Skip to content

Commit ea8f4cb

Browse files
liggittliggitt
committed
Update CSR e2e to use v1
1 parent 7ee2e2f commit ea8f4cb

File tree

2 files changed

+67
-43
lines changed

2 files changed

+67
-43
lines changed

‎test/conformance/testdata/conformance.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1301,6 +1301,27 @@
13011301
StorageClass or a dynamic provisioner.
13021302
release: v1.9
13031303
file: test/e2e/apps/statefulset.go
1304+
- testname: CertificateSigningRequest API
1305+
codename: '[sig-auth] Certificates API [Privileged:ClusterAdmin] should support
1306+
CSR API operations [Conformance]'
1307+
description: ' The certificates.k8s.io API group MUST exists in the /apis discovery
1308+
document. The certificates.k8s.io/v1 API group/version MUST exist in the /apis/certificates.k8s.io
1309+
discovery document. The certificatesigningrequests, certificatesigningrequests/approval,
1310+
and certificatesigningrequests/status resources MUST exist in the /apis/certificates.k8s.io/v1
1311+
discovery document. The certificatesigningrequests resource must support create,
1312+
get, list, watch, update, patch, delete, and deletecollection. The certificatesigningrequests/approval
1313+
resource must support get, update, patch. The certificatesigningrequests/status
1314+
resource must support get, update, patch.'
1315+
release: v1.19
1316+
file: test/e2e/auth/certificates.go
1317+
- testname: CertificateSigningRequest API Client Certificate
1318+
codename: '[sig-auth] Certificates API [Privileged:ClusterAdmin] should support
1319+
building a client with a CSR [Conformance]'
1320+
description: ' The certificatesigningrequests resource must accept a request for
1321+
a certificate signed by kubernetes.io/kube-apiserver-client. The issued certificate
1322+
must be valid as a client certificate used to authenticate to the kube-apiserver.'
1323+
release: v1.19
1324+
file: test/e2e/auth/certificates.go
13041325
- testname: Service account tokens auto mount optionally
13051326
codename: '[sig-auth] ServiceAccounts should allow opting out of API token automount [Conformance]'
13061327
description: Ensure that Service Account keys are mounted into the Pod only when

‎test/e2e/auth/certificates.go‎

Lines changed: 46 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,15 @@ import (
2525
"fmt"
2626
"time"
2727

28-
certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
28+
certificatesv1 "k8s.io/api/certificates/v1"
29+
v1 "k8s.io/api/core/v1"
2930
rbacv1 "k8s.io/api/rbac/v1"
3031
apierrors "k8s.io/apimachinery/pkg/api/errors"
3132
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3233
types "k8s.io/apimachinery/pkg/types"
3334
"k8s.io/apimachinery/pkg/util/wait"
3435
"k8s.io/apimachinery/pkg/watch"
35-
certificatesclient "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
36+
certificatesclient "k8s.io/client-go/kubernetes/typed/certificates/v1"
3637
"k8s.io/client-go/rest"
3738
"k8s.io/client-go/util/cert"
3839
"k8s.io/kubernetes/test/e2e/framework"
@@ -41,20 +42,20 @@ import (
4142
"github.com/onsi/ginkgo"
4243
)
4344

44-
var _ = SIGDescribe("Certificates API", func() {
45+
var _ = SIGDescribe("Certificates API [Privileged:ClusterAdmin]", func() {
4546
f := framework.NewDefaultFramework("certificates")
4647

4748
/*
4849
Release: v1.19
4950
Testname: CertificateSigningRequest API Client Certificate
5051
Description:
51-
- The certificatesigningrequests resource must accept a request for a certificate signed by kubernetes.io/kube-apiserver-client.
52-
- The issued certificate must be valid as a client certificate used to authenticate to the kube-apiserver.
52+
The certificatesigningrequests resource must accept a request for a certificate signed by kubernetes.io/kube-apiserver-client.
53+
The issued certificate must be valid as a client certificate used to authenticate to the kube-apiserver.
5354
*/
54-
ginkgo.It("should support building a client with a CSR", func() {
55+
framework.ConformanceIt("should support building a client with a CSR", func() {
5556
const commonName = "tester-csr"
5657

