Skip to content

Commit af6fa02

Browse files
ntnnntnn
committed
Move e2e mockoidc to authfixtures
Signed-off-by: Nelo-T. Wallus <[email protected]> Signed-off-by: Nelo-T. Wallus <[email protected]>
1 parent 9d893bb commit af6fa02

File tree

3 files changed

+131
-94
lines changed

3 files changed

+131
-94
lines changed

‎test/e2e/authentication/workspace_test.go‎

Lines changed: 23 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ package authentication
1919
import (
2020
"context"
2121
"fmt"
22-
"math/rand"
2322
"testing"
2423
"time"
2524

@@ -39,7 +38,7 @@ import (
3938
tenancyv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/tenancy/v1alpha1"
4039
kcpclientset "github.com/kcp-dev/kcp/sdk/client/clientset/versioned/cluster"
4140
kcptesting "github.com/kcp-dev/kcp/sdk/testing"
42-
"github.com/kcp-dev/kcp/sdk/testing/third_party/library-go/crypto"
41+
"github.com/kcp-dev/kcp/test/e2e/fixtures/authfixtures"
4342
"github.com/kcp-dev/kcp/test/e2e/framework"
4443
)
4544

@@ -61,19 +60,19 @@ func TestWorkspaceOIDC(t *testing.T) {
6160

6261
// start a two mock OIDC servers that will listen on random ports
6362
// (only for discovery and keyset handling, no actual login workflows)
64-
mockA, ca := startMockOIDC(t, server)
65-
mockB, _ := startMockOIDC(t, server)
63+
mockA, ca := authfixtures.StartMockOIDC(t, server)
64+
mockB, _ := authfixtures.StartMockOIDC(t, server)
6665

6766
// setup a new workspace auth config that uses mockoidc's server, one for
6867
// each of our mockoidc servers
69-
authConfigA := createWorkspaceAuthentication(t, ctx, kcpClusterClient, baseWsPath, mockA, ca)
70-
authConfigB := createWorkspaceAuthentication(t, ctx, kcpClusterClient, baseWsPath, mockB, ca)
68+
authConfigA := authfixtures.CreateWorkspaceOIDCAuthentication(t, ctx, kcpClusterClient, baseWsPath, mockA, ca)
69+
authConfigB := authfixtures.CreateWorkspaceOIDCAuthentication(t, ctx, kcpClusterClient, baseWsPath, mockB, ca)
7170

7271
// use these configs in new WorkspaceTypes and create one extra workspace type that allows
7372
// both mockoidc issuers
74-
wsTypeA := createWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, authConfigA)
75-
wsTypeB := createWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, authConfigB)
76-
wsTypeC := createWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, authConfigA, authConfigB)
73+
wsTypeA := authfixtures.CreateWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, "with-oidc-a", authConfigA)
74+
wsTypeB := authfixtures.CreateWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, "with-oidc-b", authConfigB)
75+
wsTypeC := authfixtures.CreateWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, "with-oidc-c", authConfigA, authConfigB)
7776

7877
// create a new workspace with our new type
7978
t.Log("Creating Workspaces...")
@@ -89,15 +88,15 @@ func TestWorkspaceOIDC(t *testing.T) {
8988
}
9089

9190
// grant permissions to random users and groups
92-
grantWorkspaceAccess(t, ctx, kubeClusterClient, teamAPath, []rbacv1.Subject{{
91+
authfixtures.GrantWorkspaceAccess(t, ctx, kubeClusterClient, teamAPath, "grant-oidc-user", "cluster-admin", []rbacv1.Subject{{
9392
Kind: "User",
9493
Name: "oidc:[email protected]",
9594
}, {
9695
Kind: "Group",
9796
Name: "oidc:developers",
9897
}})
9998

100-
grantWorkspaceAccess(t, ctx, kubeClusterClient, teamBPath, []rbacv1.Subject{{
99+
authfixtures.GrantWorkspaceAccess(t, ctx, kubeClusterClient, teamBPath, "grant-oidc-user", "cluster-admin", []rbacv1.Subject{{
101100
Kind: "User",
102101
Name: "oidc:[email protected]",
103102
}, {
@@ -108,7 +107,7 @@ func TestWorkspaceOIDC(t *testing.T) {
108107
Name: "oidc:developers",
109108
}})
110109

