Skip to content

Commit 5716127

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request kubernetes#75641 from fabriziopandini/e2e-kubeadm-new-test
E2e kubeadm new test
2 parents 6a277e0 + 5b675d6 commit 5716127

File tree

8 files changed

+597
-2
lines changed

8 files changed

+597
-2
lines changed

‎test/e2e_kubeadm/BUILD‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,13 @@ go_test(
1212
"bootstrap_token_test.go",
1313
"cluster_info_test.go",
1414
"controlplane_nodes_test.go",
15+
"dns_addon_test.go",
1516
"e2e_kubeadm_suite_test.go",
17+
"kubeadm_certs_test.go",
1618
"kubeadm_config_test.go",
19+
"kubelet_config_test.go",
20+
"nodes_test.go",
21+
"proxy_addon_test.go",
1722
],
1823
out = "e2e_kubeadm.test",
1924
embed = [":go_default_library"],
@@ -24,6 +29,7 @@ go_test(
2429
"//staging/src/k8s.io/api/rbac/v1:go_default_library",
2530
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
2631
"//staging/src/k8s.io/apimachinery/pkg/labels:go_default_library",
32+
"//staging/src/k8s.io/apimachinery/pkg/util/version:go_default_library",
2733
"//staging/src/k8s.io/client-go/kubernetes:go_default_library",
2834
"//staging/src/k8s.io/cluster-bootstrap/token/api:go_default_library",
2935
"//test/e2e/framework:go_default_library",
@@ -63,6 +69,7 @@ go_library(
6369
importpath = "k8s.io/kubernetes/test/e2e_kubeadm",
6470
visibility = ["//visibility:public"],
6571
deps = [
72+
"//staging/src/k8s.io/api/apps/v1:go_default_library",
6673
"//staging/src/k8s.io/api/authorization/v1:go_default_library",
6774
"//staging/src/k8s.io/api/core/v1:go_default_library",
6875
"//staging/src/k8s.io/api/rbac/v1:go_default_library",

‎test/e2e_kubeadm/const.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,4 @@ const (
2121
kubeSystemNamespace = "kube-system"
2222

2323
anonymousUser = "system:anonymous"
24-
25-
nodesGroup = "system:nodes"
2624
)