57-
csrClient := f.ClientSet.CertificatesV1beta1().CertificateSigningRequests()
58+
csrClient := f.ClientSet.CertificatesV1().CertificateSigningRequests()
5859

5960
pk, err := utils.NewPrivateKey()
6061
framework.ExpectNoError(err)
@@ -68,19 +69,18 @@ var _ = SIGDescribe("Certificates API", func() {
6869
csrb, err := cert.MakeCSR(pk, &pkix.Name{CommonName: commonName}, nil, nil)
6970
framework.ExpectNoError(err)
7071

71-
apiserverClientSigner := certificatesv1beta1.KubeAPIServerClientSignerName
72-
csrTemplate := &certificatesv1beta1.CertificateSigningRequest{
72+
csrTemplate := &certificatesv1.CertificateSigningRequest{
7373
ObjectMeta: metav1.ObjectMeta{
7474
GenerateName: commonName + "-",
7575
},
76-
Spec: certificatesv1beta1.CertificateSigningRequestSpec{
76+
Spec: certificatesv1.CertificateSigningRequestSpec{
7777
Request: csrb,
78-
Usages: []certificatesv1beta1.KeyUsage{
79-
certificatesv1beta1.UsageDigitalSignature,
80-
certificatesv1beta1.UsageKeyEncipherment,
81-
certificatesv1beta1.UsageClientAuth,
78+
Usages: []certificatesv1.KeyUsage{
79+
certificatesv1.UsageDigitalSignature,
80+
certificatesv1.UsageKeyEncipherment,
81+
certificatesv1.UsageClientAuth,
8282
},
83-
SignerName: &apiserverClientSigner,
83+
SignerName: certificatesv1.KubeAPIServerClientSignerName,
8484
},
8585
}
8686

@@ -121,14 +121,15 @@ var _ = SIGDescribe("Certificates API", func() {
121121

122122
framework.Logf("approving CSR")
123123
framework.ExpectNoError(wait.Poll(5*time.Second, time.Minute, func() (bool, error) {
124-
csr.Status.Conditions = []certificatesv1beta1.CertificateSigningRequestCondition{
124+
csr.Status.Conditions = []certificatesv1.CertificateSigningRequestCondition{
125125
{
126-
Type: certificatesv1beta1.CertificateApproved,
126+
Type: certificatesv1.CertificateApproved,
127+
Status: v1.ConditionTrue,
127128
Reason: "E2E",
128129
Message: "Set from an e2e test",
129130
},
130131
}
131-
csr, err = csrClient.UpdateApproval(context.TODO(), csr, metav1.UpdateOptions{})
132+
csr, err = csrClient.UpdateApproval(context.TODO(), csr.Name, csr, metav1.UpdateOptions{})
132133
if err != nil {
133134
csr, _ = csrClient.Get(context.TODO(), csr.Name, metav1.GetOptions{})
134135
framework.Logf("err updating approval: %v", err)
@@ -174,20 +175,20 @@ var _ = SIGDescribe("Certificates API", func() {
174175
Release: v1.19
175176
Testname: CertificateSigningRequest API
176177
Description:
177-
- The certificates.k8s.io API group MUST exists in the /apis discovery document.
178-
- The certificates.k8s.io/v1beta1 API group/version MUST exist in the /apis/certificates.k8s.io discovery document.
179-
- The certificatesigningrequests, certificatesigningrequests/approval, and certificatesigningrequests/status
180-
resources MUST exist in the /apis/certificates.k8s.io/v1beta1 discovery document.
181-
- The certificatesigningrequests resource must support create, get, list, watch, update, patch, delete, and deletecollection.
182-
- The certificatesigningrequests/approval resource must support get, update, patch.
183-
- The certificatesigningrequests/status resource must support get, update, patch.
178+
The certificates.k8s.io API group MUST exists in the /apis discovery document.
179+
The certificates.k8s.io/v1 API group/version MUST exist in the /apis/certificates.k8s.io discovery document.
180+
The certificatesigningrequests, certificatesigningrequests/approval, and certificatesigningrequests/status
181+
resources MUST exist in the /apis/certificates.k8s.io/v1 discovery document.
182+
The certificatesigningrequests resource must support create, get, list, watch, update, patch, delete, and deletecollection.
183+
The certificatesigningrequests/approval resource must support get, update, patch.
184+
The certificatesigningrequests/status resource must support get, update, patch.
184185
*/
185-
ginkgo.It("should support CSR API operations [Privileged:ClusterAdmin]", func() {
186+
framework.ConformanceIt("should support CSR API operations", func() {
186187

