Skip to content

Commit 4144a2a

Browse files
author
James Munnelly
committed
Add unit tests for IsKubeletClientCSR and IsKubeletServingCSR
1 parent c2367bd commit 4144a2a

File tree

1 file changed

+135
-0
lines changed

1 file changed

+135
-0
lines changed

‎pkg/apis/certificates/v1beta1/defaults_test.go‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,141 @@ import (
3030
capi "k8s.io/api/certificates/v1beta1"
3131
)
3232

33+
func TestIsKubeletServingCSR(t *testing.T) {
34+
newCSR := func(base pemOptions, overlays ...pemOptions) *x509.CertificateRequest {
35+
b := csrWithOpts(base, overlays...)
36+
csr, err := ParseCSR(b)
37+
if err != nil {
38+
t.Fatal(err)
39+
}
40+
return csr
41+
}
42+
tests := map[string]struct {
43+
req *x509.CertificateRequest
44+
usages []capi.KeyUsage
45+
exp bool
46+
}{
47+
"defaults for kubelet-serving": {
48+
req: newCSR(kubeletServerPEMOptions),
49+
usages: kubeletServerUsages,
50+
exp: true,
51+
},
52+
"does not default to kube-apiserver-client-kubelet if org is not 'system:nodes'": {
53+
req: newCSR(kubeletServerPEMOptions, pemOptions{org: "not-system:nodes"}),
54+
usages: kubeletServerUsages,
55+
exp: false,
56+
},
57+
"does not default to kubelet-serving if CN does not have system:node: prefix": {
58+
req: newCSR(kubeletServerPEMOptions, pemOptions{cn: "notprefixed"}),
59+
usages: kubeletServerUsages,
60+
exp: false,
61+
},
62+
"does not default to kubelet-serving if it has an unexpected usage": {
63+
req: newCSR(kubeletServerPEMOptions),
64+
usages: append(kubeletServerUsages, capi.UsageClientAuth),
65+
exp: false,
66+
},
67+
"does not default to kubelet-serving if it is missing an expected usage": {
68+
req: newCSR(kubeletServerPEMOptions),
69+
usages: kubeletServerUsages[1:],
70+
exp: false,
71+
},
72+
"does not default to kubelet-serving if it does not specify any dnsNames or ipAddresses": {
73+
req: newCSR(kubeletServerPEMOptions, pemOptions{ipAddresses: []net.IP{}, dnsNames: []string{}}),
74+
usages: kubeletServerUsages[1:],
75+
exp: false,
76+
},
77+
"does not default to kubelet-serving if it specifies a URI SAN": {
78+
req: newCSR(kubeletServerPEMOptions, pemOptions{uris: []string{"http://something"}}),
79+
usages: kubeletServerUsages,
80+
exp: false,
81+
},
82+
"does not default to kubelet-serving if it specifies an emailAddress SAN": {
83+
req: newCSR(kubeletServerPEMOptions, pemOptions{emailAddresses: []string{"something"}}),
84+
usages: kubeletServerUsages,
85+
exp: false,
86+
},
87+
}
88+
for name, test := range tests {
89+
t.Run(name, func(t *testing.T) {
90+
got := IsKubeletServingCSR(test.req, test.usages)
91+
if test.exp != got {
92+
t.Errorf("unexpected IsKubeletClientCSR output: exp=%v, got=%v", test.exp, got)
93+
}
94+
})
95+
}
96+
}
97+
98+
func TestIsKubeletClientCSR(t *testing.T) {
99+
newCSR := func(base pemOptions, overlays ...pemOptions) *x509.CertificateRequest {
100+
b := csrWithOpts(base, overlays...)
101+
csr, err := ParseCSR(b)
102+
if err != nil {
103+
t.Fatal(err)
104+
}
105+
return csr
106+
}
107+
tests := map[string]struct {
108+
req *x509.CertificateRequest
109+
usages []capi.KeyUsage
110+
exp bool
111+
}{
112+
"defaults for kube-apiserver-client-kubelet": {
113+
req: newCSR(kubeletClientPEMOptions),
114+
usages: kubeletClientUsages,
115+
exp: true,
116+
},
117+
"does not default to kube-apiserver-client-kubelet if org is not 'system:nodes'": {
118+
req: newCSR(kubeletClientPEMOptions, pemOptions{org: "not-system:nodes"}),
119+
usages: kubeletClientUsages,
120+
exp: false,
121+
},
122+
"does not default to kube-apiserver-client-kubelet if a dnsName is set": {
123+
req: newCSR(kubeletClientPEMOptions, pemOptions{dnsNames: []string{"something"}}),
124+
usages: kubeletClientUsages,
125+
exp: false,
126+
},
127+
"does not default to kube-apiserver-client-kubelet if an emailAddress is set": {
128+
req: newCSR(kubeletClientPEMOptions, pemOptions{emailAddresses: []string{"something"}}),
129+
usages: kubeletClientUsages,
130+
exp: false,
131+
},
132+
"does not default to kube-apiserver-client-kubelet if a uri SAN is set": {
133+
req: newCSR(kubeletClientPEMOptions, pemOptions{uris: []string{"http://something"}}),
134+
usages: kubeletClientUsages,
135+
exp: false,
136+
},
137+
"does not default to kube-apiserver-client-kubelet if an ipAddress is set": {
138+
req: newCSR(kubeletClientPEMOptions, pemOptions{ipAddresses: []net.IP{{0, 0, 0, 0}}}),
139+
usages: kubeletClientUsages,
140+
exp: false,
141+
},
142+
"does not default to kube-apiserver-client-kubelet if CN does not have 'system:node:' prefix": {
143+
req: newCSR(kubeletClientPEMOptions, pemOptions{cn: "not-prefixed"}),
144+
usages: kubeletClientUsages,
145+
exp: false,
146+
},
147+
"does not default to kube-apiserver-client-kubelet if it has an unexpected usage": {
148+
req: newCSR(kubeletClientPEMOptions),
149+
usages: append(kubeletClientUsages, capi.UsageServerAuth),
150+
exp: false,
151+
},
152+
"does not default to kube-apiserver-client-kubelet if it is missing an expected usage": {
153+
req: newCSR(kubeletClientPEMOptions),
154+
usages: kubeletClientUsages[1:],
155+
exp: false,
156+
},
157+
}
158+
for name, test := range tests {
159+
t.Run(name, func(t *testing.T) {
160+
got := IsKubeletClientCSR(test.req, test.usages)
161+
if test.exp != got {
162+
t.Errorf("unexpected IsKubeletClientCSR output: exp=%v, got=%v", test.exp, got)
163+
}
164+
})
165+
}
166+
}
167+
33168
var (
34169
kubeletClientUsages = []capi.KeyUsage{
35170
capi.UsageDigitalSignature,

0 commit comments

Comments
 (0)