Skip to content

Commit edccc77

Browse files
britaniarbritaniar
committed
add test cases for newly added users
Signed-off-by: Britania Rodriguez Reyes <[email protected]>
1 parent 5158d08 commit edccc77

File tree

3 files changed

+205
-3
lines changed

3 files changed

+205
-3
lines changed

‎test/e2e/framework/cluster.go‎

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ type Cluster struct {
4646
RestMapper meta.RESTMapper
4747
PricingProvider trackers.PricingProvider
4848
SystemMastersClient client.Client
49+
KubeSystemClient client.Client
50+
FleetSystemClient client.Client
4951
}
5052

5153
func NewCluster(name, svcAccountName string, scheme *runtime.Scheme, pp trackers.PricingProvider) *Cluster {
@@ -62,6 +64,8 @@ func GetClusterClient(cluster *Cluster) {
6264
clusterConfig := GetClientConfig(cluster)
6365
impersonateClusterConfig := GetImpersonateClientConfig(cluster)
6466
systemMastersConfig := GetSystemMastersClientConfig(cluster)
67+
kubeSystemConfig := GetKubeSystemClientConfig(cluster)
68+
fleetSystemConfig := GetFleetSystemClientConfig(cluster)
6569

6670
restConfig, err := clusterConfig.ClientConfig()
6771
if err != nil {
@@ -75,7 +79,17 @@ func GetClusterClient(cluster *Cluster) {
7579

7680
systemMastersRestConfig, err := systemMastersConfig.ClientConfig()
7781
if err != nil {
78-
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up impersonate rest config")
82+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up system masters rest config")
83+
}
84+
85+
kubeSystemRestConfig, err := kubeSystemConfig.ClientConfig()
86+
if err != nil {
87+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up kube-system service account rest config")
88+
}
89+
90+
fleetSystemRestConfig, err := fleetSystemConfig.ClientConfig()
91+
if err != nil {
92+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up fleet-system service account rest config")
7993
}
8094

8195
cluster.KubeClient, err = client.New(restConfig, client.Options{Scheme: cluster.Scheme})
@@ -94,7 +108,13 @@ func GetClusterClient(cluster *Cluster) {
94108
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Impersonate Kube Client")
95109

96110
cluster.SystemMastersClient, err = client.New(systemMastersRestConfig, client.Options{Scheme: cluster.Scheme})
97-
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Impersonate Kube Client")
111+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up System Masters Kube Client")
112+
113+
cluster.KubeSystemClient, err = client.New(kubeSystemRestConfig, client.Options{Scheme: cluster.Scheme})
114+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Kube System Service Account Client")
115+
116+
cluster.FleetSystemClient, err = client.New(fleetSystemRestConfig, client.Options{Scheme: cluster.Scheme})
117+
gomega.Expect(err).Should(gomega.Succeed(), "Failed to set up Fleet System Service Account Client")
98118
}
99119

100120
func GetClientConfig(cluster *Cluster) clientcmd.ClientConfig {
@@ -128,3 +148,33 @@ func GetImpersonateClientConfig(cluster *Cluster) clientcmd.ClientConfig {
128148
},
129149
})
130150
}
151+
152+
func GetKubeSystemClientConfig(cluster *Cluster) clientcmd.ClientConfig {
153+
return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
154+
&clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath},
155+
&clientcmd.ConfigOverrides{
156+
CurrentContext: cluster.ClusterName,
157+
AuthInfo: api.AuthInfo{
158+
Impersonate: "system:serviceaccount:kube-system:service-account-controller",
159+
ImpersonateGroups: []string{
160+
"system:serviceaccounts:kube-system",
161+
},
162+
},
163+
},
164+
)
165+
}
166+
167+
func GetFleetSystemClientConfig(cluster *Cluster) clientcmd.ClientConfig {
168+
return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
169+
&clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath},
170+
&clientcmd.ConfigOverrides{
171+
CurrentContext: cluster.ClusterName,
172+
AuthInfo: api.AuthInfo{
173+
Impersonate: "system:serviceaccount:fleet-system:service-account-controller",
174+
ImpersonateGroups: []string{
175+
"system:serviceaccounts:fleet-system",
176+
},
177+
},
178+
},
179+
)
180+
}

‎test/e2e/managed_resource_vap_test.go‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
2727
corev1 "k8s.io/api/core/v1"
2828
networkingv1 "k8s.io/api/networking/v1"
29+
rbacv1 "k8s.io/api/rbac/v1"
2930
k8sErrors "k8s.io/apimachinery/pkg/api/errors"
3031
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3132
"k8s.io/apimachinery/pkg/types"
@@ -127,6 +128,63 @@ func expectDeniedByVAP(err error) {
127128
}
128129