187188
// Setup
188-
csrVersion := "v1beta1"
189-
csrClient := f.ClientSet.CertificatesV1beta1().CertificateSigningRequests()
190-
csrResource := certificatesv1beta1.SchemeGroupVersion.WithResource("certificatesigningrequests")
189+
csrVersion := "v1"
190+
csrClient := f.ClientSet.CertificatesV1().CertificateSigningRequests()
191+
csrResource := certificatesv1.SchemeGroupVersion.WithResource("certificatesigningrequests")
191192

192193
pk, err := utils.NewPrivateKey()
193194
framework.ExpectNoError(err)
@@ -201,12 +202,12 @@ var _ = SIGDescribe("Certificates API", func() {
201202
framework.ExpectNoError(err)
202203

203204
signerName := "example.com/e2e-" + f.UniqueName
204-
csrTemplate := &certificatesv1beta1.CertificateSigningRequest{
205+
csrTemplate := &certificatesv1.CertificateSigningRequest{
205206
ObjectMeta: metav1.ObjectMeta{GenerateName: "e2e-example-csr-"},
206-
Spec: certificatesv1beta1.CertificateSigningRequestSpec{
207+
Spec: certificatesv1.CertificateSigningRequestSpec{
207208
Request: csrData,
208-
SignerName: &signerName,
209-
Usages: []certificatesv1beta1.KeyUsage{certificatesv1beta1.UsageDigitalSignature, certificatesv1beta1.UsageKeyEncipherment, certificatesv1beta1.UsageServerAuth},
209+
SignerName: signerName,
210+
Usages: []certificatesv1.KeyUsage{certificatesv1.UsageDigitalSignature, certificatesv1.UsageKeyEncipherment, certificatesv1.UsageServerAuth},
210211
},
211212
}
212213

@@ -218,7 +219,7 @@ var _ = SIGDescribe("Certificates API", func() {
218219
framework.ExpectNoError(err)
219220
found := false
220221
for _, group := range discoveryGroups.Groups {
221-
if group.Name == certificatesv1beta1.GroupName {
222+
if group.Name == certificatesv1.GroupName {
222223
for _, version := range group.Versions {
223224
if version.Version == csrVersion {
224225
found = true
@@ -247,7 +248,7 @@ var _ = SIGDescribe("Certificates API", func() {
247248

248249
ginkgo.By("getting /apis/certificates.k8s.io/" + csrVersion)
249250
{
250-
resources, err := f.ClientSet.Discovery().ServerResourcesForGroupVersion(certificatesv1beta1.SchemeGroupVersion.String())
251+
resources, err := f.ClientSet.Discovery().ServerResourcesForGroupVersion(certificatesv1.SchemeGroupVersion.String())
251252
framework.ExpectNoError(err)
252253
foundCSR, foundApproval, foundStatus := false, false, false
253254
for _, resource := range resources.APIResources {
@@ -308,7 +309,7 @@ var _ = SIGDescribe("Certificates API", func() {
308309
case evt, ok := <-csrWatch.ResultChan():
309310
framework.ExpectEqual(ok, true, "watch channel should not close")
310311
framework.ExpectEqual(evt.Type, watch.Modified)
311-
watchedCSR, isCSR := evt.Object.(*certificatesv1beta1.CertificateSigningRequest)
312+
watchedCSR, isCSR := evt.Object.(*certificatesv1.CertificateSigningRequest)
312313
framework.ExpectEqual(isCSR, true, fmt.Sprintf("expected CSR, got %T", evt.Object))
313314
if watchedCSR.Annotations["patched"] == "true" {
314315
framework.Logf("saw patched and updated annotations")
@@ -327,7 +328,7 @@ var _ = SIGDescribe("Certificates API", func() {
327328
ginkgo.By("getting /approval")
328329
gottenApproval, err := f.DynamicClient.Resource(csrResource).Get(context.TODO(), createdCSR.Name, metav1.GetOptions{}, "approval")
329330
framework.ExpectNoError(err)
330-
framework.ExpectEqual(gottenApproval.GetObjectKind().GroupVersionKind(), certificatesv1beta1.SchemeGroupVersion.WithKind("CertificateSigningRequest"))
331+
framework.ExpectEqual(gottenApproval.GetObjectKind().GroupVersionKind(), certificatesv1.SchemeGroupVersion.WithKind("CertificateSigningRequest"))
331332
framework.ExpectEqual(gottenApproval.GetUID(), createdCSR.UID)
332333

