From 78f3327364345164a52ac6bbf0c7df0fa1ae8951 Mon Sep 17 00:00:00 2001 From: Lee Yarwood Date: Mon, 11 Dec 2017 11:16:49 +0000 Subject: [PATCH] Verify instance snapshots when using signed images Closes-bug: #1737513 Depends-On: Ia3d80bf2f81c7317fec117aecbc3c560d51a7d4e Change-Id: I5032c71a3a0230df7352a415b5b77f37fafc29a7 --- .../tests/scenario/test_image_signing.py | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/barbican_tempest_plugin/tests/scenario/test_image_signing.py b/barbican_tempest_plugin/tests/scenario/test_image_signing.py index d641f28..794d33e 100644 --- a/barbican_tempest_plugin/tests/scenario/test_image_signing.py +++ b/barbican_tempest_plugin/tests/scenario/test_image_signing.py @@ -13,6 +13,7 @@ # under the License. from oslo_log import log as logging +from tempest.api.compute import base as compute_base from tempest.common import utils from tempest import config from tempest import exceptions @@ -81,3 +82,51 @@ class ImageSigningTest(barbican_manager.BarbicanScenarioTest): "Signature verification for the image failed", self.create_server, image_id=img_uuid) + + +class ImageSigningSnapshotTest(barbican_manager.BarbicanScenarioTest, + compute_base.BaseV2ComputeTest): + + @classmethod + def setup_clients(cls): + super(ImageSigningSnapshotTest, cls).setup_clients() + cls.client = cls.servers_client + + @decorators.idempotent_id('f0603dfd-8b2c-44e2-8b0f-d65c87aab257') + @utils.services('compute', 'image') + def test_signed_image_upload_boot_snapshot(self): + """Test that Glance can snapshot an instance using a signed image. + + Verify that a snapshot can be taken of an instance booted from a signed + image and that the resulting snapshot image has had all image signature + properties dropped from the original image. + + The test follows these steps: + * Create an asymmetric keypair + * Sign an image file with the private key + * Create a certificate with the public key + * Store the certificate in Barbican + * Store the signed image in Glance + * Boot the signed image + * Confirm the instance changes state to Active + * Snapshot the running instance + * Uploading the snapshot and confirm the state moves to ACTIVE + """ + img_uuid = self.sign_and_upload_image() + instance = self.create_server(name='signed_img_server_to_snapshot', + image_id=img_uuid, + wait_until='ACTIVE') + + # Snapshot the instance, wait until the snapshot is active + image = self.create_image_from_server(instance['id'], + wait_until='ACTIVE') + + # Ensure all img_signature image props have been dropped + signature_props = ['img_signature_hash_method', + 'img_signature', + 'img_signature_key_type', + 'img_signature_certificate_uuid'] + img_meta = self.compute_images_client.list_image_metadata(image['id']) + self.assertFalse(any(x in img_meta for x in signature_props)) + + self.servers_client.delete_server(instance['id'])