Skip to content

Run TestInteractiveTerminal inside of CI

Overview

In !2155 (merged) we started running Kubernetes integration tests inside of CI, however, we are skipping the testInteractiveTerminalFeatureFlag inside of CI because of configuration issues specified below. This is only a problem inside of CI because the cluster is set up in a different way (this also exposes some problems with the interactive web terminal in general)

Proposal

  1. The first problem is the configuration of bearer_token since web terminal requires the bearer_token and the kubeconfig has a username/password specified so we end up getting the following error: Preparation failed: error connecting to Kubernetes: username/password or bearer token may be set, but not both
    • How to fix (different options):
      1. We can update [the check of the presence of the bearer_token and empty out the username/password since it might be safe to assume if a token is specified the username/password can be ignored.
      2. Update terminal.go so it takes the specified username/password and tries to auto-discover the bearer_token for that user. However, this might a problem because it would require gitlab-runner to have more permissions to read secrets to get the token.
  2. When the step above is fixed we will start getting x509 certificate signed by unknown authority this is because the Kubernetes API is exposed via https, the kubeclient is configured to load the CA chain automatically, but since we are using raw HTTP we don't have that root certificate trusted.
    • How to fix:
      1. Inside of the container we have k3s.yml which has the certificate-authority-data which is a base64 encoded string with the root CA. Get that CA, decode it and add it to system root so that https requests are trusted.
Edited by Steve Xuereb