333334
ginkgo.By("patching /approval")
@@ -341,22 +342,23 @@ var _ = SIGDescribe("Certificates API", func() {
341342

342343
ginkgo.By("updating /approval")
343344
approvalToUpdate := patchedApproval.DeepCopy()
344-
approvalToUpdate.Status.Conditions = append(approvalToUpdate.Status.Conditions, certificatesv1beta1.CertificateSigningRequestCondition{
345-
Type: certificatesv1beta1.CertificateApproved,
345+
approvalToUpdate.Status.Conditions = append(approvalToUpdate.Status.Conditions, certificatesv1.CertificateSigningRequestCondition{
346+
Type: certificatesv1.CertificateApproved,
347+
Status: v1.ConditionTrue,
346348
Reason: "E2E",
347349
Message: "Set from an e2e test",
348350
})
349-
updatedApproval, err := csrClient.UpdateApproval(context.TODO(), approvalToUpdate, metav1.UpdateOptions{})
351+
updatedApproval, err := csrClient.UpdateApproval(context.TODO(), approvalToUpdate.Name, approvalToUpdate, metav1.UpdateOptions{})
350352
framework.ExpectNoError(err)
351353
framework.ExpectEqual(len(updatedApproval.Status.Conditions), 2, fmt.Sprintf("updated object should have the applied condition, got %#v", updatedApproval.Status.Conditions))
352-
framework.ExpectEqual(updatedApproval.Status.Conditions[1].Type, certificatesv1beta1.CertificateApproved, fmt.Sprintf("updated object should have the approved condition, got %#v", updatedApproval.Status.Conditions))
354+
framework.ExpectEqual(updatedApproval.Status.Conditions[1].Type, certificatesv1.CertificateApproved, fmt.Sprintf("updated object should have the approved condition, got %#v", updatedApproval.Status.Conditions))
353355

354356
// /status subresource operations
355357

356358
ginkgo.By("getting /status")
357359
gottenStatus, err := f.DynamicClient.Resource(csrResource).Get(context.TODO(), createdCSR.Name, metav1.GetOptions{}, "status")
358360
framework.ExpectNoError(err)
359-
framework.ExpectEqual(gottenStatus.GetObjectKind().GroupVersionKind(), certificatesv1beta1.SchemeGroupVersion.WithKind("CertificateSigningRequest"))
361+
framework.ExpectEqual(gottenStatus.GetObjectKind().GroupVersionKind(), certificatesv1.SchemeGroupVersion.WithKind("CertificateSigningRequest"))
360362
framework.ExpectEqual(gottenStatus.GetUID(), createdCSR.UID)
361363

362364
ginkgo.By("patching /status")
@@ -369,8 +371,9 @@ var _ = SIGDescribe("Certificates API", func() {
369371

370372
ginkgo.By("updating /status")
371373
statusToUpdate := patchedStatus.DeepCopy()
372-
statusToUpdate.Status.Conditions = append(statusToUpdate.Status.Conditions, certificatesv1beta1.CertificateSigningRequestCondition{
374+
statusToUpdate.Status.Conditions = append(statusToUpdate.Status.Conditions, certificatesv1.CertificateSigningRequestCondition{
373375
Type: "StatusUpdate",
376+
Status: v1.ConditionTrue,
374377
Reason: "E2E",
375378
Message: "Set from an e2e test",
376379
})

0 commit comments

Comments
 (0)