‎test/e2e_kubeadm/dns_addon_test.go‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
/*
2+
Copyright 2019 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package e2e_kubeadm
18+
19+
import (
20+
"k8s.io/kubernetes/test/e2e/framework"
21+
22+
. "github.com/onsi/ginkgo"
23+
. "github.com/onsi/gomega"
24+
)
25+
26+
const (
27+
dnsService = "kube-dns"
28+
29+
coreDNSServiceAccountName = "coredns"
30+
coreDNSConfigMap = "coredns"
31+
coreDNSConfigMapKey = "Corefile"
32+
coreDNSRoleName = "system:coredns"
33+
coreDNSRoleBindingName = coreDNSRoleName
34+
coreDNSDeploymentName = "coredns"
35+
36+
kubeDNSServiceAccountName = "kube-dns"
37+
kubeDNSDeploymentName = "kube-dns"
38+
)
39+
40+
var (
41+
dnsType = ""
42+
)
43+
44+
// Define container for all the test specification aimed at verifying
45+
// that kubeadm configures the dns as expected
46+
var _ = KubeadmDescribe("DNS addon", func() {
47+
48+
// Get an instance of the k8s test framework
49+
f := framework.NewDefaultFramework("DNS")
50+
51+
// Tests in this container are not expected to create new objects in the cluster
52+
// so we are disabling the creation of a namespace in order to get a faster execution
53+
f.SkipNamespaceCreation = true
54+
55+
// kubeadm supports two type of DNS addon, and so
56+
// it is necessary to get it from the kubeadm-config ConfigMap before testing
57+
BeforeEach(func() {
58+
// if the dnsType name is already known exit
59+
if dnsType != "" {
60+
return
61+
}
62+
63+
// gets the ClusterConfiguration from the kubeadm kubeadm-config ConfigMap as a untyped map
64+
m := getClusterConfiguration(f.ClientSet)
65+
66+
// Extract the dnsType
67+
dnsType = "CoreDNS"
68+
if _, ok := m["dns"]; ok {
69+
d := m["dns"].(map[interface{}]interface{})
70+
if t, ok := d["type"]; ok {
71+
dnsType = t.(string)
72+
}
73+
}
74+
})
75+
76+
Context("kube-dns", func() {
77+
Context("kube-dns ServiceAccount", func() {
78+
It("should exist", func() {
79+
if dnsType != "kube-dns" {
80+
framework.Skipf("Skipping because DNS type is %s", dnsType)
81+
}
82+
83+
ExpectServiceAccount(f.ClientSet, kubeSystemNamespace, kubeDNSServiceAccountName)
84+
})
85+
})
86+
87+
Context("kube-dns Deployment", func() {
88+
It("should exist and be properly configured", func() {
89+
if dnsType != "kube-dns" {
90+
framework.Skipf("Skipping because DNS type is %s", dnsType)
91+
}
92+
93+
d := GetDeployment(f.ClientSet, kubeSystemNamespace, kubeDNSDeploymentName)
94+
95+
Expect(d.Spec.Template.Spec.ServiceAccountName).To(Equal(kubeDNSServiceAccountName))
96+
})
97+
})
98+
})
99+
100+
Context("CoreDNS", func() {
101+
Context("CoreDNS ServiceAccount", func() {
102+
It("should exist", func() {
103+
if dnsType != "CoreDNS" {
104+
framework.Skipf("Skipping because DNS type is %s", dnsType)
105+
}
106+
107+
ExpectServiceAccount(f.ClientSet, kubeSystemNamespace, coreDNSServiceAccountName)
108+
})
109+
110+
It("should have related ClusterRole and ClusterRoleBinding", func() {
111+
if dnsType != "CoreDNS" {
112+
framework.Skipf("Skipping because DNS type is %s", dnsType)
113+
}
114+
115+
ExpectClusterRole(f.ClientSet, coreDNSRoleName)
116+
ExpectClusterRoleBinding(f.ClientSet, coreDNSRoleBindingName)
117+
})
118+
})
119+
120+
Context("CoreDNS ConfigMap", func() {
121+
It("should exist and be properly configured", func() {
122+
if dnsType != "CoreDNS" {
123+
framework.Skipf("Skipping because DNS type is %s", dnsType)
124+
}
125+
126+
cm := GetConfigMap(f.ClientSet, kubeSystemNamespace, coreDNSConfigMap)
127+
128+
Expect(cm.Data).To(HaveKey(coreDNSConfigMapKey))
129+
})
130+
})
131+
132+
Context("CoreDNS Deployment", func() {
133+
It("should exist and be properly configured", func() {
134+
if dnsType != "CoreDNS" {
135+
framework.Skipf("Skipping because DNS type is %s", dnsType)
136+
}
137+
138+
d := GetDeployment(f.ClientSet, kubeSystemNamespace, coreDNSDeploymentName)
139+
140+
Expect(d.Spec.Template.Spec.ServiceAccountName).To(Equal(coreDNSServiceAccountName))
141+
})
142+
})
143+
})
144+
145+
Context("DNS Service", func() {
146+
It("should exist", func() {
147+
ExpectService(f.ClientSet, kubeSystemNamespace, dnsService)
148+
})
149+
})
150+
})

