mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-20 15:04:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Modify Concierge/Superivsor TLS spec integration tests to allow for older K8s versions

Browse Source
This commit is contained in:
Joshua Casey
2024-08-05 11:32:20 -07:00
committed by Ryan Richard
parent b7c26c43ca
commit 4ec5766ea9
2 changed files with 75 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/concierge_tls_spec_test.go
+30 -24
View File
@@ -46,9 +46,9 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
`) `)
testCases := []struct { testCases := []struct {
name string name string
tlsYAML string tlsYAML string
expectedError string expectedErrorSnippets []string
}{ }{
{ {
name: "should disallow certificate authority data source with missing name", name: "should disallow certificate authority data source with missing name",
@@ -58,7 +58,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
kind: Secret kind: Secret
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Required value`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Required value`},
}, },
{ {
name: "should disallow certificate authority data source with empty value for name", name: "should disallow certificate authority data source with empty value for name",
@@ -69,7 +69,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: "" name: ""
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Invalid value: "": spec.tls.certificateAuthorityDataSource.name in body should be at least 1 chars long`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Invalid value: "": spec.tls.certificateAuthorityDataSource.name in body should be at least 1 chars long`},
}, },
{ {
name: "should disallow certificate authority data source with missing key", name: "should disallow certificate authority data source with missing key",
@@ -79,7 +79,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
kind: Secret kind: Secret
name: foo name: foo
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Required value`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Required value`},
}, },
{ {
name: "should disallow certificate authority data source with empty value for key", name: "should disallow certificate authority data source with empty value for key",
@@ -90,7 +90,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: foo name: foo
key: "" key: ""
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Invalid value: "": spec.tls.certificateAuthorityDataSource.key in body should be at least 1 chars long`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Invalid value: "": spec.tls.certificateAuthorityDataSource.key in body should be at least 1 chars long`},
}, },
{ {
name: "should disallow certificate authority data source with missing kind", name: "should disallow certificate authority data source with missing kind",
@@ -100,7 +100,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Required value`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Required value`},
}, },
{ {
name: "should disallow certificate authority data source with empty value for kind", name: "should disallow certificate authority data source with empty value for kind",
@@ -111,7 +111,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "": supported values: "Secret", "ConfigMap"`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "": supported values: "Secret", "ConfigMap"`},
}, },
{ {
name: "should disallow certificate authority data source with invalid kind", name: "should disallow certificate authority data source with invalid kind",
@@ -122,7 +122,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "sorcery": supported values: "Secret", "ConfigMap"`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "sorcery": supported values: "Secret", "ConfigMap"`},
}, },
{ {
name: "should create a custom resource passing all validations using a Secret source", name: "should create a custom resource passing all validations using a Secret source",
@@ -133,7 +133,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: "", expectedErrorSnippets: nil,
}, },
{ {
name: "should create a custom resource passing all validations using a ConfigMap source", name: "should create a custom resource passing all validations using a ConfigMap source",
@@ -144,12 +144,12 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: "", expectedErrorSnippets: nil,
}, },
{ {
name: "should create a custom resource without any tls spec", name: "should create a custom resource without any tls spec",
tlsYAML: "", tlsYAML: "",
expectedError: "", expectedErrorSnippets: nil,
}, },
} }
@@ -171,7 +171,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
t, t,
webhookYamlBytes, webhookYamlBytes,
`webhookauthenticator.authentication.concierge.pinniped.dev`, `webhookauthenticator.authentication.concierge.pinniped.dev`,
tc.expectedError, tc.expectedErrorSnippets,
"WebhookAuthenticator", "WebhookAuthenticator",
webhookResourceName, webhookResourceName,
) )
@@ -188,7 +188,7 @@ func TestTLSSpecKubeBuilderValidationConcierge_Parallel(t *testing.T) {
t, t,
jwtAuthenticatorYamlBytes, jwtAuthenticatorYamlBytes,
`jwtauthenticator.authentication.concierge.pinniped.dev`, `jwtauthenticator.authentication.concierge.pinniped.dev`,
tc.expectedError, tc.expectedErrorSnippets,
"JWTAuthenticator", "JWTAuthenticator",
jwtAuthenticatorResourceName, jwtAuthenticatorResourceName,
) )
@@ -201,7 +201,7 @@ func performKubectlApply(
t *testing.T, t *testing.T,
