tests: add unit tests for server-side apply

Signed-off-by: Chirag Rao <crao@redhat.com>
Assisted-by: Cursor

Author: SpaceFace02

operator/src/attestation_key_register.rs

@@ -388,6 +388,7 @@ pub async fn launch_secret_ak_controller(client: Client) {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use http::{Method, Request};
     use trusted_cluster_operator_test_utils::mock_client::*;
 
     #[tokio::test]
@@ -419,4 +420,243 @@ mod tests {
             |client| create_attestation_key_register_service(client, Default::default(), Some(80));
         test_create_error(clos).await;
     }
+
+    fn dummy_ak() -> AttestationKey {
+        AttestationKey {
+            metadata: ObjectMeta {
+                name: Some("ak-test".to_string()),
+                uid: Some("ak-uid".to_string()),
+                generation: Some(1),
+                ..Default::default()
+            },
+            spec: trusted_cluster_operator_lib::AttestationKeySpec {
+                public_key: "test-key".to_string(),
+                uuid: Some("machine-uuid".to_string()),
+            },
+            status: None,
+        }
+    }
+
+    fn dummy_machine() -> Machine {
+        Machine {
+            metadata: ObjectMeta {
+                name: Some("machine-test".to_string()),
+                uid: Some("machine-uid".to_string()),
+                ..Default::default()
+            },
+            spec: trusted_cluster_operator_lib::MachineSpec {
+                id: "machine-uuid".to_string(),
+            },
+            status: None,
+        }
+    }
+
+    #[tokio::test]
+    async fn test_approve_ak_full_flow() {
+        // approve_ak with no prior status, no Machine owner, and secret not existing:
+        // 1. PATCH /status (SSA status update). AttestationKey is approved.
+        // 2. PATCH owner transfer (Merge). Ownership transfered to Machine.
+        // 3. GET secret (check existence)
+        // 4. PATCH secret (apply_resource! SSA create)
+        let clos = async |req: Request<_>, ctr| match (ctr, req.method()) {
+            (0, &Method::PATCH) => {
+                assert!(req.uri().path().contains("/status"));
+                Ok(serde_json::to_string(&dummy_ak()).unwrap())
+            }
+            (1, &Method::PATCH) => {
+                assert!(!req.uri().path().contains("/status"));
+                Ok(serde_json::to_string(&dummy_ak()).unwrap())
+            }
+            (2, &Method::GET) => Err(http::StatusCode::NOT_FOUND),
+            (3, &Method::PATCH) => {
+                let body = get_body_string(req).await;
+                let v: serde_json::Value = serde_json::from_str(&body).unwrap();
+                let owners = v["metadata"]["ownerReferences"]
+                    .as_array()
+                    .expect("Secret must have ownerReferences");
+                assert_eq!(
+                    owners[0]["kind"], "AttestationKey",
+                    "Secret must be owned by AttestationKey"
+                );
+                assert_eq!(
+                    owners[0]["controller"], true,
+                    "AttestationKey must be controller of Secret"
+                );
+                assert_eq!(
+                    owners[0]["uid"], "ak-uid",
+                    "Secret owner UID must match AK UID"
+                );
+
+                // Asserting finalizers
+                let finalizers = v["metadata"]["finalizers"]
+                    .as_array()
+                    .expect("Secret must have finalizers");
+                assert!(
+                    finalizers.iter().any(|f| f
+                        .as_str()
+                        .unwrap()
+                        .contains("attestationkey-secret-finalizer")),
+                    "Secret must have the attestation key secret finalizer"
+                );
+                let data = v["data"].as_object().expect("Secret must have data");
+                assert!(
+                    data.contains_key("public_key"),
+                    "Secret data must contain public_key"
+                );
+                Ok(serde_json::to_string(&Secret::default()).unwrap())
+            }
+
+            _ => panic!("unexpected API interaction: {req:?}, counter {ctr}"),
+        };
+        count_check!(4, clos, |client| {