111-
grantWorkspaceAccess(t, ctx, kubeClusterClient, teamCPath, []rbacv1.Subject{{
110+
authfixtures.GrantWorkspaceAccess(t, ctx, kubeClusterClient, teamCPath, "grant-oidc-user", "cluster-admin", []rbacv1.Subject{{
112111
Kind: "User",
113112
Name: "oidc:[email protected]",
114113
}, {
@@ -225,7 +224,7 @@ func TestWorkspaceOIDC(t *testing.T) {
225224
t.Run(testcase.name, func(t *testing.T) {
226225
t.Parallel()
227226

228-
token := createOIDCToken(t, testcase.mock, testcase.username, testcase.email, testcase.groups)
227+
token := authfixtures.CreateOIDCToken(t, testcase.mock, testcase.username, testcase.email, testcase.groups)
229228

230229
client, err := kcpkubernetesclientset.NewForConfig(framework.ConfigWithToken(token, kcpConfig))
231230
require.NoError(t, err)
@@ -270,9 +269,9 @@ func TestUserScope(t *testing.T) {
270269
kcpClusterClient, err := kcpclientset.NewForConfig(kcpConfig)
271270
require.NoError(t, err)
272271

273-
mock, ca := startMockOIDC(t, server)
274-
authConfig := createWorkspaceAuthentication(t, ctx, kcpClusterClient, baseWsPath, mock, ca)
275-
wsType := createWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, authConfig)
272+
mock, ca := authfixtures.StartMockOIDC(t, server)
273+
authConfig := authfixtures.CreateWorkspaceOIDCAuthentication(t, ctx, kcpClusterClient, baseWsPath, mock, ca)
274+
wsType := authfixtures.CreateWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, "with-oidc", authConfig)
276275

277276
// create a new workspace with our new type
278277
t.Log("Creating Workspaces...")
@@ -289,12 +288,12 @@ func TestUserScope(t *testing.T) {
289288
expectedGroups = append(expectedGroups, "oidc:"+group)
290289
}
291290

292-
grantWorkspaceAccess(t, ctx, kubeClusterClient, teamPath, []rbacv1.Subject{{
291+
authfixtures.GrantWorkspaceAccess(t, ctx, kubeClusterClient, teamPath, "grant-oidc-user", "cluster-admin", []rbacv1.Subject{{
293292
Kind: "User",
294293
Name: "oidc:" + userEmail,
295294
}})
296295

297-
token := createOIDCToken(t, mock, userName, userEmail, userGroups)
296+
token := authfixtures.CreateOIDCToken(t, mock, userName, userEmail, userGroups)
298297

299298
peterClient, err := kcpkubernetesclientset.NewForConfig(framework.ConfigWithToken(token, kcpConfig))
300299
require.NoError(t, err)
@@ -336,7 +335,7 @@ func TestForbiddenSystemAccess(t *testing.T) {
336335
kcpClusterClient, err := kcpclientset.NewForConfig(kcpConfig)
337336
require.NoError(t, err)
338337

339-
mock, ca := startMockOIDC(t, server)
338+
mock, ca := authfixtures.StartMockOIDC(t, server)
340339

341340
// create an evil AuthConfig that would not prefix OIDC-provided groups, theoretically allowing
342341
// users to become part of system groups.
@@ -347,7 +346,7 @@ func TestForbiddenSystemAccess(t *testing.T) {
347346
},
348347
Spec: tenancyv1alpha1.WorkspaceAuthenticationConfigurationSpec{
349348
JWT: []tenancyv1alpha1.JWTAuthenticator{
350-
mockJWTAuthenticator(t, mock, ca, "", ""),
349+
authfixtures.MockJWTAuthenticator(t, mock, ca, "", ""),
351350
},
352351
},
353352
}
@@ -356,20 +355,20 @@ func TestForbiddenSystemAccess(t *testing.T) {
356355
_, err = kcpClusterClient.Cluster(baseWsPath).TenancyV1alpha1().WorkspaceAuthenticationConfigurations().Create(ctx, authConfig, metav1.CreateOptions{})
357356
require.NoError(t, err)
358357

