Skip to content

Commit 1e45a49

Browse files
britaniarbritaniar
committed
add test cases for newly added users
Signed-off-by: Britania Rodriguez Reyes <[email protected]>
1 parent 5158d08 commit 1e45a49

File tree

3 files changed

+209
-3
lines changed

3 files changed

+209
-3
lines changed

‎test/e2e/framework/cluster.go‎

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ type Cluster struct {
4646
RestMapper meta.RESTMapper
4747
PricingProvider trackers.PricingProvider
4848
SystemMastersClient client.Client
49+
KubeSystemClient client.Client
50+
FleetSystemClient client.Client
4951
}
5052

5153
func NewCluster(name, svcAccountName string, scheme *runtime.Scheme, pp trackers.PricingProvider) *Cluster {
@@ -62,6 +64,8 @@ func GetClusterClient(cluster *Cluster) {
6264
clusterConfig := GetClientConfig(cluster)
6365
impersonateClusterConfig := GetImpersonateClientConfig(cluster)
6466
systemMastersConfig := GetSystemMastersClientConfig(cluster)
67+
kubeSystemConfig := GetKubeSystemClientConfig(cluster)
68+
fleetSystemConfig := GetFleetSystemClientConfig(cluster)
6569

6670
restConfig, err := clusterConfig.ClientConfig()
6771
if err != nil {
@@ -75,7 +79,17 @@ func GetClusterClient(cluster *Cluster) {
7579

7680
systemMastersRestConfig, err := systemMastersConfig.ClientConfig()
7781
if err != nil {
78-
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up impersonate rest config")
82+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up system masters rest config")
83+
}
84+
85+
kubeSystemRestConfig, err := kubeSystemConfig.ClientConfig()
86+
if err != nil {
87+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up kube-system service account rest config")
88+
}
89+
90+
fleetSystemRestConfig, err := fleetSystemConfig.ClientConfig()
91+
if err != nil {
92+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up fleet-system service account rest config")
7993
}
8094

8195
cluster.KubeClient, err = client.New(restConfig, client.Options{Scheme: cluster.Scheme})
@@ -94,7 +108,13 @@ func GetClusterClient(cluster *Cluster) {
94108
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Impersonate Kube Client")
95109

96110
cluster.SystemMastersClient, err = client.New(systemMastersRestConfig, client.Options{Scheme: cluster.Scheme})
97-
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Impersonate Kube Client")
111+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up System Masters Kube Client")
112+
113+
cluster.KubeSystemClient, err = client.New(kubeSystemRestConfig, client.Options{Scheme: cluster.Scheme})
114+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Kube System Service Account Client")
115+
116+
cluster.FleetSystemClient, err = client.New(fleetSystemRestConfig, client.Options{Scheme: cluster.Scheme})
117+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Fleet System Service Account Client")
98118
}
99119

100120
func GetClientConfig(cluster *Cluster) clientcmd.ClientConfig {
@@ -128,3 +148,32 @@ func GetImpersonateClientConfig(cluster *Cluster) clientcmd.ClientConfig {
128148
},
129149
})
130150
}
151+
152+
func GetKubeSystemClientConfig(cluster *Cluster) clientcmd.ClientConfig {
153+
return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
154+
&clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath},
155+
&clientcmd.ConfigOverrides{
156+
CurrentContext: cluster.ClusterName,
157+
AuthInfo: api.AuthInfo{
158+
Impersonate: "kube-system:service-account-controller",
159+
ImpersonateGroups: []string{
160+
"system:serviceaccounts:kube-system",
161+
},
162+
},
163+
},
164+
)
165+
}
166+
167+
func GetFleetSystemClientConfig(cluster *Cluster) clientcmd.ClientConfig {
168+
return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
169+
&clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath},
170+
&clientcmd.ConfigOverrides{
171+
CurrentContext: cluster.ClusterName,
172+
AuthInfo: api.AuthInfo{
173+
Impersonate: "fleet-system:service-account-controller",
174+
ImpersonateGroups: []string{
175+
"system:serviceaccounts:fleet-system",
176+
},
177+
},
178+
})
179+
}

‎test/e2e/managed_resource_vap_test.go‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
2727
corev1 "k8s.io/api/core/v1"
2828
networkingv1 "k8s.io/api/networking/v1"
29+
rbacv1 "k8s.io/api/rbac/v1"
2930
k8sErrors "k8s.io/apimachinery/pkg/api/errors"
3031
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3132
"k8s.io/apimachinery/pkg/types"
@@ -127,6 +128,68 @@ func expectDeniedByVAP(err error) {
127128
}
128129

