mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
1ab6e799c1
go.mod still declared `module github.com/hanzoai/deploy` after the repo was renamed. A Go module path is not cosmetic — it is the resolvable location. So `go get github.com/hanzoai/cd` could not work, and anything importing this module had to spell a name that no longer exists at that address. The build log of v3.6.0 is where it surfaced: the compiler was still emitting github.com/hanzoai/deploy/cmd/cd/commands. 3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from the module path, replaced separately so neither could clobber the other. go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean. Co-authored-by: Hanzo Dev <[email protected]>
225 lines
7.3 KiB
Go
225 lines
7.3 KiB
Go
package e2e
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/hanzoai/cd/test/e2e/fixture/project"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
rbacv1 "k8s.io/api/rbac/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/types"
|
|
|
|
"github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/test/e2e/fixture"
|
|
. "github.com/hanzoai/cd/test/e2e/fixture/app"
|
|
)
|
|
|
|
const (
|
|
WaitDuration = time.Second
|
|
TimeoutDuration = time.Second * 3
|
|
)
|
|
|
|
func TestSyncWithFeatureDisabled(t *testing.T) {
|
|
Given(t).
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationDisabled().
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature disabled, Application sync should continue to use
|
|
// the control plane service account for the sync operation and the sync should succeed.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeSynced), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("successfully synced"))
|
|
}
|
|
|
|
func TestSyncWithNoDestinationServiceAccountsInProject(t *testing.T) {
|
|
Given(t).
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled("", nil).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync must fail
|
|
// when there are no destination service accounts configured in AppProject
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeOutOfSync), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("no matching service account found for destination server"))
|
|
}
|
|
|
|
func TestSyncWithNoDestinationServiceAccountsAndEnforcementDisabled(t *testing.T) {
|
|
Given(t).
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled("", nil).
|
|
WithImpersonationEnforcementDisabled().
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, but not enforced, Application sync must succeed
|
|
// by using the controller service account for the sync operation.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeSynced), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("successfully synced"))
|
|
}
|
|
|
|
func TestSyncWithImpersonateWithSyncServiceAccount(t *testing.T) {
|
|
serviceAccountName := "test-account"
|
|
|
|
projectCtx := project.Given(t)
|
|
appCtx := GivenWithSameState(projectCtx)
|
|
|
|
projectCtx.
|
|
Name("sync-test-project").
|
|
SourceNamespaces([]string{"*"}).
|
|
SourceRepositories([]string{"*"}).
|
|
Destination("*,*").
|
|
DestinationServiceAccounts(
|
|
[]string{
|
|
fmt.Sprintf("%s,%s,%s", "*", projectCtx.DeploymentNamespace(), serviceAccountName),
|
|
fmt.Sprintf("%s,%s,%s", v1alpha1.KubernetesInternalAPIServerAddr, projectCtx.DeploymentNamespace(), "missing-serviceAccount"),
|
|
}).
|
|
When().
|
|
Create().
|
|
Then().
|
|
Expect()
|
|
|
|
appCtx.
|
|
Project(projectCtx.GetName()).
|
|
SetTrackingMethod("annotation").
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled(serviceAccountName, []rbacv1.PolicyRule{
|
|
{
|
|
APIGroups: []string{"apps", ""},
|
|
Resources: []string{"deployments"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
{
|
|
APIGroups: []string{""},
|
|
Resources: []string{"services"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
}).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync should succeed
|
|
// as there is a valid match found in the available destination service accounts configured in AppProject
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeSynced), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("successfully synced"))
|
|
}
|
|
|
|
func TestSyncWithMissingServiceAccount(t *testing.T) {
|
|
serviceAccountName := "test-account"
|
|
|
|
projectCtx := project.Given(t)
|
|
appCtx := GivenWithSameState(projectCtx)
|
|
|
|
projectCtx.
|
|
Name("false-test-project").
