chainsaw-test.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: firewall-integration
  # Label to trigger the test on every PR
  labels:
    all:
    quick:
    linodecluster:
spec:
  bindings:
    # A short identifier for the E2E test run
    - name: run
      value: (join('-', ['e2e', 'firewall-integration', random('[0-9a-z]{8}')]))
    - name: firewall
      # Format the firewall name into a valid Kubernetes object name
      value: (trim((truncate(($run), `63`)), '-'))
    - name: cluster
      # Format the cluster name
      value: (trim((truncate(($run), `29`)), '-'))
    - name: nodebalancer
      value: ($cluster)
  template: true
  steps:
    - name: Check if CAPI provider resources exist
      try:
        - assert:
            file: assert-capi-resources.yaml
    - name: Create LinodeFirewall
      try:
        - apply:
            file: create-firewall.yaml
        - assert:
            file: assert-firewall.yaml
      catch:
        - describe:
            apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
            kind: LinodeFirewall
    - name: Check if the Firewall was created
      try:
        - script:
            env:
              - name: FILTER
                value: (to_string({"label":($firewall)}))
            content: |
              set -e
              curl -s \
                -H "Authorization: Bearer $LINODE_TOKEN" \
                -H "X-Filter: $FILTER" \
                -H "Content-Type: application/json" \
                "https://api.linode.com/v4/networking/firewalls"
            check:
              ($error): ~
              (json_parse($stdout)):
                results: 1
    - name: Create Cluster resource
      try:
        - apply:
            file: create-cluster.yaml
      catch:
        - describe:
            apiVersion: cluster.x-k8s.io/v1beta1
            kind: Cluster
    - name: Create LinodeCluster resource
      try:
        - apply:
            file: create-linodecluster.yaml
        - assert:
            file: assert-linodecluster.yaml
      catch:
        - describe:
            apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
            kind: LinodeCluster
    - name: Check if the nodebalancer exists and it has the firewall
      try:
        - script:
            env:
              - name: TARGET_API
                value: api.linode.com
              - name: TARGET_API_VERSION
                value: v4beta
              - name: URI
                value: nodebalancers
              - name: FILTER
                value: (to_string({"label":($nodebalancer)}))
              - name: FIREWALL_LABEL
                value: (to_string({"label":($firewall)}))
            content: |
              set -e
              
              # Check if nodebalancer exists and get its ID
              NB_RESPONSE=$(curl -s \
                -H "Authorization: Bearer $LINODE_TOKEN" \
                -H "X-Filter: $FILTER" \
                -H "Content-Type: application/json" \
                "https://$TARGET_API/$TARGET_API_VERSION/$URI")
              
              NB_COUNT=$(echo $NB_RESPONSE | jq '.results | length')
              if [ "$NB_COUNT" -ne 1 ]; then
                echo "Nodebalancer not found or multiple found"
                exit 1
              fi
              
              NB_ID=$(echo $NB_RESPONSE | jq -r '.data[0].id')
              
              # Check if firewall is configured for the nodebalancer
              FW_RESPONSE=$(curl -s \
                -H "Authorization: Bearer $LINODE_TOKEN" \
                -H "X-Filter: $FIREWALL_LABEL" \
                -H "Content-Type: application/json" \
                "https://$TARGET_API/$TARGET_API_VERSION/$URI/$NB_ID/firewalls")
              
              FW_COUNT=$(echo $FW_RESPONSE | jq '.results')
              if [ "$FW_COUNT" -eq 0 ]; then
                echo "No firewall found for the nodebalancer"
                exit 1
              fi
              
              echo "Nodebalancer exists and has the correct firewall configuration"
              exit 0
            check:
              ($error): ~
              ($stdout): "Nodebalancer exists and has the correct firewall configuration\n"
    - name: Delete Firewall, Cluster, and LinodeCluster
      try:
        - delete:
            ref:
              apiVersion: infrastructure.cluster.x-k8s.io/v1alpha2
              kind: LinodeFirewall
              name: ($firewall)
        - delete:
            ref:
              apiVersion: cluster.x-k8s.io/v1beta1
              kind: Cluster
              name: ($cluster)
        - error:
            file: check-resource-deleted.yaml
    - name: Check if the Firewall was deleted
      try:
        - script:
            env:
              - name: FILTER
                value: (to_string({"label":($firewall)}))
            content: |
              set -e
              curl -s \
                -H "Authorization: Bearer $LINODE_TOKEN" \
                -H "X-Filter: $FILTER" \
                -H "Content-Type: application/json" \
                "https://api.linode.com/v4/networking/firewalls"
            check:
              ($error): ~
              (json_parse($stdout)):
                results: 0
    - name: Check if the nodebalancer is deleted
      try:
        - script:
            env:
              - name: TARGET_API
                value: api.linode.com
              - name: TARGET_API_VERSION
                value: v4beta
              - name: URI
                value: nodebalancers
              - name: FILTER
                value: (to_string({"label":($nodebalancer)}))
            content: |
              set -e
              curl -s \
                -H "Authorization: Bearer $LINODE_TOKEN" \
                -H "X-Filter: $FILTER" \
                -H "Content-Type: application/json" \
                "https://$TARGET_API/$TARGET_API_VERSION/$URI"
            check:
              ($error): ~
              (json_parse($stdout)):
                results: 0