mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
1ab6e799c1
go.mod still declared `module github.com/hanzoai/deploy` after the repo was renamed. A Go module path is not cosmetic — it is the resolvable location. So `go get github.com/hanzoai/cd` could not work, and anything importing this module had to spell a name that no longer exists at that address. The build log of v3.6.0 is where it surfaced: the compiler was still emitting github.com/hanzoai/deploy/cmd/cd/commands. 3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from the module path, replaced separately so neither could clobber the other. go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean. Co-authored-by: Hanzo Dev <[email protected]>
244 lines
10 KiB
Go
244 lines
10 KiB
Go
package rbacpolicy
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/client-go/kubernetes/fake"
|
|
|
|
"github.com/hanzoai/cd/common"
|
|
argoappv1 "github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/test"
|
|
"github.com/hanzoai/cd/util/rbac"
|
|
settings_util "github.com/hanzoai/cd/util/settings"
|
|
)
|
|
|
|
func init() {
|
|
settings_util.ConfigureGoClientFeatures()
|
|
}
|
|
|
|
func newFakeProj() *argoappv1.AppProject {
|
|
jwtTokenByRole := make(map[string]argoappv1.JWTTokens)
|
|
jwtTokenByRole["my-role"] = argoappv1.JWTTokens{Items: []argoappv1.JWTToken{{IssuedAt: 1234}}}
|
|
|
|
return &argoappv1.AppProject{
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Name: "my-proj",
|
|
Namespace: test.FakeArgoCDNamespace,
|
|
},
|
|
Spec: argoappv1.AppProjectSpec{
|
|
Roles: []argoappv1.ProjectRole{
|
|
{
|
|
Name: "my-role",
|
|
Policies: []string{
|
|
"p, proj:my-proj:my-role, applications, create, my-proj/*, allow",
|
|
"p, proj:my-proj:my-role, logs, get, my-proj/*, allow",
|
|
"p, proj:my-proj:my-role, exec, create, my-proj/*, allow",
|
|
},
|
|
Groups: []string{
|
|
"my-org:my-team",
|
|
},
|
|
JWTTokens: []argoappv1.JWTToken{
|
|
{
|
|
IssuedAt: 1234,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
Status: argoappv1.AppProjectStatus{JWTTokensByRole: jwtTokenByRole},
|
|
}
|
|
}
|
|
|
|
func TestEnforceAllPolicies(t *testing.T) {
|
|
t.Parallel()
|
|
kubeclientset := fake.NewClientset(test.NewFakeConfigMap())
|
|
projLister := test.NewFakeProjLister(newFakeProj())
|
|
enf := rbac.NewEnforcer(kubeclientset, test.FakeArgoCDNamespace, common.ArgoCDConfigMapName, nil)
|
|
enf.EnableLog(true)
|
|
_ = enf.SetBuiltinPolicy(`p, alice, applications, create, my-proj/*, allow` + "\n" + `p, alice, logs, get, my-proj/*, allow` + "\n" + `p, alice, exec, create, my-proj/*, allow`)
|
|
_ = enf.SetUserPolicy(`p, bob, applications, create, my-proj/*, allow` + "\n" + `p, bob, logs, get, my-proj/*, allow` + "\n" + `p, bob, exec, create, my-proj/*, allow`)
|
|
rbacEnf := NewRBACPolicyEnforcer(enf, projLister)
|
|
enf.SetClaimsEnforcerFunc(rbacEnf.EnforceClaims)
|
|
|
|
claims := jwt.MapClaims{"sub": "alice"}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "bob"}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "qwertyuiop", "federated_claims": map[string]any{"user_id": "bob"}}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "proj:my-proj:my-role", "iat": 1234}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"groups": []string{"my-org:my-team"}}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "cathy"}
|
|
assert.False(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.False(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.False(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
// AWS cognito returns its groups in cognito:groups
|
|
rbacEnf.SetScopes([]string{"cognito:groups"})
|
|
claims = jwt.MapClaims{"cognito:groups": []string{"my-org:my-team"}}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
}
|
|
|
|
func TestEnforceActionActions(t *testing.T) {
|
|
t.Parallel()
|
|
kubeclientset := fake.NewClientset(test.NewFakeConfigMap())
|
|
projLister := test.NewFakeProjLister(newFakeProj())
|
|
enf := rbac.NewEnforcer(kubeclientset, test.FakeArgoCDNamespace, common.ArgoCDConfigMapName, nil)
|
|
enf.EnableLog(true)
|
|
_ = enf.SetBuiltinPolicy(fmt.Sprintf(`p, alice, applications, %s/*, my-proj/*, allow
|
|
p, bob, applications, %s/apps.hanzo.ai/Rollout/*, my-proj/*, allow
|
|
p, cam, applications, %s/apps.hanzo.ai/Rollout/resume, my-proj/*, allow
|
|
`, rbac.ActionAction, rbac.ActionAction, rbac.ActionAction))
|
|
rbacEnf := NewRBACPolicyEnforcer(enf, projLister)
|
|
enf.SetClaimsEnforcerFunc(rbacEnf.EnforceClaims)
|
|
|
|
// Alice has wild-card approval for all actions
|
|
claims := jwt.MapClaims{"sub": "alice"}
|
|
assert.True(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/Rollout/resume", "my-proj/my-app"))
|
|
claims = jwt.MapClaims{"sub": "alice"}
|
|
assert.True(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/NewCrd/abort", "my-proj/my-app"))
|
|
// Bob has wild-card approval for all actions under apps.hanzo.ai/Rollout
|
|
claims = jwt.MapClaims{"sub": "bob"}