129130
var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("managedresource"), Ordered, func() {
131+
var clusterRole *rbacv1.ClusterRole
132+
var clusterRoleBinding *rbacv1.ClusterRoleBinding
133+
134+
BeforeAll(func() {
135+
By("Give permissions to service accounts")
136+
// --- Create ClusterRole ---
137+
clusterRole = &rbacv1.ClusterRole{
138+
ObjectMeta: metav1.ObjectMeta{
139+
Name: "allow-certain-managed-resources",
140+
},
141+
Rules: []rbacv1.PolicyRule{
142+
{
143+
APIGroups: []string{""}, // Core API group
144+
Resources: []string{"resourcequotas"},
145+
Verbs: []string{"create", "update", "delete"},
146+
},
147+
{
148+
APIGroups: []string{""}, // Core API group
149+
Resources: []string{"namespaces"},
150+
Verbs: []string{"create", "update", "delete"},
151+
},
152+
{
153+
APIGroups: []string{"networking.k8s.io"},
154+
Resources: []string{"networkpolicies"},
155+
Verbs: []string{"create", "update", "delete"},
156+
},
157+
},
158+
}
159+
Expect(hubClient.Create(ctx, clusterRole)).To(Succeed())
160+
161+
// --- Create ClusterRoleBinding ---
162+
clusterRoleBinding = &rbacv1.ClusterRoleBinding{
163+
ObjectMeta: metav1.ObjectMeta{
164+
Name: "service-accounts-binding",
165+
},
166+
Subjects: []rbacv1.Subject{
167+
{
168+
Kind: rbacv1.ServiceAccountKind,
169+
Name: "service-account-controller", // The service account's name
170+
Namespace: "kube-system", // The service account's namespace
171+
},
172+
{
173+
Kind: rbacv1.ServiceAccountKind,
174+
Name: "service-account-controller", // The service account's name
175+
Namespace: "fleet-system", // The service account's namespace
176+
},
177+
},
178+
RoleRef: rbacv1.RoleRef{
179+
APIGroup: rbacv1.GroupName,
180+
Kind: "ClusterRole",
181+
Name: clusterRole.Name,
182+
},
183+
}
184+
Expect(hubClient.Create(ctx, clusterRoleBinding)).To(Succeed())
185+
})
186+
187+
AfterAll(func() {
188+
By("Cleaning up service account permissions")
189+
Expect(hubClient.Delete(ctx, clusterRoleBinding)).To(Succeed())
190+
Expect(hubClient.Delete(ctx, clusterRole)).To(Succeed())
191+
})
192+
130193
It("The VAP and its binding should exist", func() {
131194
var vap admissionregistrationv1.ValidatingAdmissionPolicy
132195
Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vap)).Should(Succeed(), "ValidatingAdmissionPolicy should be installed")
@@ -169,6 +232,24 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
169232

170233
Expect(sysMastersClient.Delete(ctx, managedNS)).To(Succeed())
171234
})
235+
236+
It("should allow CREATE operation on managed namespace for system:serviceaccount:kube-system:default user", func() {
237+
managedNS := createManagedNamespace("test-managed-ns-kubesystem-sa")
238+
By("expecting successful CREATE operation with system:serviceaccount:kube-system:default user")
239+
Expect(kubeSystemClient.Create(ctx, managedNS)).To(Succeed())
240+
241+
By("expecting successful DELETE operation on managed namespace")
242+
Expect(sysMastersClient.Delete(ctx, managedNS)).To(Succeed())
243+
})
244+
245+
It("should allow CREATE operation on managed namespace for system:serviceaccounts:fleet-system user", func() {
246+
managedNS := createManagedNamespace("test-managed-ns-fleet-system")
247+
By("expecting successful CREATE operation with system:serviceaccounts:fleet-system user")
248+
Expect(fleetSystemClient.Create(ctx, managedNS)).To(Succeed())
249+
250+
By("expecting successful DELETE operation on managed namespace")
251+
Expect(fleetSystemClient.Delete(ctx, managedNS)).To(Succeed())
252+
})
172253
})
173254

174255
Context("When the namespace exists", Ordered, func() {
@@ -227,6 +308,40 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
227308
}, eventuallyDuration, eventuallyInterval).Should(Succeed())
228309
})
229310

