mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-27 18:42:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix want errors in impersonator integration tests

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-05-06 12:53:43 -07:00
parent 06b85bf841
commit d28b485a4c
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/integration/concierge_impersonation_proxy_test.go
+7 -7
View File
@@ -590,10 +590,10 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
// this user is not allowed to impersonate other users
require.True(t, apierrors.IsForbidden(err), err)
require.EqualError(t, err, fmt.Sprintf(
`users "other-user-to-impersonate" is forbidden: `+
`User "%s" cannot impersonate resource "users" in API group "" at the cluster scope: `+
`secrets "%s" is forbidden: `+
`User "%s" cannot impersonate-on:user-info:get resource "secrets" in API group "" in the namespace "%s": `+
`decision made by impersonation-proxy.concierge.pinniped.dev`,
env.TestUser.ExpectedUsername))
impersonationProxyTLSSecretName(env), env.TestUser.ExpectedUsername, env.ConciergeNamespace))
// impersonate the GC service account instead which can read anything (the binding to edit allows this)
nestedImpersonationClientAsSA, credentialsAsSA := newImpersonationProxyClient(t, impersonationProxyURL, impersonationProxyCACertPEM,
@@ -778,7 +778,7 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
})
_, errUID := testlib.NewKubeclient(t, nestedImpersonationUIDOnly).Kubernetes.CoreV1().Secrets("foo").Get(ctx, "bar", metav1.GetOptions{})
msg := `requested [{UID some-awesome-uid authentication.k8s.io/v1 }] without impersonating a user`
msg := `requested &user.DefaultInfo{Name:"", UID:"some-awesome-uid", Groups:[]string(nil), Extra:map[string][]string(nil)} without impersonating a user name`
require.EqualError(t, errUID, msg)
require.True(t, apierrors.IsBadRequest(errUID), errUID) // starting in k8s 1.35 libs, this was changed from internal error to bad request
require.Equal(t, &apierrors.StatusError{
@@ -837,10 +837,10 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl
// this SA is not yet allowed to impersonate SAs
require.True(t, apierrors.IsForbidden(err), err)
require.EqualError(t, err, fmt.Sprintf(
`serviceaccounts "root-ca-cert-publisher" is forbidden: `+
`User "%s" cannot impersonate resource "serviceaccounts" in API group "" in the namespace "kube-system": `+
`whoamirequests.identity.concierge.%s is forbidden: `+
`User "%s" cannot impersonate-on:serviceaccount:create resource "whoamirequests" in API group "identity.concierge.%s" at the cluster scope: `+
`decision made by impersonation-proxy.concierge.pinniped.dev`,
serviceaccount.MakeUsername(namespaceName, saName)))
env.APIGroupSuffix, serviceaccount.MakeUsername(namespaceName, saName), env.APIGroupSuffix))
// webhook authorizer deny cache TTL is 10 seconds so we need to wait long enough for it to drain
time.Sleep(15 * time.Second)