test: add unit test for listener, pdb and oidc

Author: maltesander

rust/operator-binary/src/controller/build/authentication/mod.rs

@@ -234,11 +234,9 @@ mod test {
     use super::*;
     use crate::crd::authentication::{AuthenticationClassResolved, AuthenticationClassesResolved};
 
-    #[test]
-    fn test_ldap_config_is_added() {
-        let auth_config =
-            DruidAuthenticationConfig::from_auth_classes(AuthenticationClassesResolved {
-                auth_classes: vec![AuthenticationClassResolved::Ldap {
+    fn ldap_auth_config() -> DruidAuthenticationConfig {
+        DruidAuthenticationConfig::from_auth_classes(AuthenticationClassesResolved {
+            auth_classes: vec![AuthenticationClassResolved::Ldap {
                 auth_class_name: "ldap".to_string(),
                 provider: serde_yaml::from_str::<
                     stackable_operator::crd::authentication::ldap::v1alpha1::AuthenticationProvider,
@@ -251,13 +249,50 @@ mod test {
                 )
                 .unwrap(),
             }],
-            })
+        })
+        .unwrap()
+    }
+
+    #[test]
+    fn test_ldap_config_is_added() {
+        let got = generate_runtime_properties_config(&ldap_auth_config(), &DruidRole::Coordinator)
             .unwrap();
 
-        let role = DruidRole::Coordinator;
+        assert!(got.contains_key("druid.auth.authenticator.Ldap.type"));
+    }
 
-        let got = generate_runtime_properties_config(&auth_config, &role).unwrap();
+    /// The Druid system authenticator, escalator and system authorizer are always configured
+    /// alongside the provider-specific (LDAP/OIDC) config.
+    #[test]
+    fn common_system_auth_config_is_added() {
+        let got = generate_runtime_properties_config(&ldap_auth_config(), &DruidRole::Coordinator)
+            .unwrap();
 
-        assert!(got.contains_key("druid.auth.authenticator.Ldap.type"));
+        assert_eq!(
+            got.get("druid.auth.authenticator.DruidSystemAuthenticator.type"),
+            Some(&"basic".to_owned())
+        );
+        assert_eq!(
+            got.get("druid.auth.authenticator.DruidSystemAuthenticator.authorizerName"),
+            Some(&"DruidSystemAuthorizer".to_owned())
+        );
+        assert_eq!(got.get("druid.escalator.type"), Some(&"basic".to_owned()));
+        assert_eq!(
+            got.get("druid.auth.authorizer.DruidSystemAuthorizer.type"),
+            Some(&"allowAll".to_owned())
+        );
+    }
+
+    /// Pure TLS authentication is rendered in `controller::build::security`, so the auth module
+    /// contributes nothing to runtime.properties.
+    #[test]
+    fn tls_only_produces_no_runtime_properties() {
+        let got = generate_runtime_properties_config(
+            &DruidAuthenticationConfig::Tls {},
+            &DruidRole::Broker,
+        )
+        .unwrap();
+
+        assert!(got.is_empty());
     }
 }

rust/operator-binary/src/controller/build/authentication/oidc.rs

@@ -152,22 +152,14 @@ pub(super) fn add_volumes_and_mounts(
 #[cfg(test)]
 mod tests {
     use rstest::rstest;
-    use stackable_operator::commons::tls_verification::{Tls, TlsClientDetails};
+    use stackable_operator::commons::tls_verification::{
+        CaCert, Tls, TlsClientDetails, TlsServerVerification, TlsVerification,
+    };
 
     use super::*;
 
-    #[rstest]
-    #[case("/realms/sdp")]
-    #[case("/realms/sdp/")]
-    #[case("/realms/sdp/////")]
-    fn test_add_authenticator_config(#[case] root_path: String) {
-        use stackable_operator::{
-            commons::tls_verification::{CaCert, TlsServerVerification, TlsVerification},
-            crd::authentication::oidc,
-        };
-
-        let mut properties = BTreeMap::new();
-        let provider = oidc::v1alpha1::AuthenticationProvider::new(
+    fn test_provider(root_path: String) -> oidc::v1alpha1::AuthenticationProvider {
+        oidc::v1alpha1::AuthenticationProvider::new(
             "keycloak.mycorp.org".to_owned().try_into().unwrap(),
             Some(443),
             root_path,
@@ -181,15 +173,28 @@ mod tests {
             "preferred_username".to_owned(),
             vec!["openid".to_owned()],
             Some(oidc::v1alpha1::IdentityProviderHint::Keycloak),
-        );
-        let oidc = DruidClientAuthenticationOptions {
+        )
+    }
+
+    fn test_options() -> DruidClientAuthenticationOptions {
+        DruidClientAuthenticationOptions {
             client_credentials_secret_ref: "nifi-keycloak-client".to_owned(),
             extra_scopes: vec![],
             product_specific_fields: oidc::v1alpha1::ClientAuthenticationMethodOption {
                 client_authentication_method:
                     oidc::v1alpha1::ClientAuthenticationMethod::ClientSecretPost,
             },
-        };
+        }
+    }
+
+    #[rstest]
+    #[case("/realms/sdp")]
+    #[case("/realms/sdp/")]
+    #[case("/realms/sdp/////")]
+    fn test_add_authenticator_config(#[case] root_path: String) {
+        let provider = test_provider(root_path);
+        let oidc = test_options();
+        let mut properties = BTreeMap::new();
 