|
|
SourceNamespaces([]string{"*"}).
|
|
SourceRepositories([]string{"*"}).
|
|
Destination("*,*").
|
|
DestinationServiceAccounts(
|
|
[]string{
|
|
fmt.Sprintf("%s,%s,%s", v1alpha1.KubernetesInternalAPIServerAddr, projectCtx.DeploymentNamespace(), "missing-serviceAccount"),
|
|
fmt.Sprintf("%s,%s,%s", "*", projectCtx.DeploymentNamespace(), serviceAccountName),
|
|
}).
|
|
When().
|
|
Create().
|
|
Then().
|
|
Expect()
|
|
|
|
appCtx.
|
|
Project(projectCtx.GetName()).
|
|
SetTrackingMethod("annotation").
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled(serviceAccountName, []rbacv1.PolicyRule{
|
|
{
|
|
APIGroups: []string{"apps", ""},
|
|
Resources: []string{"deployments"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
{
|
|
APIGroups: []string{""},
|
|
Resources: []string{"services"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
}).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync must fail
|
|
// when there is a valid match found in the available destination service accounts configured in AppProject,
|
|
// but the matching service account is missing.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeOutOfSync), WaitDuration, TimeoutDuration).
|
|
Expect(OperationMessageContains("one or more objects failed to apply"))
|
|
}
|
|
|
|
func TestSyncWithValidSAButDisallowedDestination(t *testing.T) {
|
|
serviceAccountName := "test-account"
|
|
|
|
projectCtx := project.Given(t)
|
|
appCtx := GivenWithSameState(projectCtx)
|
|
|
|
projectCtx.
|
|
Name("negation-test-project").
|
|
SourceNamespaces([]string{"*"}).
|
|
SourceRepositories([]string{"*"}).
|
|
Destination("*,*").
|
|
DestinationServiceAccounts(
|
|
[]string{
|
|
fmt.Sprintf("%s,%s,%s", "*", projectCtx.DeploymentNamespace(), serviceAccountName),
|
|
}).
|
|
When().
|
|
Create().
|
|
Then().
|
|
Expect()
|
|
|
|
appCtx.
|
|
Project(projectCtx.GetName()).
|
|
SetTrackingMethod("annotation").
|
|
Path("guestbook").
|
|
When().
|
|
WithImpersonationEnabled(serviceAccountName, []rbacv1.PolicyRule{
|
|
{
|
|
APIGroups: []string{"apps", ""},
|
|
Resources: []string{"deployments"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
{
|
|
APIGroups: []string{""},
|
|
Resources: []string{"services"},
|
|
Verbs: []string{"*"},
|
|
},
|
|
}).
|
|
CreateFromFile(func(app *v1alpha1.Application) {
|
|
app.Spec.SyncPolicy = &v1alpha1.SyncPolicy{Automated: &v1alpha1.SyncPolicyAutomated{}}
|
|
}).
|
|
Then().
|
|
Expect(SyncStatusIs(v1alpha1.SyncStatusCodeSynced)).
|
|
When().
|
|
And(func() {
|
|
// Patch destination to disallow target destination namespace
|
|
patch := fmt.Appendf(nil, `{"spec": {"destinations": [{"namespace": %q}]}}`, "!"+appCtx.DeploymentNamespace())
|
|
|
|
_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Patch(t.Context(), projectCtx.GetName(), types.MergePatchType, patch, metav1.PatchOptions{})
|
|
require.NoError(t, err)
|
|
}).
|
|
Refresh(v1alpha1.RefreshTypeNormal).
|
|
Then().
|
|
// With the impersonation feature enabled, Application sync must fail
|
|
// as there is a valid match found in the available destination service accounts configured in AppProject
|
|
// but the destination namespace is now disallowed.
|
|
ExpectConsistently(SyncStatusIs(v1alpha1.SyncStatusCodeUnknown), WaitDuration, TimeoutDuration)
|
|
}
|