Skip to content

Commit de2730a

Browse files
richabankerrichabanker
committed
split Test_CostLimitForValidation into feature-enabled and feature-disabled tests, init a common apiserver for all testcases
1 parent 1e03472 commit de2730a

File tree

1 file changed

+98
-102
lines changed

1 file changed

+98
-102
lines changed

‎test/integration/apiserver/cel/validatingadmissionpolicy_test.go‎

Lines changed: 98 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -2132,16 +2132,30 @@ func Test_ValidatingAdmissionPolicy_ParamResourceDeletedThenRecreated(t *testing
21322132
}
21332133
}
21342134

2135-
// Test_CostLimitForValidation tests the cost limit set for a ValidatingAdmissionPolicy.
2135+
// Test_CostLimitForValidation tests the cost limit set for a ValidatingAdmissionPolicy
2136+
// with StrictCostEnforcementForVAP feature enabled.
21362137
func Test_CostLimitForValidation(t *testing.T) {
2138+
generic.PolicyRefreshInterval = 10 * time.Millisecond
2139+
featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, genericfeatures.StrictCostEnforcementForVAP, true)
2140+
server, err := apiservertesting.StartTestServer(t, nil, []string{
2141+
"--enable-admission-plugins", "ValidatingAdmissionPolicy",
2142+
}, framework.SharedEtcd())
2143+
if err != nil {
2144+
t.Fatal(err)
2145+
}
2146+
defer server.TearDownFn()
2147+
2148+
config := server.ClientConfig
2149+
client, err := clientset.NewForConfig(config)
2150+
if err != nil {
2151+
t.Fatal(err)
2152+
}
2153+
21372154
testcases := []struct {
2138-
name string
2139-
policy *admissionregistrationv1.ValidatingAdmissionPolicy
2140-
policyBinding *admissionregistrationv1.ValidatingAdmissionPolicyBinding
2141-
namespace *v1.Namespace
2142-
err string
2143-
failureReason metav1.StatusReason
2144-
strictCostEnforcement bool
2155+
name string
2156+
policy *admissionregistrationv1.ValidatingAdmissionPolicy
2157+
err string
2158+
failureReason metav1.StatusReason
21452159
}{
21462160
{
21472161
name: "With StrictCostEnforcementForVAP: Single expression exceeds per call cost limit for native library",
@@ -2150,15 +2164,8 @@ func Test_CostLimitForValidation(t *testing.T) {
21502164
Expression: "[1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(x, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(y, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z2, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z3, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z4, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z5, int('1'.find('[0-9]*')) < 100)))))))",
21512165
},
21522166
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
2153-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2154-
namespace: &v1.Namespace{
2155-
ObjectMeta: metav1.ObjectMeta{
2156-
Name: "test-k8s",
2157-
},
2158-
},
2159-
err: "operation cancelled: actual cost limit exceeded",
2160-
failureReason: metav1.StatusReasonInvalid,
2161-
strictCostEnforcement: true,
2167+
err: "operation cancelled: actual cost limit exceeded",
2168+
failureReason: metav1.StatusReasonInvalid,
21622169
},
21632170
{
21642171
name: "With StrictCostEnforcementForVAP: Expression exceeds per call cost limit for extended library",
@@ -2168,15 +2175,8 @@ func Test_CostLimitForValidation(t *testing.T) {
21682175
Expression: "authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed() && authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed() && authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed()",
21692176
},
21702177
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
2171-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2172-
namespace: &v1.Namespace{
2173-
ObjectMeta: metav1.ObjectMeta{
2174-
Name: "test-k8s",
2175-
},
2176-
},
2177-
err: "operation cancelled: actual cost limit exceeded",
2178-
failureReason: metav1.StatusReasonInvalid,
2179-
strictCostEnforcement: true,
2178+
err: "operation cancelled: actual cost limit exceeded",
2179+
failureReason: metav1.StatusReasonInvalid,
21802180
},
21812181
{
21822182
name: "With StrictCostEnforcementForVAP: Expression exceeds per call cost limit for extended library in variables",
@@ -2190,15 +2190,8 @@ func Test_CostLimitForValidation(t *testing.T) {
21902190
Expression: "variables.authzCheck",
21912191
},
21922192
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix"))))),
2193-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2194-
namespace: &v1.Namespace{
2195-
ObjectMeta: metav1.ObjectMeta{
2196-
Name: "test-k8s",
2197-
},
2198-
},
2199-
err: "operation cancelled: actual cost limit exceeded",