359-
wsType := createWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, authConfig.Name)
358+
wsType := authfixtures.CreateWorkspaceType(t, ctx, kcpClusterClient, baseWsPath, "with-oidc", authConfig.Name)
360359

361360
// create a new workspace with our new type
362361
t.Log("Creating Workspaces...")
363362
teamPath, _ := kcptesting.NewWorkspaceFixture(t, server, baseWsPath, kcptesting.WithName("team-a"), kcptesting.WithType(baseWsPath, tenancyv1alpha1.WorkspaceTypeName(wsType)))
364363

365364
// give a dummy user access
366-
grantWorkspaceAccess(t, ctx, kubeClusterClient, teamPath, []rbacv1.Subject{{
365+
authfixtures.GrantWorkspaceAccess(t, ctx, kubeClusterClient, teamPath, "grant-oidc-user", "cluster-admin", []rbacv1.Subject{{
367366
Kind: "User",
368367
Name: "[email protected]",
369368
}})
370369

371370
// wait until the authenticator is ready
372-
token := createOIDCToken(t, mock, "dummy", "[email protected]", nil)
371+
token := authfixtures.CreateOIDCToken(t, mock, "dummy", "[email protected]", nil)
373372

374373
client, err := kcpkubernetesclientset.NewForConfig(framework.ConfigWithToken(token, kcpConfig))
375374
require.NoError(t, err)
@@ -409,7 +408,7 @@ func TestForbiddenSystemAccess(t *testing.T) {
409408
t.Run(testcase.name, func(t *testing.T) {
410409
t.Parallel()
411410

412-
token := createOIDCToken(t, mock, testcase.username, testcase.email, testcase.groups)
411+
token := authfixtures.CreateOIDCToken(t, mock, testcase.username, testcase.email, testcase.groups)
413412

414413
client, err := kcpkubernetesclientset.NewForConfig(framework.ConfigWithToken(token, kcpConfig))
415414
require.NoError(t, err)
@@ -548,69 +547,3 @@ func TestAcceptableWorkspaceAuthenticationConfigurations(t *testing.T) {
548547
})
549548
}
550549
}
551-
552-
func createWorkspaceAuthentication(t *testing.T, ctx context.Context, client kcpclientset.ClusterInterface, workspace logicalcluster.Path, mock *mockoidc.MockOIDC, ca *crypto.CA) string {
553-
name := fmt.Sprintf("mockoidc-%d", rand.Int())
554-
555-
// setup a new workspace auth config that uses mockoidc's server
556-
authConfig := &tenancyv1alpha1.WorkspaceAuthenticationConfiguration{
557-
ObjectMeta: metav1.ObjectMeta{
558-
Name: name,
559-
},
560-
Spec: tenancyv1alpha1.WorkspaceAuthenticationConfigurationSpec{
561-
JWT: []tenancyv1alpha1.JWTAuthenticator{
562-
mockJWTAuthenticator(t, mock, ca, "oidc:", "oidc:"),
563-
},
564-
},
565-
}
566-
567-
t.Logf("Creating WorkspaceAuthenticationConfguration %s...", name)
568-
_, err := client.Cluster(workspace).TenancyV1alpha1().WorkspaceAuthenticationConfigurations().Create(ctx, authConfig, metav1.CreateOptions{})
569-
require.NoError(t, err)
570-
571-
return name
572-
}
573-
574-
func createWorkspaceType(t *testing.T, ctx context.Context, client kcpclientset.ClusterInterface, workspace logicalcluster.Path, authConfigNames ...string) string {
575-
name := fmt.Sprintf("with-oidc-%d", rand.Int())
576-
577-
configs := []tenancyv1alpha1.AuthenticationConfigurationReference{}
578-
for _, name := range authConfigNames {
579-
configs = append(configs, tenancyv1alpha1.AuthenticationConfigurationReference{
580-
Name: name,
581-
})
582-
}
583-
584-
// setup a new workspace auth config that uses mockoidc's server
585-
wsType := &tenancyv1alpha1.WorkspaceType{
586-
ObjectMeta: metav1.ObjectMeta{
587-
Name: name,
588-
},
589-
Spec: tenancyv1alpha1.WorkspaceTypeSpec{
590-
AuthenticationConfigurations: configs,
591-
},
592-
}
593-
594-
t.Logf("Creating WorkspaceType %s...", name)
595-
_, err := client.Cluster(workspace).TenancyV1alpha1().WorkspaceTypes().Create(ctx, wsType, metav1.CreateOptions{})
596-
require.NoError(t, err)
597-
598-
return name
599-
}
600-
601-
func grantWorkspaceAccess(t *testing.T, ctx context.Context, client kcpkubernetesclientset.ClusterInterface, workspace logicalcluster.Path, subjects []rbacv1.Subject) {
602-
crb := &rbacv1.ClusterRoleBinding{
603-
ObjectMeta: metav1.ObjectMeta{
604-
Name: "allow-oidc-user",
605-
},
606-
RoleRef: rbacv1.RoleRef{
607-
Kind: "ClusterRole",
608-
Name: "cluster-admin",
609-
},
610-
Subjects: subjects,
611-
}
612-
613-
t.Log("Creating ClusterRoleBinding...")
614-
_, err := client.Cluster(workspace).RbacV1().ClusterRoleBindings().Create(ctx, crb, metav1.CreateOptions{})
615-
require.NoError(t, err)
616-
}

