@@ -95,6 +95,25 @@ func createManagedCRP(name string) *placementv1beta1.ClusterResourcePlacement {
9595 }
9696}
9797
98+ func createManagedResourcePlacement (name string ) * placementv1beta1.ResourcePlacement {
99+ return & placementv1beta1.ResourcePlacement {
100+ ObjectMeta : metav1.ObjectMeta {
101+ Name : name ,
102+ Namespace : "default" ,
103+ Labels : managedByLabelMap ,
104+ },
105+ Spec : placementv1beta1.PlacementSpec {
106+ ResourceSelectors : []placementv1beta1.ResourceSelectorTerm {
107+ {
108+ Group : "" ,
109+ Version : "v1" ,
110+ Kind : "Pod" ,
111+ },
112+ },
113+ },
114+ }
115+ }
116+
98117func expectDeniedByVAP (err error ) {
99118 var statusErr * k8sErrors.StatusError
100119 Expect (errors .As (err , & statusErr )).To (BeTrue (), fmt .Sprintf ("Expected StatusError, got error %s of type %s" , err , reflect .TypeOf (err )))
@@ -238,14 +257,18 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
238257 err = sysMastersClient .Create (ctx , crp )
239258 Expect (err ).To (BeNil (), "system:masters user should create managed CRP" )
240259
260+ work := createManagedResourcePlacement ("test-work" )
261+ err = notMasterUser .Create (ctx , work )
262+ expectDeniedByVAP (err )
263+
241264 var updateErr error
242265 Eventually (func () error {
243266 var urq corev1.ResourceQuota
244267 if err := sysMastersClient .Get (ctx , types.NamespacedName {Name : "default" , Namespace : "default" }, & urq ); err != nil {
245268 return err
246269 }
247270 urq .Annotations = map [string ]string {"test" : "annotation" }
248- By ("expecting denial of UPDATE operation on managed namespace " )
271+ By ("expecting denial of UPDATE operation on managed resource quota " )
249272 updateErr = notMasterUser .Update (ctx , & urq )
250273 if k8sErrors .IsConflict (updateErr ) {
251274 return updateErr
@@ -260,11 +283,11 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
260283 expectDeniedByVAP (err )
261284
262285 err = sysMastersClient .Delete (ctx , rq )
263- Expect (err ).To (BeNil (), "system:masters user should create managed ResourceQuota" )
286+ Expect (err ).To (BeNil (), "system:masters user should delete managed ResourceQuota" )
264287 err = sysMastersClient .Delete (ctx , np )
265- Expect (err ).To (BeNil (), "system:masters user should create managed NetworkPolicy" )
288+ Expect (err ).To (BeNil (), "system:masters user should delete managed NetworkPolicy" )
266289 err = sysMastersClient .Delete (ctx , crp )
267- Expect (err ).To (BeNil (), "system:masters user should create managed CRP" )
290+ Expect (err ).To (BeNil (), "system:masters user should delete managed CRP" )
268291 })
269292 })
270293
0 commit comments