Skip to content

Commit 5a1b069

Browse files
glrfglrf
committed
Add some more tests and fix obvious bug
1 parent 1e00c95 commit 5a1b069

3 files changed

Lines changed: 145 additions & 42 deletions

File tree

‎pkg/service/api_service_test.go‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,9 @@ var (
136136
}
137137
clusterBSecret = &corev1.Secret{
138138
ObjectMeta: metav1.ObjectMeta{
139-
Name: "anotherName", // We do not have guarantees that the secret name matches any fixed naming scheme
140-
Namespace: clusterB.Namespace,
139+
Name: "anotherName", // We do not have guarantees that the secret name matches any fixed naming scheme
140+
Namespace: clusterB.Namespace,
141+
CreationTimestamp: metav1.NewTime(time.Now().Add(-1 * time.Hour)),
141142
Annotations: map[string]string{
142143
"kubernetes.io/service-account.name": clusterB.Name,
143144
},
@@ -170,6 +171,12 @@ var (
170171
Type: corev1.SecretTypeServiceAccountToken,
171172
Data: map[string][]byte{"token": []byte("newtoken")},
172173
}
174+
clusterASA = &corev1.ServiceAccount{
175+
ObjectMeta: metav1.ObjectMeta{
176+
Name: clusterA.Name,
177+
Namespace: clusterA.Namespace,
178+
},
179+
}
173180
testObjects = []client.Object{
174181
tenantA,
175182
tenantB,
@@ -179,12 +186,7 @@ var (
179186
newClusterASecret,
180187
clusterASecret,
181188
clusterB,
182-
&corev1.ServiceAccount{
183-
ObjectMeta: metav1.ObjectMeta{
184-
Name: clusterA.Name,
185-
Namespace: clusterA.Namespace,
186-
},
187-
},
189+
clusterASA,
188190
&corev1.ServiceAccount{
189191
ObjectMeta: metav1.ObjectMeta{
190192
Name: clusterB.Name,
@@ -213,8 +215,12 @@ func TestNewServer(t *testing.T) {
213215
}
214216

215217
func setupTest(t *testing.T, _ ...[]runtime.Object) (*echo.Echo, client.Client) {
218+
return rawSetupTest(t, testObjects...)
219+
}
220+
221+
func rawSetupTest(t *testing.T, obj ...client.Object) (*echo.Echo, client.Client) {
216222

217-
f := fake.NewClientBuilder().WithScheme(scheme).WithObjects(testObjects...).Build()
223+
f := fake.NewClientBuilder().WithScheme(scheme).WithObjects(obj...).Build()
218224
testMiddleWare := KubernetesAuth{
219225
CreateClientFunc: func(token string) (client.Client, error) {
220226
return f, nil

‎pkg/service/steward.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,14 +117,14 @@ func findOldestSAToken(secrets []corev1.Secret, saName string) string {
117117
token := ""
118118
var created *metav1.Time
119119

120-
for _, secret := range secrets {
120+
for i, secret := range secrets {
121121
if secret.Type == corev1.SecretTypeServiceAccountToken && // Not strictly necessary but our testing framework can't handle field selectors
122122
secret.Annotations[corev1.ServiceAccountNameKey] == saName &&
123123
len(secret.Data[corev1.ServiceAccountTokenKey]) > 0 &&
124124
!created.Before(&secret.CreationTimestamp) {
125125

126126
token = string(secret.Data[corev1.ServiceAccountTokenKey])
127-
created = &secret.CreationTimestamp
127+
created = &secrets[i].CreationTimestamp
128128
}
129129
}
130130
return token

‎pkg/service/steward_test.go‎

Lines changed: 128 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -3,51 +3,148 @@ package service
33
import (
44
"net/http"
55
"testing"
6+
"time"
67

78
"github.com/deepmap/oapi-codegen/pkg/testutil"
89
"github.com/stretchr/testify/assert"
910
appsv1 "k8s.io/api/apps/v1"
1011
corev1 "k8s.io/api/core/v1"
12+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1113
"k8s.io/apimachinery/pkg/runtime"
1214
"k8s.io/apimachinery/pkg/runtime/serializer/json"
15+
"sigs.k8s.io/controller-runtime/pkg/client"
1316

