mirror of
https://github.com/hanzoai/cd.git
synced 2026-10-30 14:56:45 +00:00
zeekayandHanzo Dev
cbf668a980
go fix applied the modernizers: promoted-field keys in struct literals,
strings.Cut, SplitSeq, new(expr), slices and maps helpers, wg.Go, reflect.TypeFor
and errors.AsType. omitzero is left out, since omitting a zero struct such as
time.Time{} is a per-field wire decision and not a mechanical one.
Two changes the modernizers could not make for themselves. AsType needs its type
argument to be an error, so the git exit-status reader embeds error in the
interface it asks for. And an error built by concatenating a tag list into its
own format string now says so with a verb, which is what vet was pointing at.
Co-authored-by: Hanzo Dev <[email protected]>
342 lines
9.0 KiB
Go
342 lines
9.0 KiB
Go
package application
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/hanzoai/cd/gitops-engine/pkg/utils/kube"
|
|
"github.com/stretchr/testify/assert"
|
|
corev1 "k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
appv1 "github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/util/cd"
|
|
"github.com/hanzoai/cd/util/security"
|
|
)
|
|
|
|
func TestPodExists(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
podName string
|
|
namespace string
|
|
treeNodes []appv1.ResourceNode
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "empty tree nodes",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "matched Pod but empty UID",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{Name: "test-pod", Namespace: "test", UID: "", Kind: kube.PodKind}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "matched Pod",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{Name: "test-pod", Namespace: "test", UID: "testUID", Kind: kube.PodKind}},
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "unmatched Pod Namespace",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{Name: "test-pod", Namespace: "test-A", UID: "testUID", Kind: kube.PodKind}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "unmatched Kind",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{Name: "test-pod", Namespace: "test-A", UID: "testUID", Kind: kube.DeploymentKind}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "unmatched Group",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{Name: "test-pod", Namespace: "test", UID: "testUID", Group: "A", Kind: kube.PodKind}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "unmatched Pod Name",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{Name: "test", Namespace: "test", UID: "testUID", Kind: kube.PodKind}},
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := podExists(tcase.treeNodes, tcase.podName, tcase.namespace)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestContainerRunning(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
pod *corev1.Pod
|
|
containerName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "empty container",
|
|
pod: &corev1.Pod{},
|
|
containerName: "",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "container not found",
|
|
pod: &corev1.Pod{},
|
|
containerName: "not-found",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "container running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
ContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test",
|
|
State: corev1.ContainerState{
|
|
Running: &corev1.ContainerStateRunning{
|
|
StartedAt: metav1.NewTime(time.Now()),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "init container running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
ContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test",
|
|
State: corev1.ContainerState{
|
|
Running: &corev1.ContainerStateRunning{
|
|
StartedAt: metav1.NewTime(time.Now()),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
InitContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test-init",
|
|
State: corev1.ContainerState{
|
|
Running: &corev1.ContainerStateRunning{
|
|
StartedAt: metav1.NewTime(time.Now()),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test-init",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "container not running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
ContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test",
|
|
State: corev1.ContainerState{
|
|
Running: nil,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "init container not running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
InitContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test-init",
|
|
State: corev1.ContainerState{
|
|
Running: nil,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test-init",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := containerRunning(tcase.pod, tcase.containerName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsValidPodName(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
resourceName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "valid pod name",
|
|
resourceName: "cd-server-794644486d-r8v9d",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "not valid contains spaces",
|
|
resourceName: "kubectl delete pods",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid",
|
|
resourceName: "kubectl -n kube-system delete pods --all",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid contains special characters",
|
|
resourceName: "delete+*+from+etcd%3b",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := cd.IsValidPodName(tcase.resourceName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsValidNamespaceName(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
resourceName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "valid pod namespace name",
|
|
resourceName: "cd",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "not valid contains spaces",
|
|
resourceName: "kubectl delete ns cd",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid contains special characters",
|
|
resourceName: "delete+*+from+etcd%3b",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := cd.IsValidNamespaceName(tcase.resourceName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsValidContainerNameName(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
resourceName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "valid container name",
|
|
resourceName: "cd-server",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "not valid contains spaces",
|
|
resourceName: "kubectl delete pods",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid contains special characters",
|
|
resourceName: "delete+*+from+etcd%3b",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := cd.IsValidContainerName(tcase.resourceName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestTerminalHandler_ServeHTTP_empty_params(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
testKeys := []string{
|
|
"pod",
|
|
"container",
|
|
"app",
|
|
"project",
|
|
"namespace",
|
|
}
|
|
|
|
// test both empty and invalid
|
|
testValues := []string{"", "invalid%20name"}
|
|
|
|
for _, testKey := range testKeys {
|
|
testKeyCopy := testKey
|
|
|
|
for _, testValue := range testValues {
|
|
testValueCopy := testValue
|
|
|
|
t.Run(testKeyCopy+" "+testValueCopy, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
handler := terminalHandler{}
|
|
params := map[string]string{
|
|
"pod": "valid",
|
|
"container": "valid",
|
|
"app": "valid",
|
|
"project": "valid",
|
|
"namespace": "valid",
|
|
}
|
|
params[testKeyCopy] = testValueCopy
|
|
var paramsArray []string
|
|
for key, value := range params {
|
|
paramsArray = append(paramsArray, key+"="+value)
|
|
}
|
|
paramsString := strings.Join(paramsArray, "&")
|
|
request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "https://cd.example.com/terminal?"+paramsString, http.NoBody)
|
|
recorder := httptest.NewRecorder()
|
|
handler.ServeHTTP(recorder, request)
|
|
response := recorder.Result()
|
|
assert.Equal(t, http.StatusBadRequest, response.StatusCode)
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestTerminalHandler_ServeHTTP_disallowed_namespace(t *testing.T) {
|
|
handler := terminalHandler{namespace: "cd", enabledNamespaces: []string{"allowed"}}
|
|
request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "https://cd.example.com/terminal?pod=valid&container=valid&appName=valid&projectName=valid&namespace=test&appNamespace=disallowed", http.NoBody)
|
|
recorder := httptest.NewRecorder()
|
|
handler.ServeHTTP(recorder, request)
|
|
response := recorder.Result()
|
|
assert.Equal(t, http.StatusForbidden, response.StatusCode)
|
|
assert.Equal(t, security.NamespaceNotPermittedError("disallowed").Error()+"\n", recorder.Body.String())
|
|
}
|