+            let ak = dummy_ak();
+            let machine = dummy_machine();
+            assert!(approve_ak(&ak, &machine, client).await.is_ok());
+        });
+    }
+
+    #[tokio::test]
+    async fn test_approve_ak_already_approved_and_owned() {
+        // Building a pre-populated AttestationKey with the approved condition. This would prevent upsert from changing the status field, preventing the initial status PATCH.
+        // Further-more, we set owner of AttestationKey to the Machine, so that no owner transfer PATCH is needed.
+        // Further, get secret returns valid secret, so no secret PATCH is needed.
+        // Only 1 GET call to fetch secret is needed.
+        let mut ak = dummy_ak();
+        let approve_reason =
+            trusted_cluster_operator_lib::conditions::ATTESTATION_KEY_MACHINE_APPROVE;
+        let existing_condition = crate::conditions::attestation_key_approved_condition(
+            approve_reason,
+            ak.metadata.generation,
+            &ak.status,
+        );
+        ak.status = Some(AttestationKeyStatus {
+            conditions: Some(vec![existing_condition]),
+        });
+        ak.metadata.owner_references = Some(vec![OwnerReference {
+            kind: "Machine".to_string(),
+            name: "machine-test".to_string(),
+            uid: "machine-uid".to_string(),
+            api_version: "trusted-execution-clusters.io/v1alpha1".to_string(),
+            controller: Some(true),
+            block_owner_deletion: Some(true),
+        }]);
+
+        // No status or owner PATCH needed; only GET secret (exists)
+        let clos = async |req: Request<_>, ctr| match (ctr, req.method()) {
+            (0, &Method::GET) => Ok(serde_json::to_string(&Secret::default()).unwrap()),
+            _ => panic!("unexpected API interaction: {req:?}, counter {ctr}"),
+        };
+        count_check!(1, clos, |client| {
+            let machine = dummy_machine();
+            assert!(approve_ak(&ak, &machine, client).await.is_ok());
+        });
+    }
+
+    #[tokio::test]
+    async fn test_approve_ak_status_update_error() {
+        let clos = async |req: Request<_>, ctr| match (ctr, req.method()) {
+            (0, &Method::PATCH) => Err(http::StatusCode::INTERNAL_SERVER_ERROR),
+            _ => panic!("unexpected API interaction: {req:?}, counter {ctr}"),
+        };
+        count_check!(1, clos, |client| {
+            let ak = dummy_ak();
+            let machine = dummy_machine();
+            assert!(approve_ak(&ak, &machine, client).await.is_err());
+        });
+    }
+
+    #[tokio::test]
+    async fn test_approve_ak_status_patch_contains_approved_condition() {
+        use kube::client::Body;
+        let clos = async |req: Request<Body>, ctr| match (ctr, req.method()) {
+            // Validates whether attestation key is immediately approved as per TOFU (Trust on first use) principles.
+            // Also makes sure that the approved condition is set to True, and the reason is MachineCreated.
+            (0, &Method::PATCH) => {
+                assert!(
+                    req.uri().path().contains("/status"),
+                    "First PATCH must target /status subresource"
+                );
+                let body = get_body_string(req).await;
+                let v: serde_json::Value = serde_json::from_str(&body).unwrap();
+                let conditions = v["status"]["conditions"]
+                    .as_array()
+                    .expect("Status body must contain conditions array");
+                let approved_type =
+                    trusted_cluster_operator_lib::conditions::ATTESTATION_KEY_APPROVED_CONDITION;
+                let approved = conditions.iter().find(|c| c["type"] == approved_type);
+                assert!(
+                    approved.is_some(),
+                    "Must contain the '{approved_type}' condition"
+                );
+                let cond = approved.unwrap();
+                assert_eq!(cond["status"], "True", "Approved condition must be True");
+                assert_eq!(
+                    cond["reason"], ATTESTATION_KEY_MACHINE_APPROVE,
+                    "Reason must be MachineCreated"
+                );
+                Ok(serde_json::to_string(&dummy_ak()).unwrap())
+            }
