Skip to content

Commit 1bea393

Browse files
sancyxlpuskas
sancyx
and
lpuskas
authored
Sanity test mtls with spire agent (#120)
* feat: add mtls and spire support Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * feat: added tasks for deploying and removing spire using helm Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * feat: add spire to mcp proxy Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * fix: enable mcp proxy only for base Slim test Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * fix: use latest sllim chart and images Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * feat: add possibility to run slim with spire test Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * fix: declare new params Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> * fix: add missing param for spire test Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> --------- Signed-off-by: Magyari Sandor Szilard <sancyx@gmail.com> Co-authored-by: Laszlo Puskas <laszlo.puskas1@gmail.com>
1 parent 6909226 commit 1bea393

File tree

16 files changed

+562
-33
lines changed

16 files changed

+562
-33
lines changed

‎.github/actions/deploy-components/action.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,14 @@ inputs:
1717
description: 'Deploy slim to a kind cluster'
1818
required: false
1919
default: 'false'
20+
slim-config:
21+
description: 'Set slim configuration to deploy'
22+
required: false
23+
default: 'base'
24+
deploy-spire:
25+
description: 'Deploy SPIRE to a kind cluster'
26+
required: false
27+
default: 'false'
2028
slim-image-tag:
2129
description: 'Set slim container image version'
2230
required: false
@@ -104,11 +112,18 @@ runs:
104112
task -d ./${{ inputs.checkout-path }} integrations:kind:create \
105113
KIND_CLUSTER_NAME=${{ inputs.kind-cluster-name }}
106114
115+
- name: Deploy SPIRE
116+
if: ${{ inputs.deploy-spire != 'false' }}
117+
shell: bash
118+
run: |
119+
task -d ./${{ inputs.checkout-path }} integrations:slim:spire:deploy
120+
107121
- name: Deploy Slim
108122
if: ${{ inputs.deploy-slim != 'false' }}
109123
shell: bash
110124
run: |
111125
task -d ./${{ inputs.checkout-path }} integrations:slim:test-env:deploy \
126+
SLIM_CONFIG=${{ inputs.slim-config }} \
112127
SLIM_IMAGE_TAG=${{ inputs.slim-image-tag }} \
113128
SLIM_CHART_TAG=${{ inputs.slim-chart-tag }} \
114129
KIND_CLUSTER_NAME=${{ inputs.kind-cluster-name }} \

‎.github/workflows/test-integrations.yaml‎

Lines changed: 76 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,22 @@ on:
3939
required: false
4040
default: true
4141
type: boolean
42+
skip_slim_spire_test:
43+
description: 'Skip slim with SPIRE tests'
44+
required: false
45+
default: true
46+
type: boolean
47+
run_agentic_apps_test:
48+
description: 'Run agentic apps tests'
49+
required: false
50+
default: false
51+
type: boolean
52+
run_wfsm_test:
53+
description: 'Run WFSM tests'
54+
required: false
55+
default: false
56+
type: boolean
57+
4258
schedule:
4359
- cron: "0 4 * * *"
4460

@@ -62,7 +78,7 @@ jobs:
6278
echo "kind-version=$KIND_VERSION" >> "$GITHUB_OUTPUT"
6379
6480
run-tests-slim:
65-
if: ${{ inputs.skip_slim_test == false }}
81+
if: ${{ !inputs.skip_slim_test }}
6682
needs: [ set-kind-version ]
6783
runs-on: ubuntu-latest
6884

@@ -99,6 +115,7 @@ jobs:
99115
- name: Deploy Slim
100116
uses: ./.github/actions/deploy-components
101117
with:
118+
deploy-spire: 'true'
102119
deploy-slim: 'true'
103120
slim-image-tag: ${{ inputs.override_slim_image_tag }}
104121
slim-chart-tag: ${{ inputs.override_slim_chart_tag }}
@@ -123,8 +140,63 @@ jobs:
123140
run: task integrations:slim:test:mcp-server
124141
shell: bash
125142

