|
| 1 | +//go:build e2e |
| 2 | +// +build e2e |
| 3 | + |
| 4 | +/* |
| 5 | +Copyright 2026 The Tekton Authors |
| 6 | +
|
| 7 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 8 | +you may not use this file except in compliance with the License. |
| 9 | +You may obtain a copy of the License at |
| 10 | +
|
| 11 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | +
|
| 13 | +Unless required by applicable law or agreed to in writing, software |
| 14 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 15 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | +See the License for the specific language governing permissions and |
| 17 | +limitations under the License. |
| 18 | +*/ |
| 19 | + |
| 20 | +package common |
| 21 | + |
| 22 | +import ( |
| 23 | + "context" |
| 24 | + "fmt" |
| 25 | + "testing" |
| 26 | + |
| 27 | + "github.com/tektoncd/operator/test/client" |
| 28 | + "github.com/tektoncd/operator/test/resources" |
| 29 | + "github.com/tektoncd/operator/test/utils" |
| 30 | + pipelinev1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" |
| 31 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 32 | +) |
| 33 | + |
| 34 | +// TestTektonResultNetworkPolicy verifies NetworkPolicies are created by default |
| 35 | +// for Results workloads, that Results stays Ready under those policies (API can |
| 36 | +// reach Postgres; watcher can reach the API server), and that toggling |
| 37 | +// spec.networkPolicy.disabled correctly adds and removes the policies. |
| 38 | +func TestTektonResultNetworkPolicy(t *testing.T) { |
| 39 | + |
| 40 | + crNames := utils.GetResourceNames() |
| 41 | + clients := client.Setup(t, crNames.TargetNamespace) |
| 42 | + |
| 43 | + utils.CleanupOnInterrupt(func() { utils.TearDownPipeline(clients, crNames.TektonPipeline) }) |
| 44 | + utils.CleanupOnInterrupt(func() { utils.TearDownResult(clients, crNames.TektonResult) }) |
| 45 | + defer utils.TearDownResult(clients, crNames.TektonResult) |
| 46 | + defer utils.TearDownPipeline(clients, crNames.TektonPipeline) |
| 47 | + |
| 48 | + resources.EnsureNoTektonConfigInstance(t, clients, crNames) |
| 49 | + |
| 50 | + if _, err := resources.EnsureTektonPipelineExists(clients.TektonPipeline(), crNames); err != nil { |
| 51 | + t.Fatalf("TektonPipeline %q failed to create: %v", crNames.TektonPipeline, err) |
| 52 | + } |
| 53 | + resources.AssertTektonPipelineCRReadyStatus(t, clients, crNames) |
| 54 | + |
| 55 | + // Operator creates default TLS + Postgres secrets when missing. |
| 56 | + if _, err := resources.EnsureTektonResultExists(clients.TektonResult(), crNames); err != nil { |
| 57 | + t.Fatalf("TektonResult %q failed to create: %v", crNames.TektonResult, err) |
| 58 | + } |
| 59 | + resources.AssertTektonResultCRReadyStatus(t, clients, crNames) |
| 60 | + |
| 61 | + expectedPolicies := []string{ |
| 62 | + "results-default-deny", |
| 63 | + "results-api", |
| 64 | + "results-watcher", |
| 65 | + "results-retention-policy-agent", |
| 66 | + "results-postgres", |
| 67 | + } |
| 68 | + |
| 69 | + t.Run("default-policies-created", func(t *testing.T) { |
| 70 | + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) |
| 71 | + }) |
| 72 | + |
| 73 | + // Ready status already proves API↔DB and watcher↔API-server under NP. |
| 74 | + // A successful TaskRun additionally exercises watcher API-server egress |
| 75 | + t.Run("results-functional-with-networkpolicies", func(t *testing.T) { |
| 76 | + resources.AssertTektonResultCRReadyStatus(t, clients, crNames) |
