mirror of
https://github.com/hanzoai/cd.git
synced 2026-10-30 14:56:45 +00:00
zeekayandHanzo Dev
cbf668a980
go fix applied the modernizers: promoted-field keys in struct literals,
strings.Cut, SplitSeq, new(expr), slices and maps helpers, wg.Go, reflect.TypeFor
and errors.AsType. omitzero is left out, since omitting a zero struct such as
time.Time{} is a per-field wire decision and not a mechanical one.
Two changes the modernizers could not make for themselves. AsType needs its type
argument to be an error, so the git exit-status reader embeds error in the
interface it asks for. And an error built by concatenating a tag list into its
own format string now says so with a verb, which is what vet was pointing at.
Co-authored-by: Hanzo Dev <[email protected]>
280 lines
8.7 KiB
Go
280 lines
8.7 KiB
Go
package settings
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
)
|
|
|
|
func TestDeriveServiceAccountToImpersonate(t *testing.T) {
|
|
t.Parallel()
|
|
t.Run("MatchingServerAndNamespace", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "https://cluster-api.example.com", Namespace: "dest-ns", DefaultServiceAccount: "test-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "system:serviceaccount:dest-ns:test-sa", user)
|
|
})
|
|
|
|
t.Run("MatchingWithGlobPatterns", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "*", Namespace: "*", DefaultServiceAccount: "test-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "any-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "system:serviceaccount:any-ns:test-sa", user)
|
|
})
|
|
|
|
t.Run("MatchingWithNamespacedServiceAccount", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "https://cluster-api.example.com", Namespace: "dest-ns", DefaultServiceAccount: "other-ns:deploy-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "system:serviceaccount:other-ns:deploy-sa", user)
|
|
})
|
|
|
|
t.Run("FallbackToAppNamespaceWhenDestEmpty", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
// Namespace pattern matches empty string via glob "*"
|
|
{Server: "*", Namespace: "", DefaultServiceAccount: "test-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Namespace: "app-ns",
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
// Should use app.Namespace ("app-ns") as the SA namespace since Destination.Namespace is empty
|
|
assert.Equal(t, "system:serviceaccount:app-ns:test-sa", user)
|
|
})
|
|
|
|
t.Run("NoMatchingEntry", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "https://other-server.com", Namespace: "other-ns", DefaultServiceAccount: "test-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
assert.Empty(t, user)
|
|
})
|
|
|
|
t.Run("EmptyDestinationServiceAccounts", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
assert.Empty(t, user)
|
|
})
|
|
|
|
t.Run("InvalidServiceAccountChars", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "*", Namespace: "*", DefaultServiceAccount: "bad*sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
assert.Empty(t, user)
|
|
assert.ErrorContains(t, err, "default service account contains invalid chars")
|
|
})
|
|
|
|
t.Run("BlankServiceAccount", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "*", Namespace: "*", DefaultServiceAccount: " "},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
assert.Empty(t, user)
|
|
assert.ErrorContains(t, err, "default service account contains invalid chars")
|
|
})
|
|
|
|
t.Run("InvalidServerGlobPattern", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "[", Namespace: "dest-ns", DefaultServiceAccount: "test-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
assert.Empty(t, user)
|
|
assert.ErrorContains(t, err, "invalid glob pattern for destination server")
|
|
})
|
|
|
|
t.Run("InvalidNamespaceGlobPattern", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "*", Namespace: "[", DefaultServiceAccount: "test-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
assert.Empty(t, user)
|
|
assert.ErrorContains(t, err, "invalid glob pattern for destination namespace")
|
|
})
|
|
|
|
t.Run("FirstMatchWins", func(t *testing.T) {
|
|
t.Parallel()
|
|
project := &v1alpha1.AppProject{
|
|
Spec: v1alpha1.AppProjectSpec{
|
|
DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
|
|
{Server: "*", Namespace: "dest-ns", DefaultServiceAccount: "first-sa"},
|
|
{Server: "*", Namespace: "*", DefaultServiceAccount: "second-sa"},
|
|
},
|
|
},
|
|
}
|
|
app := &v1alpha1.Application{
|
|
Spec: v1alpha1.ApplicationSpec{
|
|
Destination: v1alpha1.ApplicationDestination{
|
|
Server: "https://cluster-api.example.com",
|
|
Namespace: "dest-ns",
|
|
},
|
|
},
|
|
}
|
|
cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
|
|
|
|
user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "system:serviceaccount:dest-ns:first-sa", user)
|
|
})
|
|
}
|