Skip to content

Commit 5711d2f

Browse files
joshfrenchjoshfrench
committed
Add e2e tests for access config bootstrap cluster admin permissions
1 parent b57f094 commit 5711d2f

File tree

4 files changed

+111
-1
lines changed

4 files changed

+111
-1
lines changed

‎test/e2e/data/e2e_eks_conf.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ providers:
118118
targetName: "cluster-template-eks-control-plane-bare-eks.yaml"
119119
- sourcePath: "./eks/cluster-template-eks-auth-api-and-config-map.yaml"
120120
targetName: "cluster-template-eks-auth-api-and-config-map.yaml"
121+
- sourcePath: "./eks/cluster-template-eks-auth-bootstrap-disabled.yaml"
122+
targetName: "cluster-template-eks-auth-bootstrap-disabled.yaml"
121123
- sourcePath: "./infrastructure-aws/withclusterclass/kustomize_sources/eks-clusterclass/clusterclass-eks-e2e.yaml"
122124
- sourcePath: "./infrastructure-aws/withclusterclass/generated/cluster-template-eks-clusterclass.yaml"
123125

‎test/e2e/data/eks/cluster-template-eks-auth-bootstrap-disabled.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
apiVersion: cluster.x-k8s.io/v1beta1
3+
kind: Cluster
4+
metadata:
5+
name: "${CLUSTER_NAME}"
6+
spec:
7+
clusterNetwork:
8+
pods:
9+
cidrBlocks: ["192.168.0.0/16"]
10+
infrastructureRef:
11+
kind: AWSManagedCluster
12+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
13+
name: "${CLUSTER_NAME}"
14+
controlPlaneRef:
15+
kind: AWSManagedControlPlane
16+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
17+
name: "${CLUSTER_NAME}-control-plane"
18+
---
19+
kind: AWSManagedCluster
20+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
21+
metadata:
22+
name: "${CLUSTER_NAME}"
23+
spec: {}
24+
---
25+
kind: AWSManagedControlPlane
26+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
27+
metadata:
28+
name: "${CLUSTER_NAME}-control-plane"
29+
spec:
30+
region: "${AWS_REGION}"
31+
sshKeyName: "${AWS_SSH_KEY_NAME}"
32+
version: "${KUBERNETES_VERSION}"
33+
accessConfig:
34+
bootstrapClusterCreatorAdminPermissions: false
35+
identityRef:
36+
kind: AWSClusterStaticIdentity
37+
name: e2e-account

‎test/e2e/suites/managed/eks_auth_test.go‎

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ var _ = ginkgo.Describe("[managed] [auth] EKS authentication mode tests", func()
7777
ginkgo.By("verifying cluster has the correct authentication mode")
7878
verifyClusterAuthenticationMode(ctx, eksClusterName, ekstypes.AuthenticationModeApiAndConfigMap, e2eCtx.BootstrapUserAWSSessionV2)
7979

80+
ginkgo.By("verifying cluster has default bootstrap permissions")
81+
verifyClusterBootstrapPermissions(ctx, eksClusterName, true, e2eCtx.BootstrapUserAWSSessionV2)
82+
8083
ginkgo.By("attempting to downgrade from api_and_config_map to config_map should fail")
8184
controlPlaneName := fmt.Sprintf("%s-control-plane", clusterName)
8285
controlPlane := &ekscontrolplanev1.AWSManagedControlPlane{}
@@ -130,5 +133,56 @@ var _ = ginkgo.Describe("[managed] [auth] EKS authentication mode tests", func()
130133
ArtifactFolder: e2eCtx.Settings.ArtifactFolder,
131134
}, e2eCtx.E2EConfig.GetIntervals("", "wait-delete-cluster")...)
132135
})
133-
})
134136

