Repository: camunda/camunda-platform-helm
Pull request #616 (2023-04-18 03:32:28)

test: add web-modeler integration tests
### Which problem does the PR fix?

#611

### What's in this PR?

Add WebModeler integration tests and make it clear that the WM Docker image is not public (and will not be).

### Checklist

Please make sure to follow our [Contributing Guide](../blob/main/CONTRIBUTING.md).

<!-- Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields. -->

**Before opening the PR:**

- [x] There is no other open [pull request](../pulls) for the same update/change.
- [x] The commits follow our [Commit Guidelines](../blob/main/CONTRIBUTING.md#commit-guidelines).
- [x] Tests for charts are added (if needed).
- [x] The main Helm chart and sub-chart are updated (if needed).
- [x] In-repo [documentation](../blob/main/CONTRIBUTING.md#documentation) are updated (if needed).

**After opening the PR:**

- [x] Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
- [x] Did all checks/tests pass in the PR?

<!--
### To-Do

- [ ] If the PR is not complete but you want to discuss the approach,
  list what remains to be done here.
-->



Patch:
diff --git a/charts/camunda-platform/templates/web-modeler/service-webapp.yaml b/charts/camunda-platform/templates/web-modeler/service-webapp.yaml
index 45528ff0..c3e5374e 100644
--- a/charts/camunda-platform/templates/web-modeler/service-webapp.yaml
+++ b/charts/camunda-platform/templates/web-modeler/service-webapp.yaml
@@ -18,6 +18,10 @@ spec:
     name: http
     targetPort: 8070
     protocol: TCP
+  - port: {{ .Values.webModeler.webapp.service.managementPort }}
+    name: http-management
+    targetPort: 8071
+    protocol: TCP
   selector:
     {{- include "webModeler.webapp.matchLabels" . | nindent 4 }}
 {{- end }}
diff --git a/charts/camunda-platform/values.yaml b/charts/camunda-platform/values.yaml
index 8c7f6d21..1f0d5d1e 100644
--- a/charts/camunda-platform/values.yaml
+++ b/charts/camunda-platform/values.yaml
@@ -1588,6 +1588,8 @@ webModeler:
       type: ClusterIP
       # Webapp.service.port defines the port of the service
       port: 80
+      # Webapp.service.managementPort defines the management port of the service
+      managementPort: 8071
       # Webapp.service.annotations can be used to define annotations which will be applied to the service
       annotations: {}
 


Test patch:
diff --git a/.github/workflows/test-integration-kubernetes.yaml b/.github/workflows/test-integration-kubernetes.yaml
index 8541cbfd..2dc6cbd7 100644
--- a/.github/workflows/test-integration-kubernetes.yaml
+++ b/.github/workflows/test-integration-kubernetes.yaml
@@ -26,7 +26,7 @@ env:
   TEST_CREATE_DOCKER_LOGIN_SECRET: "TRUE"
   TEST_DOCKER_USERNAME: ${{ secrets.TEST_DOCKER_USERNAME }}
   TEST_DOCKER_PASSWORD: ${{ secrets.TEST_DOCKER_PASSWORD }}
-  # This is needed to access WebModeler Docker image. It will be removed once WebModeler is public.
+  # This is needed to access WebModeler Docker image since it's not public.
   TEST_DOCKER_USERNAME_CAMUNDA_CLOUD: ${{ secrets.CAMUNDA_REGISTRY_USER }}
   TEST_DOCKER_PASSWORD_CAMUNDA_CLOUD: ${{ secrets.CAMUNDA_REGISTRY_PASSWORD }}
 
