~~~~~~ + +- Docker_ engine +- make (optional) + +.. _Docker: https://docs.docker.com/install + +Test +~~~~ + +- Ginkgo_ +- GolangCI-Lint_ (optional) + +.. _Ginkgo: https://onsi.github.io/ginkgo/#getting-ginkgo +.. _GolangCI-Lint: https://github.com/golangci/golangci-lint#install + +Building +-------- + +Command (local) +~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ mkdir bin + $ go build -o bin/sslendpoints + +Additional ``bin`` directory and specifying ``go build`` output are used to +declutter project and maintain compatibility with Docker-based process. Running +``go build`` without parameters will create ``sslendpoints`` binary in current +directory. + +Command (Docker) +~~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ make # or commands from corresponding "make" targets + + +Running +------- + +Command (local) +~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ bin/sslendpoints [-kubeconfig KUBECONFIG] [-xfail XFAIL] + +Command (Docker) +~~~~~~~~~~~~~~~~ + +.. code-block:: shell + + $ docker run --rm --volume $KUBECONFIG:/.kube/config \ + sslendpoints-build-img /bin/sslendpoints + + $ docker run --rm --volume $KUBECONFIG:/opt/config \ + sslendpoints-build-img /bin/sslendpoints -kubeconfig /opt/config + + $ docker run --rm \ + --volume $KUBECONFIG:/opt/config \ + --volume $XFAIL:/opt/xfail \ + sslendpoints-build-img /bin/sslendpoints \ + -kubeconfig /opt/config + -xfail /opt/xfail + +Output +~~~~~~ + +.. code-block:: shell + + $ ./sslendpoints -kubeconfig ~/.kube/config.onap + 2020/03/17 10:40:29 Host 192.168.2.10 + 2020/03/17 10:40:29 PORT SERVICE + 2020/03/17 10:40:29 30203 sdnc-dgbuilder + 2020/03/17 10:40:29 30204 sdc-be + 2020/03/17 10:40:29 30207 sdc-fe + 2020/03/17 10:40:29 30220 aai-sparky-be + 2020/03/17 10:40:29 30226 message-router + 2020/03/17 10:40:29 30233 aai + 2020/03/17 10:40:29 30256 sdc-wfd-fe + 2020/03/17 10:40:29 30257 sdc-wfd-be + 2020/03/17 10:40:29 30264 sdc-dcae-fe + 2020/03/17 10:40:29 30266 sdc-dcae-dt + 2020/03/17 10:40:29 30279 aai-babel + 2020/03/17 10:40:29 30406 so-vnfm-adapter + 2020/03/17 10:40:29 There are 12 non-SSL NodePorts in the cluster + + +Testing +------- + +.. code-block:: shell + + $ go test ./... # basic + $ ginkgo -r # pretty + $ golangci-lint run # linters |