mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-19 22:44:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Refactor kubectl exec test in TestCLI to avoid assuming any RBAC settings

Browse Source
This commit is contained in:
Ryan Richard
2020-09-21 11:40:11 -07:00
parent 49145791cc
commit cfb76a538c
3 changed files with 163 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/cli_test.go
+20 -50
View File
@@ -56,29 +56,35 @@ func TestCLI(t *testing.T) {
defer cleanupFunc()
// Run pinniped CLI to get kubeconfig.
kubeConfig := runPinnipedCLI(t, pinnipedExe, token, namespaceName)
kubeConfigYAML := runPinnipedCLI(t, pinnipedExe, token, namespaceName)
// In addition to the client-go based testing below, also try the kubeconfig
// with kubectl once just in case it is somehow different.
runKubectlCLI(t, kubeConfig, namespaceName, testUsername)
// Create Kubernetes client with kubeconfig from pinniped CLI.
kubeClient := library.NewClientsetForKubeConfig(t, kubeConfig)
// Validate that we can auth to the API via our user.
adminClient := library.NewClientset(t)
ctx, cancelFunc := context.WithTimeout(context.Background(), time.Second*3)
defer cancelFunc()
adminClient := library.NewClientset(t)
t.Run("access as user", accessAsUserTest(ctx, adminClient, testUsername, kubeClient))
// In addition to the client-go based testing below, also try the kubeconfig
// with kubectl to validate that it works.
t.Run(
"access as user with kubectl",
accessAsUserWithKubectlTest(ctx, adminClient, kubeConfigYAML, testUsername, namespaceName),
)
for _, group := range expectedTestUserGroups {
group := group
t.Run(
"access as group "+group,
accessAsGroupTest(ctx, adminClient, group, kubeClient),
"access as group "+group+" with kubectl",
accessAsGroupWithKubectlTest(ctx, adminClient, kubeConfigYAML, group, namespaceName),
)
}
// Create Kubernetes client with kubeconfig from pinniped CLI.
kubeClient := library.NewClientsetForKubeConfig(t, kubeConfigYAML)
// Validate that we can auth to the API via our user.
t.Run("access as user with client-go", accessAsUserTest(ctx, adminClient, testUsername, kubeClient))
for _, group := range expectedTestUserGroups {
group := group
t.Run("access as group "+group+" with client-go", accessAsGroupTest(ctx, adminClient, group, kubeClient))
}
}
func buildPinnipedCLI(t *testing.T) (string, func()) {
@@ -115,39 +121,3 @@ func runPinnipedCLI(t *testing.T, pinnipedExe, token, namespaceName string) stri
return string(output)
}
func runKubectlCLI(t *testing.T, kubeConfig, namespaceName, username string) string {
t.Helper()
f, err := ioutil.TempFile("", "pinniped-generated-kubeconfig-*")
require.NoError(t, err)
defer func() {
err := os.Remove(f.Name())
require.NoError(t, err)
}()
_, err = f.WriteString(kubeConfig)
require.NoError(t, err)
err = f.Close()
require.NoError(t, err)
//nolint: gosec // It's okay that we are passing f.Name() to an exec command here. It was created above.
output, err := exec.Command(
"kubectl",
"get",
"pods",
"--kubeconfig", f.Name(),
"--namespace", namespaceName,
).CombinedOutput()
// Expect an error because this user has no RBAC permission. However, the
// error message should state that we had already authenticated as the test user.
expectedErrorMessage := `Error from server (Forbidden): pods is forbidden: User "` +
username +
`" cannot list resource "pods" in API group "" in the namespace "` +
namespaceName +
`"` + "\n"
require.EqualError(t, err, "exit status 1")
require.Equal(t, expectedErrorMessage, string(output))
return string(output)
}