diff --git a/.github/workflows/test-integration-openshift.yaml b/.github/workflows/test-integration-openshift.yaml
index 037bd2b1..18d2ae0c 100644
--- a/.github/workflows/test-integration-openshift.yaml
+++ b/.github/workflows/test-integration-openshift.yaml
@@ -24,7 +24,7 @@ env:
   TEST_CREATE_DOCKER_LOGIN_SECRET: "TRUE"
   TEST_DOCKER_USERNAME: ${{ secrets.TEST_DOCKER_USERNAME }}
   TEST_DOCKER_PASSWORD: ${{ secrets.TEST_DOCKER_PASSWORD }}
-  # This is needed to access WebModeler Docker image.
+  # This is needed to access WebModeler Docker image since it's not public.
   TEST_DOCKER_USERNAME_CAMUNDA_CLOUD: ${{ secrets.CAMUNDA_REGISTRY_USER }}
   TEST_DOCKER_PASSWORD_CAMUNDA_CLOUD: ${{ secrets.CAMUNDA_REGISTRY_PASSWORD }}
 
diff --git a/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/Taskfile.yaml b/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/Taskfile.yaml
index 465d7656..4de5ded4 100644
--- a/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/Taskfile.yaml
+++ b/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/Taskfile.yaml
@@ -26,12 +26,13 @@ tasks:
     - test -n "${TEST_DOCKER_USERNAME_CAMUNDA_CLOUD}"
     - test -n "${TEST_DOCKER_PASSWORD_CAMUNDA_CLOUD}"
     cmds:
-    # This is needed to access WebModeler Docker image. It will be removed once WebModeler is public.
+    # This is needed to access WebModeler Docker image since it's not public.
     - kubectl create secret docker-registry registry-camunda-cloud
         --namespace {{ .TEST_NAMESPACE }}
         --docker-server "registry.camunda.cloud"
         --docker-username "${TEST_DOCKER_USERNAME_CAMUNDA_CLOUD}"
         --docker-password "${TEST_DOCKER_PASSWORD_CAMUNDA_CLOUD}"
+    - echo "VENOM_VAR_SKIP_TEST_WEBMODELER=false" >> ../../testsuites/base/files/vars.env
 
   setup.exec:
     deps: [init.seed]
diff --git a/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/values-web-modeler-enabled.yaml b/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/values-web-modeler-enabled.yaml
index 7eb18e05..91efac3a 100644
--- a/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/values-web-modeler-enabled.yaml
+++ b/charts/camunda-platform/test/integration/scenarios/chart-with-web-modeler/values-web-modeler-enabled.yaml
@@ -1,3 +1,11 @@
+global:
+  identity:
+    auth:
+      # NOTE: In Camunda Platform v8.2.0 (apps and Helm chart), WebModeler expects to have
+      # Keycloak externally configured to work with M2M tokens (unlike other components like
+      # Operate, Tasklist, and Optimize).
+      publicIssuerUrl: http://integration-keycloak/auth/realms/camunda-platform
+
 webModeler:
   # Web Modeler is disabled by default
   enabled: true
diff --git a/charts/camunda-platform/test/integration/scenarios/fixtures/values-integration-test.yaml b/charts/camunda-platform/test/integration/scenarios/fixtures/values-integration-test.yaml
index f95065e8..0f27ff26 100644
--- a/charts/camunda-platform/test/integration/scenarios/fixtures/values-integration-test.yaml
+++ b/charts/camunda-platform/test/integration/scenarios/fixtures/values-integration-test.yaml
@@ -51,7 +51,14 @@ identity:
     value: optimize-api
   - name: KEYCLOAK_CLIENTS_1_PERMISSIONS_6_DEFINITION
     value: "write:*"
-  # TODO: Add WebModeler access when it's public.
+  # WebModeler access.
+  # NOTE: This actually should be only in the chart-with-web-modeler scenarios,
+  # but since Helm doesn't support merge lists it's added here.
+  # It could be removed later when the env vars could be configured via ConfigMap.
+  - name: KEYCLOAK_CLIENTS_1_PERMISSIONS_7_RESOURCE_SERVER_ID
+    value: web-modeler-api
+  - name: KEYCLOAK_CLIENTS_1_PERMISSIONS_7_DEFINITION
+    value: "write:*"
 
