Run TestInteractiveTerminal inside of CI
Overview
In !2155 (merged) we started running Kubernetes integration tests inside of CI, however, we are skipping the testInteractiveTerminalFeatureFlag
inside of CI because of configuration issues specified below. This is only a problem inside of CI because the cluster is set up in a different way (this also exposes some problems with the interactive web terminal in general)
Proposal
- The first problem is the configuration of
bearer_token
since web terminal requires the bearer_token and the kubeconfig has a username/password specified so we end up getting the following error:Preparation failed: error connecting to Kubernetes: username/password or bearer token may be set, but not both
- How to fix (different options):
- We can update [the check of the presence of the
bearer_token
and empty out the username/password since it might be safe to assume if a token is specified the username/password can be ignored. - Update terminal.go so it takes the specified username/password and tries to auto-discover the
bearer_token
for that user. However, this might a problem because it would requiregitlab-runner
to have more permissions to read secrets to get the token.
- We can update [the check of the presence of the
- How to fix (different options):
- When the step above is fixed we will start getting
x509 certificate signed by unknown authority
this is because the Kubernetes API is exposed via https, the kubeclient is configured to load the CA chain automatically, but since we are using raw HTTP we don't have that root certificate trusted.- How to fix:
- Inside of the container we have k3s.yml which has the
certificate-authority-data
which is a base64 encoded string with the root CA. Get that CA, decode it and add it to system root so that https requests are trusted.
- Inside of the container we have k3s.yml which has the
- How to fix:
Edited by Steve Xuereb