Add Encryption Class to the vcsim test

Author: laozc

test/e2e/data/infrastructure-vsphere-supervisor/main/clusterclass/kustomization.yaml

@@ -15,6 +15,9 @@ patches:
   - target:
       kind: ClusterClass
     path: ./patch-namingstrategy.yaml
+  - target:
+      kind: ClusterClass
+    path: ./patch-encryption-class.yaml
   - target:
       kind: VSphereMachineTemplate
     path: ./patch-vm-namingstrategy.yaml

test/e2e/data/infrastructure-vsphere-supervisor/main/clusterclass/patch-encryption-class.yaml

@@ -0,0 +1,33 @@
+- op: add
+  path: /spec/patches/-
+  value:
+    definitions:
+    - jsonPatches:
+      - op: add
+        path: /spec/template/spec/crypto
+        valueFrom:
+          template: |
+            encryptionClassName: {{ .encryptionClassName }}
+            useDefaultKeyProvider: true
+      selector:
+        apiVersion: vmware.infrastructure.cluster.x-k8s.io/v1beta1
+        kind: VSphereMachineTemplate
+        matchResources:
+          controlPlane: true
+    - jsonPatches:
+      - op: add
+        path: /spec/template/spec/crypto
+        valueFrom:
+          template: |
+            encryptionClassName: {{ .encryptionClassName }}
+            useDefaultKeyProvider: true
+      selector:
+        apiVersion: vmware.infrastructure.cluster.x-k8s.io/v1beta1
+        kind: VSphereMachineTemplate
+        matchResources:
+          machineDeploymentClass:
+            names:
+            - ${CLUSTER_CLASS_NAME}-worker
+    enabledIf: '{{ if .encryptionClassName }}true{{end}}'
+    name: encryptionClass
+

test/e2e/e2e_setup_test.go

@@ -139,6 +139,10 @@ func Setup(specName string, f func(testSpecificSettings func() testSettings), op
 			// but it is okay to be empty.
 			testSpecificVariables["VSPHERE_USERNAME"] = ""
 			testSpecificVariables["VSPHERE_PASSWORD"] = ""
+			// Set default encryption class for vcsim tests
+			if testMode == SupervisorTestMode {
+				testSpecificVariables["VSPHERE_ENCRYPTION_CLASS_NAME"] = "vcsim-default-encryption-class"
+			}
 		}
 
 		// Create a new clusterctl config file based on the passed file. The postNamespaceCreatedFunc

test/framework/vmoperator/vmoperator.go

@@ -38,6 +38,8 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/klog/v2"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -453,6 +455,65 @@ func ReconcileDependencies(ctx context.Context, c client.Client, dependenciesCon
 		}
 	}
 
+	// Create EncryptionClass in K8s
+	encryptionClassGVR := schema.GroupVersionResource{
+		Group:    "encryption.vmware.com",
+		Version:  "v1alpha1",
+		Resource: "encryptionclasses",
+	}
+	for _, ec := range config.Spec.EncryptionClasses {
+		metadata := map[string]interface{}{
+			"name":      ec.Name,
+			"namespace": config.Namespace,
+		}
+		// Add default label if this is the default EncryptionClass
+		if ec.Default {
+			metadata["labels"] = map[string]interface{}{
+				"encryption.vmware.com/default": "true",
+			}
+		}
+
+		spec := map[string]interface{}{}
+		spec["keyProvider"] = ec.KeyProvider
+		spec["keyID"] = ec.KeyID
+
+		encryptionClass := &unstructured.Unstructured{
+			Object: map[string]interface{}{
+				"apiVersion": "encryption.vmware.com/v1alpha1",
+				"kind":       "EncryptionClass",
+				"metadata":   metadata,
+				"spec":       spec,
+			},
+		}
+		_ = wait.PollUntilContextTimeout(ctx, 250*time.Millisecond, 5*time.Second, true, func(ctx context.Context) (bool, error) {
+			retryError = nil
+			existing := &unstructured.Unstructured{}
+			existing.SetGroupVersionKind(schema.GroupVersionKind{
+				Group:   encryptionClassGVR.Group,
+				Version: encryptionClassGVR.Version,
+				Kind:    "EncryptionClass",
+			})
+			if err := c.Get(ctx, client.ObjectKey{
+				Name:      ec.Name,
+				Namespace: config.Namespace,
+			}, existing); err != nil {
+				if !apierrors.IsNotFound(err) {
+					retryError = errors.Wrapf(err, "failed to get EncryptionClass %s", ec.Name)
+					return false, nil
+				}
+				if err := c.Create(ctx, encryptionClass); err != nil {
+					retryError = errors.Wrapf(err, "failed to create EncryptionClass %s", ec.Name)
+					return false, nil
+				}
+				log.Info("Created EncryptionClass", "EncryptionClass", klog.KRef(config.Namespace, ec.Name))
+			}
+			return true, nil
+		})
+		if retryError != nil {
+			return retryError
+		}
+	}
+
 	// Create a ContentLibrary in K8s and in vCenter,
 	// This requires a set of objects in vCenter(or vcsim) as well as their mapping in K8s
 	// - vCenter: a Library containing an Item

test/infrastructure/vcsim/api/v1alpha1/vmoperatordependencies_types.go

@@ -45,6 +45,9 @@ type VMOperatorDependenciesSpec struct {
 
 	// VirtualMachineClasses defines a list of VirtualMachineClasses to be bound to the namespace where this object is created.
 	VirtualMachineClasses []VirtualMachineClass `json:"virtualMachineClasses,omitempty"`
+
+	// EncryptionClasses defines a list of EncryptionClasses to be created in the namespace where this object is created.
+	EncryptionClasses []EncryptionClass `json:"encryptionClasses,omitempty"`
 }
 
 // VMOperatorRef provide a reference to the running instance of vm-operator.
@@ -80,6 +83,14 @@ type VirtualMachineClass struct {
 	Memory resource.Quantity `json:"memory,omitempty"`
 }
 
+type EncryptionClass struct {
+	Name        string `json:"name,omitempty"`
+	KeyProvider string `json:"keyProvider,omitempty"`
+	KeyID       string `json:"keyID,omitempty"`
+	// Default indicates if this EncryptionClass should be marked as default
+	Default bool `json:"default,omitempty"`
+}
+
 type ContentLibraryItemFilesConfig struct {
 	Name    string `json:"name,omitempty"`
 	Content []byte `json:"content,omitempty"`
@@ -179,7 +190,7 @@ func (d *VMOperatorDependencies) SetVCenterFromVCenterSimulator(vCenterSimulator
 		)
 	}
 
-	//  Add default storage and vm class for vcsim in not otherwise specified.
+	// Add default storage and vm class for vcsim if not otherwise specified.
 	if len(d.Spec.StorageClasses) == 0 {
 		d.Spec.StorageClasses = []StorageClass{
 			{
@@ -197,4 +208,15 @@ func (d *VMOperatorDependencies) SetVCenterFromVCenterSimulator(vCenterSimulator
 			},
 		}
 	}
+	// Add default encryption class for vcsim if not otherwise specified.
+	if len(d.Spec.EncryptionClasses) == 0 {
+		d.Spec.EncryptionClasses = []EncryptionClass{
+			{
+				Name:        "vcsim-default-encryption-class",
+				KeyProvider: "vcsim-key-provider",
+				KeyID:       "vcsim-key-id",
+				Default:     true,
+			},
+		}
+	}
 }