Skip to content

Commit 6beffc1

Browse files
filariowfilariow
authored
restrict update event for integration's ClusterPolicy (#7298)
* restrict update event for integration's ClusterPolicy We need to create the resources only when the namespace is promoted to tenant namespace. We can skip the other updates to the namespaces. Signed-off-by: Francesco Ilario <[email protected]> * increasing timeout Signed-off-by: Francesco Ilario <[email protected]> * Update components/policies/development/integration/bootstrap-namespace/.chainsaw-test/chainsaw-test.yaml * restrict update event for integration's ClusterPolicy We need to create the resources only when the namespace is promoted to tenant namespace. We can skip the other updates to the namespaces. Signed-off-by: Francesco Ilario <[email protected]> --------- Signed-off-by: Francesco Ilario <[email protected]>
1 parent de5e61a commit 6beffc1

File tree

3 files changed

+151
-0
lines changed

3 files changed

+151
-0
lines changed

‎components/policies/development/integration/bootstrap-namespace/.chainsaw-test/chainsaw-test.yaml

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ spec:
130130
- name: then-serviceaccount-is-created
131131
try:
132132
- assert:
133+
timeout: 180s
133134
file: resources/expected-integration-serviceaccount.yaml
134135
template: true
135136
- name: then-rolebinding-is-created
@@ -188,3 +189,141 @@ spec:
188189
expect:
189190
- check:
190191
($error != null): true
192+
---
193+
# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
194+
apiVersion: chainsaw.kyverno.io/v1alpha1
195+
kind: Test
196+
metadata:
197+
name: mutate-existing-namespace-unlabeled-to-labeled
198+
spec:
199+
description: |
200+
tests that the ServiceAccount and RoleBinding are created in an
201+
existing unlabeled namespace when it is labeled
202+
concurrent: false
203+
namespace: 'generate-existing-namespace'
204+
bindings:
205+
- name: suffix
206+
value: to-labeled
207+
steps:
208+
- name: given-konflux-integration-runner-clusterrole-exists
209+
try:
210+
- apply:
211+
file: resources/actual-konflux-integration-runner-clusterrole.yaml
212+
- name: given-kyverno-has-permission-on-resources
213+
try:
214+
- apply:
215+
file: ../kyverno-rbac.yaml
216+
- name: given-unlabeled-namespace-is-created
217+
try:
218+
- apply:
219+
file: resources/actual-namespace-unlabeled.yaml
220+
template: true
221+
- name: given-cluster-policy-is-ready
222+
try:
223+
- apply:
224+
file: ../bootstrap-namespace.yaml
225+
- assert:
226+
file: chainsaw-assert-clusterpolicy.yaml
227+
- name: given-serviceaccount-is-not-created
228+
try:
229+
- delete:
230+
file: resources/expected-integration-serviceaccount.yaml
231+
template: true
232+
expect:
233+
- check:
234+
($error != null): true
235+
- name: given-rolebinding-is-not-created
236+
try:
237+
- delete:
238+
file: resources/expected-integration-rolebinding.yaml
239+
template: true
240+
expect:
241+
- check:
242+
($error != null): true
243+
- name: when-konfluxci-namespace-is-labeled-namespace
244+
try:
245+
- apply:
246+
file: resources/actual-namespace-konfluxcidev.yaml
247+
template: true
248+
- name: then-serviceaccount-is-created
249+
try:
250+
- assert:
251+
file: resources/expected-integration-serviceaccount.yaml
252+
template: true
253+
- name: then-rolebinding-is-created
254+
try:
255+
- assert:
256+
file: resources/expected-integration-rolebinding.yaml
257+
template: true
258+
---
259+
# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
260+
apiVersion: chainsaw.kyverno.io/v1alpha1
261+
kind: Test
262+
metadata:
263+
name: mutate-existing-namespace-unlabeled-to-unlabeled
264+
spec:
265+
description: |
266+
tests that the ServiceAccount and RoleBinding are not created in an
267+
existing unlabeled namespace when it is updated but still found unlabeled
268+
concurrent: false
269+
namespace: 'generate-existing-namespace'
270+
bindings:
271+
- name: suffix
272+
value: to-unlabeled
273+
steps:
274+
- name: given-konflux-integration-runner-clusterrole-exists
275+
try:
276+
- apply:
277+
file: resources/actual-konflux-integration-runner-clusterrole.yaml
278+
- name: given-kyverno-has-permission-on-resources
279+
try:
280+
- apply:
281+
file: ../kyverno-rbac.yaml
282+
- name: given-unlabeled-namespace-is-created
283+
try:
284+
- apply:
285+
file: resources/actual-namespace-unlabeled.yaml
286+
template: true
287+
- name: given-cluster-policy-is-ready
288+
try:
289+
- apply:
290+
file: ../bootstrap-namespace.yaml
291+
- assert:
292+
file: chainsaw-assert-clusterpolicy.yaml
293+
- name: given-serviceaccount-is-not-created
294+
try:
295+
- delete:
296+
file: resources/expected-integration-serviceaccount.yaml
297+
template: true
298+
expect:
299+
- check:
300+
($error != null): true
301+
- name: given-rolebinding-is-not-created
302+
try:
303+
- delete:
304+
file: resources/expected-integration-rolebinding.yaml
305+
template: true
306+
expect:
307+
- check:
308+
($error != null): true
309+
- name: when-konfluxci-namespace-is-updated-to-unlabeled-namespace
310+
try:
311+
- apply:
312+
file: resources/actual-namespace-unlabeled-extra.yaml
313+
template: true
314+
- name: then-serviceaccount-is-not-created
315+
try:
316+
- delete:
317+
file: resources/expected-integration-serviceaccount.yaml
318+
template: true
319+
expect:
320+
- check:
321+
($error != null): true
322+
- name: then-rolebinding-is-not-created
323+
try:
324+
- delete:
325+
file: resources/expected-integration-rolebinding.yaml
326+
template: true
327+
expect:
328+
- check:
329+
($error != null): true

‎components/policies/development/integration/bootstrap-namespace/.chainsaw-test/resources/actual-namespace-unlabeled-extra.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: (join('-', [$namespace, $suffix]))
5+
labels:
6+
mylabel: extra

‎components/policies/development/integration/bootstrap-namespace/bootstrap-namespace.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ spec:
1919
selector:
2020
matchLabels:
2121
konflux-ci.dev/type: tenant
22+
celPreconditions:
23+
- name: "on update, oldObject had no konflux-ci.dev/type=tenant label"
24+
expression: "request.operation != UPDATE || ! (has(oldObject.metadata.labels) && 'konflux-ci.dev/type' in oldObject.metadata.labels && oldObject.metadata.labels['konflux-ci.dev/type] == 'tenant')"
2225
generate:
2326
generateExisting: true
2427
synchronize: false
@@ -36,6 +39,9 @@ spec:
3639
selector:
3740
matchLabels:
3841
konflux-ci.dev/type: tenant
42+
celPreconditions:
43+
- name: "on update, oldObject had no konflux-ci.dev/type=tenant label"
44+
expression: "request.operation != UPDATE || ! (has(oldObject.metadata.labels) && 'konflux-ci.dev/type' in oldObject.metadata.labels && oldObject.metadata.labels['konflux-ci.dev/type] == 'tenant')"
3945
generate:
4046
generateExisting: true
4147
synchronize: false

0 commit comments

Comments
 (0)