|
|
assert.True(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/Rollout/resume", "my-proj/my-app"))
|
|
claims = jwt.MapClaims{"sub": "bob"}
|
|
assert.False(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/NewCrd/abort", "my-proj/my-app"))
|
|
// Cam only has approval for actions/apps.hanzo.ai/Rollout:resume
|
|
claims = jwt.MapClaims{"sub": "cam"}
|
|
assert.True(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/Rollout/resume", "my-proj/my-app"))
|
|
claims = jwt.MapClaims{"sub": "cam"}
|
|
assert.False(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/Rollout/abort", "my-proj/my-app"))
|
|
|
|
// Eve does not have approval for any actions
|
|
claims = jwt.MapClaims{"sub": "eve"}
|
|
assert.False(t, enf.Enforce(claims, "applications", rbac.ActionAction+"/apps.hanzo.ai/Rollout/resume", "my-proj/my-app"))
|
|
}
|
|
|
|
func TestInvalidatedCache(t *testing.T) {
|
|
t.Parallel()
|
|
kubeclientset := fake.NewClientset(test.NewFakeConfigMap())
|
|
projLister := test.NewFakeProjLister(newFakeProj())
|
|
enf := rbac.NewEnforcer(kubeclientset, test.FakeArgoCDNamespace, common.ArgoCDConfigMapName, nil)
|
|
enf.EnableLog(true)
|
|
_ = enf.SetBuiltinPolicy(`p, alice, applications, create, my-proj/*, allow` + "\n" + `p, alice, logs, get, my-proj/*, allow` + "\n" + `p, alice, exec, create, my-proj/*, allow`)
|
|
_ = enf.SetUserPolicy(`p, bob, applications, create, my-proj/*, allow` + "\n" + `p, bob, logs, get, my-proj/*, allow` + "\n" + `p, bob, exec, create, my-proj/*, allow`)
|
|
rbacEnf := NewRBACPolicyEnforcer(enf, projLister)
|
|
enf.SetClaimsEnforcerFunc(rbacEnf.EnforceClaims)
|
|
|
|
claims := jwt.MapClaims{"sub": "alice"}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "bob"}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
_ = enf.SetBuiltinPolicy(`p, alice, applications, create, my-proj2/*, allow` + "\n" + `p, alice, logs, get, my-proj2/*, allow` + "\n" + `p, alice, exec, create, my-proj2/*, allow`)
|
|
_ = enf.SetUserPolicy(`p, bob, applications, create, my-proj2/*, allow` + "\n" + `p, bob, logs, get, my-proj2/*, allow` + "\n" + `p, bob, exec, create, my-proj2/*, allow`)
|
|
claims = jwt.MapClaims{"sub": "alice"}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj2/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj2/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj2/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "bob"}
|
|
assert.True(t, enf.Enforce(claims, "applications", "create", "my-proj2/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "logs", "get", "my-proj2/my-app"))
|
|
assert.True(t, enf.Enforce(claims, "exec", "create", "my-proj2/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "alice"}
|
|
assert.False(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.False(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.False(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
|
|
claims = jwt.MapClaims{"sub": "bob"}
|
|
assert.False(t, enf.Enforce(claims, "applications", "create", "my-proj/my-app"))
|
|
assert.False(t, enf.Enforce(claims, "logs", "get", "my-proj/my-app"))
|
|
assert.False(t, enf.Enforce(claims, "exec", "create", "my-proj/my-app"))
|
|
}
|
|
|
|
func TestGetScopes_DefaultScopes(t *testing.T) {
|
|
t.Parallel()
|
|
rbacEnforcer := NewRBACPolicyEnforcer(nil, nil)
|
|
|
|
scopes := rbacEnforcer.GetScopes()
|
|
assert.Equal(t, scopes, rbac.DefaultScopes)
|
|
}
|
|
|
|
func TestGetScopes_CustomScopes(t *testing.T) {
|
|
t.Parallel()
|
|
rbacEnforcer := NewRBACPolicyEnforcer(nil, nil)
|
|
customScopes := []string{"custom"}
|
|
rbacEnforcer.SetScopes(customScopes)
|
|
|
|
scopes := rbacEnforcer.GetScopes()
|
|
assert.Equal(t, scopes, customScopes)
|
|
}
|
|
|
|
func Test_getProjectFromRequest(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
resource string
|
|
action string
|
|
arg string
|
|
}{
|
|
{
|
|
name: "valid project/repo string",
|
|
resource: "repositories",
|
|
action: "create",
|
|
arg: newFakeProj().Name + "/https://github.com/argoproj/argocd-example-apps",
|
|
},
|
|
{
|
|
name: "applicationsets with project/repo string",
|
|
resource: "applicationsets",
|
|
action: "create",
|
|
arg: newFakeProj().Name + "/https://github.com/argoproj/argocd-example-apps",
|
|
},
|
|
{
|
|
name: "applicationsets with project/repo string",
|
|
resource: "applicationsets",
|
|
action: "*",
|
|
arg: newFakeProj().Name + "/https://github.com/argoproj/argocd-example-apps",
|
|
},
|
|
{
|
|
name: "applicationsets with project/repo string",
|
|
resource: "applicationsets",
|
|
action: "get",
|
|
arg: newFakeProj().Name + "/https://github.com/argoproj/argocd-example-apps",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
fp := newFakeProj()
|
|
projLister := test.NewFakeProjLister(fp)
|
|
rbacEnforcer := NewRBACPolicyEnforcer(nil, projLister)
|
|
|
|
project := rbacEnforcer.getProjectFromRequest("", tt.resource, tt.action, tt.arg)
|
|
require.Equal(t, fp.Name, project.Name)
|
|
})
|
|
}
|
|
}
|