‎test/e2e/fixtures/authfixtures/authfixtures.go‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
/*
2+
Copyright 2025 The KCP Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package authfixtures
18+
19+
import (
20+
"context"
21+
"testing"
22+
23+
"github.com/stretchr/testify/require"
24+
25+
rbacv1 "k8s.io/api/rbac/v1"
26+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
27+
28+
kcpkubernetesclientset "github.com/kcp-dev/client-go/kubernetes"
29+
"github.com/kcp-dev/logicalcluster/v3"
30+
31+
tenancyv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/tenancy/v1alpha1"
32+
kcpclientset "github.com/kcp-dev/kcp/sdk/client/clientset/versioned/cluster"
33+
)
34+
35+
func CreateWorkspaceType(t *testing.T, ctx context.Context, client kcpclientset.ClusterInterface, workspace logicalcluster.Path, name string, authConfigNames ...string) string {
36+
configs := []tenancyv1alpha1.AuthenticationConfigurationReference{}
37+
for _, name := range authConfigNames {
38+
configs = append(configs, tenancyv1alpha1.AuthenticationConfigurationReference{
39+
Name: name,
40+
})
41+
}
42+
43+
// setup a new workspace auth config that uses mockoidc's server
44+
wsType := &tenancyv1alpha1.WorkspaceType{
45+
ObjectMeta: metav1.ObjectMeta{
46+
Name: name,
47+
},
48+
Spec: tenancyv1alpha1.WorkspaceTypeSpec{
49+
AuthenticationConfigurations: configs,
50+
},
51+
}
52+
53+
t.Logf("Creating WorkspaceType %s...", name)
54+
_, err := client.Cluster(workspace).TenancyV1alpha1().WorkspaceTypes().Create(ctx, wsType, metav1.CreateOptions{})
55+
require.NoError(t, err)
56+
57+
return name
58+
}
59+
60+
func GrantWorkspaceAccess(t *testing.T, ctx context.Context, client kcpkubernetesclientset.ClusterInterface, workspace logicalcluster.Path, name, clusterRole string, subjects []rbacv1.Subject) {
61+
crb := &rbacv1.ClusterRoleBinding{
62+
ObjectMeta: metav1.ObjectMeta{
63+
Name: name,
64+
},
65+
RoleRef: rbacv1.RoleRef{
66+
Kind: "ClusterRole",
67+
Name: clusterRole,
68+
},
69+
Subjects: subjects,
70+
}
71+
72+
t.Log("Creating ClusterRoleBinding...")
73+
_, err := client.Cluster(workspace).RbacV1().ClusterRoleBindings().Create(ctx, crb, metav1.CreateOptions{})
74+
require.NoError(t, err)
75+
}

‎test/e2e/authentication/mockoidc.go‎ renamed to ‎test/e2e/fixtures/authfixtures/mockoidc.go‎

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,14 @@ See the License for the specific language governing permissions and
1414
limitations under the License.
1515
*/
1616

