Add ability to test sg-core with mTLS

This adds the sg_core_client_cert and sg_core_client_key config
options. When both are configured to a path, tempest will use
the given client cert/key when accesing sg-core during tests.
This change also demonstrates an extensible pattern if we decide
to extend mTLS testing to other components as well.

Assisted-by: Claude-Code claude-opus-4-6
Change-Id: I3a18b25fbb608a531da450c494b937f571f926c3
Signed-off-by: Jaromir Wysoglad <jwysogla@redhat.com>

telemetry_tempest_plugin/config.py

@@ -83,6 +83,14 @@ telemetry_opts = [
     cfg.URIOpt('sg_core_service_url',
                default="http://127.0.0.1:3000",
                help="URL to sg-core prometheus endpoint"),
+    cfg.StrOpt('sg_core_client_cert',
+               default='',
+               help="Path to a client certificate for mTLS "
+                    "authentication against sg-core"),
+    cfg.StrOpt('sg_core_client_key',
+               default='',
+               help="Path to a client private key for mTLS "
+                    "authentication against sg-core"),
     cfg.URIOpt('prometheus_service_url',
                default="http://127.0.0.1:9090",
                help="URL to prometheus endpoint"),

telemetry_tempest_plugin/scenario/telemetry_integration_prometheus_gabbits/ceilometer-sg-core-integration.yaml

@@ -1,3 +1,5 @@
+ssl_client_cert: $ENVIRON['SG_CORE_CLIENT_CERT']
+ssl_client_key: $ENVIRON['SG_CORE_CLIENT_KEY']
 tests:
   - name: Check for ceilometer metrics
     desc: Check the sg-core prometheus endpoint for ceilometer metrics

telemetry_tempest_plugin/scenario/test_telemetry_integration_prometheus.py

@@ -145,6 +145,10 @@ class PrometheusGabbiTest(manager.ScenarioTest):
             "NOVA_SERVICE_URL": self._get_endpoint(auth, "compute"),
             "SG_CORE_SERVICE_URL":
             config.CONF.telemetry.sg_core_service_url,
+            "SG_CORE_CLIENT_CERT":
+            config.CONF.telemetry.sg_core_client_cert,
+            "SG_CORE_CLIENT_KEY":
+            config.CONF.telemetry.sg_core_client_key,
             "CEILOMETER_POLLING_INTERVAL":
             str(config.CONF.telemetry.ceilometer_polling_interval),
             "PROMETHEUS_SERVICE_URL":

telemetry_tempest_plugin/scenario/utils.py

@@ -11,17 +11,29 @@
 #    under the License.
 
 import os
+import re
 import unittest
 
 from gabbi import runner
 from gabbi import suitemaker
 from gabbi import utils
+import httpx
 from oslo_config import cfg
 from oslo_log import log as logging
 
 LOG = logging.getLogger(__name__)
 CONF = cfg.CONF
 
+ENVIRON_RE = re.compile(r"\$ENVIRON\['([^']+)'\]")
+
+
+def _resolve_environ(value):
+    """Resolve a $ENVIRON['VAR'] reference to its value."""
+    match = ENVIRON_RE.fullmatch(str(value))
+    if match:
+        return os.environ.get(match.group(1), '')
+    return str(value)
+
 
 def run_test(test_class_instance, test_dir, filename):
     d = utils.load_yaml(yaml_file=os.path.join(test_dir, filename))
@@ -41,6 +53,15 @@ def run_test(test_class_instance, test_dir, filename):
         handlers=runner.initialize_handlers([], []),
         test_loader_name="tempest")
 
+    client_cert = _resolve_environ(d.get('ssl_client_cert', ''))
+    client_key = _resolve_environ(d.get('ssl_client_key', ''))
+    if client_cert and client_key:
+        for test in test_suite:
+            test.http.client = httpx.Client(
+                verify=cert_validate,
+                cert=(client_cert, client_key),
+            )
+
     # NOTE(sileht): We hide stdout/stderr and reraise the failure
     # manually, tempest will print it ittest_class.
     with open(os.devnull, 'w') as stream: