test: parallel execution of e2e tests

osmman · osmman · commit 901041325a7b · 2025-09-08T17:54:52.000+02:00
diff --git a/Makefile b/Makefile
@@ -136,7 +136,7 @@ test: manifests generate fmt vet envtest ## Run tests.
 # Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors.
 .PHONY: test-e2e  # Run the e2e tests against a Kind k8s instance that is spun up.
 test-e2e: generate
-	go test -p 1 ./test/e2e/... -tags=integration -timeout 20m
+	go test ./test/e2e/... -tags=integration -timeout 20m
 
 # Switch images from `registry.redhat.io` images to the dev images
 .PHONY: dev-images
diff --git a/go.mod b/go.mod
@@ -5,6 +5,7 @@ go 1.24.4
 toolchain go1.24.6
 
 require (
+	github.com/alexflint/go-filemutex v1.3.0
 	github.com/blang/semver/v4 v4.0.0
 	github.com/go-logr/logr v1.4.3
 	github.com/google/certificate-transparency-go v1.3.2
diff --git a/go.sum b/go.sum
@@ -1,3 +1,5 @@
+github.com/alexflint/go-filemutex v1.3.0 h1:LgE+nTUWnQCyRKbpoceKZsPQbs84LivvgwUymZXdOcM=
+github.com/alexflint/go-filemutex v1.3.0/go.mod h1:U0+VA/i30mGBlLCrFPGtTe9y6wGQfNAWPBTekHQ+c8A=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -156,6 +158,7 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
@@ -199,6 +202,7 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
 golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
@@ -230,6 +234,7 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/test/benchmark/install_test.go b/test/benchmark/install_test.go
diff --git a/test/e2e/byo/database_test.go b/test/e2e/byo/database_test.go
@@ -1,6 +1,6 @@
 //go:build integration
 
-package e2e
+package byo
 
 import (
 	"context"
diff --git a/test/e2e/byo/provided_certs_test.go b/test/e2e/byo/provided_certs_test.go
@@ -1,6 +1,6 @@
 //go:build integration
 
-package e2e
+package byo
 
 import (
 	"github.com/securesign/operator/test/e2e/support/steps"
diff --git a/test/e2e/byo/suite_test.go b/test/e2e/byo/suite_test.go
@@ -0,0 +1,24 @@
+//go:build integration
+
+package byo
+
+import (
+	"testing"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/format"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+func TestE2e(t *testing.T) {
+	RegisterFailHandler(Fail)
+	log.SetLogger(GinkgoLogr)
+	SetDefaultEventuallyTimeout(time.Duration(3) * time.Minute)
+	EnforceDefaultTimeoutsWhenUsingContexts()
+	RunSpecs(t, "Bring your own")
+
+	// print whole stack in case of failure
+	format.MaxLength = 0
+}
diff --git a/test/e2e/deployment/common_test.go b/test/e2e/deployment/common_test.go
@@ -1,6 +1,6 @@
 //go:build integration
 
-package e2e
+package deployment
 
 import (
 	"net/http"
@@ -31,7 +31,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 )
 
-var _ = Describe("Securesign install with certificate generation", Ordered, func() {
+var _ = Describe("Install with generated certs and keys", Ordered, func() {
 	cli, _ := support.CreateClient()
 
 	var targetImageName string
diff --git a/test/e2e/deployment/key_autodiscovery_test.go b/test/e2e/deployment/key_autodiscovery_test.go
@@ -1,6 +1,6 @@
 //go:build integration
 
-package e2e
+package deployment
 
 import (
 	"github.com/securesign/operator/internal/utils/kubernetes"
@@ -21,7 +21,7 @@ import (
 	v1 "k8s.io/api/core/v1"
 )
 
-var _ = Describe("Securesign key autodiscovery test", Ordered, func() {
+var _ = Describe("Install with auto-discovered keys", Ordered, func() {
 	cli, _ := support.CreateClient()
 
 	var targetImageName string
diff --git a/test/e2e/deployment/namespaced.go b/test/e2e/deployment/namespaced.go
@@ -1,18 +1,17 @@
 //go:build integration
 
-package e2e
+package deployment
 
 import (
 	"fmt"
-	"time"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	"github.com/securesign/operator/api/v1alpha1"
 	"github.com/securesign/operator/test/e2e/support"
 	testSupportKubernetes "github.com/securesign/operator/test/e2e/support/kubernetes"
 	"github.com/securesign/operator/test/e2e/support/steps"
-	clients "github.com/securesign/operator/test/e2e/support/tas/cli"
+	"github.com/securesign/operator/test/e2e/support/tas"
 	"github.com/securesign/operator/test/e2e/support/tas/ctlog"
 	"github.com/securesign/operator/test/e2e/support/tas/fulcio"
 	"github.com/securesign/operator/test/e2e/support/tas/rekor"
@@ -346,38 +345,7 @@ var _ = Describe("Install components to separate namespaces", Ordered, func() {
 			ts := tsa.Get(ctx, cli, namespaces["tsa"].Name, tsaObject.Name)
 			Expect(ts).ToNot(BeNil())
 
-			Eventually(func() error {
-				return tsa.GetCertificateChain(ctx, cli, "", "", ts.Status.Url)
-			}).Should(Succeed())
-
-			oidcToken, err := support.OidcToken(ctx)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(oidcToken).ToNot(BeEmpty())
-
-			// sleep for a while to be sure everything has settled down
-			time.Sleep(time.Duration(10) * time.Second)
-
-			Expect(clients.Execute("cosign", "initialize", "--mirror="+t.Status.Url, "--root="+t.Status.Url+"/root.json")).To(Succeed())
-
-			Expect(clients.Execute(
-				"cosign", "sign", "-y",
-				"--fulcio-url="+f.Status.Url,
-				"--rekor-url="+r.Status.Url,
-				"--timestamp-server-url="+ts.Status.Url+"/api/v1/timestamp",
-				"--oidc-issuer="+support.OidcIssuerUrl(),
-				"--oidc-client-id="+support.OidcClientID(),
-				"--identity-token="+oidcToken,
-				targetImageName,
-			)).To(Succeed())
-
-			Expect(clients.Execute(
-				"cosign", "verify",
-				"--rekor-url="+r.Status.Url,
-				"--timestamp-certificate-chain=ts_chain.pem",
-				"--certificate-identity-regexp", ".*@redhat",
-				"--certificate-oidc-issuer-regexp", ".*keycloak.*",
-				targetImageName,
-			)).To(Succeed())
+			tas.VerifyByCosignCustom(ctx, cli, f, r, t, ts, targetImageName)
 		})
 	})
 })
diff --git a/test/e2e/deployment/suite_test.go b/test/e2e/deployment/suite_test.go
@@ -0,0 +1,24 @@
+//go:build integration
+
+package deployment
+
+import (
+	"testing"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/format"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+)
+
+func TestE2e(t *testing.T) {
+	RegisterFailHandler(Fail)
+	log.SetLogger(GinkgoLogr)
+	SetDefaultEventuallyTimeout(time.Duration(3) * time.Minute)
+	EnforceDefaultTimeoutsWhenUsingContexts()
+	RunSpecs(t, "Deployment Suite")
+
+	// print whole stack in case of failure
+	format.MaxLength = 0
+}
diff --git a/test/e2e/suite_test.go b/test/e2e/suite_test.go
@@ -15,7 +15,7 @@ func TestE2e(t *testing.T) {
 	log.SetLogger(GinkgoLogr)
 	SetDefaultEventuallyTimeout(time.Duration(3) * time.Minute)
 	EnforceDefaultTimeoutsWhenUsingContexts()
-	RunSpecs(t, "Trusted Artifact Signer E2E Suite")
+	RunSpecs(t, "E2E Suite")
 
 	// print whole stack in case of failure
 	format.MaxLength = 0
diff --git a/test/e2e/support/tas/tas.go b/test/e2e/support/tas/tas.go
@@ -2,8 +2,11 @@ package tas
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"time"
 
+	"github.com/alexflint/go-filemutex"
 	"github.com/securesign/operator/test/e2e/support/tas/securesign"
 	"github.com/securesign/operator/test/e2e/support/tas/tsa"
 
@@ -19,6 +22,8 @@ import (
 	runtimeCli "sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+const lockFileName = "cosign.lock"
+
 func VerifyAllComponents(ctx context.Context, cli runtimeCli.Client, s *rhtasv1alpha1.Securesign, dbPresent bool) {
 	trillian.Verify(ctx, cli, s.Namespace, s.Name, dbPresent)
 	fulcio.Verify(ctx, cli, s.Namespace, s.Name)
@@ -29,22 +34,26 @@ func VerifyAllComponents(ctx context.Context, cli runtimeCli.Client, s *rhtasv1a
 	securesign.Verify(ctx, cli, s.Namespace, s.Name)
 }
 