17-
package authentication
17+
package authfixtures
1818

1919
import (
20+
"context"
2021
"crypto/tls"
2122
"crypto/x509"
23+
"fmt"
24+
"math/rand"
2225
"net"
2326
"path/filepath"
2427
"sync"
@@ -28,15 +31,19 @@ import (
2831
"github.com/stretchr/testify/require"
2932
"github.com/xrstf/mockoidc"
3033

34+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3135
"k8s.io/apimachinery/pkg/util/sets"
3236
"k8s.io/utils/ptr"
3337

38+
"github.com/kcp-dev/logicalcluster/v3"
39+
3440
tenancyv1alpha1 "github.com/kcp-dev/kcp/sdk/apis/tenancy/v1alpha1"
41+
kcpclientset "github.com/kcp-dev/kcp/sdk/client/clientset/versioned/cluster"
3542
kcptestingserver "github.com/kcp-dev/kcp/sdk/testing/server"
3643
"github.com/kcp-dev/kcp/sdk/testing/third_party/library-go/crypto"
3744
)
3845

39-
func startMockOIDC(t *testing.T, server kcptestingserver.RunningServer) (*mockoidc.MockOIDC, *crypto.CA) {
46+
func StartMockOIDC(t *testing.T, server kcptestingserver.RunningServer) (*mockoidc.MockOIDC, *crypto.CA) {
4047
// start a mock OIDC server that will listen on a random port
4148
// (only for discovery and keyset handling, no actual login workflows)
4249
caDir := server.CADirectory()
@@ -86,7 +93,7 @@ func startMockOIDC(t *testing.T, server kcptestingserver.RunningServer) (*mockoi
8693
return m, ca
8794
}
8895

89-
func mockJWTAuthenticator(t *testing.T, m *mockoidc.MockOIDC, ca *crypto.CA, userPrefix, groupPrefix string) tenancyv1alpha1.JWTAuthenticator {
96+
func MockJWTAuthenticator(t *testing.T, m *mockoidc.MockOIDC, ca *crypto.CA, userPrefix, groupPrefix string) tenancyv1alpha1.JWTAuthenticator {
9097
cfg := m.Config()
9198

9299
caCert, _, err := ca.Config.GetPEMBytes()
@@ -113,7 +120,7 @@ func mockJWTAuthenticator(t *testing.T, m *mockoidc.MockOIDC, ca *crypto.CA, use
113120

114121
var tokenLock sync.Mutex
115122

116-
func createOIDCToken(t *testing.T, mock *mockoidc.MockOIDC, subject, email string, groups []string) string {
123+
func CreateOIDCToken(t *testing.T, mock *mockoidc.MockOIDC, subject, email string, groups []string) string {
117124
var (
118125
cfg = mock.Config()
119126
now = mockoidc.NowFunc()
@@ -159,3 +166,25 @@ func createOIDCToken(t *testing.T, mock *mockoidc.MockOIDC, subject, email strin
159166

160167
return token
161168
}
169+
170+
func CreateWorkspaceOIDCAuthentication(t *testing.T, ctx context.Context, client kcpclientset.ClusterInterface, workspace logicalcluster.Path, mock *mockoidc.MockOIDC, ca *crypto.CA) string {
171+
name := fmt.Sprintf("mockoidc-%d", rand.Int())
172+
173+
// setup a new workspace auth config that uses mockoidc's server
174+
authConfig := &tenancyv1alpha1.WorkspaceAuthenticationConfiguration{
175+
ObjectMeta: metav1.ObjectMeta{
176+
Name: name,
177+
},
178+
Spec: tenancyv1alpha1.WorkspaceAuthenticationConfigurationSpec{
179+
JWT: []tenancyv1alpha1.JWTAuthenticator{
180+
MockJWTAuthenticator(t, mock, ca, "oidc:", "oidc:"),
181+
},
182+
},
183+
}
184+
185+
t.Logf("Creating WorkspaceAuthenticationConfguration %s...", name)
186+
_, err := client.Cluster(workspace).TenancyV1alpha1().WorkspaceAuthenticationConfigurations().Create(ctx, authConfig, metav1.CreateOptions{})
187+
require.NoError(t, err)
188+
189+
return name
190+
}

0 commit comments

Comments
 (0)