Add dryrun CLI e2e tests

ref: https://issues.redhat.com/browse/ACM-22932

Tests the dryrun CLI can read resources from a cluster with
--from-cluster flag.
Reuses the dryrun unit test cases, applies the resources to the test
kind cluster, then runs the e2e tests.

Sometimes the policy diff from the cluster returns extra context lines
surrounding the relevant +/- changes. When this diff does not match the
expected output.txt from the unit tests, the e2e test will compare the output
with the output_from_cluster.txt file.

Signed-off-by: Janelle Law <[email protected]>

Author: jan-law

test/dryrun/context_vars/object_cluster_scoped/output_from_cluster.txt

@@ -0,0 +1,15 @@
+# Diffs:
+v1 Namespace mega-mart:
+--- mega-mart : existing
++++ mega-mart : updated
+@@ -5,10 +5,12 @@
+     city: durham
+   labels:
+     box: big
++    name: mega-mart
++    new-label: durham
+   name: mega-mart
+ spec:
+   finalizers:
+# Compliance messages:
+NonCompliant; violation - namespaces [mega-mart] found but not as specified

test/dryrun/context_vars/object_namespaced/output_from_cluster.txt

@@ -0,0 +1,16 @@
+# Diffs:
+v1 ConfigMap mega-mart/inventory:
+--- mega-mart/inventory : existing
++++ mega-mart/inventory : updated
+@@ -2,10 +2,12 @@
+ data:
+   inventory.yaml: 'appliance: toaster'
+ kind: ConfigMap
+ metadata:
++  labels:
++    new-label: toaster
+   name: inventory
+   namespace: mega-mart
+ 
+# Compliance messages:
+NonCompliant; violation - configmaps [inventory] found but not as specified in namespace mega-mart

test/dryrun/context_vars/object_namespaced/policy.yaml

@@ -19,4 +19,4 @@ spec:
           name: '{{ .ObjectName }}'
           namespace: '{{ .ObjectNamespace }}'
           labels:
-            new-label: '{{ (fromYAML (index .Object.data "inventory.yaml")).appliance }}'
+            new-label: '{{ ne (printf "%s" .ObjectName) "inventory" | skipObject }}{{ (fromYAML (index .Object.data "inventory.yaml")).appliance }}'

test/dryrun/context_vars/object_pod/output_from_cluster.txt

@@ -0,0 +1,15 @@
+# Diffs:
+v1 Pod default/nginx-pod:
+--- default/nginx-pod : existing
++++ default/nginx-pod : updated
+@@ -1,9 +1,11 @@
+ apiVersion: v1
+ kind: Pod
+ metadata:
++  labels:
++    image: nginx:1.7.9
+   name: nginx-pod
+   namespace: default
+ spec:
+# Compliance messages:
+NonCompliant; violation - pods [nginx-pod] found but not as specified in namespace default

test/dryrun/context_vars/object_pod_default_func/output_from_cluster.txt

@@ -0,0 +1,17 @@
+# Diffs:
+v1 Pod dangler/nginx-pod:
+
+v1 Pod default/nginx-pod:
+--- default/nginx-pod : existing
++++ default/nginx-pod : updated
+@@ -1,9 +1,11 @@
+ apiVersion: v1
+ kind: Pod
+ metadata:
++  labels:
++    image: nginx:1.7.9
+   name: nginx-pod
+   namespace: default
+ spec:
+# Compliance messages:
+NonCompliant; violation - pods [nginx-pod] not found in namespace dangler; pods [nginx-pod] found but not as specified in namespace default

test/dryrun/context_vars/objectname_nsselector/output_from_cluster.txt

@@ -0,0 +1,36 @@
+# Diffs:
+v1 ConfigMap mega-mart/inventory:
+--- mega-mart/inventory : existing
++++ mega-mart/inventory : updated
+@@ -1,6 +1,8 @@
+ apiVersion: v1
++data:
++  hocus: pocus
+ kind: ConfigMap
+ metadata:
+   name: inventory
+   namespace: mega-mart
+v1 ConfigMap mega-mart-2/inventory:
+--- mega-mart-2/inventory : existing
++++ mega-mart-2/inventory : updated
+@@ -1,7 +1,8 @@
+ apiVersion: v1
+ data:
++  hocus: pocus
+   things: original-stuff
+ kind: ConfigMap
+ metadata:
+   name: inventory
+v1 ConfigMap mega-mart-2/inventory-2:
+--- mega-mart-2/inventory-2 : existing
++++ mega-mart-2/inventory-2 : updated
+@@ -1,7 +1,8 @@
+ apiVersion: v1
+ data:
++  hocus: pocus
+   things: stuff
+ kind: ConfigMap
+ metadata:
+   name: inventory-2
+# Compliance messages:
+NonCompliant; violation - configmaps [inventory-2] found but not as specified in namespace mega-mart-2; configmaps [inventory] found but not as specified in namespaces: mega-mart, mega-mart-2