129130
var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("managedresource"), Ordered, func() {
131+
var clusterRole *rbacv1.ClusterRole
132+
var clusterRoleBinding *rbacv1.ClusterRoleBinding
133+
134+
BeforeAll(func() {
135+
By("Give permissions to service accounts")
136+
// --- Create ClusterRole ---
137+
clusterRole = &rbacv1.ClusterRole{
138+
ObjectMeta: metav1.ObjectMeta{
139+
Name: "allow-certain-managed-resources",
140+
},
141+
Rules: []rbacv1.PolicyRule{
142+
{
143+
APIGroups: []string{""}, // Core API group
144+
Resources: []string{"resourcequotas", "namespaces"},
145+
Verbs: []string{"create", "update", "delete"},
146+
},
147+
{
148+
APIGroups: []string{"networking.k8s.io"},
149+
Resources: []string{"networkpolicies"},
150+
Verbs: []string{"create", "update", "delete"},
151+
},
152+
},
153+
}
154+
Expect(hubClient.Create(ctx, clusterRole)).To(Succeed())
155+
156+
// --- Create ClusterRoleBinding ---
157+
clusterRoleBinding = &rbacv1.ClusterRoleBinding{
158+
ObjectMeta: metav1.ObjectMeta{
159+
Name: "service-accounts-binding-for-managed-resources",
160+
},
161+
Subjects: []rbacv1.Subject{
162+
{
163+
Kind: rbacv1.ServiceAccountKind,
164+
Name: "service-account-controller", // The service account's name
165+
Namespace: "kube-system", // The service account's namespace
166+
},
167+
{
168+
Kind: rbacv1.ServiceAccountKind,
169+
Name: "service-account-controller", // The service account's name
170+
Namespace: "fleet-system", // The service account's namespace
171+
},
172+
},
173+
RoleRef: rbacv1.RoleRef{
174+
APIGroup: rbacv1.GroupName,
175+
Kind: "ClusterRole",
176+
Name: clusterRole.Name,
177+
},
178+
}
179+
Expect(hubClient.Create(ctx, clusterRoleBinding)).To(Succeed())
180+
})
181+
182+
AfterAll(func() {
183+
By("Cleaning up service account permissions")
184+
Expect(hubClient.Delete(ctx, clusterRoleBinding)).To(Succeed())
185+
Expect(hubClient.Delete(ctx, clusterRole)).To(Succeed())
186+
})
187+
130188
It("The VAP and its binding should exist", func() {
131189
var vap admissionregistrationv1.ValidatingAdmissionPolicy
132190
Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vap)).Should(Succeed(), "ValidatingAdmissionPolicy should be installed")
@@ -169,6 +227,24 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
169227

170228
Expect(sysMastersClient.Delete(ctx, managedNS)).To(Succeed())
171229
})
230+
231+
It("should allow CREATE operation on managed namespace for system:serviceaccount:kube-system user", func() {
232+
managedNS := createManagedNamespace("test-managed-ns-kubesystem-sa")
233+
By("expecting successful CREATE operation with system:serviceaccount:kube-system user")
234+
Expect(kubeSystemClient.Create(ctx, managedNS)).To(Succeed())
235+
236+
By("expecting successful DELETE operation on managed namespace")
237+
Expect(sysMastersClient.Delete(ctx, managedNS)).To(Succeed())
238+
})
239+
240+
It("should allow CREATE operation on managed namespace for system:serviceaccounts:fleet-system user", func() {
241+
managedNS := createManagedNamespace("test-managed-ns-fleet-system")
242+
By("expecting successful CREATE operation with system:serviceaccounts:fleet-system user")
243+
Expect(fleetSystemClient.Create(ctx, managedNS)).To(Succeed())
244+
245+
By("expecting successful DELETE operation on managed namespace")
246+
Expect(fleetSystemClient.Delete(ctx, managedNS)).To(Succeed())
247+
})
172248
})
173249

174250
Context("When the namespace exists", Ordered, func() {
@@ -227,6 +303,40 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
227303
}, eventuallyDuration, eventuallyInterval).Should(Succeed())
228304
})
229305

