mirror of
https://github.com/hanzoai/cd.git
synced 2026-10-30 14:56:45 +00:00
zeekay
01a52090a9
clientgen/mockgen hadn't been rerun since the group rename, even though
pkg/apis/application/v1alpha1/doc.go and the shipped CRDs already say
apps.hanzo.ai. pkg/client/** still derived ArgoprojV1alpha1/Argoproj()
from the old argoproj.io group, and .mockery.yaml still named ArgoDB
(renamed to DB in util/db/db.go a few commits back) and
util/notification/cd (deleted in b2d7140a0, we use hanzoai/notify).
Reran clientgen (deepcopy-gen/client-gen/lister-gen/informer-gen) off
the current group, and mockgen after fixing .mockery.yaml. Moved every
hand-written call site that holds a versioned.Interface or
SharedInformerFactory with it: .ArgoprojV1alpha1() -> .AppsV1alpha1(),
ArgoprojV1alpha1Interface/Client -> AppsV1alpha1Interface/Client,
.Argoproj() -> .Apps() across controller, server, util, cmd,
hack/gen-resources, and test/e2e. controller/metrics/metrics_test.go's
mocks.NewArgoDB -> mocks.NewDB. Deleted the orphaned
util/db/mocks/ArgoDB.go; mockery writes DB.go for the renamed
interface but doesn't clean up the old filename on its own.
Left CHANGELOG.md/SECURITY.md's real argoproj/argo-cd history and
gitops-engine/pkg/diff/testdata/openapiv2.bin's Argo Rollouts OpenAPI
fixture untouched - genuine history and a real third-party schema, not
our naming.
go build/vet clean. Same 19 pre-existing package-level test failures
as baseline (missing git-verify-wrapper.sh, no live cluster, etc.),
none new. All 32 manifests/ kustomization paths still build;
manifests/ha/** untouched.
225 lines
7.3 KiB
Go
225 lines
7.3 KiB
Go
package e2e
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/hanzoai/cd/test/e2e/fixture/project"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
rbacv1 "k8s.io/api/rbac/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
|
|
"github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/test/e2e/fixture"
|
|
. "github.com/hanzoai/cd/test/e2e/fixture/app"
|
|
)
|
|
|
|
const (
|
|
WaitDuration = time.Second
|
|
TimeoutDuration = time.Second * 3
|
|
)
|
|
|
|
func TestSyncWithFeatureDisabled(t *testing.T) {
|
|
Given(t).
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationDisabled().
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature disabled, Application sync should continue to use
|
|
// the control plane service account for the sync operation and the sync should succeed.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeSynced), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("successfully synced"))
|
|
}
|
|
|
|
func TestSyncWithNoDestinationServiceAccountsInProject(t *testing.T) {
|
|
Given(t).
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled("", nil).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync must fail
|
|
// when there are no destination service accounts configured in AppProject
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeOutOfSync), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("no matching service account found for destination server"))
|
|
}
|
|
|
|
func TestSyncWithNoDestinationServiceAccountsAndEnforcementDisabled(t *testing.T) {
|
|
Given(t).
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled("", nil).
|
|
WithImpersonationEnforcementDisabled().
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, but not enforced, Application sync must succeed
|
|
// by using the controller service account for the sync operation.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeSynced), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("successfully synced"))
|
|
}
|
|
|
|
func TestSyncWithImpersonateWithSyncServiceAccount(t *testing.T) {
|
|
serviceAccountName := "test-account"
|
|
|
|
projectCtx := project.Given(t)
|
|
appCtx := GivenWithSameState(projectCtx)
|
|
|
|
projectCtx.
|
|
Name("sync-test-project").
|
|
SourceNamespaces([]string{"*"}).
|
|
SourceRepositories([]string{"*"}).
|
|
Destination("*,*").
|
|
DestinationServiceAccounts(
|
|
[]string{
|
|
fmt.Sprintf("%s,%s,%s", "*", projectCtx.DeploymentNamespace(), serviceAccountName),
|
|
fmt.Sprintf("%s,%s,%s", v1alpha1.KubernetesInternalAPIServerAddr, projectCtx.DeploymentNamespace(), "missing-serviceAccount"),
|
|
}).
|
|
When().
|
|
Create().
|
|
Then().
|
|
Expect()
|
|
|
|
appCtx.
|
|
Project(projectCtx.GetName()).
|
|
SetTrackingMethod("annotation").