test/dryrun/context_vars/objectname_nsselector/policy.yaml

@@ -15,4 +15,4 @@ spec:
         kind: ConfigMap
         metadata:
           name: '{{ not (hasPrefix "inv" .ObjectName) | skipObject }}'
-        data: '{{ set .Object.data "hocus" "pocus" | toJSON | toLiteral }}'
+        data: '{{ set (.Object.data | default (dict)) "hocus" "pocus" | toJSON | toLiteral }}'

test/dryrun/diff/truncated/desired_status_from_cluster.yaml

@@ -0,0 +1,62 @@
+compliant: NonCompliant
+relatedObjects:
+- compliant: NonCompliant
+  object:
+    apiVersion: v1
+    kind: Namespace
+  properties:
+    diff: |-
+      # Truncated: showing 50/68 diff lines:
+      --- default : existing
+      +++ default : updated
+      @@ -1,8 +1,64 @@
+       apiVersion: v1
+       kind: Namespace
+       metadata:
+      +  annotations:
+      +    message1: message
+      +    message2: message
+      +    message3: message
+      +    message4: message
+      +    message5: message
+      +    message6: message
+      +    message7: message
+      +    message8: message
+      +    message9: message
+      +    message10: message
+      +    message11: message
+      +    message12: message
+      +    message13: message
+      +    message14: message
+      +    message15: message
+      +    message16: message
+      +    message17: message
+      +    message18: message
+      +    message19: message
+      +    message20: message
+      +    message21: message
+      +    message22: message
+      +    message23: message
+      +    message24: message
+      +    message25: message
+      +    message26: message
+      +    message27: message
+      +    message28: message
+      +    message29: message
+      +    message30: message
+      +    message31: message
+      +    message32: message
+      +    message33: message
+      +    message34: message
+      +    message35: message
+      +    message36: message
+      +    message37: message
+      +    message38: message
+      +    message39: message
+      +    message40: message
+      +    message41: message
+      +    message42: message
+      +    message43: message
+      +    message44: message
+      +    message45: message
+      +    message46: message

test/dryrun/diff/truncated/output_from_cluster.txt

@@ -0,0 +1,64 @@
+# Status compare:
+.compliant: 'NonCompliant' does match 'NonCompliant'
+.relatedObjects[0] matches
+.relatedObjects matches
+ Expected status matches the actual status
+
+# Diffs:
+v1 Namespace default:
+# Truncated: showing 50/68 diff lines:
+--- default : existing
++++ default : updated
+@@ -1,8 +1,64 @@
+ apiVersion: v1
+ kind: Namespace
+ metadata:
++  annotations:
++    message1: message
++    message2: message
++    message3: message
++    message4: message
++    message5: message
++    message6: message
++    message7: message
++    message8: message
++    message9: message
++    message10: message
++    message11: message
++    message12: message
++    message13: message
++    message14: message
++    message15: message
++    message16: message
++    message17: message
++    message18: message
++    message19: message
++    message20: message
++    message21: message
++    message22: message
++    message23: message
++    message24: message
++    message25: message
++    message26: message
++    message27: message
++    message28: message
++    message29: message
++    message30: message
++    message31: message
++    message32: message
++    message33: message
++    message34: message
++    message35: message
++    message36: message
++    message37: message
++    message38: message
++    message39: message
++    message40: message
++    message41: message
++    message42: message
++    message43: message
++    message44: message
++    message45: message
++    message46: message
+# Compliance messages:
+NonCompliant; violation - namespaces [default] found but not as specified

test/dryrun/no_name/with_object_selector/musthave_mixed_noncompliant/output_from_cluster.txt

@@ -0,0 +1,41 @@
+# Status compare:
+.compliant: 'NonCompliant' does match 'NonCompliant'
+.relatedObjects[0] matches
+.relatedObjects[1] matches
+.relatedObjects[2] matches
+.relatedObjects matches
+ Expected status matches the actual status
+
+# Diffs:
+networking.k8s.io/v1 Ingress default/good-ingress:
+
+networking.k8s.io/v1 Ingress default/wrong-1-ingress:
+--- default/wrong-1-ingress : existing
++++ default/wrong-1-ingress : updated
+@@ -7,11 +7,11 @@
+   name: wrong-1-ingress
+   namespace: default
+ spec:
+-  ingressClassName: wrong-name
++  ingressClassName: test
+   rules:
+   - http:
+       paths:
+       - backend:
+           service:
+networking.k8s.io/v1 Ingress default/wrong-2-ingress:
+--- default/wrong-2-ingress : existing
++++ default/wrong-2-ingress : updated
+@@ -7,11 +7,11 @@
+   name: wrong-2-ingress
+   namespace: default
+ spec:
+-  ingressClassName: wrong-name
++  ingressClassName: test
+   rules:
+   - http:
+       paths:
+       - backend:
+           service:
+# Compliance messages:
+NonCompliant; violation - ingresses [wrong-1-ingress, wrong-2-ingress] found but not as specified in namespace default