143+
run-tests-slim-spire:
144+
if: ${{ !inputs.skip_slim_spire_test }}
145+
needs: [ set-kind-version ]
146+
runs-on: ubuntu-latest
147+
148+
permissions:
149+
contents: 'read'
150+
id-token: 'write'
151+
packages: 'read'
152+
attestations: 'read'
153+
154+
steps:
155+
- name: Checkout code
156+
uses: actions/checkout@v4
157+
with:
158+
fetch-depth: 0
159+
160+
- name: Login to GitHub Container Registry
161+
uses: docker/login-action@v3
162+
with:
163+
registry: ghcr.io
164+
username: ${{ github.actor }}
165+
password: ${{ secrets.GITHUB_TOKEN }}
166+
167+
- name: Setup Environment
168+
uses: ./.github/actions/setup-env
169+
with:
170+
python: true
171+
go: false
172+
173+
- name: Setup K8S Tools
174+
uses: ./.github/actions/setup-k8s
175+
with:
176+
kind-version: ${{ needs.set-kind-version.outputs.kind-version }}
177+
178+
- name: Deploy Slim with SPIRE
179+
uses: ./.github/actions/deploy-components
180+
with:
181+
deploy-slim: 'true'
182+
deploy-spire: 'true'
183+
slim-config: 'spire'
184+
slim-image-tag: ${{ inputs.override_slim_image_tag }}
185+
slim-chart-tag: ${{ inputs.override_slim_chart_tag }}
186+
187+
- name: Run slim sanity tests (mtls with SPIRE)
188+
env:
189+
AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
190+
AZURE_MODEL_VERSION: ${{ vars.AZURE_MODEL_VERSION }}
191+
AZURE_DEPLOYMENT_NAME: ${{ vars.AZURE_DEPLOYMENT_NAME }}
192+
AZURE_OPENAI_API_VERSION: ${{ vars.AZURE_OPENAI_API_VERSION }}
193+
AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
194+
SLIM_CONFIG: 'spire'
195+
run: task integrations:slim:test:sanity
196+
shell: bash
197+
126198
run-tests-directory:
127-
if: ${{ inputs.skip_directory_test == false }}
199+
if: ${{ !inputs.skip_directory_test }}
128200
needs: [ set-kind-version ]
129201
runs-on: ubuntu-latest
130202

@@ -170,6 +242,7 @@ jobs:
170242
shell: bash
171243

172244
run-agentic-apps:
245+
if: ${{ inputs.run_agentic_apps_test }}
173246
runs-on: ubuntu-latest
174247

175248
steps:
@@ -194,6 +267,7 @@ jobs:
194267
shell: bash
195268

196269
run-tests-wfsm:
270+
if: ${{ inputs.run_wfsm_test }}
197271
needs: [ set-kind-version ]
198272
runs-on: ubuntu-latest
199273

‎integrations/agntcy-slim/Taskfile.yml‎

Lines changed: 38 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ vars:
1313
IMAGE_REPO: '{{ .IMAGE_REPO | default "ghcr.io/agntcy" }}'
1414
SLIM_IMAGE_TAG: '{{ .SLIM_IMAGE_TAG | default "0.3.15" }}'
1515
MCP_PROXY_IMAGE_TAG: '{{ .MCP_PROXY_IMAGE_TAG | default "0.1.5" }}'
16-
SLIM_CHART_TAG: '{{ .SLIM_CHART_TAG | default "v0.1.7" }}'
16+
SLIM_CHART_TAG: '{{ .SLIM_CHART_TAG | default "v0.1.8" }}'
1717
SLIM_CONFIG: '{{ .SLIM_CONFIG | default "base" }}'
1818