yamlBytes []byte, yamlBytes []byte,
expectedSuccessPrefix string, expectedSuccessPrefix string,
expectedError string, expectedErrorSnippets []string,
resourceType string, resourceType string,
resourceName string, resourceName string,
) { ) {
@@ -227,11 +227,17 @@ func performKubectlApply(
require.NoError(t, exec.Command("kubectl", []string{"delete", "--ignore-not-found", "-f", yamlFilepath}...).Run()) require.NoError(t, exec.Command("kubectl", []string{"delete", "--ignore-not-found", "-f", yamlFilepath}...).Run())
}) })
if expectedError == "" { if len(expectedErrorSnippets) > 0 {
require.Empty(t, stdErr.String()) actualErrorString := strings.TrimSuffix(stdErr.String(), "\n")
require.Regexp(t, regexp.QuoteMeta(expectedSuccessPrefix)+regexp.QuoteMeta(fmt.Sprintf("/%s created\n", resourceName)), stdOut.String()) for i, snippet := range expectedErrorSnippets {
require.NoError(t, err) if i == 0 {
} else { snippet = fmt.Sprintf(snippet, resourceType, resourceName)
require.Equal(t, fmt.Sprintf(expectedError, resourceType, resourceName), strings.TrimSuffix(stdErr.String(), "\n")) }
require.Contains(t, actualErrorString, snippet)
}
return
} }
require.Empty(t, stdErr.String())
require.Regexp(t, regexp.QuoteMeta(expectedSuccessPrefix)+regexp.QuoteMeta(fmt.Sprintf("/%s created\n", resourceName)), stdOut.String())
require.NoError(t, err)
} }
test/integration/supervisor_tls_spec_test.go
+45 -45
View File
@@ -76,10 +76,10 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
`) `)
testCases := []struct { testCases := []struct {
name string name string
tlsYAML string tlsYAML string
expectedError string expectedErrorSnippets []string
expectedGitHubError string expectedGitHubErrorSnippets []string
}{ }{
{ {
name: "should disallow certificate authority data source with missing name", name: "should disallow certificate authority data source with missing name",
@@ -89,11 +89,11 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
kind: Secret kind: Secret
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Required value`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Required value`},
expectedGitHubError: here.Doc(` expectedGitHubErrorSnippets: []string{
The %s "%s" is invalid: `The %s "%s" is invalid:`,
* spec.githubAPI.tls.certificateAuthorityDataSource.name: Required value "* spec.githubAPI.tls.certificateAuthorityDataSource.name: Required value",
* <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation`), },
}, },
{ {
name: "should disallow certificate authority data source with empty value for name", name: "should disallow certificate authority data source with empty value for name",
@@ -104,8 +104,8 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: "" name: ""
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Invalid value: "": spec.tls.certificateAuthorityDataSource.name in body should be at least 1 chars long`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.name: Invalid value: "": spec.tls.certificateAuthorityDataSource.name in body should be at least 1 chars long`},
expectedGitHubError: `The %s "%s" is invalid: spec.githubAPI.tls.certificateAuthorityDataSource.name: Invalid value: "": spec.githubAPI.tls.certificateAuthorityDataSource.name in body should be at least 1 chars long`, expectedGitHubErrorSnippets: []string{`The %s "%s" is invalid: spec.githubAPI.tls.certificateAuthorityDataSource.name: Invalid value: "": spec.githubAPI.tls.certificateAuthorityDataSource.name in body should be at least 1 chars long`},
}, },
{ {
name: "should disallow certificate authority data source with missing key", name: "should disallow certificate authority data source with missing key",
@@ -115,11 +115,11 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
kind: Secret kind: Secret
name: foo name: foo
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Required value`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Required value`},
expectedGitHubError: here.Doc(` expectedGitHubErrorSnippets: []string{
The %s "%s" is invalid: `The %s "%s" is invalid:`,
* spec.githubAPI.tls.certificateAuthorityDataSource.key: Required value "* spec.githubAPI.tls.certificateAuthorityDataSource.key: Required value",
* <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation`), },
}, },
{ {
name: "should disallow certificate authority data source with empty value for key", name: "should disallow certificate authority data source with empty value for key",
@@ -130,8 +130,8 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: foo name: foo
key: "" key: ""
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Invalid value: "": spec.tls.certificateAuthorityDataSource.key in body should be at least 1 chars long`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.key: Invalid value: "": spec.tls.certificateAuthorityDataSource.key in body should be at least 1 chars long`},
expectedGitHubError: `The %s "%s" is invalid: spec.githubAPI.tls.certificateAuthorityDataSource.key: Invalid value: "": spec.githubAPI.tls.certificateAuthorityDataSource.key in body should be at least 1 chars long`, expectedGitHubErrorSnippets: []string{`The %s "%s" is invalid: spec.githubAPI.tls.certificateAuthorityDataSource.key: Invalid value: "": spec.githubAPI.tls.certificateAuthorityDataSource.key in body should be at least 1 chars long`},
}, },
{ {
name: "should disallow certificate authority data source with missing kind", name: "should disallow certificate authority data source with missing kind",
