mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-06 08:07:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update how integration tests which use LoginRequest make their clients

Browse Source 
- When we call the LoginRequest endpoint in loginrequest_test.go,
  do it with an unauthenticated client, to make sure that endpoint works
  with unauthenticated clients.
- For tests which want to test using certs returned by LoginRequest to
  make API calls back to kube to check if those certs are working, make
  sure they start with a bare client and then add only those certs.
  Avoid accidentally picking up other kubeconfig configuration like
  tokens, etc.

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
This commit is contained in:
Ryan Richard
2020-08-12 14:30:07 -07:00
parent ba0b997234
commit 9648db0837
3 changed files with 74 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/client_test.go
+2 -2
View File
@@ -60,7 +60,7 @@ func TestClient(t *testing.T) {
defer cancel()
// Use an invalid certificate/key to validate that the ServerVersion API fails like we assume.
invalidClient := library.NewClientsetWithConfig(t, library.NewClientConfigWithCertAndKey(t, testCert, testKey))
invalidClient := library.NewClientsetWithCertAndKey(t, testCert, testKey)
_, err := invalidClient.Discovery().ServerVersion()
require.EqualError(t, err, "the server has asked for the client to provide credentials")
@@ -72,7 +72,7 @@ func TestClient(t *testing.T) {
require.InDelta(t, time.Until(*resp.ExpirationTimestamp), 1*time.Hour, float64(3*time.Minute))
// Create a client using the certificate and key returned by the token exchange.
validClient := library.NewClientsetWithConfig(t, library.NewClientConfigWithCertAndKey(t, resp.ClientCertificateData, resp.ClientKeyData))
validClient := library.NewClientsetWithCertAndKey(t, resp.ClientCertificateData, resp.ClientKeyData)
// Make a version request, which should succeed even without any authorization.
_, err = validClient.Discovery().ServerVersion()
test/integration/loginrequest_test.go
+6 -9
View File
@@ -24,7 +24,7 @@ import (
func makeRequest(t *testing.T, spec v1alpha1.LoginRequestSpec) (*v1alpha1.LoginRequest, error) {
t.Helper()
client := library.NewPlaceholderNameClientset(t)
client := library.NewAnonymousPlaceholderNameClientset(t)
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
@@ -88,13 +88,10 @@ func TestSuccessfulLoginRequest(t *testing.T) {
adminClient := library.NewClientset(t)
// Create a client using the certificate from the LoginRequest.
clientWithCert := library.NewClientsetWithConfig(
clientWithCertFromLoginRequest := library.NewClientsetWithCertAndKey(
t,
library.NewClientConfigWithCertAndKey(
t,
response.Status.Credential.ClientCertificateData,
response.Status.Credential.ClientKeyData,
),
response.Status.Credential.ClientCertificateData,
response.Status.Credential.ClientKeyData,
)
t.Run("access as user", func(t *testing.T) {
@@ -116,7 +113,7 @@ func TestSuccessfulLoginRequest(t *testing.T) {
})
// Use the client which is authenticated as the TMC user to list namespaces
listNamespaceResponse, err := clientWithCert.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
listNamespaceResponse, err := clientWithCertFromLoginRequest.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
require.NoError(t, err)
require.NotEmpty(t, listNamespaceResponse.Items)
})
@@ -140,7 +137,7 @@ func TestSuccessfulLoginRequest(t *testing.T) {
})
// Use the client which is authenticated as the TMC group to list namespaces
listNamespaceResponse, err := clientWithCert.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
listNamespaceResponse, err := clientWithCertFromLoginRequest.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
require.NoError(t, err)
require.NotEmpty(t, listNamespaceResponse.Items)
})