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled(serviceAccountName, []rbacv1.PolicyRule{
|
|
{
|
|
APIGroups: []string{"apps", ""},
|
|
Resources: []string{"deployments"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
{
|
|
APIGroups: []string{""},
|
|
Resources: []string{"services"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
}).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync should succeed
|
|
// as there is a valid match found in the available destination service accounts configured in AppProject
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeSynced), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("successfully synced"))
|
|
}
|
|
|
|
func TestSyncWithMissingServiceAccount(t *testing.T) {
|
|
serviceAccountName := "test-account"
|
|
|
|
projectCtx := project.Given(t)
|
|
appCtx := GivenWithSameState(projectCtx)
|
|
|
|
projectCtx.
|
|
Name("false-test-project").
|
|
SourceNamespaces([]string{"*"}).
|
|
SourceRepositories([]string{"*"}).
|
|
Destination("*,*").
|
|
DestinationServiceAccounts(
|
|
[]string{
|
|
fmt.Sprintf("%s,%s,%s", v1alpha1.KubernetesInternalAPIServerAddr, projectCtx.DeploymentNamespace(), "missing-serviceAccount"),
|
|
fmt.Sprintf("%s,%s,%s", "*", projectCtx.DeploymentNamespace(), serviceAccountName),
|
|
}).
|
|
When().
|
|
Create().
|
|
Then().
|
|
Expect()
|
|
|
|
appCtx.
|
|
Project(projectCtx.GetName()).
|
|
SetTrackingMethod("annotation").
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled(serviceAccountName, []rbacv1.PolicyRule{
|
|
{
|
|
APIGroups: []string{"apps", ""},
|
|
Resources: []string{"deployments"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
{
|
|
APIGroups: []string{""},
|
|
Resources: []string{"services"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
}).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync must fail
|
|
// when there is a valid match found in the available destination service accounts configured in AppProject,
|
|
// but the matching service account is missing.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeOutOfSync), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("one or more objects failed to apply"))
|
|
}
|
|
|
|
func TestSyncWithValidSAButDisallowedDestination(t *testing.T) {
|
|
serviceAccountName := "test-account"
|
|
|
|
projectCtx := project.Given(t)
|
|
appCtx := GivenWithSameState(projectCtx)
|
|
|
|
projectCtx.
|
|
Name("negation-test-project").
|
|
SourceNamespaces([]string{"*"}).
|
|
SourceRepositories([]string{"*"}).
|
|
Destination("*,*").
|
|
DestinationServiceAccounts(
|
|
[]string{
|
|
fmt.Sprintf("%s,%s,%s", "*", projectCtx.DeploymentNamespace(), serviceAccountName),
|
|
}).
|
|
When().
|
|
Create().
|
|
Then().
|
|
Expect()
|
|
|
|
appCtx.
|
|
Project(projectCtx.GetName()).
|
|
SetTrackingMethod("annotation").
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled(serviceAccountName, []rbacv1.PolicyRule{
|
|
{
|
|
APIGroups: []string{"apps", ""},
|
|
Resources: []string{"deployments"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
{
|
|
APIGroups: []string{""},
|
|
Resources: []string{"services"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
}).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
Expect(SyncStatusIs(v1alpha1.SyncStatusCodeSynced)).
|
|
When().
|
|
And(func() {
|
|
// Patch destination to disallow target destination namespace
|
|
patch := fmt.Appendf(nil, `{"spec": {"destinations": [{"namespace": %q}]}}`, "!"+appCtx.DeploymentNamespace())
|
|
|
|
_, err := fixture.AppClientset.AppsV1alpha1().AppProjects(fixture.TestNamespace()).Patch(t.Context(), projectCtx.GetName(), types.MergePatchType, patch, metav1.PatchOptions{})
|
|
require.NoError(t, err)
|
|
}).
|
|
Refresh(v1alpha1.RefreshTypeNormal).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync must fail
|
|
// as there is a valid match found in the available destination service accounts configured in AppProject
|
|
// but the destination namespace is now disallowed.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeUnknown), WaitDuration, TimeoutDuration)
|
|
}
|