‎test/e2e_kubeadm/kubeadm_certs_test.go‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
/*
2+
Copyright 2019 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package e2e_kubeadm
18+
19+
import (
20+
"fmt"
21+
22+
authv1 "k8s.io/api/authorization/v1"
23+
corev1 "k8s.io/api/core/v1"
24+
rbacv1 "k8s.io/api/rbac/v1"
25+
"k8s.io/kubernetes/test/e2e/framework"
26+
27+
. "github.com/onsi/ginkgo"
28+
. "github.com/onsi/gomega"
29+
)
30+
31+
const (
32+
kubeadmCertsSecretName = "kubeadm-certs"
33+
)
34+
35+
var (
36+
kubeadmCertsRoleName = fmt.Sprintf("kubeadm:%s", kubeadmCertsSecretName)
37+
kubeadmCertsRoleBindingName = kubeadmCertsRoleName
38+
39+
kubeadmCertsSecretResource = &authv1.ResourceAttributes{
40+
Namespace: kubeSystemNamespace,
41+
Name: kubeadmCertsSecretName,
42+
Resource: "secrets",
43+
Verb: "get",
44+
}
45+
)
46+
47+
// Define container for all the test specification aimed at verifying
48+
// that kubeadm creates the kubeadm-certs Secret, that it is properly configured
49+
// and that all the related RBAC rules are in place
50+
51+
// Important! please note that kubeadm-certs is not created by default (still alpha)
52+
// in case you want to skip this test use SKIP=copy-certs
53+
var _ = KubeadmDescribe("kubeadm-certs [copy-certs]", func() {
54+
55+
// Get an instance of the k8s test framework
56+
f := framework.NewDefaultFramework("kubeadm-certs")
57+
58+
// Tests in this container are not expected to create new objects in the cluster
59+
// so we are disabling the creation of a namespace in order to get a faster execution
60+
f.SkipNamespaceCreation = true
61+
62+
It("should exist and be properly configured", func() {
63+
s := GetSecret(f.ClientSet, kubeSystemNamespace, kubeadmCertsSecretName)
64+
65+
// Checks the kubeadm-certs is ownen by a time lived token
66+
Expect(s.OwnerReferences).To(HaveLen(1), "%s should have one owner reference", kubeadmCertsSecretName)
67+
ownRef := s.OwnerReferences[0]
68+
Expect(ownRef.Kind).To(Equal("Secret"), "%s should be owned by a secret", kubeadmCertsSecretName)
69+
Expect(*ownRef.BlockOwnerDeletion).To(BeTrue(), "%s should be deleted on owner deletion", kubeadmCertsSecretName)
70+
71+
o := GetSecret(f.ClientSet, kubeSystemNamespace, ownRef.Name)
72+
Expect(o.Type).To(Equal(corev1.SecretTypeBootstrapToken), "%s should have an owner reference that refers to a bootstrap-token", kubeadmCertsSecretName)
73+
Expect(o.Data).To(HaveKey("expiration"), "%s should have an owner reference with an expiration", kubeadmCertsSecretName)
74+
75+
// gets the ClusterConfiguration from the kubeadm kubeadm-config ConfigMap as a untyped map
76+
m := getClusterConfiguration(f.ClientSet)
77+
78+
// Extract the etcd Type
79+
etcdType := "local"
80+
if _, ok := m["etcd"]; ok {
81+
d := m["etcd"].(map[interface{}]interface{})
82+
if _, ok := d["external"]; ok {
83+
etcdType = "external"
84+
}
85+
}
86+
87+
// check if all the expected key exists
88+
Expect(s.Data).To(HaveKey("ca.crt"))
89+
Expect(s.Data).To(HaveKey("ca.key"))
90+
Expect(s.Data).To(HaveKey("front-proxy-ca.crt"))
91+
Expect(s.Data).To(HaveKey("front-proxy-ca.key"))
92+
Expect(s.Data).To(HaveKey("sa.pub"))
93+
Expect(s.Data).To(HaveKey("sa.key"))
94+
95+
if etcdType == "local" {
96+
Expect(s.Data).To(HaveKey("etcd-ca.crt"))
97+
Expect(s.Data).To(HaveKey("etcd-ca.key"))
98+
} else {
99+
Expect(s.Data).To(HaveKey("external-etcd-ca.crt"))
100+
Expect(s.Data).To(HaveKey("external-etcd.crt"))
101+
Expect(s.Data).To(HaveKey("external-etcd.key"))
102+
}
103+
})
104+
105+
It("should have related Role and RoleBinding", func() {
106+
ExpectRole(f.ClientSet, kubeSystemNamespace, kubeadmCertsRoleName)
107+
ExpectRoleBinding(f.ClientSet, kubeSystemNamespace, kubeadmCertsRoleBindingName)
108+
})
109+
110+
It("should be accessible for bootstrap tokens", func() {
111+
ExpectSubjectHasAccessToResource(f.ClientSet,
112+
rbacv1.GroupKind, bootstrapTokensGroup,
113+
kubeadmCertsSecretResource,
114+
)
115+
})
116+
})

0 commit comments

Comments
 (0)