1919
IMAGE_BAKE_OPTS: '{{ .IMAGE_BAKE_OPTS | default "--set *.platform=linux/arm64" }}'
20-
LANGCHAIN_APP_TAG: '{{ .LANGCHAIN_APP_TAG | default "v0.0.10" }}'
21-
AUTOGEN_APP_TAG: '{{ .AUTOGEN_APP_TAG | default "v0.0.10" }}'
20+
LANGCHAIN_APP_TAG: '{{ .LANGCHAIN_APP_TAG | default "v0.0.12" }}'
21+
AUTOGEN_APP_TAG: '{{ .AUTOGEN_APP_TAG | default "v0.0.12" }}'
2222

2323
AZURE_OPENAI_API_KEY: '{{ .AZURE_OPENAI_API_KEY | default "" }}'
2424
AZURE_OPENAI_ENDPOINT: '{{ .AZURE_OPENAI_ENDPOINT | default "" }}'
@@ -32,6 +32,9 @@ vars:
3232

3333
RUNNER_TYPE: '{{ .RUNNER_TYPE | default "docker" }}'
3434

35+
SPIRE_NAMESPACE: '{{ .SPIRE_NAMESPACE | default "spire-server" }}'
36+
37+
3538
tasks:
3639
k8s:port-forward:setup:
3740
internal: true
@@ -53,14 +56,13 @@ tasks:
5356
--version {{ .SLIM_CHART_TAG }} \
5457
--set slim.image.tag="{{ .SLIM_IMAGE_TAG }}" \
5558
--set mcpProxy.image.tag="{{ .MCP_PROXY_IMAGE_TAG }}" \
56-
--set mcpProxy.enabled="{{ .MCP_PROXY_DEPLOY }}" \
5759
-f components/config/{{ .SLIM_CONFIG }}/server-config.yaml \
5860
--namespace {{ .HELM_NAMESPACE }} \
5961
--create-namespace \
6062
--install \
6163
--wait \
6264
--wait-for-jobs \
63-
--timeout "15m"
65+
--timeout "15m"
6466
6567
test-env:cleanup:
6668
desc: Remove agent slim test env
@@ -92,6 +94,36 @@ tasks:
9294
cmds:
9395
- kubectl apply -f components/certificates
9496

97+
spire:deploy:
98+
desc: Deploy SPIRE server
99+
cmds:
100+
- |
101+
helm upgrade --install \
102+
spire-crds \
103+
spire-crds \
104+
--repo https://spiffe.github.io/helm-charts-hardened/ \
105+
--namespace {{ .SPIRE_NAMESPACE }} \
106+
--create-namespace \
107+
--wait \
108+
--wait-for-jobs \
109+
--timeout "15m"
110+
- |
111+
helm upgrade --install \
112+
spire \
113+
spire \
114+
--repo https://spiffe.github.io/helm-charts-hardened/ \
115+
--namespace {{ .SPIRE_NAMESPACE }} \
116+
--create-namespace \
117+
--wait \
118+
--wait-for-jobs \
119+
--timeout "15m"
120+
121+
spire:remove:
122+
desc: Remove SPIRE server
123+
cmds:
124+
- helm delete spire -n {{ .SPIRE_NAMESPACE }}
125+
- helm delete spire-crds -n {{ .SPIRE_NAMESPACE }}
126+
95127
build:agentic-apps:
96128
desc: Build agentic containers
97129
dir: ./agentic-apps
@@ -101,7 +133,7 @@ tasks:
101133
test:sanity:
102134
desc: Sanity slim test
103135
cmds:
104-
- NAMESPACE={{.HELM_NAMESPACE}} IMAGE_REPO={{.IMAGE_REPO}} LANGCHAIN_APP_TAG={{.LANGCHAIN_APP_TAG}} AUTOGEN_APP_TAG={{.AUTOGEN_APP_TAG}} go test ./tests -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 30m -timeout 30m -ginkgo.v -ginkgo.focus "Agntcy slim sanity test"
136+
- SLIM_CONFIG={{ .SLIM_CONFIG }} NAMESPACE={{.HELM_NAMESPACE}} IMAGE_REPO={{.IMAGE_REPO}} LANGCHAIN_APP_TAG={{.LANGCHAIN_APP_TAG}} AUTOGEN_APP_TAG={{.AUTOGEN_APP_TAG}} go test ./tests -v -failfast -test.v -test.paniconexit0 -ginkgo.timeout 30m -timeout 30m -ginkgo.v -ginkgo.focus "Agntcy slim sanity test"
105137

