@@ -17,6 +17,7 @@ limitations under the License.
1717package config
1818
1919import (
20+ "crypto/tls"
2021 "errors"
2122 "io/fs"
2223 "net"
@@ -37,6 +38,7 @@ import (
3738 "sigs.k8s.io/controller-runtime/pkg/webhook"
3839
3940 configapi "sigs.k8s.io/jobset/api/config/v1alpha1"
41+ "sigs.k8s.io/jobset/pkg/features"
4042)
4143
4244func TestLoad (t * testing.T ) {
@@ -596,3 +598,144 @@ func TestEncode(t *testing.T) {
596598 })
597599 }
598600}
601+
602+ func TestTLSConfiguration (t * testing.T ) {
603+ testScheme := runtime .NewScheme ()
604+ err := configapi .AddToScheme (testScheme )
605+ if err != nil {
606+ t .Fatal (err )
607+ }
608+
609+ tmpDir := t .TempDir ()
610+
611+ // Config with TLS settings
612+ tlsConfig := filepath .Join (tmpDir , "tls-config.yaml" )
613+ if err := os .WriteFile (tlsConfig , []byte (`
614+ apiVersion: config.jobset.x-k8s.io/v1alpha1
615+ kind: Configuration
616+ health:
617+ healthProbeBindAddress: :8081
618+ metrics:
619+ bindAddress: :8443
620+ leaderElection:
621+ leaderElect: true
622+ resourceName: 6d4f6a47.jobset.x-k8s.io
623+ webhook:
624+ port: 9443
625+ tls:
626+ minVersion: VersionTLS12
627+ cipherSuites:
628+ - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
629+ - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
630+ ` ), os .FileMode (0600 )); err != nil {
631+ t .Fatal (err )
632+ }
633+
634+ // Config with TLS 1.3 (no cipher suites)
635+ tls13Config := filepath .Join (tmpDir , "tls13-config.yaml" )
636+ if err := os .WriteFile (tls13Config , []byte (`
637+ apiVersion: config.jobset.x-k8s.io/v1alpha1
638+ kind: Configuration
639+ health:
640+ healthProbeBindAddress: :8081
641+ metrics:
642+ bindAddress: :8443
643+ leaderElection:
644+ leaderElect: true
645+ resourceName: 6d4f6a47.jobset.x-k8s.io
646+ webhook:
647+ port: 9443
648+ tls:
649+ minVersion: VersionTLS13
650+ ` ), os .FileMode (0600 )); err != nil {
651+ t .Fatal (err )
652+ }
653+
654+ testcases := []struct {
655+ name string
656+ configFile string
657+ featureGateEnabled bool
658+ wantTLSOptsApplied bool
659+ wantMinVersion uint16
660+ wantCipherSuiteSet bool
661+ }{
662+ {
663+ name : "TLS config with feature gate enabled" ,
664+ configFile : tlsConfig ,
665+ featureGateEnabled : true ,
666+ wantTLSOptsApplied : true ,
667+ wantMinVersion : tls .VersionTLS12 ,
668+ wantCipherSuiteSet : true ,
669+ },
670+ {
671+ name : "TLS config with feature gate disabled" ,
672+ configFile : tlsConfig ,
673+ featureGateEnabled : false ,
674+ wantTLSOptsApplied : false ,
675+ },
676+ {
677+ name : "TLS 1.3 config with feature gate enabled" ,
678+ configFile : tls13Config ,
679+ featureGateEnabled : true ,
680+ wantTLSOptsApplied : true ,
681+ wantMinVersion : tls .VersionTLS13 ,
682+ wantCipherSuiteSet : false ,
683+ },
684+ }
685+
686+ for _ , tc := range testcases {
687+ t .Run (tc .name , func (t * testing.T ) {
688+ features .SetFeatureGateDuringTest (t , features .TLSOptions , tc .featureGateEnabled )
689+
690+ options , cfg , err := Load (testScheme , tc .configFile )
691+ if err != nil {
692+ t .Fatalf ("Unexpected error: %s" , err )
693+ }
694+
695+ // Verify TLS config is in the parsed configuration
696+ if cfg .TLS == nil {
697+ t .Errorf ("Expected TLS configuration to be present in config" )
698+ return
699+ }
700+
701+ // Check webhook server TLS options
702+ webhookServer := options .WebhookServer
703+ if webhookServer == nil {
704+ t .Errorf ("Expected webhook server to be set" )
705+ return
706+ }
707+
708+ defaultServer , ok := webhookServer .(* webhook.DefaultServer )
709+ if ! ok {
710+ t .Errorf ("Expected webhook server to be DefaultServer type" )
711+ return
712+ }
713+
714+ // Verify TLSOpts is set correctly based on feature gate
715+ if tc .wantTLSOptsApplied {
716+ if len (defaultServer .Options .TLSOpts ) == 0 {
717+ t .Errorf ("Expected TLSOpts to be set when feature gate is enabled" )
718+ } else {
719+ // Verify the TLS options are correctly applied by invoking them
720+ tlsConfig := & tls.Config {}
721+ for _ , opt := range defaultServer .Options .TLSOpts {
722+ opt (tlsConfig )
723+ }
724+ if tlsConfig .MinVersion != tc .wantMinVersion {
725+ t .Errorf ("MinVersion = %v, want %v" , tlsConfig .MinVersion , tc .wantMinVersion )
726+ }
727+ if tc .wantCipherSuiteSet && len (tlsConfig .CipherSuites ) == 0 {
728+ t .Errorf ("Expected cipher suites to be set" )
729+ }
730+ if ! tc .wantCipherSuiteSet && len (tlsConfig .CipherSuites ) != 0 {
731+ t .Errorf ("Expected cipher suites to not be set for TLS 1.3" )
732+ }
733+ }
734+ } else {
735+ if len (defaultServer .Options .TLSOpts ) != 0 {
736+ t .Errorf ("Expected TLSOpts to be empty when feature gate is disabled, got %d options" , len (defaultServer .Options .TLSOpts ))
737+ }
738+ }
739+ })
740+ }
741+ }
0 commit comments