@@ -141,11 +141,11 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Required value`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Required value`},
expectedGitHubError: here.Doc(` expectedGitHubErrorSnippets: []string{
The %s "%s" is invalid: `The %s "%s" is invalid:`,
* spec.githubAPI.tls.certificateAuthorityDataSource.kind: Required value "* spec.githubAPI.tls.certificateAuthorityDataSource.kind: Required value",
* <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation`), },
}, },
{ {
name: "should disallow certificate authority data source with empty value for kind", name: "should disallow certificate authority data source with empty value for kind",
@@ -156,11 +156,11 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "": supported values: "Secret", "ConfigMap"`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "": supported values: "Secret", "ConfigMap"`},
expectedGitHubError: here.Doc(` expectedGitHubErrorSnippets: []string{
The %s "%s" is invalid: `The %s "%s" is invalid:`,
* spec.githubAPI.tls.certificateAuthorityDataSource.kind: Unsupported value: "": supported values: "Secret", "ConfigMap" `spec.githubAPI.tls.certificateAuthorityDataSource.kind: Unsupported value: "": supported values: "Secret", "ConfigMap"`,
* <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation`), },
}, },
{ {
name: "should disallow certificate authority data source with invalid kind", name: "should disallow certificate authority data source with invalid kind",
@@ -171,11 +171,11 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: `The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "sorcery": supported values: "Secret", "ConfigMap"`, expectedErrorSnippets: []string{`The %s "%s" is invalid: spec.tls.certificateAuthorityDataSource.kind: Unsupported value: "sorcery": supported values: "Secret", "ConfigMap"`},
expectedGitHubError: here.Doc(` expectedGitHubErrorSnippets: []string{
The %s "%s" is invalid: `The %s "%s" is invalid:`,
* spec.githubAPI.tls.certificateAuthorityDataSource.kind: Unsupported value: "sorcery": supported values: "Secret", "ConfigMap" `spec.githubAPI.tls.certificateAuthorityDataSource.kind: Unsupported value: "sorcery": supported values: "Secret", "ConfigMap"`,
* <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation`), },
}, },
{ {
name: "should create a custom resource passing all validations using a Secret source", name: "should create a custom resource passing all validations using a Secret source",
@@ -186,7 +186,8 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: "", expectedErrorSnippets: nil,
expectedGitHubErrorSnippets: nil,
}, },
{ {
name: "should create a custom resource passing all validations using a ConfigMap source", name: "should create a custom resource passing all validations using a ConfigMap source",
@@ -197,12 +198,14 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
name: foo name: foo
key: bar key: bar
`), `),
expectedError: "", expectedErrorSnippets: nil,
expectedGitHubErrorSnippets: nil,
}, },
{ {
name: "should create a custom resource without any tls spec", name: "should create a custom resource without any tls spec",
tlsYAML: "", tlsYAML: "",
expectedError: "", expectedErrorSnippets: nil,
expectedGitHubErrorSnippets: nil,
}, },
} }
@@ -224,7 +227,7 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
t, t,
yamlBytes, yamlBytes,
`oidcidentityprovider.idp.supervisor.pinniped.dev`, `oidcidentityprovider.idp.supervisor.pinniped.dev`,
tc.expectedError, tc.expectedErrorSnippets,
"OIDCIdentityProvider", "OIDCIdentityProvider",
resourceName, resourceName,
) )
@@ -239,7 +242,7 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
t, t,
yamlBytes, yamlBytes,
`ldapidentityprovider.idp.supervisor.pinniped.dev`, `ldapidentityprovider.idp.supervisor.pinniped.dev`,
tc.expectedError, tc.expectedErrorSnippets,
"LDAPIdentityProvider", "LDAPIdentityProvider",
resourceName, resourceName,
) )
@@ -254,7 +257,7 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
t, t,
yamlBytes, yamlBytes,
`activedirectoryidentityprovider.idp.supervisor.pinniped.dev`, `activedirectoryidentityprovider.idp.supervisor.pinniped.dev`,
tc.expectedError, tc.expectedErrorSnippets,
"ActiveDirectoryIdentityProvider", "ActiveDirectoryIdentityProvider",
resourceName, resourceName,
) )
@@ -264,9 +267,6 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
// GitHub is nested deeper // GitHub is nested deeper
indentedTLSYAMLForGitHub := strings.ReplaceAll(indentedTLSYAML, "\n", "\n ") indentedTLSYAMLForGitHub := strings.ReplaceAll(indentedTLSYAML, "\n", "\n ")
// This is how kubectl shows this error
expectedGitHubError := strings.ReplaceAll(tc.expectedGitHubError, "invalid:\n", "invalid: \n")
resourceName := "test-github-idp-" + testlib.RandHex(t, 7) resourceName := "test-github-idp-" + testlib.RandHex(t, 7)
yamlBytes := []byte(fmt.Sprintf(githubIDPTemplate, yamlBytes := []byte(fmt.Sprintf(githubIDPTemplate,
env.APIGroupSuffix, resourceName, indentedTLSYAMLForGitHub)) env.APIGroupSuffix, resourceName, indentedTLSYAMLForGitHub))
@@ -275,7 +275,7 @@ func TestTLSSpecKubeBuilderValidationSupervisor_Parallel(t *testing.T) {
t, t,
yamlBytes, yamlBytes,
`githubidentityprovider.idp.supervisor.pinniped.dev`, `githubidentityprovider.idp.supervisor.pinniped.dev`,
expectedGitHubError, tc.expectedGitHubErrorSnippets,
"GitHubIdentityProvider", "GitHubIdentityProvider",
resourceName, resourceName,
) )