106138
test:mcp-server:
107139
desc: Test MCP over Slim

‎integrations/agntcy-slim/components/certificates/client-cert.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ spec:
1515
kind: ClusterIssuer
1616
commonName: "client.agntcy.org"
1717
dnsNames:
18-
- client.agntcy.org
18+
- agntcy-slim
19+
- agntcy-slim.default.svc.cluster.local
1920
usages:
2021
- client auth

‎integrations/agntcy-slim/components/certificates/server-cert.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ spec:
1515
kind: ClusterIssuer
1616
commonName: "server.agntcy.org"
1717
dnsNames:
18-
- server.agntcy.org
18+
- agntcy-slim
19+
- agntcy-slim.default.svc.cluster.local
1920
usages:
2021
- server auth

‎integrations/agntcy-slim/components/config/base/server-config.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,7 @@ slim:
2626
server:
2727
endpoint: "0.0.0.0:46358"
2828
tls:
29-
insecure: true
29+
insecure: true
30+
31+
mcpProxy:
32+
enabled: true

‎integrations/agntcy-slim/components/config/mtls/server-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
slim:
5+
56
config:
67
tracing:
78
log_level: debug
@@ -21,8 +22,7 @@ slim:
2122
tls:
2223
cert_file: "/etc/certs/tls.crt"
2324
key_file: "/etc/certs/tls.key"
24-
25-
client_ca_file: "/etc/certs/ca.crt"
25+
ca_file: "/etc/certs/ca.crt"
2626

2727
clients: []
2828

‎integrations/agntcy-slim/components/config/spire/helper.conf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
agent_address = "/run/spire/agent-sockets/api.sock"
2+
cmd = ""
3+
cmd_args = ""
4+
cert_dir = "/svids"
5+
renew_signal = ""
6+
svid_file_name = "tls.crt"
7+
svid_key_file_name = "tls.key"
8+
svid_bundle_file_name = "svid_bundle.pem"
9+
jwt_bundle_file_name = "cert.jwt"
10+
cert_file_mode = 0644
11+
key_file_mode = 0644
12+
jwt_svid_file_mode = 0644
13+
jwt_bundle_file_mode = 0644
14+
jwt_svids = [{jwt_audience="test", jwt_svid_file_name="jwt_svid.token"}]
15+
daemon_mode = false

‎integrations/agntcy-slim/components/config/spire/server-config.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Copyright AGNTCY Contributors (https://github.com/agntcy)
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
spire:
5+
enabled: true
6+
7+
slim:
8+
9+
config:
10+
tracing:
11+
log_level: debug
12+
display_thread_names: true
13+
display_thread_ids: true
14+
15+
runtime:
16+
n_cores: 0
17+
thread_name: "slim-data-plane"
18+
drain_timeout: 10s
19+
20+
services:
21+
slim/0:
22+
pubsub:
23+
servers:
24+
- endpoint: "0.0.0.0:46357"
25+
tls:
26+
cert_file: "/svids/tls.crt"
27+
key_file: "/svids/tls.key"
28+
ca_file: "/svids/svid_bundle.pem"
29+
30+
clients: []
31+
32+
mcpProxy:
33+
enabled: false
34+
config:
35+
services:
36+
slim/0:
37+
pubsub:
38+
clients:
39+
- endpoint: "https://agntcy-slim:46357"
40+
tls:
41+
cert_file: "/svids/tls.crt"
42+
key_file: "/svids/tls.key"
43+
ca_file: "/svids/svid_bundle.pem"

‎integrations/agntcy-slim/tests/json‎

Whitespace-only changes.

0 commit comments

Comments
 (0)