Adds test for role bindings in cluster (#100)

Signed-off-by: Sean Sundberg <[email protected]>

Author: Sean Sundberg

main.tf

@@ -94,10 +94,8 @@ data ibm_container_cluster_versions cluster_versions {
   resource_group_id = data.ibm_resource_group.resource_group.id
 }
 
-module setup_clis {
-  source = "cloud-native-toolkit/clis/util"
-
-  clis = ["jq"]
+data clis_check clis {
+  clis = ["jq","oc"]
 }
 
 data ibm_is_vpc vpc {
@@ -229,6 +227,7 @@ data external credentials {
     username = "apikey"
     ibmcloud_api_key = var.ibmcloud_api_key
     token = ""
+    bin_dir = data.clis_check.clis.bin_dir
   }
 }
 
@@ -262,6 +261,20 @@ data ibm_container_cluster_config cluster {
   config_dir        = data.external.dirs.result.cluster_config_dir
 }
 
+resource null_resource wait_for_iam_sync {
+  count = local.login ? 1 : 0
+  depends_on = [data.ibm_container_cluster_config.cluster]
+
+  provisioner "local-exec" {
+    command = "${path.module}/scripts/wait-for-iam-sync.sh"
+
+    environment = {
+      BIN_DIR = data.clis_check.clis.bin_dir
+      KUBECONFIG = local.cluster_config
+    }
+  }
+}
+
 data "ibm_container_vpc_cluster_worker" "workers" {
   depends_on        = [
     data.ibm_container_vpc_cluster.config

module.yaml

@@ -14,6 +14,8 @@ versions:
   providers:
     - name: ibm
       source: "ibm-cloud/ibm"
+    - name: clis
+      source: "cloud-native-toolkit/clis"
   dependencies:
     - id: resource-group
       refs:

outputs.tf

@@ -11,19 +11,19 @@ output "name" {
 output "resource_group_name" {
   value       = var.resource_group_name
   description = "Name of the resource group containing the cluster."
-  depends_on  = [data.ibm_container_cluster_config.cluster]
+  depends_on  = [null_resource.wait_for_iam_sync]
 }
 
 output "region" {
   value       = var.region
   description = "Region containing the cluster."
-  depends_on  = [data.ibm_container_cluster_config.cluster]
+  depends_on  = [null_resource.wait_for_iam_sync]
 }
 
 output "config_file_path" {
   value       = local.cluster_config
   description = "Path to the config file for the cluster."
-  depends_on  = [data.ibm_container_cluster_config.cluster]
+  depends_on  = [null_resource.wait_for_iam_sync]
 }
 
 output "platform" {
@@ -39,13 +39,13 @@ output "platform" {
   }
   sensitive = true
   description = "Configuration values for the cluster platform"
-  depends_on  = [data.ibm_container_cluster_config.cluster]
+  depends_on  = [null_resource.wait_for_iam_sync]
 }
 
 output "sync" {
   value = local.cluster_name
   description = "Value used to sync downstream modules"
-  depends_on  = [data.ibm_container_cluster_config.cluster]
+  depends_on  = [null_resource.wait_for_iam_sync]
 }
 
 output "total_worker_count" {

scripts/wait-for-iam-sync.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+if [[ -n "${BIN_DIR}" ]]; then
+  export PATH="${BIN_DIR}:${PATH}"
+fi
+
+if [[ -z "${KUBECONFIG}" ]]; then
+  exit 0
+fi
+
+USERNAME=$(oc whoami)
+
+echo "Checking for user: $USERNAME"
+
+count=0
+until [[ -n $(oc get user -o json | jq -r --arg NAME "${USERNAME}" '.items[].metadata.name | select(. == $NAME)') ]] || [[ $count -eq 20 ]]; do
+  count=$((count + 1))
+  echo "  Waiting for 30 seconds"
+  sleep 30
+done
+
+if [[ $count -eq 20 ]]; then
+  echo "Timed out waiting for user: $USERNAME" >&2
+  exit 1
+else
+  echo "  Found user: $USERNAME"
+fi
+
+echo "Waiting for role bindings for user: $USERNAME"
+
+function role_binding_count {
+  local name="$1"
+
+  local length=$(oc get clusterrolebinding -o json | jq --arg NAME "${name}" '[.items[] | select(.metadata.name | test("ibm-admin|ibm-edit|ibm-view")) | .subjects[] | select(.name | test($NAME))] | length')
+
+  echo "${length}"
+}
+
+count=0
+until [[ $(role_binding_count "${USERNAME}") -gt 0 ]] || [[ $count -eq 20 ]]; do
+  count=$((count + 1))
+  echo "  Waiting for 30 seconds"
+  sleep 30
+done
+
+if [[ $count -eq 20 ]]; then
+  echo "Timed out waiting for role bindings: $USERNAME" >&2
+  exit 1
+else
+  echo "  Found role bindings for user: $USERNAME"
+fi

test/stages/stage0.tf

@@ -5,6 +5,9 @@ terraform {
     ibm = {
       source = "ibm-cloud/ibm"
     }
+    clis = {
+      source  = "cloud-native-toolkit/clis"
+    }
   }
 }
 

version.tf

@@ -3,8 +3,11 @@ terraform {
 
   required_providers {
     ibm = {
-      source = "ibm-cloud/ibm"
+      source  = "ibm-cloud/ibm"
       version = ">= 1.18"
     }
+    clis = {
+      source  = "cloud-native-toolkit/clis"
+    }
   }
 }