+            (1, &Method::PATCH) => Ok(serde_json::to_string(&dummy_ak()).unwrap()),
+            (2, &Method::GET) => Err(http::StatusCode::NOT_FOUND),
+            (3, &Method::PATCH) => Ok(serde_json::to_string(&Secret::default()).unwrap()),
+            _ => panic!("unexpected API interaction: {req:?}, counter {ctr}"),
+        };
+        count_check!(4, clos, |client| {
+            let ak = dummy_ak();
+            let machine = dummy_machine();
+            assert!(approve_ak(&ak, &machine, client).await.is_ok());
+        });
+    }
+
+    // Makes sure that the owner transfer patch uses merge patch, and not SSA patch.
+    // SSA can't transfer ownership, and would cause issues where we might not cleanly remove the TEC owner reference.
+    #[tokio::test]
+    async fn test_approve_ak_owner_transfer_uses_merge_patch() {
+        use kube::client::Body;
+        let clos = async |req: Request<Body>, ctr| match (ctr, req.method()) {
+            (0, &Method::PATCH) => Ok(serde_json::to_string(&dummy_ak()).unwrap()),
+            (1, &Method::PATCH) => {
+                assert!(
+                    !req.uri().path().contains("/status"),
+                    "Owner transfer must not target /status"
+                );
+                let query = req.uri().query().unwrap_or("");
+                assert!(
+                    !query.contains("fieldManager"),
+                    "Merge patch must NOT use a field manager (not SSA): {query}"
+                );
+                let content_type = req
+                    .headers()
+                    .get("content-type")
+                    .and_then(|v| v.to_str().ok())
+                    .unwrap_or("");
+                assert!(
+                    content_type.contains("merge-patch"),
+                    "Owner transfer must use Merge patch, got content-type: {content_type}"
+                );
+                let body = get_body_string(req).await;
+                let v: serde_json::Value = serde_json::from_str(&body).unwrap();
+                let owners = v["metadata"]["ownerReferences"]
+                    .as_array()
+                    .expect("Merge patch must set ownerReferences");
+                assert_eq!(
+                    owners.len(),
+                    1,
+                    "Must replace entire ownerReferences (not append)"
+                );
+                assert_eq!(owners[0]["kind"], "Machine", "New owner must be Machine");
+                assert_eq!(owners[0]["name"], "machine-test");
+                assert_eq!(owners[0]["controller"], true, "Machine must be controller");
+                Ok(serde_json::to_string(&dummy_ak()).unwrap())
+            }
+            (2, &Method::GET) => Err(http::StatusCode::NOT_FOUND),
+            (3, &Method::PATCH) => Ok(serde_json::to_string(&Secret::default()).unwrap()),
+            _ => panic!("unexpected API interaction: {req:?}, counter {ctr}"),
+        };
+        count_check!(4, clos, |client| {
+            let ak = dummy_ak();
+            let machine = dummy_machine();
+            assert!(approve_ak(&ak, &machine, client).await.is_ok());
+        });
+    }
 }

operator/src/main.rs

@@ -505,6 +505,7 @@ mod tests {
         };
 
         let clos = async |req: Request<Body>, _ctr| {
+            let is_status_patch = req.uri().path().ends_with("/status");
             match *req.method() {
                 Method::GET => {
                     let object_list = ObjectList::<TrustedExecutionCluster> {
@@ -514,7 +515,11 @@ mod tests {
                     };
                     Ok(serde_json::to_string(&object_list).unwrap())
                 }
-                Method::POST => Ok(serde_json::to_string(&dummy_cluster()).unwrap()),
+                // Patches which update the status field, like installing secrets, config maps etc.
+                Method::PATCH if !is_status_patch => {
+                    Ok(serde_json::to_string(&dummy_cluster()).unwrap())
+                }
+                // Patches which update the status field, to check whether foreign conditions are present and not overwritten.
                 Method::PATCH => {
                     let body = req.into_body().collect_bytes().await.unwrap().to_vec();
                     let body = String::from_utf8_lossy(&body);