Adds logs to e2e test output + updates impersonation tests for better

converage

Signed-off-by: JoshVanL <[email protected]>

Author: JoshVanL

test/e2e/framework/framework.go

@@ -91,8 +91,14 @@ func (f *Framework) BeforeEach() {
 
 // AfterEach deletes the namespace, after reading its events.
 func (f *Framework) AfterEach() {
+	// Output logs from proxy of test case.
+	err := f.Helper().Kubectl(f.Namespace.Name).Run("logs", "-lapp=kube-oidc-proxy-e2e")
+	if err != nil {
+		By("Failed to gather logs from kube-oidc-proxy: " + err.Error())
+	}
+
 	By("Deleting kube-oidc-proxy deployment")
-	err := f.Helper().DeleteProxy(f.Namespace.Name)
+	err = f.Helper().DeleteProxy(f.Namespace.Name)
 	Expect(err).NotTo(HaveOccurred())
 
 	By("Deleting mock OIDC issuer")

test/e2e/suite/cases/impersonation/impersonation.go

@@ -8,6 +8,7 @@ import (
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
 
+	rbacv1 "k8s.io/api/rbac/v1"
 	k8sErrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -67,13 +68,78 @@ var _ = framework.CasesDescribe("Impersonation", func() {
 		By("Enabling the disabling of impersonation")
 		f.DeployProxyWith(nil, "--disable-impersonation")
 
-		// Should return an Unauthorized response from Kubernetes as it does not
-		// trust the OIDC token we have presented however it has been authenticated
-		// by kube-oidc-proxy.
-		_, err := f.NewProxyClient().CoreV1().Pods(f.Namespace.Name).List(metav1.ListOptions{})
-		if !k8sErrors.IsUnauthorized(err) {
-			Expect(err).NotTo(HaveOccurred())
+		By("Creating ClusterRole for system:anonymous to impersonate")
+		roleImpersonate, err := f.Helper().KubeClient.RbacV1().ClusterRoles().Create(&rbacv1.ClusterRole{
+			ObjectMeta: metav1.ObjectMeta{
+				GenerateName: fmt.Sprintf("test-user-role-impersonate-"),
+			},
+			Rules: []rbacv1.PolicyRule{
+				{APIGroups: []string{""}, Resources: []string{"users"}, Verbs: []string{"impersonate"}},
+			},
+		})
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Creating Role for user foo to list Pods")
+		rolePods, err := f.Helper().KubeClient.RbacV1().Roles(f.Namespace.Name).Create(&rbacv1.Role{
+			ObjectMeta: metav1.ObjectMeta{
+				GenerateName: fmt.Sprintf("test-user-role-pods-"),
+			},
+			Rules: []rbacv1.PolicyRule{
+				{APIGroups: []string{""}, Resources: []string{"pods"}, Verbs: []string{"get", "list"}},
+			},
+		})
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Creating ClusterRoleBinding for user system:anonymous")
+		rolebindingImpersonate, err := f.Helper().KubeClient.RbacV1().ClusterRoleBindings().Create(
+			&rbacv1.ClusterRoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					GenerateName: "test-user-binding-system-anonymous",
+				},
+				Subjects: []rbacv1.Subject{{Name: "system:anonymous", Kind: "User"}},
+				RoleRef:  rbacv1.RoleRef{Name: roleImpersonate.Name, Kind: "ClusterRole"},
+			})
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Creating RoleBinding for user [email protected]")
+		rolebindingPods, err := f.Helper().KubeClient.RbacV1().RoleBindings(f.Namespace.Name).Create(
+			&rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					GenerateName: "test-user-binding-user-foo-example-com",
+				},
+				Subjects: []rbacv1.Subject{{Name: "[email protected]", Kind: "User"}},
+				RoleRef:  rbacv1.RoleRef{Name: rolePods.Name, Kind: "Role"},
+			})
+		Expect(err).NotTo(HaveOccurred())
+
+		// build client with impersonation
+		config := f.NewProxyRestConfig()
+		config.Impersonate = rest.ImpersonationConfig{
+			UserName: "[email protected]",
 		}
+		client, err := kubernetes.NewForConfig(config)
+		Expect(err).NotTo(HaveOccurred())
+
+		// Should not error since we have authorized system:anonymous to
+		// impersonate and [email protected] to list pods
+		_, err = client.CoreV1().Pods(f.Namespace.Name).List(metav1.ListOptions{})
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Deleting RoleBinding for user [email protected]")
+		err = f.Helper().KubeClient.RbacV1().RoleBindings(f.Namespace.Name).Delete(rolebindingPods.Name, nil)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Deleting Role for list Pods")
+		err = f.Helper().KubeClient.RbacV1().Roles(f.Namespace.Name).Delete(rolePods.Name, nil)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Deleting ClusterRoleBinding for user system:anonymous")
+		err = f.Helper().KubeClient.RbacV1().ClusterRoleBindings().Delete(rolebindingImpersonate.Name, nil)
+		Expect(err).NotTo(HaveOccurred())
+
+		By("Deleting ClusterRole for Impersonate")
+		err = f.Helper().KubeClient.RbacV1().ClusterRoles().Delete(roleImpersonate.Name, nil)
+		Expect(err).NotTo(HaveOccurred())
 	})
 })