137+
shared.ConditionalIt(runGeneralTests, "should create a cluster with bootstrapClusterCreatorAdminPermissions disabled", func() {
138+
ginkgo.By("should have a valid test configuration")
139+
Expect(e2eCtx.Environment.BootstrapClusterProxy).ToNot(BeNil(), "Invalid argument. BootstrapClusterProxy can't be nil")
140+
Expect(e2eCtx.E2EConfig).ToNot(BeNil(), "Invalid argument. e2eConfig can't be nil when calling bootstrap spec")
141+
Expect(e2eCtx.E2EConfig.Variables).To(HaveKey(shared.KubernetesVersion))
142+
143+
ctx = context.TODO()
144+
namespace = shared.SetupSpecNamespace(ctx, "bootstrap", e2eCtx)
145+
clusterName = fmt.Sprintf("bootstrap-%s", util.RandomString(6))
146+
eksClusterName := getEKSClusterName(namespace.Name, clusterName)
147+
148+
ginkgo.By("should create an EKS control plane with bootstrapClusterCreatorAdminPermissions disabled")
149+
ManagedClusterSpec(ctx, func() ManagedClusterSpecInput {
150+
return ManagedClusterSpecInput{
151+
E2EConfig: e2eCtx.E2EConfig,
152+
ConfigClusterFn: defaultConfigCluster,
153+
BootstrapClusterProxy: e2eCtx.Environment.BootstrapClusterProxy,
154+
AWSSession: e2eCtx.BootstrapUserAWSSession,
155+
AWSSessionV2: e2eCtx.BootstrapUserAWSSessionV2,
156+
Namespace: namespace,
157+
ClusterName: clusterName,
158+
Flavour: EKSAuthBootstrapDisabledFlavor,
159+
ControlPlaneMachineCount: 1,
160+
WorkerMachineCount: 0,
161+
}
162+
})
163+
164+
ginkgo.By("EKS cluster should be active")
165+
verifyClusterActiveAndOwned(ctx, eksClusterName, e2eCtx.BootstrapUserAWSSessionV2)
166+
167+
ginkgo.By("verifying cluster has bootstrap permissions disabled")
168+
verifyClusterBootstrapPermissions(ctx, eksClusterName, false, e2eCtx.BootstrapUserAWSSessionV2)
169+
170+
cluster := framework.GetClusterByName(ctx, framework.GetClusterByNameInput{
171+
Getter: e2eCtx.Environment.BootstrapClusterProxy.GetClient(),
172+
Namespace: namespace.Name,
173+
Name: clusterName,
174+
})
175+
Expect(cluster).NotTo(BeNil(), "couldn't find CAPI cluster")
176+
177+
framework.DeleteCluster(ctx, framework.DeleteClusterInput{
178+
Deleter: e2eCtx.Environment.BootstrapClusterProxy.GetClient(),
179+
Cluster: cluster,
180+
})
181+
framework.WaitForClusterDeleted(ctx, framework.WaitForClusterDeletedInput{
182+
ClusterProxy: e2eCtx.Environment.BootstrapClusterProxy,
183+
Cluster: cluster,
184+
ClusterctlConfigPath: e2eCtx.Environment.ClusterctlConfigPath,
185+
ArtifactFolder: e2eCtx.Settings.ArtifactFolder,
186+
}, e2eCtx.E2EConfig.GetIntervals("", "wait-delete-cluster")...)
187+
})
188+
})

‎test/e2e/suites/managed/helpers.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ const (
5151
EKSControlPlaneOnlyLegacyFlavor = "eks-control-plane-only-legacy"
5252
EKSClusterClassFlavor = "eks-clusterclass"
5353
EKSAuthAPIAndConfigMapFlavor = "eks-auth-api-and-config-map"
54+
EKSAuthBootstrapDisabledFlavor = "eks-auth-bootstrap-disabled"
5455
)
5556

5657
const (
@@ -122,6 +123,22 @@ func verifyClusterAuthenticationMode(ctx context.Context, eksClusterName string,
122123
fmt.Sprintf("expecting authentication mode to be %s, got %s", expectedAuthMode, cluster.AccessConfig.AuthenticationMode))
123124
}
124125

126+
func verifyClusterBootstrapPermissions(ctx context.Context, eksClusterName string, expectedBootstrapPermissions bool, sess *aws.Config) {
127+
var (
128+
cluster *ekstypes.Cluster
129+
err error
130+
)
131+
Eventually(func() error {
132+
cluster, err = getEKSCluster(ctx, eksClusterName, sess)
133+
return err
134+
}, clientRequestTimeout, clientRequestCheckInterval).Should(Succeed(), fmt.Sprintf("eventually failed trying to get EKS Cluster %q", eksClusterName))
135+
136+
Expect(cluster.AccessConfig).ToNot(BeNil(), "expecting AccessConfig to be set on the cluster")
137+
Expect(cluster.AccessConfig.BootstrapClusterCreatorAdminPermissions).ToNot(BeNil(), "expecting BootstrapClusterCreatorAdminPermissions to be set")
138+
Expect(*cluster.AccessConfig.BootstrapClusterCreatorAdminPermissions).To(Equal(expectedBootstrapPermissions),
139+
fmt.Sprintf("expecting bootstrap cluster creator admin permissions to be %t, got %t", expectedBootstrapPermissions, *cluster.AccessConfig.BootstrapClusterCreatorAdminPermissions))
140+
}
141+
125142
func getEKSClusterAddon(ctx context.Context, eksClusterName, addonName string, sess *aws.Config) (*ekstypes.Addon, error) {
126143
eksClient := eks.NewFromConfig(*sess)
127144

0 commit comments

Comments
 (0)