2200-
failureReason: metav1.StatusReasonInvalid,
2201-
strictCostEnforcement: true,
2193+
err: "operation cancelled: actual cost limit exceeded",
2194+
failureReason: metav1.StatusReasonInvalid,
22022195
},
22032196
{
22042197
name: "With StrictCostEnforcementForVAP: Expression exceeds per call cost limit for extended library in matchConditions",
@@ -2212,45 +2205,75 @@ func Test_CostLimitForValidation(t *testing.T) {
22122205
Expression: "true",
22132206
},
22142207
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix"))))),
2215-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2216-
namespace: &v1.Namespace{
2217-
ObjectMeta: metav1.ObjectMeta{
2218-
Name: "test-k8s",
2219-
},
2220-
},
2221-
err: "operation cancelled: actual cost limit exceeded",
2222-
failureReason: metav1.StatusReasonInvalid,
2223-
strictCostEnforcement: true,
2208+
err: "operation cancelled: actual cost limit exceeded",
2209+
failureReason: metav1.StatusReasonInvalid,
22242210
},
22252211
{
22262212
name: "With StrictCostEnforcementForVAP: Expression exceeds per policy cost limit for extended library",
22272213
policy: withValidations(generateValidationsWithAuthzCheck(29, "authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed()"), withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
2228-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2229-
namespace: &v1.Namespace{
2214+
err: "validation failed due to running out of cost budget, no further validation rules will be run",
2215+
failureReason: metav1.StatusReasonInvalid,
2216+
},
2217+
}
2218+
for _, testcase := range testcases {
2219+
t.Run(testcase.name, func(t *testing.T) {
2220+
policy := withWaitReadyConstraintAndExpression(testcase.policy)
2221+
if _, err := client.AdmissionregistrationV1().ValidatingAdmissionPolicies().Create(context.TODO(), policy, metav1.CreateOptions{}); err != nil {
2222+
t.Fatal(err)
2223+
}
2224+
policyBinding := makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", "")
2225+
if err := createAndWaitReady(t, client, policyBinding, nil); err != nil {
2226+
t.Fatal(err)
2227+
}
2228+
2229+
ns := &v1.Namespace{
22302230
ObjectMeta: metav1.ObjectMeta{
22312231
Name: "test-k8s",
22322232
},
2233-
},
2234-
err: "validation failed due to running out of cost budget, no further validation rules will be run",
2235-
failureReason: metav1.StatusReasonInvalid,
2236-
strictCostEnforcement: true,
2237-
},
2233+
}
2234+
_, err = client.CoreV1().Namespaces().Create(context.TODO(), ns, metav1.CreateOptions{})
2235+
checkExpectedError(t, err, testcase.err)
2236+
checkFailureReason(t, err, testcase.failureReason)
2237+
if err := cleanupPolicy(t, client, policy, policyBinding); err != nil {
2238+
t.Fatalf("error while cleaning up policy and its bindings: %v", err)
2239+
}
2240+
})
2241+
}
2242+
}
2243+
2244+
// Test_CostLimitForValidationWithFeatureDisabled tests the cost limit set for a ValidatingAdmissionPolicy
2245+
// with StrictCostEnforcementForVAP feature disabled.
2246+
func Test_CostLimitForValidationWithFeatureDisabled(t *testing.T) {
2247+
generic.PolicyRefreshInterval = 10 * time.Millisecond
2248+
server, err := apiservertesting.StartTestServer(t, nil, []string{
2249+
"--enable-admission-plugins", "ValidatingAdmissionPolicy",
2250+
}, framework.SharedEtcd())
2251+
if err != nil {
2252+
t.Fatal(err)
2253+
}
2254+
defer server.TearDownFn()
2255+
2256+
config := server.ClientConfig
2257+
client, err := clientset.NewForConfig(config)
2258+
if err != nil {
2259+
t.Fatal(err)
2260+
}
2261+
2262+
testcases := []struct {
2263+
name string
2264+
policy *admissionregistrationv1.ValidatingAdmissionPolicy
2265+
err string
2266+
failureReason metav1.StatusReason
2267+
}{
22382268
{
22392269
name: "Without StrictCostEnforcementForVAP: Single expression exceeds per call cost limit for native library",
22402270
policy: withValidations([]admissionregistrationv1.Validation{
22412271
{
22422272
Expression: "[1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(x, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(y, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z2, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z3, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z4, [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].all(z5, int('1'.find('[0-9]*')) < 100)))))))",
22432273
},
22442274
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
2245-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2246-
namespace: &v1.Namespace{
2247-
ObjectMeta: metav1.ObjectMeta{
2248-
Name: "test-k8s",
2249-