| 77 | + |
| 78 | + taskRun := createResultNPProbeTaskRun(crNames.TargetNamespace) |
| 79 | + createdTaskRun, err := clients.TektonClient.TaskRuns(crNames.TargetNamespace).Create( |
| 80 | + context.TODO(), taskRun, metav1.CreateOptions{}) |
| 81 | + if err != nil { |
| 82 | + t.Fatalf("failed to create TaskRun: %v", err) |
| 83 | + } |
| 84 | + |
| 85 | + if err := resources.WaitForTaskRunHappy( |
| 86 | + clients.TektonClient, |
| 87 | + crNames.TargetNamespace, |
| 88 | + createdTaskRun.Name, |
| 89 | + func(tr *pipelinev1.TaskRun) (bool, error) { |
| 90 | + if tr.IsDone() { |
| 91 | + if tr.IsSuccessful() { |
| 92 | + return true, nil |
| 93 | + } |
| 94 | + return false, fmt.Errorf("TaskRun failed") |
| 95 | + } |
| 96 | + return false, nil |
| 97 | + }, |
| 98 | + ); err != nil { |
| 99 | + t.Fatalf("TaskRun did not complete successfully under NetworkPolicy: %v", err) |
| 100 | + } |
| 101 | + |
| 102 | + // Results must still be Ready after the TaskRun (watcher/API/DB path). |
| 103 | + resources.AssertTektonResultCRReadyStatus(t, clients, crNames) |
| 104 | + }) |
| 105 | + |
| 106 | + t.Run("disable-removes-policies", func(t *testing.T) { |
| 107 | + tr, err := clients.TektonResult().Get(context.TODO(), crNames.TektonResult, metav1.GetOptions{}) |
| 108 | + if err != nil { |
| 109 | + t.Fatalf("failed to get TektonResult: %v", err) |
| 110 | + } |
| 111 | + tr.Spec.NetworkPolicy.Disabled = true |
| 112 | + if _, err := clients.TektonResult().Update(context.TODO(), tr, metav1.UpdateOptions{}); err != nil { |
| 113 | + t.Fatalf("failed to disable NetworkPolicy on TektonResult: %v", err) |
| 114 | + } |
| 115 | + resources.AssertTektonResultCRReadyStatus(t, clients, crNames) |
| 116 | + resources.AssertNetworkPoliciesAbsent(t, clients, crNames.TargetNamespace, expectedPolicies) |
| 117 | + }) |
| 118 | + |
| 119 | + t.Run("reenable-restores-policies", func(t *testing.T) { |
| 120 | + tr, err := clients.TektonResult().Get(context.TODO(), crNames.TektonResult, metav1.GetOptions{}) |
| 121 | + if err != nil { |
| 122 | + t.Fatalf("failed to get TektonResult: %v", err) |
| 123 | + } |
| 124 | + tr.Spec.NetworkPolicy.Disabled = false |
| 125 | + if _, err := clients.TektonResult().Update(context.TODO(), tr, metav1.UpdateOptions{}); err != nil { |
| 126 | + t.Fatalf("failed to re-enable NetworkPolicy on TektonResult: %v", err) |
| 127 | + } |
| 128 | + resources.AssertTektonResultCRReadyStatus(t, clients, crNames) |
| 129 | + resources.AssertNetworkPoliciesExist(t, clients, crNames.TargetNamespace, expectedPolicies) |
| 130 | + }) |
| 131 | +} |
| 132 | + |
| 133 | +// createResultNPProbeTaskRun creates a minimal TaskRun that completes quickly. |
| 134 | +// Completion exercises the Results watcher watch of the API server under NP. |
| 135 | +func createResultNPProbeTaskRun(namespace string) *pipelinev1.TaskRun { |
| 136 | + return &pipelinev1.TaskRun{ |
| 137 | + ObjectMeta: metav1.ObjectMeta{ |
| 138 | + GenerateName: "result-np-probe-taskrun-", |
| 139 | + Namespace: namespace, |
| 140 | + }, |
| 141 | + Spec: pipelinev1.TaskRunSpec{ |
| 142 | + ServiceAccountName: "default", |
| 143 | + TaskSpec: &pipelinev1.TaskSpec{ |
| 144 | + Steps: []pipelinev1.Step{ |
| 145 | + { |
| 146 | + Name: "echo", |
| 147 | + Image: "busybox:stable", |
| 148 | + Command: []string{"echo"}, |
| 149 | + Args: []string{"results NetworkPolicy probe"}, |
| 150 | + }, |
| 151 | + }, |
| 152 | + }, |
| 153 | + }, |
| 154 | + } |
| 155 | +} |
0 commit comments