-func VerifyByCosign(ctx context.Context, cli runtimeCli.Client, s *rhtasv1alpha1.Securesign, targetImageName string) {
-	f := fulcio.Get(ctx, cli, s.Namespace, s.Name)
-	Expect(f).ToNot(BeNil())
-
-	r := rekor.Get(ctx, cli, s.Namespace, s.Name)
-	Expect(r).ToNot(BeNil())
-
-	t := tuf.Get(ctx, cli, s.Namespace, s.Name)
-	Expect(t).ToNot(BeNil())
+func VerifyByCosignCustom(ctx context.Context, cli runtimeCli.Client,
+	fulcio *rhtasv1alpha1.Fulcio,
+	rekor *rhtasv1alpha1.Rekor,
+	tuf *rhtasv1alpha1.Tuf,
+	timestampAuthority *rhtasv1alpha1.TimestampAuthority,
+	targetImageName string) {
 
-	ts := tsa.Get(ctx, cli, s.Namespace, s.Name)
-	Expect(ts).ToNot(BeNil())
+	var m *filemutex.FileMutex
+	var err error
+	lockFilePath := filepath.Join(os.TempDir(), lockFileName)
+	m, err = filemutex.New(lockFilePath)
+	if err != nil {
+		panic(err)
+	}
+	_ = m.Lock()
+	defer func() { _ = m.Unlock() }()
 
-	Eventually(func(ctx context.Context) error {
-		return tsa.GetCertificateChain(ctx, cli, s.Namespace, s.Name, ts.Status.Url)
-	}).WithContext(ctx).Should(Succeed())
+	Eventually(func() error {
+		return tsa.GetCertificateChain(ctx, cli, timestampAuthority.Namespace, timestampAuthority.Name, timestampAuthority.Status.Url)
+	}).Should(Succeed())
 
 	oidcToken, err := support.OidcToken(ctx)
 	Expect(err).ToNot(HaveOccurred())
@@ -53,13 +62,13 @@ func VerifyByCosign(ctx context.Context, cli runtimeCli.Client, s *rhtasv1alpha1
 	// sleep for a while to be sure everything has settled down
 	time.Sleep(time.Duration(10) * time.Second)
 
-	Expect(clients.Execute("cosign", "initialize", "--mirror="+t.Status.Url, "--root="+t.Status.Url+"/root.json")).To(Succeed())
+	Expect(clients.Execute("cosign", "initialize", "--mirror="+tuf.Status.Url, "--root="+tuf.Status.Url+"/root.json")).To(Succeed())
 
 	Expect(clients.Execute(
 		"cosign", "sign", "-y",
-		"--fulcio-url="+f.Status.Url,
-		"--rekor-url="+r.Status.Url,
-		"--timestamp-server-url="+ts.Status.Url+"/api/v1/timestamp",
+		"--fulcio-url="+fulcio.Status.Url,
+		"--rekor-url="+rekor.Status.Url,
+		"--timestamp-server-url="+timestampAuthority.Status.Url+"/api/v1/timestamp",
 		"--oidc-issuer="+support.OidcIssuerUrl(),
 		"--oidc-client-id="+support.OidcClientID(),
 		"--identity-token="+oidcToken,
@@ -68,10 +77,26 @@ func VerifyByCosign(ctx context.Context, cli runtimeCli.Client, s *rhtasv1alpha1
 
 	Expect(clients.Execute(
 		"cosign", "verify",
-		"--rekor-url="+r.Status.Url,
+		"--rekor-url="+rekor.Status.Url,
 		"--timestamp-certificate-chain=ts_chain.pem",
 		"--certificate-identity-regexp", ".*@redhat",
 		"--certificate-oidc-issuer-regexp", ".*keycloak.*",
 		targetImageName,
 	)).To(Succeed())
 }
+
+func VerifyByCosign(ctx context.Context, cli runtimeCli.Client, s *rhtasv1alpha1.Securesign, targetImageName string) {
+	f := fulcio.Get(ctx, cli, s.Namespace, s.Name)
+	Expect(f).ToNot(BeNil())
+
+	r := rekor.Get(ctx, cli, s.Namespace, s.Name)
+	Expect(r).ToNot(BeNil())
+
+	t := tuf.Get(ctx, cli, s.Namespace, s.Name)
+	Expect(t).ToNot(BeNil())
+
+	ts := tsa.Get(ctx, cli, s.Namespace, s.Name)
+	Expect(ts).ToNot(BeNil())
+
+	VerifyByCosignCustom(ctx, cli, f, r, t, ts, targetImageName)
+}
diff --git a/test/e2e/update/suite_test.go b/test/e2e/update/suite_test.go
@@ -26,7 +26,7 @@ func TestUpdateComponents(t *testing.T) {
 	log.SetLogger(GinkgoLogr)
 	SetDefaultEventuallyTimeout(time.Duration(1) * time.Minute)
 	EnforceDefaultTimeoutsWhenUsingContexts()
-	RunSpecs(t, "Update components E2E Suite")
+	RunSpecs(t, "Update components Suite")
 
 	// print whole stack in case of failure
 	format.MaxLength = 0