},
2250-
},
2251-
err: "operation cancelled: actual cost limit exceeded",
2252-
failureReason: metav1.StatusReasonInvalid,
2253-
strictCostEnforcement: false,
2275+
err: "operation cancelled: actual cost limit exceeded",
2276+
failureReason: metav1.StatusReasonInvalid,
22542277
},
22552278
{
22562279
name: "Without StrictCostEnforcementForVAP: Expression does not exceed per call cost limit for extended library",
@@ -2260,13 +2283,6 @@ func Test_CostLimitForValidation(t *testing.T) {
22602283
Expression: "authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed() && authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed() && authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed()",
22612284
},
22622285
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
2263-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2264-
namespace: &v1.Namespace{
2265-
ObjectMeta: metav1.ObjectMeta{
2266-
Name: "test-k8s",
2267-
},
2268-
},
2269-
strictCostEnforcement: false,
22702286
},
22712287
{
22722288
name: "Without StrictCostEnforcementForVAP: Expression does not exceed per call cost limit for extended library in variables",
@@ -2280,56 +2296,36 @@ func Test_CostLimitForValidation(t *testing.T) {
22802296
Expression: "variables.authzCheck",
22812297
},
22822298
}, withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix"))))),
2283-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2284-
namespace: &v1.Namespace{
2285-
ObjectMeta: metav1.ObjectMeta{
2286-
Name: "test-k8s",
2287-
},
2288-
},
2289-
strictCostEnforcement: false,
22902299
},
22912300
{
2292-
name: "Without StrictCostEnforcementForVAP: Expression does not exceed per policy cost limit for extended library",
2293-
policy: withValidations(generateValidationsWithAuthzCheck(29, "authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed()"), withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
2294-
policyBinding: makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", ""),
2295-
namespace: &v1.Namespace{
2296-
ObjectMeta: metav1.ObjectMeta{
2297-
Name: "test-k8s",
2298-
},
2299-
},
2300-
strictCostEnforcement: false,
2301+
name: "Without StrictCostEnforcementForVAP: Expression does not exceed per policy cost limit for extended library",
2302+
policy: withValidations(generateValidationsWithAuthzCheck(29, "authorizer.group('apps').resource('deployments').subresource('status').namespace('test').name('backend').check('create').allowed()"), withFailurePolicy(admissionregistrationv1.Fail, withNamespaceMatch(makePolicy("validate-namespace-suffix")))),
23012303
},
23022304
}
2303-
for _, testcase := range testcases {
2305+
for i, testcase := range testcases {
23042306
t.Run(testcase.name, func(t *testing.T) {
2305-
featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, genericfeatures.StrictCostEnforcementForVAP, testcase.strictCostEnforcement)
2306-
2307-
server, err := apiservertesting.StartTestServer(t, nil, []string{
2308-
"--enable-admission-plugins", "ValidatingAdmissionPolicy",
2309-
}, framework.SharedEtcd())
2310-
if err != nil {
2311-
t.Fatal(err)
2312-
}
2313-
defer server.TearDownFn()
2314-
2315-
config := server.ClientConfig
2316-
2317-
client, err := clientset.NewForConfig(config)
2318-
if err != nil {
2319-
t.Fatal(err)
2320-
}
23212307
policy := withWaitReadyConstraintAndExpression(testcase.policy)
23222308
if _, err := client.AdmissionregistrationV1().ValidatingAdmissionPolicies().Create(context.TODO(), policy, metav1.CreateOptions{}); err != nil {
23232309
t.Fatal(err)
23242310
}
2325-
if err := createAndWaitReady(t, client, testcase.policyBinding, nil); err != nil {
2311+
policyBinding := makeBinding("validate-namespace-suffix-binding", "validate-namespace-suffix", "")
2312+
if err := createAndWaitReady(t, client, policyBinding, nil); err != nil {
23262313
t.Fatal(err)
23272314
}
23282315

2329-
_, err = client.CoreV1().Namespaces().Create(context.TODO(), testcase.namespace, metav1.CreateOptions{})
2316+
nsName := fmt.Sprintf("test-%d-k8s", i)
2317+
ns := &v1.Namespace{
2318+
ObjectMeta: metav1.ObjectMeta{
2319+
Name: nsName,
2320+
},
2321+
}
23302322

2323+
_, err = client.CoreV1().Namespaces().Create(context.TODO(), ns, metav1.CreateOptions{})
23312324
checkExpectedError(t, err, testcase.err)
23322325
checkFailureReason(t, err, testcase.failureReason)
2326+
if err := cleanupPolicy(t, client, policy, policyBinding); err != nil {
2327+
t.Fatalf("error while cleaning up policy and its bindings: %v", err)
2328+
}
23332329
})
23342330
}
23352331
}

0 commit comments

Comments
 (0)