 # Auth to avoid Docker download rate limit.
 # https://docs.docker.com/docker-hub/download-rate-limit/
diff --git a/charts/camunda-platform/test/integration/testsuites/base/files/secrets.env b/charts/camunda-platform/test/integration/testsuites/base/files/vars.env
similarity index 75%
rename from charts/camunda-platform/test/integration/testsuites/base/files/secrets.env
rename to charts/camunda-platform/test/integration/testsuites/base/files/vars.env
index c28e757b..f8bc8167 100644
--- a/charts/camunda-platform/test/integration/testsuites/base/files/secrets.env
+++ b/charts/camunda-platform/test/integration/testsuites/base/files/vars.env
@@ -1,2 +1,1 @@
 # The values here will be autogenerated at the deploy time.
-client-secret=venom
diff --git a/charts/camunda-platform/test/integration/testsuites/base/job.yaml b/charts/camunda-platform/test/integration/testsuites/base/job.yaml
index 327b984d..e19c6e1e 100644
--- a/charts/camunda-platform/test/integration/testsuites/base/job.yaml
+++ b/charts/camunda-platform/test/integration/testsuites/base/job.yaml
@@ -34,7 +34,9 @@ spec:
         command:
         - sh
         - -c
+        # TODO: Debug why envs from "envFrom" are not exported by default.
         - |
+          export $(env | grep VENOM_VAR_);
           /usr/local/venom run ./tests/${VENOM_RUN_ARGS:-*.y*ml} ||
           (cat ./results/venom.log; exit 1)
         env:
@@ -46,6 +48,9 @@ spec:
               key: client-secret
               # Making it optional for debugging Venom where is no Camunda Platform os deployed.
               optional: true
+        envFrom:
+        - configMapRef:
+            name: venom-env-vars
         volumeMounts:
         - mountPath: /usr/local/bin/zbctl
           name: tools
diff --git a/charts/camunda-platform/test/integration/testsuites/base/kustomization.yaml b/charts/camunda-platform/test/integration/testsuites/base/kustomization.yaml
index 913cee11..49c494b0 100644
--- a/charts/camunda-platform/test/integration/testsuites/base/kustomization.yaml
+++ b/charts/camunda-platform/test/integration/testsuites/base/kustomization.yaml
@@ -10,6 +10,11 @@ configMapGenerator:
     disableNameSuffixHash: true
   files:
   - testsuites/00-info.yaml
+- name: venom-env-vars
+  options:
+    disableNameSuffixHash: true
+  files:
+  - files/vars.env
 - name: venom-fixtures
   options:
     disableNameSuffixHash: true
diff --git a/charts/camunda-platform/test/integration/testsuites/core/testsuites/core.yaml b/charts/camunda-platform/test/integration/testsuites/core/testsuites/core.yaml
index 4d0e92da..fe025064 100644
--- a/charts/camunda-platform/test/integration/testsuites/core/testsuites/core.yaml
+++ b/charts/camunda-platform/test/integration/testsuites/core/testsuites/core.yaml
@@ -1,3 +1,5 @@
+# NOTE: WebModeler has its own step because Venom doesn't support skip in loops yet.
+# https://github.com/ovh/venom/issues/651
 name: Test core functionality of Camunda Platform
 
 vars:
@@ -5,6 +7,7 @@ vars:
   venomClientID: '{{ .TEST_CLIENT_ID | default "venom" }}'
   # Passed as a Venom var, e.g. "VENOM_VAR_TEST_CLIENT_SECRET".
   venomClientSecret: "{{ .TEST_CLIENT_SECRET }}"
+  skipTestWebModeler: '{{ .SKIP_TEST_WEBMODELER }}'
 
 testcases:
 
@@ -90,6 +93,22 @@ testcases:
     assertions:
     - result.statuscode ShouldEqual 200
 