311+
It("should allow UPDATE operation on managed namespace for system:serviceaccounts:kube-system user", func() {
312+
var updateErr error
313+
Eventually(func() error {
314+
var ns corev1.Namespace
315+
if err := sysMastersClient.Get(ctx, types.NamespacedName{Name: managedNS.Name}, &ns); err != nil {
316+
return err
317+
}
318+
ns.Annotations = map[string]string{"test": "annotation"}
319+
By("expecting denial of UPDATE operation on managed namespace")
320+
updateErr = kubeSystemClient.Update(ctx, &ns)
321+
if k8sErrors.IsConflict(updateErr) {
322+
return updateErr
323+
}
324+
return nil
325+
}, eventuallyDuration, eventuallyInterval).Should(Succeed())
326+
})
327+
328+
It("should allow UPDATE operation on managed namespace for system:serviceaccounts:fleet-system user", func() {
329+
var updateErr error
330+
Eventually(func() error {
331+
var ns corev1.Namespace
332+
if err := sysMastersClient.Get(ctx, types.NamespacedName{Name: managedNS.Name}, &ns); err != nil {
333+
return err
334+
}
335+
ns.Annotations = map[string]string{"test": "annotation"}
336+
By("expecting denial of UPDATE operation on managed namespace")
337+
updateErr = fleetSystemClient.Update(ctx, &ns)
338+
if k8sErrors.IsConflict(updateErr) {
339+
return updateErr
340+
}
341+
return nil
342+
}, eventuallyDuration, eventuallyInterval).Should(Succeed())
343+
})
344+
230345
Context("For other resources in scope", func() {
231346
It("should deny creating managed resource quotas", func() {
232347
rq := createManagedResourceQuota("default", "default")
@@ -289,6 +404,42 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
289404
err = sysMastersClient.Delete(ctx, crp)
290405
Expect(err).To(BeNil(), "system:masters user should delete managed CRP")
291406
})
407+
408+
It("should allow CREATE operation on managed ResourceQuota for kube-system service account", func() {
409+
rq := createManagedResourceQuota(managedNS.Name, "test-rq-kubesystem-sa")
410+
By("expecting successful CREATE operation with kube-system service account")
411+
Expect(kubeSystemClient.Create(ctx, rq)).To(Succeed())
412+
413+
By("expecting successful DELETE operation with kube-system service account")
414+
Expect(kubeSystemClient.Delete(ctx, rq)).To(Succeed())
415+
})
416+
417+
It("should allow CREATE operation on managed ResourceQuota for fleet-system service account", func() {
418+
rq := createManagedResourceQuota(managedNS.Name, "test-rq-fleetsystem-sa")
419+
By("expecting successful CREATE operation with fleet-system service account")
420+
Expect(fleetSystemClient.Create(ctx, rq)).To(Succeed())
421+
422+
By("expecting successful DELETE operation with fleet-system service account")
423+
Expect(fleetSystemClient.Delete(ctx, rq)).To(Succeed())
424+
})
425+
426+
It("should allow CREATE operation on managed NetworkPolicy for kube-system service account", func() {
427+
netpol := createManagedNetworkPolicy(managedNS.Name, "test-netpol-kubesystem-sa")
428+
By("expecting successful CREATE operation with kube-system service account")
429+
Expect(kubeSystemClient.Create(ctx, netpol)).To(Succeed())
430+
431+
By("expecting successful DELETE operation with kube-system service account")
432+
Expect(kubeSystemClient.Delete(ctx, netpol)).To(Succeed())
433+
})
434+
435+
It("should allow CREATE operation on managed NetworkPolicy for fleet-system service account", func() {
436+
netpol := createManagedNetworkPolicy(managedNS.Name, "test-netpol-fleetsystem-sa")
437+
By("expecting successful CREATE operation with fleet-system service account")
438+
Expect(fleetSystemClient.Create(ctx, netpol)).To(Succeed())
439+
440+
By("expecting successful DELETE operation with fleet-system service account")
441+
Expect(fleetSystemClient.Delete(ctx, netpol)).To(Succeed())
442+
})
292443
})
293444

294445
AfterAll(func() {

‎test/e2e/setup_test.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ var (
109109
hubClient client.Client
110110
notMasterUser client.Client
111111
sysMastersClient client.Client
112+
kubeSystemClient client.Client
113+
fleetSystemClient client.Client
112114
memberCluster1EastProdClient client.Client
113115
memberCluster2EastCanaryClient client.Client
114116
memberCluster3WestProdClient client.Client
@@ -336,7 +338,11 @@ func beforeSuiteForAllProcesses() {
336338
notMasterUser = hubCluster.ImpersonateKubeClient
337339
Expect(notMasterUser).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster")
338340
sysMastersClient = hubCluster.SystemMastersClient
339-
Expect(sysMastersClient).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster")
341+
Expect(sysMastersClient).NotTo(BeNil(), "Failed to initialize impersonate system masters client for accessing Kubernetes cluster")
342+
kubeSystemClient = hubCluster.KubeSystemClient
343+
Expect(kubeSystemClient).NotTo(BeNil(), "Failed to initialize kube-system service account client for accessing Kubernetes cluster")
344+
fleetSystemClient = hubCluster.FleetSystemClient
345+
Expect(fleetSystemClient).NotTo(BeNil(), "Failed to initialize fleet-system service account client for accessing Kubernetes cluster")
340346

341347
var pricingProvider1 trackers.PricingProvider
342348
if isAzurePropertyProviderEnabled {

0 commit comments

Comments
 (0)