         add_authenticator_config(&provider, &oidc, &mut properties)
             .expect("OIDC config adding failed");
@@ -230,4 +235,73 @@ mod tests {
         assert!(properties.contains_key("druid.auth.pac4j.oidc.clientSecret"));
         assert!(properties.contains_key("druid.auth.pac4j.cookiePassphrase"));
     }
+
+    /// The MiddleManager must not get an Oidc authenticator/authorizer, only the Druid system
+    /// authenticator in the chain (OIDC on MiddleManagers breaks coordinator<->mm ingest).
+    #[test]
+    fn middlemanager_is_not_configured_for_oidc() {
+        let provider = test_provider("/realms/sdp".to_owned());
+        let oidc = test_options();
+        let mut config = BTreeMap::new();
+
+        generate_runtime_properties_config(
+            &provider,
+            &oidc,
+            &DruidRole::MiddleManager,
+            &mut config,
+        )
+        .expect("generate runtime properties");
+
+        assert_eq!(
+            config.get("druid.auth.authenticatorChain"),
+            Some(&r#"["DruidSystemAuthenticator"]"#.to_owned())
+        );
+        assert!(!config.contains_key("druid.auth.authenticator.Oidc.type"));
+        assert!(!config.contains_key("druid.auth.authorizers"));
+    }
+
+    /// Every non-MiddleManager role gets the full Oidc authenticator and authorizer.
+    #[test]
+    fn non_middlemanager_is_configured_for_oidc() {
+        let provider = test_provider("/realms/sdp".to_owned());
+        let oidc = test_options();
+        let mut config = BTreeMap::new();
+
+        generate_runtime_properties_config(&provider, &oidc, &DruidRole::Broker, &mut config)
+            .expect("generate runtime properties");
+
+        assert_eq!(
+            config.get("druid.auth.authenticator.Oidc.type"),
+            Some(&"pac4j".to_owned())
+        );
+        assert_eq!(
+            config.get("druid.auth.authenticator.Oidc.authorizerName"),
+            Some(&"OidcAuthorizer".to_owned())
+        );
+        assert!(config.contains_key("druid.auth.authorizers"));
+    }
+
+    /// The MiddleManager mounts no OIDC env vars (OIDC is not configured on it).
+    #[test]
+    fn middlemanager_gets_no_oidc_env_vars() {
+        let oidc = test_options();
+
+        let envs = get_env_var_mounts(&DruidRole::MiddleManager, &oidc, "internal-secret");
+
+        assert!(envs.is_empty());
+    }
+
+    /// Non-MiddleManager roles mount the OIDC credentials and the cookie-passphrase env var.
+    #[test]
+    fn non_middlemanager_gets_oidc_env_vars() {
+        let oidc = test_options();
+
+        let envs = get_env_var_mounts(&DruidRole::Broker, &oidc, "internal-secret");
+
+        assert!(
+            envs.iter()
+                .any(|e| e.name.as_str() == COOKIE_PASSPHRASE_ENV),
+            "expected the cookie passphrase env var to be mounted"
+        );
+    }
 }

