system-tests: new test for disk encryption with support for TMPv2 PCR protection

[edcdavid]

Ready for review:

• Needs global functions defined in global: move internal ran functions to global scope #128
• This PR is split from This is PR is split from Adding test suite for disk encryption with support for TMPv2 PCR protection #83 to review the global code only to review the Test code only
• Missing Polarion IDs -> will be added in a future PR
• Missing additional test case for to test PCR1 protection

This PR adds a CI test for TPM encryptions with PCR 1 and 7
The test defines the following 3 tests:

• "Verifies that disabling Secure Boot prevents Disk decryption (PCR 7)":
  • start from a SNO system with secure boot enabled and the root disk encrypted with PCR 1 and 7
  • check that secure boot is enabled with PCR 1 and 7
  • check that reserved slot is not present
  • Disable secure boot with Redfish (gofish)
  • Restart the node gracefully and observe console with Redfish (ssh console)
  • wait for disk decryption failure logs to be detected
  • Enable secure boot
  • Force reboot node
• "Verifies update indication with file (/etc/host-hw-Updating.flag)"
  • start from a SNO system with secure boot enabled and the root disk encrypted with PCR 1 and 7
  • check that secure boot is enabled with PCR 1 and 7
  • check that reserved slot is not present
  • Touch the "/etc/host-hw-Updating.flag" to notify a firmware upgrade. This essentially disables PCR protection. So any changes to PCR 1 and 7 will not prevent the disk to be decrypted
  • Disable secure boot with Redfish (gofish)
  • Restart the node gracefully and observe console with Redfish (ssh console)
  • wait for disk decryption to succeed and for the system to finish booting
  • Enable secure boot
  • Gracefully reboot node
• "Verify that changing Host boot order prevents Disk decryption (TPM PCR 1)":
  • start from a SNO system with secure boot enabled and the root disk encrypted with PCR 1 and 7
  • check that secure boot is enabled with PCR 1 and 7
  • check that reserved slot is not present
  • Change the Server boot order
  • Restart the node gracefully and observe console with Redfish (ssh console)
  • wait for disk decryption failure logs to be detected
  • Change the Server boot order back to original settings
  • Force reboot node
    Notes:
• uses environment variables ECO_CNF_RAN_BMC_USERNAME, ECO_CNF_RAN_BMC_PASSWORD, ECO_CNF_RAN_BMC_HOSTS to get BMC credential for SNO
• uses KUBECONFIG to access SNO spoke
• needs to the spoke to configure text mode on the console. This can be done with this extra manifest

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: master
  name: 05-worker-kernel-log
spec:
  kernelArguments:
    - nomodeset
    - console=tty0
    - console=ttyS0,115200n8

[mcornea]

lgtm

[mcornea]

lgtm

[klaskosk]

/lgtm

[kononovn]

global level lgmt