1417
"github.com/projectsyn/lieutenant-api/pkg/api"
1518
)
1619

1720
func TestInstallSteward(t *testing.T) {
18-
e, _ := setupTest(t)
1921

20-
result := testutil.NewRequest().
21-
WithHeader("X-Forwarded-Proto", "https").
22-
Get("/install/steward.json?token="+clusterA.Status.BootstrapToken.Token).
23-
Go(t, e)
24-
assert.Equal(t, http.StatusOK, result.Code())
25-
manifests := &corev1.List{}
26-
err := result.UnmarshalJsonToObject(&manifests)
27-
assert.NoError(t, err)
28-
assert.Len(t, manifests.Items, 6)
29-
decoder := json.NewSerializer(json.DefaultMetaFactory, scheme, scheme, true)
30-
foundSecret := false
31-
foundDeployment := false
32-
for i, item := range manifests.Items {
33-
obj, err := runtime.Decode(decoder, item.Raw)
34-
assert.NoError(t, err)
35-
if i == 0 {
36-
_, ok := obj.(*corev1.Namespace)
37-
assert.True(t, ok, "First object needs to be a namespace")
38-
}
39-
if secret, ok := obj.(*corev1.Secret); ok {
40-
foundSecret = true
41-
assert.Equal(t, secret.StringData["token"], string(clusterASecret.Data["token"]))
42-
}
43-
if deployment, ok := obj.(*appsv1.Deployment); ok {
44-
foundDeployment = true
45-
assert.Equal(t, "https://example.com", deployment.Spec.Template.Spec.Containers[0].Env[0].Value)
46-
assert.Equal(t, clusterA.Name, deployment.Spec.Template.Spec.Containers[0].Env[1].Value)
47-
}
22+
tcs := map[string]struct {
23+
bootstrapToken string
24+
objs []client.Object
25+
saToken string
26+
clusterName string
27+
}{
28+
"default": {
29+
bootstrapToken: clusterA.Status.BootstrapToken.Token,
30+
objs: testObjects,
31+
saToken: "sometoken",
32+
clusterName: clusterA.Name,
33+
},
34+
"reordered": {
35+
bootstrapToken: clusterA.Status.BootstrapToken.Token,
36+
objs: []client.Object{
37+
newClusterASecret,
38+
clusterA,
39+
tenantA,
40+
wrongSecret,
41+
clusterASA,
42+
clusterASecret,
43+
},
44+
saToken: "sometoken",
45+
clusterName: clusterA.Name,
46+
},
47+
"older secret": {
48+
bootstrapToken: clusterA.Status.BootstrapToken.Token,
49+
objs: []client.Object{
50+
newClusterASecret,
51+
tenantA,
52+
clusterASecret,
53+
&corev1.Secret{
54+
ObjectMeta: metav1.ObjectMeta{
55+
Name: "old-secret",
56+
Namespace: clusterA.Namespace,
57+
CreationTimestamp: metav1.NewTime(time.Now().Add(-24 * time.Hour)),
58+
Annotations: map[string]string{
59+
"kubernetes.io/service-account.name": clusterA.Name,
60+
},
61+
},
62+
Type: corev1.SecretTypeServiceAccountToken,
63+
Data: map[string][]byte{"token": []byte("someoldertoken")},
64+
},
65+
clusterA,
66+
wrongSecret,
67+
clusterASA,
68+
},
69+
saToken: "someoldertoken",
70+
clusterName: clusterA.Name,
71+
},
72+
"even older secret": {
73+
bootstrapToken: clusterA.Status.BootstrapToken.Token,
74+
objs: []client.Object{
75+
tenantA,
76+
&corev1.Secret{
77+
ObjectMeta: metav1.ObjectMeta{
78+
Name: "old-secret",
79+
Namespace: clusterA.Namespace,
80+
CreationTimestamp: metav1.NewTime(time.Now().Add(-24 * time.Hour)),
81+
Annotations: map[string]string{
82+
"kubernetes.io/service-account.name": clusterA.Name,
83+
},
84+
},
85+
Type: corev1.SecretTypeServiceAccountToken,
86+
Data: map[string][]byte{"token": []byte("someoldertoken")},
87+
},
88+
clusterA,
89+
wrongSecret,
90+
clusterASA,
91+
&corev1.Secret{
92+
ObjectMeta: metav1.ObjectMeta{
93+
Name: "arcane-secret",
94+
Namespace: clusterA.Namespace,
95+
CreationTimestamp: metav1.NewTime(time.Unix(0, 0)),
96+
Annotations: map[string]string{
97+
"kubernetes.io/service-account.name": clusterA.Name,
98+
},
99+
},
100+
Type: corev1.SecretTypeServiceAccountToken,
101+
Data: map[string][]byte{"token": []byte("mysterytoken")},
102+
},
103+
newClusterASecret,
104+
clusterASecret,
105+
},
106+
saToken: "mysterytoken",
107+
clusterName: clusterA.Name,
108+
},
109+
}
110+
111+
for n, tc := range tcs {
112+
t.Run(n, func(t *testing.T) {
113+
e, _ := rawSetupTest(t, tc.objs...)
114+
115+
result := testutil.NewRequest().
116+
WithHeader("X-Forwarded-Proto", "https").
117+
Get("/install/steward.json?token="+tc.bootstrapToken).
118+
Go(t, e)
119+
assert.Equal(t, http.StatusOK, result.Code())
120+
manifests := &corev1.List{}
121+
err := result.UnmarshalJsonToObject(&manifests)
122+
assert.NoError(t, err)
123+
assert.Len(t, manifests.Items, 6)
124+
decoder := json.NewSerializer(json.DefaultMetaFactory, scheme, scheme, true)
125+
foundSecret := false
126+
foundDeployment := false
127+
for i, item := range manifests.Items {
128+
obj, err := runtime.Decode(decoder, item.Raw)
129+
assert.NoError(t, err)
130+
if i == 0 {
131+
_, ok := obj.(*corev1.Namespace)
132+
assert.True(t, ok, "First object needs to be a namespace")
133+
}
134+
if secret, ok := obj.(*corev1.Secret); ok {
135+
foundSecret = true
136+
assert.Equal(t, tc.saToken, secret.StringData["token"])
137+
}
138+
if deployment, ok := obj.(*appsv1.Deployment); ok {
139+
foundDeployment = true
140+
assert.Equal(t, "https://example.com", deployment.Spec.Template.Spec.Containers[0].Env[0].Value)
141+
assert.Equal(t, tc.clusterName, deployment.Spec.Template.Spec.Containers[0].Env[1].Value)
142+
}
143+
}
144+
assert.True(t, foundSecret, "Could not find secret with steward token")
145+
assert.True(t, foundDeployment, "Could not find deployment for steward")
146+
})
48147
}
49-
assert.True(t, foundSecret, "Could not find secret with steward token")
50-
assert.True(t, foundDeployment, "Could not find deployment for steward")
51148
}
52149

53150
func TestInstallStewardNoToken(t *testing.T) {

0 commit comments

Comments
 (0)