Files
seaweedfs/test/s3/iam/Makefile
T
chrislu 27f2a88f10 🧪 CREATE S3 IAM INTEGRATION TESTS: Comprehensive End-to-End Testing Suite!
MAJOR ENHANCEMENT: Complete S3+IAM Integration Test Framework

🏆 COMPREHENSIVE TEST SUITE CREATED:
- Full end-to-end S3 API testing with IAM authentication and authorization
- JWT token-based authentication testing with OIDC provider simulation
- Policy enforcement validation for read-only, write-only, and admin roles
- Session management and expiration testing framework
- Multipart upload IAM integration testing
- Bucket policy integration and conflict resolution testing
- Contextual policy enforcement (IP-based, time-based conditions)
- Presigned URL generation with IAM validation

✅ COMPLETE TEST FRAMEWORK (10 FILES CREATED):
- s3_iam_integration_test.go: Main integration test suite (17KB, 7 test functions)
- s3_iam_framework.go: Test utilities and mock infrastructure (10KB)
- Makefile: Comprehensive build and test automation (7KB, 20+ targets)
- README.md: Complete documentation and usage guide (12KB)
- test_config.json: IAM configuration for testing (8KB)
- go.mod/go.sum: Dependency management with AWS SDK and JWT libraries
- Dockerfile.test: Containerized testing environment
- docker-compose.test.yml: Multi-service testing with LDAP support

🧪 TEST SCENARIOS IMPLEMENTED:
1. TestS3IAMAuthentication: Valid/invalid/expired JWT token handling
2. TestS3IAMPolicyEnforcement: Role-based access control validation
3. TestS3IAMSessionExpiration: Session lifecycle and expiration testing
4. TestS3IAMMultipartUploadPolicyEnforcement: Multipart operation IAM integration
5. TestS3IAMBucketPolicyIntegration: Resource-based policy testing
6. TestS3IAMContextualPolicyEnforcement: Conditional access control
7. TestS3IAMPresignedURLIntegration: Temporary access URL generation

🔧 TESTING INFRASTRUCTURE:
- Mock OIDC Provider: In-memory OIDC server with JWT signing capabilities
- RSA Key Generation: 2048-bit keys for secure JWT token signing
- Service Lifecycle Management: Automatic SeaweedFS service startup/shutdown
- Resource Cleanup: Automatic bucket and object cleanup after tests
- Health Checks: Service availability monitoring and wait strategies

�� AUTOMATION & CI/CD READY:
- Make targets for individual test categories (auth, policy, expiration, etc.)
- Docker support for containerized testing environments
- CI/CD integration with GitHub Actions and Jenkins examples
- Performance benchmarking capabilities with memory profiling
- Watch mode for development with automatic test re-runs

✅ SERVICE INTEGRATION TESTING:
- Master Server (9333): Cluster coordination and metadata management
- Volume Server (8080): Object storage backend testing
- Filer Server (8888): Metadata and IAM persistent storage testing
- S3 API Server (8333): Complete S3-compatible API with IAM integration
- Mock OIDC Server: Identity provider simulation for authentication testing

🎯 PRODUCTION-READY FEATURES:
- Comprehensive error handling and assertion validation
- Realistic test scenarios matching production use cases
- Multiple authentication methods (JWT, session tokens, basic auth)
- Policy conflict resolution testing (IAM vs bucket policies)
- Concurrent operations testing with multiple clients
- Security validation with proper access denial testing

🔒 ENTERPRISE TESTING CAPABILITIES:
- Multi-tenant access control validation
- Role-based permission inheritance testing
- Session token expiration and renewal testing
- IP-based and time-based conditional access testing
- Audit trail validation for compliance testing
- Load testing framework for performance validation

📋 DEVELOPER EXPERIENCE:
- Comprehensive README with setup instructions and examples
- Makefile with intuitive targets and help documentation
- Debug mode for manual service inspection and troubleshooting
- Log analysis tools and service health monitoring
- Extensible framework for adding new test scenarios

This provides a complete, production-ready testing framework for validating
the advanced IAM integration with SeaweedFS S3 API functionality!