+  - name: WebModeler
+    skip:
+    - skiptestwebmodeler ShouldBeFalse
+    type: http
+    method: GET
+    url: "http://{{ .releaseName }}-web-modeler-restapi/api/beta/info"
+    headers:
+      Content-Type: application/json
+      Authorization: "Bearer {{ .helperVenomToken.jwt }}"
+    # info: |
+    #   - Request Body: {{ .result.request.body }}
+    #   - Response Body: {{ .result.body }}
+    assertions:
+    - result.statuscode ShouldEqual 200
+    - result.bodyjson.version ShouldNotBeEmpty
+
 - name: TEST - Interacting with Zeebe Gateway
   steps:
   - name: Check Zeebe Gateway status
diff --git a/charts/camunda-platform/test/integration/testsuites/preflight/testsuites/preflight.yaml b/charts/camunda-platform/test/integration/testsuites/preflight/testsuites/preflight.yaml
index e0f2e0f2..60bb1f98 100644
--- a/charts/camunda-platform/test/integration/testsuites/preflight/testsuites/preflight.yaml
+++ b/charts/camunda-platform/test/integration/testsuites/preflight/testsuites/preflight.yaml
@@ -1,7 +1,10 @@
+# NOTE: WebModeler has its own step because Venom doesn't support skip in loops yet.
+# https://github.com/ovh/venom/issues/651
 name: Run preflight checks for Camunda Platform
 
 vars:
   releaseName: '{{ .RELEASE_NAME | default "integration" }}'
+  skipTestWebModeler: '{{ .SKIP_TEST_WEBMODELER }}'
 
 testcases:
 
@@ -38,6 +41,25 @@ testcases:
     assertions:
     - result.statuscode ShouldEqual 200
 
+  - name: "WebModeler - {{ .value.component }}"
+    skip:
+    - skiptestwebmodeler ShouldBeFalse
+    type: http
+    range:
+    - component: RESTAPI
+      url: http://{{ .releaseName }}-web-modeler-restapi:8091/health/readiness
+    - component: WebApp
+      url: http://{{ .releaseName }}-web-modeler-webapp:8071/health/readiness
+    method: GET
+    url: "{{ .value.url }}"
+    retry: 3
+    delay: 10
+    # info: |
+    #   {{ .value.component }} URL: {{ .value.url }}
+    #   Response Body: {{ .result.body }}
+    assertions:
+    - result.statuscode ShouldEqual 200
+
 - name: TEST - Liveness
   steps:
   - name: "{{ .value.component }}"
@@ -70,5 +92,23 @@ testcases:
     #   Response Body: {{ .result.body }}
     assertions:
     - result.statuscode ShouldEqual 200
+  - name: "WebModeler - {{ .value.component }}"
+    skip:
+    - skiptestwebmodeler ShouldBeFalse
+    type: http
+    range:
+    - component: RESTAPI
+      url: http://{{ .releaseName }}-web-modeler-restapi:8091/health/liveness
+    - component: WebApp
+      url: http://{{ .releaseName }}-web-modeler-webapp:8071/health/liveness
+    method: GET
+    url: "{{ .value.url }}"
+    retry: 3
+    delay: 10
+    # info: |
+    #   {{ .value.component }} URL: {{ .value.url }}
+    #   Response Body: {{ .result.body }}
+    assertions:
+    - result.statuscode ShouldEqual 200
 
 # TODO: Check seed config like ES indexes.
diff --git a/charts/camunda-platform/test/unit/web-modeler/golden/service-webapp.golden.yaml b/charts/camunda-platform/test/unit/web-modeler/golden/service-webapp.golden.yaml
index 45c930dc..31918bcd 100644
--- a/charts/camunda-platform/test/unit/web-modeler/golden/service-webapp.golden.yaml
+++ b/charts/camunda-platform/test/unit/web-modeler/golden/service-webapp.golden.yaml
@@ -20,6 +20,10 @@ spec:
     name: http
     targetPort: 8070
     protocol: TCP
+  - port: 8071
+    name: http-management
+    targetPort: 8071
+    protocol: TCP
   selector:
     app: camunda-platform
     app.kubernetes.io/name: web-modeler