Skip to content

Commit 49f5e33

Browse files
ecordellecordell
committed
test(certs): add a test the ensures services do not get the same
ownerref added twice
1 parent 4869be8 commit 49f5e33

File tree

1 file changed

+218
-7
lines changed

1 file changed

+218
-7
lines changed

‎pkg/controller/install/certresources_test.go

Lines changed: 218 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,17 @@ func newFakeLister(state fakeState) *operatorlisterfakes.FakeOperatorLister {
106106
}
107107

108108
func TestInstallCertRequirementsForDeployment(t *testing.T) {
109+
owner := ownerutil.Owner(&v1alpha1.ClusterServiceVersion{
110+
TypeMeta: metav1.TypeMeta{
111+
Kind: v1alpha1.ClusterServiceVersionKind,
112+
APIVersion: v1alpha1.ClusterServiceVersionAPIVersion,
113+
},
114+
ObjectMeta: metav1.ObjectMeta{
115+
Name: "owner",
116+
Namespace: "test-namespace",
117+
UID: "123-uid",
118+
},
119+
})
109120
ca := keyPair(t, time.Now().Add(time.Hour))
110121
caPEM, _, err := ca.ToPEM()
111122
assert.NoError(t, err)
@@ -143,7 +154,7 @@ func TestInstallCertRequirementsForDeployment(t *testing.T) {
143154
mockOpClient.EXPECT().DeleteService(namespace, "test-service", &metav1.DeleteOptions{}).Return(nil)
144155
service := corev1.Service{
145156
ObjectMeta: metav1.ObjectMeta{
146-
Name: "test-service",
157+
Name: "test-service",
147158
OwnerReferences: []metav1.OwnerReference{
148159
ownerutil.NonBlockingOwner(&v1alpha1.ClusterServiceVersion{}),
149160
},
@@ -168,13 +179,14 @@ func TestInstallCertRequirementsForDeployment(t *testing.T) {
168179