Ready for comprehensive S3+IAM validation 🚀
2025-08-24 10:20:32 -07:00

207 lines
7.1 KiB
Makefile

# SeaweedFS S3 IAM Integration Tests Makefile
.PHONY: all test clean setup start-services stop-services wait-for-services help
# Default target
all: test
# Test configuration
WEED_BINARY ?= ../../../weed
LOG_LEVEL ?= 2
S3_PORT ?= 8333
FILER_PORT ?= 8888
MASTER_PORT ?= 9333
VOLUME_PORT ?= 8080
TEST_TIMEOUT ?= 30m
# Service PIDs
MASTER_PID_FILE = /tmp/weed-master.pid
VOLUME_PID_FILE = /tmp/weed-volume.pid
FILER_PID_FILE = /tmp/weed-filer.pid
S3_PID_FILE = /tmp/weed-s3.pid
help: ## Show this help message
@echo "SeaweedFS S3 IAM Integration Tests"
@echo ""
@echo "Usage:"
@echo " make [target]"
@echo ""
@echo "Targets:"
@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf " %-20s %s\n", $$1, $$2}' $(MAKEFILE_LIST)
test: clean setup start-services wait-for-services run-tests stop-services ## Run complete IAM integration test suite
test-quick: run-tests ## Run tests assuming services are already running
run-tests: ## Execute the Go tests
@echo "🧪 Running S3 IAM Integration Tests..."
go test -v -timeout $(TEST_TIMEOUT) ./...
setup: ## Setup test environment
@echo "🔧 Setting up test environment..."
@mkdir -p test-volume-data/filerldb2
@mkdir -p test-volume-data/m9333
start-services: ## Start SeaweedFS services for testing
@echo "🚀 Starting SeaweedFS services..."
@echo "Starting master server..."
@$(WEED_BINARY) master -port=$(MASTER_PORT) -v=$(LOG_LEVEL) \
-dataCenter=dc1 -rack=rack1 \
-dir=test-volume-data/m9333 > weed-master.log 2>&1 & \
echo $$! > $(MASTER_PID_FILE)
@sleep 2
@echo "Starting volume server..."
@$(WEED_BINARY) volume -port=$(VOLUME_PORT) -v=$(LOG_LEVEL) \
-dataCenter=dc1 -rack=rack1 \
-dir=test-volume-data \
-mserver=localhost:$(MASTER_PORT) > weed-volume.log 2>&1 & \
echo $$! > $(VOLUME_PID_FILE)
@sleep 2
@echo "Starting filer server..."
@$(WEED_BINARY) filer -port=$(FILER_PORT) -v=$(LOG_LEVEL) \
-defaultStoreDir=test-volume-data/filerldb2 \
-master=localhost:$(MASTER_PORT) > weed-filer.log 2>&1 & \
echo $$! > $(FILER_PID_FILE)
@sleep 2
@echo "Starting S3 API server with IAM..."
@$(WEED_BINARY) s3 -port=$(S3_PORT) -v=$(LOG_LEVEL) \
-filer=localhost:$(FILER_PORT) \
-config=test_config.json > weed-s3.log 2>&1 & \
echo $$! > $(S3_PID_FILE)
@echo "✅ All services started"
wait-for-services: ## Wait for all services to be ready
@echo "⏳ Waiting for services to be ready..."
@echo "Checking master server..."
@timeout 30 bash -c 'until curl -s http://localhost:$(MASTER_PORT)/cluster/status > /dev/null; do sleep 1; done' || (echo "❌ Master failed to start" && exit 1)
@echo "Checking filer server..."
@timeout 30 bash -c 'until curl -s http://localhost:$(FILER_PORT)/status > /dev/null; do sleep 1; done' || (echo "❌ Filer failed to start" && exit 1)
@echo "Checking S3 API server..."
@timeout 30 bash -c 'until curl -s http://localhost:$(S3_PORT) > /dev/null 2>&1; do sleep 1; done' || (echo "❌ S3 API failed to start" && exit 1)
@sleep 3
@echo "✅ All services are ready"
stop-services: ## Stop all SeaweedFS services
@echo "🛑 Stopping SeaweedFS services..."
@if [ -f $(S3_PID_FILE) ]; then \
echo "Stopping S3 API server..."; \
kill $$(cat $(S3_PID_FILE)) 2>/dev/null || true; \
rm -f $(S3_PID_FILE); \
fi
@if [ -f $(FILER_PID_FILE) ]; then \
echo "Stopping filer server..."; \
kill $$(cat $(FILER_PID_FILE)) 2>/dev/null || true; \
rm -f $(FILER_PID_FILE); \
fi
@if [ -f $(VOLUME_PID_FILE) ]; then \
echo "Stopping volume server..."; \
kill $$(cat $(VOLUME_PID_FILE)) 2>/dev/null || true; \
rm -f $(VOLUME_PID_FILE); \
fi
