mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-31 20:36:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

adjust an expected err msg in impersonator int test

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-05-07 16:19:04 -07:00
parent 3fbc7ed0d8
commit c62aafa6f2
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/concierge_impersonation_proxy_test.go
+2 -5
View File
@@ -589,11 +589,8 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
_, err = nestedImpersonationClient.Kubernetes.CoreV1().Secrets(env.ConciergeNamespace).Get(ctx, impersonationProxyTLSSecretName(env), metav1.GetOptions{})
// this user is not allowed to impersonate other users
require.True(t, apierrors.IsForbidden(err), err)
require.EqualError(t, err, fmt.Sprintf(
`secrets "%s" is forbidden: `+
`User "%s" cannot impersonate-on:user-info:get resource "secrets" in API group "" in the namespace "%s": `+
`decision made by impersonation-proxy.concierge.pinniped.dev`,
impersonationProxyTLSSecretName(env), env.TestUser.ExpectedUsername, env.ConciergeNamespace))
require.Contains(t, err.Error(), fmt.Sprintf(`is forbidden: User "%s" cannot impersonate`, env.TestUser.ExpectedUsername))
require.Contains(t, err.Error(), `decision made by impersonation-proxy.concierge.pinniped.dev`)
// impersonate the GC service account instead which can read anything (the binding to edit allows this)
nestedImpersonationClientAsSA, credentialsAsSA := newImpersonationProxyClient(t, impersonationProxyURL, impersonationProxyCACertPEM,