169180
secret := &corev1.Secret{
170181
ObjectMeta: metav1.ObjectMeta{
171-
Name: "test-service-cert",
172-
Namespace: namespace,
182+
Name: "test-service-cert",
183+
Namespace: namespace,
173184
Annotations: map[string]string{OLMCAHashAnnotationKey: caHash},
174185
},
175186
Data: map[string][]byte{
176-
"tls.crt": certPEM,
177-
"tls.key": privPEM,
187+
"tls.crt": certPEM,
188+
"tls.key": privPEM,
189+
OLMCAPEMKey: caPEM,
178190
},
179191
Type: corev1.SecretTypeTLS,
180192
}
@@ -333,6 +345,205 @@ func TestInstallCertRequirementsForDeployment(t *testing.T) {
333345
},
334346
},
335347
},
348+
{
349+
name: "doesn't add duplicate service ownerrefs",
350+
mockExternal: func(mockOpClient *operatorclientmocks.MockClientInterface, fakeLister *operatorlisterfakes.FakeOperatorLister, namespace string, args args) {
351+
mockOpClient.EXPECT().DeleteService(namespace, "test-service", &metav1.DeleteOptions{}).Return(nil)
352+
service := corev1.Service{
353+
ObjectMeta: metav1.ObjectMeta{
354+
Name: "test-service",
355+
Namespace: owner.GetNamespace(),
356+
OwnerReferences: []metav1.OwnerReference{
357+
ownerutil.NonBlockingOwner(owner),
358+
},
359+
},
360+
Spec: corev1.ServiceSpec{
361+
Ports: args.ports,
362+
Selector: selector(t, "test=label").MatchLabels,
363+
},
364+
}
365+
mockOpClient.EXPECT().CreateService(&service).Return(&service, nil)
366+
367+
hosts := []string{
368+
fmt.Sprintf("%s.%s", service.GetName(), namespace),
369+
fmt.Sprintf("%s.%s.svc", service.GetName(), namespace),
370+
}
371+
servingPair, err := certGenerator.Generate(args.rotateAt, Organization, args.ca, hosts)
372+
require.NoError(t, err)
373+
374+
// Create Secret for serving cert
375+
certPEM, privPEM, err := servingPair.ToPEM()
376+
require.NoError(t, err)
377+
378+
secret := &corev1.Secret{
379+
ObjectMeta: metav1.ObjectMeta{
380+
Name: "test-service-cert",
381+
Namespace: namespace,
382+
Annotations: map[string]string{OLMCAHashAnnotationKey: caHash},
383+
},
384+
Data: map[string][]byte{
385+
"tls.crt": certPEM,
386+
"tls.key": privPEM,
387+
OLMCAPEMKey: caPEM,
388+
},
389+
Type: corev1.SecretTypeTLS,
390+
}
391+
mockOpClient.EXPECT().UpdateSecret(secret).Return(secret, nil)
392+
393+
secretRole := &rbacv1.Role{
394+
ObjectMeta: metav1.ObjectMeta{
395+
Name: secret.GetName(),
396+
Namespace: namespace,
397+
},
398+
Rules: []rbacv1.PolicyRule{
399+
{
400+
Verbs: []string{"get"},
401+
APIGroups: []string{""},
402+
Resources: []string{"secrets"},
403+
ResourceNames: []string{secret.GetName()},
404+
},
405+
},
406+
}
407+
mockOpClient.EXPECT().UpdateRole(secretRole).Return(secretRole, nil)
408+
409+
roleBinding := &rbacv1.RoleBinding{
410+
ObjectMeta: metav1.ObjectMeta{
411+
Name: secret.GetName(),
412+
Namespace: namespace,
413+
},
414+
Subjects: []rbacv1.Subject{
415+
{
416+
Kind: "ServiceAccount",
417+
APIGroup: "",
418+
Name: "test-sa",
419+
Namespace: namespace,
420+
},
421+
},
422+
RoleRef: rbacv1.RoleRef{
423+
APIGroup: "rbac.authorization.k8s.io",
424+
Kind: "Role",
425+
Name: secretRole.GetName(),
426+
},
427+
}
428+
mockOpClient.EXPECT().UpdateRoleBinding(roleBinding).Return(roleBinding, nil)
429+
430+
authDelegatorClusterRoleBinding := &rbacv1.ClusterRoleBinding{
431+
ObjectMeta: metav1.ObjectMeta{
432+
Name: service.GetName() + "-system:auth-delegator",
433+
},
434+
Subjects: []rbacv1.Subject{
435+
{
436+
Kind: "ServiceAccount",
437+
APIGroup: "",
438+
Name: "test-sa",
439+
Namespace: namespace,
440+
},
441+
},
442+
RoleRef: rbacv1.RoleRef{
443+
APIGroup: "rbac.authorization.k8s.io",
444+
Kind: "ClusterRole",
445+
Name: "system:auth-delegator",
446+
},
447+
}
448+
449+