@if [ -f $(MASTER_PID_FILE) ]; then \
echo "Stopping master server..."; \
kill $$(cat $(MASTER_PID_FILE)) 2>/dev/null || true; \
rm -f $(MASTER_PID_FILE); \
fi
@echo "✅ All services stopped"
clean: stop-services ## Clean up test environment
@echo "🧹 Cleaning up test environment..."
@rm -rf test-volume-data
@rm -f weed-*.log
@rm -f *.test
@echo "✅ Cleanup complete"
logs: ## Show service logs
@echo "📋 Service Logs:"
@echo "=== Master Log ==="
@tail -20 weed-master.log 2>/dev/null || echo "No master log"
@echo ""
@echo "=== Volume Log ==="
@tail -20 weed-volume.log 2>/dev/null || echo "No volume log"
@echo ""
@echo "=== Filer Log ==="
@tail -20 weed-filer.log 2>/dev/null || echo "No filer log"
@echo ""
@echo "=== S3 API Log ==="
@tail -20 weed-s3.log 2>/dev/null || echo "No S3 log"
status: ## Check service status
@echo "📊 Service Status:"
@echo -n "Master: "; curl -s http://localhost:$(MASTER_PORT)/cluster/status > /dev/null 2>&1 && echo "✅ Running" || echo "❌ Not running"
@echo -n "Filer: "; curl -s http://localhost:$(FILER_PORT)/status > /dev/null 2>&1 && echo "✅ Running" || echo "❌ Not running"
@echo -n "S3 API: "; curl -s http://localhost:$(S3_PORT) > /dev/null 2>&1 && echo "✅ Running" || echo "❌ Not running"
debug: start-services wait-for-services ## Start services and keep them running for debugging
@echo "🐛 Services started in debug mode. Press Ctrl+C to stop..."
@trap 'make stop-services' INT; \
while true; do \
sleep 1; \
done
# Test specific scenarios
test-auth: ## Test only authentication scenarios
go test -v -run TestS3IAMAuthentication ./...
test-policy: ## Test only policy enforcement
go test -v -run TestS3IAMPolicyEnforcement ./...
test-expiration: ## Test only session expiration
go test -v -run TestS3IAMSessionExpiration ./...
test-multipart: ## Test only multipart upload IAM integration
go test -v -run TestS3IAMMultipartUploadPolicyEnforcement ./...
test-bucket-policy: ## Test only bucket policy integration
go test -v -run TestS3IAMBucketPolicyIntegration ./...
test-context: ## Test only contextual policy enforcement
go test -v -run TestS3IAMContextualPolicyEnforcement ./...
test-presigned: ## Test only presigned URL integration
go test -v -run TestS3IAMPresignedURLIntegration ./...
# Performance testing
benchmark: setup start-services wait-for-services ## Run performance benchmarks
@echo "🏁 Running IAM performance benchmarks..."
go test -bench=. -benchmem -timeout $(TEST_TIMEOUT) ./...
@make stop-services
# Continuous integration
ci: ## Run tests suitable for CI environment
@echo "🔄 Running CI tests..."
@export CGO_ENABLED=0; make test
# Development helpers
watch: ## Watch for file changes and re-run tests
@echo "👀 Watching for changes..."
@command -v entr >/dev/null 2>&1 || (echo "entr is required for watch mode. Install with: brew install entr" && exit 1)
@find . -name "*.go" | entr -r make test-quick
install-deps: ## Install test dependencies
@echo "📦 Installing test dependencies..."
go mod tidy
go get -u github.com/stretchr/testify
go get -u github.com/aws/aws-sdk-go
go get -u github.com/golang-jwt/jwt/v5
# Docker support
docker-test: ## Run tests in Docker container
@echo "🐳 Running tests in Docker..."
docker build -f Dockerfile.test -t seaweedfs-s3-iam-test .
docker run --rm -v $(PWD)/../../../:/app seaweedfs-s3-iam-test
.PHONY: test test-quick run-tests setup start-services stop-services wait-for-services clean logs status debug
.PHONY: test-auth test-policy test-expiration test-multipart test-bucket-policy test-context test-presigned
.PHONY: benchmark ci watch install-deps docker-test