Merge pull request #398 from flatcar/tormath1/payload

kola: add --force-flatcar-key flag

CHANGELOG.md

@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - plume: generate AMI ID files locally ([#373](https://github.com/flatcar/mantle/pull/373))
 - Kola test for devcontainer ([#367](https://github.com/flatcar-linux/mantle/pull/367))
 - `--qemu-grow-base-disk-by` flag to grow the base disk ([#367](https://github.com/flatcar-linux/mantle/pull/367))
+- `--force-flatcar-key` flag to force injecting the Flatcar production key when testing the Flatcar update with `cl.update.payload` ([#398](https://github.com/flatcar/mantle/pull/398))
 
 ### Changed
 - organization renaming (`flatcar-linux` -> `flatcar`) ([#372](https://github.com/flatcar/mantle/pull/372), [#374](https://github.com/flatcar/mantle/pull/374))

cmd/kola/options.go

@@ -82,6 +82,7 @@ func init() {
 	sv(&kola.Options.BaseName, "basename", "kola", "Cluster name prefix")
 	ss("debug-systemd-unit", []string{}, "full-unit-name.service to enable SYSTEMD_LOG_LEVEL=debug on. Specify multiple times for multiple units.")
 	sv(&kola.UpdatePayloadFile, "update-payload", "", "Path to an update payload that should be made available to tests")
+	bv(&kola.ForceFlatcarKey, "force-flatcar-key", false, "Use the Flatcar production key to verify update payload")
 	sv(&kola.Options.IgnitionVersion, "ignition-version", "", "Ignition version override: v2, v3")
 	iv(&kola.Options.SSHRetries, "ssh-retries", kolaSSHRetries, "Number of retries with the SSH timeout when starting the machine")
 	dv(&kola.Options.SSHTimeout, "ssh-timeout", kolaSSHTimeout, "A timeout for a single try of establishing an SSH connection when starting the machine")

kola/harness.go

@@ -82,6 +82,7 @@ var (
 	TorcxManifest *torcx.Manifest = nil
 
 	UpdatePayloadFile string
+	ForceFlatcarKey   bool
 
 	consoleChecks = []struct {
 		desc        string

kola/tests/update/update.go

@@ -135,18 +135,35 @@ SERVER=http://%s/v1/update
 EOF"`, addr))
 	c.MustSSH(m, "sudo mv /etc/coreos/update.conf{.new,}")
 
-	// inject dev key
-	c.MustSSH(m, `sudo bash -c "cat >/etc/coreos/update-payload-key.pub.pem <<EOF
------BEGIN PUBLIC KEY-----
+	// dev key
+	key := `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzFS5uVJ+pgibcFLD3kbY
 k02Edj0HXq31ZT/Bva1sLp3Ysv+QTv/ezjf0gGFfASdgpz6G+zTipS9AIrQr0yFR
 +tdp1ZsHLGxVwvUoXFftdapqlyj8uQcWjjbN7qJsZu0Ett/qo93hQ5nHW7Sv5dRm
 /ZsDFqk2Uvyaoef4bF9r03wYpZq7K3oALZ2smETv+A5600mj1Xg5M52QFU67UHls
 EFkZphrGjiqiCdp9AAbAvE7a5rFcJf86YR73QX08K8BX7OMzkn3DsqdnWvLB3l3W
 6kvIuP+75SrMNeYAcU8PI1+bzLcAG3VN3jA78zeKALgynUNH50mxuiiU3DO4DZ+p
 5QIDAQAB
------END PUBLIC KEY-----
-EOF"`)
+-----END PUBLIC KEY-----`
+
+	if kola.ForceFlatcarKey {
+		// prod key
+		// https://github.com/flatcar/coreos-overlay/blob/flatcar-master/coreos-base/coreos-au-key/files/official-v2.pub.pem
+		key = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw/NZ5Tvc93KynOLPDOxa
+hyAGRKB2NvgF9l2A61SsFw5CuZc/k02u1/BvFehK4XL/eOo90Dt8A2l28D/YKs7g
+2IPUSAnA9hc5OKBbpHsDzisxlAh7kg4FpeeJJWJMzO8NDCG5NZVqXEpGjCmX0qSh
+5MLiTDr9dU2YhLo93/92dKnTvsLjUVv5wnuF55Lt2wJv4CbxVn4hHwotGfSomTBO
++7o6hE3VIIo1C6lkP+FAqMyWKA9s6U0x4tGxCXszW3hPWOANLIT4m0e55ayxiy5A
+ESEVW/xx6Rul75u925m21AqA6wwaEB6ZPKTnUiWoNKNv1xi8LPIz12+0nuE6iT1K
+jQIDAQAB
+-----END PUBLIC KEY-----`
+	}
+
+	// inject key
+	c.MustSSH(m, fmt.Sprintf(`sudo bash -c "cat >/etc/coreos/update-payload-key.pub.pem <<EOF
+%s
+EOF"`, key))
 
 	c.MustSSH(m, "sudo mount --bind /etc/coreos/update-payload-key.pub.pem /usr/share/update_engine/update-payload-key.pub.pem")