mockOpClient.EXPECT().UpdateClusterRoleBinding(authDelegatorClusterRoleBinding).Return(authDelegatorClusterRoleBinding, nil)
450+
451+
authReaderRoleBinding := &rbacv1.RoleBinding{
452+
Subjects: []rbacv1.Subject{
453+
{
454+
Kind: "ServiceAccount",
455+
APIGroup: "",
456+
Name: args.depSpec.Template.Spec.ServiceAccountName,
457+
Namespace: namespace,
458+
},
459+
},
460+
RoleRef: rbacv1.RoleRef{
461+
APIGroup: "rbac.authorization.k8s.io",
462+
Kind: "Role",
463+
Name: "extension-apiserver-authentication-reader",
464+
},
465+
}
466+
authReaderRoleBinding.SetName(service.GetName() + "-auth-reader")
467+
authReaderRoleBinding.SetNamespace(KubeSystem)
468+
469+
mockOpClient.EXPECT().UpdateRoleBinding(authReaderRoleBinding).Return(authReaderRoleBinding, nil)
470+
},
471+
state: fakeState{
472+
existingService: &corev1.Service{
473+
ObjectMeta: metav1.ObjectMeta{
474+
Namespace: owner.GetNamespace(),
475+
OwnerReferences: []metav1.OwnerReference{
476+
ownerutil.NonBlockingOwner(owner),
477+
},
478+
},
479+
},
480+
existingSecret: &corev1.Secret{
481+
ObjectMeta: metav1.ObjectMeta{},
482+
},
483+
existingRole: &rbacv1.Role{
484+
ObjectMeta: metav1.ObjectMeta{},
485+
},
486+
existingRoleBinding: &rbacv1.RoleBinding{
487+
ObjectMeta: metav1.ObjectMeta{},
488+
},
489+
existingClusterRoleBinding: &rbacv1.ClusterRoleBinding{
490+
ObjectMeta: metav1.ObjectMeta{},
491+
},
492+
},
493+
fields: fields{
494+
owner: owner,
495+
previousStrategy: nil,
496+
templateAnnotations: nil,
497+
initializers: nil,
498+
apiServiceDescriptions: []certResource{},
499+
webhookDescriptions: []certResource{},
500+
},
501+
args: args{
502+
deploymentName: "test",
503+
ca: ca,
504+
rotateAt: time.Now().Add(time.Hour),
505+
ports: []corev1.ServicePort{},
506+
depSpec: appsv1.DeploymentSpec{
507+
Selector: selector(t, "test=label"),
508+
Template: corev1.PodTemplateSpec{
509+
Spec: corev1.PodSpec{
510+
ServiceAccountName: "test-sa",
511+
},
512+
},
513+
},
514+
},
515+
want: &appsv1.DeploymentSpec{
516+
Selector: selector(t, "test=label"),
517+
Template: corev1.PodTemplateSpec{
518+
ObjectMeta: metav1.ObjectMeta{
519+
Annotations: map[string]string{OLMCAHashAnnotationKey: caHash},
520+
},
521+
Spec: corev1.PodSpec{
522+
ServiceAccountName: "test-sa",
523+
Volumes: []corev1.Volume{
524+
{
525+
Name: "apiservice-cert",
526+
VolumeSource: corev1.VolumeSource{
527+
Secret: &corev1.SecretVolumeSource{
528+
SecretName: "test-service-cert",
529+
Items: []corev1.KeyToPath{
530+
{
531+
Key: "tls.crt",
532+
Path: "apiserver.crt",
533+
},
534+
{
535+
Key: "tls.key",
536+
Path: "apiserver.key",
537+
},
538+
},
539+
},
540+
},
541+
},
542+
},
543+
},
544+
},
545+
},
546+
},
336547
}
337548
for _, tt := range tests {
338549
t.Run(tt.name, func(t *testing.T) {
@@ -355,13 +566,13 @@ func TestInstallCertRequirementsForDeployment(t *testing.T) {
355566
apiServiceDescriptions: tt.fields.apiServiceDescriptions,
356567
webhookDescriptions: tt.fields.webhookDescriptions,
357568
}
358-
got, err := i.installCertRequirementsForDeployment(tt.args.deploymentName, tt.args.ca, tt.args.rotateAt, tt.args.depSpec, tt.args.ports)
569+
got, _, err := i.installCertRequirementsForDeployment(tt.args.deploymentName, tt.args.ca, tt.args.rotateAt, tt.args.depSpec, tt.args.ports)
359570
if (err != nil) != tt.wantErr {
360571
t.Errorf("installCertRequirementsForDeployment() error = %v, wantErr %v", err, tt.wantErr)
361572
return
362573
}
363574
if !reflect.DeepEqual(got, tt.want) {
364-
t.Errorf("installCertRequirementsForDeployment() got = %v, want %v", got, tt.want)
575+
t.Errorf("installCertRequirementsForDeployment() \n got = %v \n want = %v", got, tt.want)
365576
}
366577
})
367578
}

0 commit comments

Comments
 (0)