rust/operator-binary/src/controller/build/resource/listener.rs

@@ -132,3 +132,91 @@ pub fn secret_volume_listener_scope(role: &DruidRole) -> Option<String> {
         DruidRole::Historical | DruidRole::MiddleManager => None,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::BTreeMap, str::FromStr};
+
+    use stackable_operator::{kube::api::ObjectMeta, v2::types::kubernetes::SecretClassName};
+
+    use super::*;
+    use crate::controller::validate::test_support::{
+        MINIMAL_DRUID_YAML, druid_from_yaml, validated_cluster,
+    };
+
+    fn cluster() -> ValidatedCluster {
+        validated_cluster(&druid_from_yaml(MINIMAL_DRUID_YAML))
+    }
+
+    #[test]
+    fn group_listener_name_only_for_externally_reachable_roles() {
+        let cluster = cluster();
+        assert!(group_listener_name(&cluster, &DruidRole::Broker).is_some());
+        assert!(group_listener_name(&cluster, &DruidRole::Coordinator).is_some());
+        assert!(group_listener_name(&cluster, &DruidRole::Router).is_some());
+        assert!(group_listener_name(&cluster, &DruidRole::Historical).is_none());
+        assert!(group_listener_name(&cluster, &DruidRole::MiddleManager).is_none());
+    }
+
+    #[test]
+    fn group_listener_name_is_cluster_and_role_scoped() {
+        let name =
+            group_listener_name(&cluster(), &DruidRole::Broker).expect("broker has a listener");
+        assert_eq!(name.to_string(), "simple-druid-broker");
+    }
+
+    #[test]
+    fn secret_volume_listener_scope_only_for_externally_reachable_roles() {
+        assert_eq!(
+            secret_volume_listener_scope(&DruidRole::Broker),
+            Some("listener".to_string())
+        );
+        assert!(secret_volume_listener_scope(&DruidRole::Historical).is_none());
+        assert!(secret_volume_listener_scope(&DruidRole::MiddleManager).is_none());
+    }
+
+    /// A listener exposing both the plaintext and TLS ports, so the connection-string builder's
+    /// port selection can be exercised.
+    fn listener_with_both_ports() -> Listener {
+        Listener {
+            metadata: ObjectMeta::default(),
+            spec: listener::v1alpha1::ListenerSpec::default(),
+            status: Some(listener::v1alpha1::ListenerStatus {
+                service_name: None,
+                ingress_addresses: Some(vec![listener::v1alpha1::ListenerIngress {
+                    address: "druid.example.com".to_string(),
+                    address_type: listener::v1alpha1::AddressType::Hostname,
+                    ports: BTreeMap::from([
+                        (PLAINTEXT_PORT_NAME.to_string(), 8888),
+                        (TLS_PORT_NAME.to_string(), 9088),
+                    ]),
+                }]),
+                node_ports: None,
+            }),
+        }
+    }
+
+    #[test]
+    fn connection_string_uses_plaintext_port_without_tls() {
+        let tls = DruidTlsSecurity::new(false, None);
+        let conn = build_listener_connection_string(
+            listener_with_both_ports(),
+            &tls,
+            &"router".to_string(),
+        )
+        .expect("a connection string");
+        assert_eq!(conn, "druid.example.com:8888");
+    }
+
+    #[test]
+    fn connection_string_uses_tls_port_with_tls() {
+        let tls = DruidTlsSecurity::new(false, Some(SecretClassName::from_str("tls").unwrap()));
+        let conn = build_listener_connection_string(
+            listener_with_both_ports(),
+            &tls,
+            &"router".to_string(),
+        )
+        .expect("a connection string");
+        assert_eq!(conn, "druid.example.com:9088");
+    }
+}

rust/operator-binary/src/controller/build/resource/pdb.rs

@@ -56,3 +56,54 @@ fn max_unavailable_middle_managers() -> u16 {
 fn max_unavailable_routers() -> u16 {
     1
 }
+
+#[cfg(test)]
+mod tests {
+    use stackable_operator::{
+        commons::pdb::PdbConfig, k8s_openapi::apimachinery::pkg::util::intstr::IntOrString,
+    };
+
+    use super::*;
+    use crate::controller::validate::test_support::{
+        MINIMAL_DRUID_YAML, druid_from_yaml, validated_cluster,
+    };
+
+    fn cluster() -> ValidatedCluster {
+        validated_cluster(&druid_from_yaml(MINIMAL_DRUID_YAML))
+    }
+
+    #[test]
+    fn disabled_pdb_returns_none() {
+        let pdb = PdbConfig {
+            enabled: false,
+            max_unavailable: None,
+        };
+        assert!(build_pdb(&pdb, &cluster(), &DruidRole::Broker).is_none());
+    }
+
+    #[test]
+    fn enabled_pdb_uses_role_default() {
+        let pdb = PdbConfig {
+            enabled: true,
+            max_unavailable: None,
+        };
+        let built = build_pdb(&pdb, &cluster(), &DruidRole::Broker).expect("a PDB is built");
+        assert_eq!(
+            built.spec.and_then(|spec| spec.max_unavailable),
+            Some(IntOrString::Int(1))
+        );
+    }
+
+    #[test]
+    fn enabled_pdb_respects_explicit_max_unavailable() {
+        let pdb = PdbConfig {
+            enabled: true,
+            max_unavailable: Some(3),
+        };
+        let built = build_pdb(&pdb, &cluster(), &DruidRole::Broker).expect("a PDB is built");
+        assert_eq!(
+            built.spec.and_then(|spec| spec.max_unavailable),
+            Some(IntOrString::Int(3))
+        );
+    }
+}