306+
It("should allow UPDATE operation on managed namespace for system:serviceaccounts:kube-system user", func() {
307+
var updateErr error
308+
Eventually(func() error {
309+
var ns corev1.Namespace
310+
if err := sysMastersClient.Get(ctx, types.NamespacedName{Name: managedNS.Name}, &ns); err != nil {
311+
return err
312+
}
313+
ns.Annotations = map[string]string{"test": "annotation"}
314+
By("expecting denial of UPDATE operation on managed namespace")
315+
updateErr = kubeSystemClient.Update(ctx, &ns)
316+
if k8sErrors.IsConflict(updateErr) {
317+
return updateErr
318+
}
319+
return nil
320+
}, eventuallyDuration, eventuallyInterval).Should(Succeed())
321+
})
322+
323+
It("should allow UPDATE operation on managed namespace for system:serviceaccounts:fleet-system user", func() {
324+
var updateErr error
325+
Eventually(func() error {
326+
var ns corev1.Namespace
327+
if err := sysMastersClient.Get(ctx, types.NamespacedName{Name: managedNS.Name}, &ns); err != nil {
328+
return err
329+
}
330+
ns.Annotations = map[string]string{"test": "annotation"}
331+
By("expecting denial of UPDATE operation on managed namespace")
332+
updateErr = fleetSystemClient.Update(ctx, &ns)
333+
if k8sErrors.IsConflict(updateErr) {
334+
return updateErr
335+
}
336+
return nil
337+
}, eventuallyDuration, eventuallyInterval).Should(Succeed())
338+
})
339+
230340
Context("For other resources in scope", func() {
231341
It("should deny creating managed resource quotas", func() {
232342
rq := createManagedResourceQuota("default", "default")
@@ -289,6 +399,42 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag
289399
err = sysMastersClient.Delete(ctx, crp)
290400
Expect(err).To(BeNil(), "system:masters user should delete managed CRP")
291401
})
402+
403+
It("should allow CREATE operation on managed ResourceQuota for kube-system service account", func() {
404+
rq := createManagedResourceQuota(managedNS.Name, "default")
405+
By("expecting successful CREATE operation with kube-system service account")
406+
Expect(kubeSystemClient.Create(ctx, rq)).To(Succeed())
407+
408+
By("expecting successful DELETE operation with kube-system service account")
409+
Expect(kubeSystemClient.Delete(ctx, rq)).To(Succeed())
410+
})
411+
412+
It("should allow CREATE operation on managed ResourceQuota for fleet-system service account", func() {
413+
rq := createManagedResourceQuota(managedNS.Name, "default")
414+
By("expecting successful CREATE operation with fleet-system service account")
415+
Expect(fleetSystemClient.Create(ctx, rq)).To(Succeed())
416+
417+
By("expecting successful DELETE operation with fleet-system service account")
418+
Expect(fleetSystemClient.Delete(ctx, rq)).To(Succeed())
419+
})
420+
421+
It("should allow CREATE operation on managed NetworkPolicy for kube-system service account", func() {
422+
netpol := createManagedNetworkPolicy(managedNS.Name, "default")
423+
By("expecting successful CREATE operation with kube-system service account")
424+
Expect(kubeSystemClient.Create(ctx, netpol)).To(Succeed())
425+
426+
By("expecting successful DELETE operation with kube-system service account")
427+
Expect(kubeSystemClient.Delete(ctx, netpol)).To(Succeed())
428+
})
429+
430+
It("should allow CREATE operation on managed NetworkPolicy for fleet-system service account", func() {
431+
netpol := createManagedNetworkPolicy(managedNS.Name, "default")
432+
By("expecting successful CREATE operation with fleet-system service account")
433+
Expect(fleetSystemClient.Create(ctx, netpol)).To(Succeed())
434+
435+
By("expecting successful DELETE operation with fleet-system service account")
436+
Expect(fleetSystemClient.Delete(ctx, netpol)).To(Succeed())
437+
})
292438
})
293439

294440
AfterAll(func() {

‎test/e2e/setup_test.go‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ var (
109109
hubClient client.Client
110110
notMasterUser client.Client
111111
sysMastersClient client.Client
112+
kubeSystemClient client.Client
113+
fleetSystemClient client.Client
112114
memberCluster1EastProdClient client.Client
113115
memberCluster2EastCanaryClient client.Client
114116
memberCluster3WestProdClient client.Client
@@ -336,7 +338,11 @@ func beforeSuiteForAllProcesses() {
336338
notMasterUser = hubCluster.ImpersonateKubeClient
337339
Expect(notMasterUser).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster")
338340
sysMastersClient = hubCluster.SystemMastersClient
339-
Expect(sysMastersClient).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster")
341+
Expect(sysMastersClient).NotTo(BeNil(), "Failed to initialize impersonate system masters client for accessing Kubernetes cluster")
342+
kubeSystemClient = hubCluster.KubeSystemClient
343+
Expect(kubeSystemClient).NotTo(BeNil(), "Failed to initialize kube-system service account client for accessing Kubernetes cluster")
344+
fleetSystemClient = hubCluster.FleetSystemClient
345+
Expect(fleetSystemClient).NotTo(BeNil(), "Failed to initialize fleet-system service account client for accessing Kubernetes cluster")
340346

341347
var pricingProvider1 trackers.PricingProvider
342348
if isAzurePropertyProviderEnabled {

0 commit comments

Comments
 (0)