|
| 1 | +/* |
| 2 | +Copyright 2026 The Kube Bind Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package e2e |
| 18 | + |
| 19 | +import ( |
| 20 | + "context" |
| 21 | + "testing" |
| 22 | + "time" |
| 23 | + |
| 24 | + "github.com/stretchr/testify/require" |
| 25 | + corev1 "k8s.io/api/core/v1" |
| 26 | + apierrors "k8s.io/apimachinery/pkg/api/errors" |
| 27 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 28 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 29 | + |
| 30 | + "github.com/kube-bind/kube-bind/v2/konnector/test/e2e/framework" |
| 31 | + corev1alpha1 "github.com/kube-bind/kube-bind/v2/sdk/apis/core/v1alpha1" |
| 32 | +) |
| 33 | + |
| 34 | +// TestSlimCoreRelatedResources binds the Widget API with a relatedResources rule |
| 35 | +// that syncs label-selected Secrets FromProvider, and verifies sync + GC. |
| 36 | +func TestSlimCoreRelatedResources(t *testing.T) { |
| 37 | + env := framework.Start(t) |
| 38 | + ctx := context.Background() |
| 39 | + env.InstallExportedWidgetCRD(t) |
| 40 | + |
| 41 | + require.NoError(t, env.ConsumerClient.Create(ctx, &corev1alpha1.Connection{ |
| 42 | + ObjectMeta: metav1.ObjectMeta{Name: "demo-provider"}, |
| 43 | + Spec: corev1alpha1.ConnectionSpec{ |
| 44 | + KubeconfigSecretRef: corev1alpha1.SecretKeyRef{Namespace: framework.KubeBindNamespace, Name: "demo-provider-kubeconfig", Key: "kubeconfig"}, |
| 45 | + Schema: corev1alpha1.SchemaPolicy{Source: corev1alpha1.SchemaSourceCRD}, |
| 46 | + }, |
| 47 | + })) |
| 48 | + require.NoError(t, env.ConsumerClient.Create(ctx, &corev1alpha1.ClusterBinding{ |
| 49 | + ObjectMeta: metav1.ObjectMeta{Name: "widgets"}, |
| 50 | + Spec: corev1alpha1.BindingSpec{ |
| 51 | + ConnectionRef: corev1alpha1.ConnectionRef{Name: "demo-provider"}, |
| 52 | + APIs: []corev1alpha1.APIRef{{Name: widgetCRDName}}, |
| 53 | + RelatedResources: []corev1alpha1.RelatedResource{{ |
| 54 | + Group: "", |
| 55 | + Resource: "secrets", |
| 56 | + Direction: corev1alpha1.FromProvider, |
| 57 | + Selector: &corev1alpha1.RelatedResourceSelector{ |
| 58 | + LabelSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"app": "widget"}}, |
| 59 | + }, |
| 60 | + }}, |
| 61 | + }, |
| 62 | + })) |
| 63 | + framework.WaitForConditionTrue(t, func() ([]metav1.Condition, error) { |
| 64 | + cb := &corev1alpha1.ClusterBinding{} |
| 65 | + err := env.ConsumerClient.Get(ctx, client.ObjectKey{Name: "widgets"}, cb) |
| 66 | + return cb.Status.Conditions, err |
| 67 | + }, corev1alpha1.ConditionReady) |
| 68 | + |
| 69 | + secretKey := client.ObjectKey{Namespace: "default", Name: "widget-creds"} |
| 70 | + |
| 71 | + t.Run("a label-selected provider Secret syncs to the consumer", func(t *testing.T) { |
| 72 | + require.NoError(t, env.ProviderClient.Create(ctx, &corev1.Secret{ |
| 73 | + ObjectMeta: metav1.ObjectMeta{Namespace: "default", Name: "widget-creds", Labels: map[string]string{"app": "widget"}}, |
| 74 | + StringData: map[string]string{"token": "s3cr3t"}, |
| 75 | + })) |
| 76 | + require.Eventually(t, func() bool { |
| 77 | + s := &corev1.Secret{} |
| 78 | + if err := env.ConsumerClient.Get(ctx, secretKey, s); err != nil { |
| 79 | + return false |
| 80 | + } |
| 81 | + return string(s.Data["token"]) == "s3cr3t" && |
| 82 | + s.Labels[corev1alpha1.LabelManaged] == "true" && |
| 83 | + s.Annotations[corev1alpha1.AnnotationRelatedBinding] != "" |
| 84 | + }, 30*time.Second, 200*time.Millisecond, "the label-selected provider Secret should sync to the consumer") |
| 85 | + }) |
| 86 | + |
| 87 | + t.Run("the synced copy is GC'd when it stops matching", func(t *testing.T) { |
| 88 | + s := &corev1.Secret{} |
| 89 | + require.NoError(t, env.ProviderClient.Get(ctx, secretKey, s)) |
| 90 | + delete(s.Labels, "app") |
| 91 | + require.NoError(t, env.ProviderClient.Update(ctx, s)) |
| 92 | + |
| 93 | + require.Eventually(t, func() bool { |
| 94 | + c := &corev1.Secret{} |
| 95 | + return apierrors.IsNotFound(env.ConsumerClient.Get(ctx, secretKey, c)) |
| 96 | + }, 30*time.Second, 200*time.Millisecond, "the consumer copy should be GC'd once the Secret stops matching the selector") |
| 97 | + }) |
| 98 | +} |
0 commit comments