-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add unit tests for csrsigning controller (#611)
Add unit tests for csrsigning controller reconcile loop
- Loading branch information
1 parent
84551b1
commit 0c90519
Showing
8 changed files
with
842 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
163 changes: 163 additions & 0 deletions
163
src/k8s/pkg/k8sd/controllers/csrsigning/reconcile_approve_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,163 @@ | ||
| package csrsigning | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/rand" | ||
| "crypto/rsa" | ||
| "crypto/x509/pkix" | ||
| "errors" | ||
| "testing" | ||
|
|
||
| . "github.com/onsi/gomega" | ||
| certv1 "k8s.io/api/certificates/v1" | ||
| v1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| ctrl "sigs.k8s.io/controller-runtime" | ||
|
|
||
| k8smock "github.com/canonical/k8s/pkg/k8sd/controllers/csrsigning/test" | ||
| "github.com/canonical/k8s/pkg/log" | ||
| pkiutil "github.com/canonical/k8s/pkg/utils/pki" | ||
| ) | ||
|
|
||
| func TestAutoApprove(t *testing.T) { | ||
| g := NewWithT(t) | ||
|
|
||
| key, err := rsa.GenerateKey(rand.Reader, 2048) | ||
| g.Expect(err).NotTo(HaveOccurred()) | ||
|
|
||
| csrPEM, _, err := pkiutil.GenerateCSR( | ||
| pkix.Name{ | ||
| CommonName: "system:node:valid-node", | ||
| Organization: []string{"system:nodes"}, | ||
| }, | ||
| 2048, | ||
| nil, | ||
| nil, | ||
| ) | ||
| g.Expect(err).NotTo(HaveOccurred()) | ||
|
|
||
| for _, tc := range []struct { | ||
| name string | ||
| csr certv1.CertificateSigningRequest | ||
| updateErr error | ||
|
|
||
| expectResult ctrl.Result | ||
| expectErr error | ||
| expectCondition certv1.CertificateSigningRequestCondition | ||
| }{ | ||
| { | ||
| name: "InvalidCSR/UpdateSuccessful", | ||
| csr: certv1.CertificateSigningRequest{}, // invalid csr | ||
|
|
||
| expectResult: ctrl.Result{}, | ||
| expectCondition: certv1.CertificateSigningRequestCondition{ | ||
| Type: certv1.CertificateDenied, | ||
| Status: v1.ConditionTrue, | ||
| Reason: "K8sdDeny", | ||
| }, | ||
| }, | ||
| { | ||
| name: "InvalidCSR/UpdateFailed", | ||
| csr: certv1.CertificateSigningRequest{}, // invalid csr | ||
|
|
||
| updateErr: errors.New("failed to update"), | ||
| expectResult: ctrl.Result{}, | ||
| expectErr: errors.New("failed to update"), | ||
| expectCondition: certv1.CertificateSigningRequestCondition{ | ||
| Type: certv1.CertificateDenied, | ||
| Status: v1.ConditionTrue, | ||
| Reason: "K8sdDeny", | ||
| }, | ||
| }, | ||
| { | ||
| name: "ValidCSR/UpdateSuccessful", | ||
| csr: certv1.CertificateSigningRequest{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Annotations: map[string]string{ | ||
| "k8sd.io/signature": mustCreateEncryptedSignature(g, &key.PublicKey, csrPEM), | ||
| "k8sd.io/node": "valid-node", | ||
| }, | ||
| }, | ||
| Spec: certv1.CertificateSigningRequestSpec{ | ||
| Request: []byte(csrPEM), | ||
| Username: "system:node:valid-node", | ||
| Groups: []string{"system:nodes"}, | ||
| SignerName: "k8sd.io/kubelet-serving", | ||
| Usages: []certv1.KeyUsage{certv1.UsageServerAuth, certv1.UsageDigitalSignature, certv1.UsageKeyEncipherment}, | ||
| }, | ||
| }, | ||
|
|
||
| expectResult: ctrl.Result{}, | ||
| expectCondition: certv1.CertificateSigningRequestCondition{ | ||
| Type: certv1.CertificateApproved, | ||
| Status: v1.ConditionTrue, | ||
| Reason: "K8sdApprove", | ||
| }, | ||
| }, | ||
| { | ||
| name: "ValidCSR/UpdateFailed", | ||
| csr: certv1.CertificateSigningRequest{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Annotations: map[string]string{ | ||
| "k8sd.io/signature": mustCreateEncryptedSignature(g, &key.PublicKey, csrPEM), | ||
| "k8sd.io/node": "valid-node", | ||
| }, | ||
| }, | ||
| Spec: certv1.CertificateSigningRequestSpec{ | ||
| Request: []byte(csrPEM), | ||
| Username: "system:node:valid-node", | ||
| Groups: []string{"system:nodes"}, | ||
| SignerName: "k8sd.io/kubelet-serving", | ||
| Usages: []certv1.KeyUsage{certv1.UsageServerAuth, certv1.UsageDigitalSignature, certv1.UsageKeyEncipherment}, | ||
| }, | ||
| }, | ||
|
|
||
| updateErr: errors.New("failed to update"), | ||
| expectResult: ctrl.Result{}, | ||
| expectErr: errors.New("failed to update"), | ||
| expectCondition: certv1.CertificateSigningRequestCondition{ | ||
| Type: certv1.CertificateApproved, | ||
| Status: v1.ConditionTrue, | ||
| Reason: "K8sdApprove", | ||
| }, | ||
| }, | ||
| } { | ||
| t.Run(tc.name, func(t *testing.T) { | ||
| k8sM := k8smock.New( | ||
| t, | ||
| k8smock.NewSubResourceClientMock(tc.updateErr), | ||
| tc.csr, | ||
| nil, // we don't call get in reconcileAutoApprove | ||
| ) | ||
|
|
||
| result, err := reconcileAutoApprove( | ||
| context.Background(), | ||
| log.L(), | ||
| &tc.csr, | ||
| key, | ||
| k8sM, | ||
| ) | ||
|
|
||
| g := NewWithT(t) | ||
| k8sM.AssertUpdateCalled(t) | ||
| g.Expect(result).To(Equal(tc.expectResult)) | ||
| if tc.expectErr == nil { | ||
| g.Expect(err).ToNot(HaveOccurred()) | ||
| } else { | ||
| g.Expect(err).To(MatchError(tc.expectErr)) | ||
| } | ||
| g.Expect(containsCondition(tc.csr.Status.Conditions, tc.expectCondition)).To(BeTrue(), "expected condition not found") | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func containsCondition(cc []certv1.CertificateSigningRequestCondition, c certv1.CertificateSigningRequestCondition) bool { | ||
| for _, cond := range cc { | ||
| if cond.Type == c.Type && | ||
| cond.Status == c.Status && | ||
| cond.Reason == c.Reason { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } |
Oops, something went wrong.