deploy/util/settings/impersonation_test.go at main

mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00

Files

T

zeekayandHanzo Dev 1ab6e799c1 cd: the module is github.com/hanzoai/cd, where it is actually hosted

go.mod still declared `module github.com/hanzoai/deploy` after the repo was
renamed. A Go module path is not cosmetic — it is the resolvable location. So
`go get github.com/hanzoai/cd` could not work, and anything importing this
module had to spell a name that no longer exists at that address. The build log
of v3.6.0 is where it surfaced: the compiler was still emitting
github.com/hanzoai/deploy/cmd/cd/commands.

3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile
and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to
ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from
the module path, replaced separately so neither could clobber the other.

go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean.

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-28 21:16:24 -07:00

281 lines

8.8 KiB

Go

Raw Permalink Blame History

 package settings
 import (
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
 )
 func TestDeriveServiceAccountToImpersonate(t *testing.T) {
 	t.Parallel()
 	t.Run("MatchingServerAndNamespace", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "https://cluster-api.example.com", Namespace: "dest-ns", DefaultServiceAccount: "test-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		assert.Equal(t, "system:serviceaccount:dest-ns:test-sa", user)
 	})
 	t.Run("MatchingWithGlobPatterns", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "*", Namespace: "*", DefaultServiceAccount: "test-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "any-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		assert.Equal(t, "system:serviceaccount:any-ns:test-sa", user)
 	})
 	t.Run("MatchingWithNamespacedServiceAccount", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "https://cluster-api.example.com", Namespace: "dest-ns", DefaultServiceAccount: "other-ns:deploy-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		assert.Equal(t, "system:serviceaccount:other-ns:deploy-sa", user)
 	})
 	t.Run("FallbackToAppNamespaceWhenDestEmpty", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					// Namespace pattern matches empty string via glob "*"
 					{Server: "*", Namespace: "", DefaultServiceAccount: "test-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			ObjectMeta: metav1.ObjectMeta{Namespace: "app-ns"},
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		// Should use app.Namespace ("app-ns") as the SA namespace since Destination.Namespace is empty
 		assert.Equal(t, "system:serviceaccount:app-ns:test-sa", user)
 	})
 	t.Run("NoMatchingEntry", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "https://other-server.com", Namespace: "other-ns", DefaultServiceAccount: "test-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		assert.Empty(t, user)
 	})
 	t.Run("EmptyDestinationServiceAccounts", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		assert.Empty(t, user)
 	})
 	t.Run("InvalidServiceAccountChars", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "*", Namespace: "*", DefaultServiceAccount: "bad*sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		assert.Empty(t, user)
 		assert.ErrorContains(t, err, "default service account contains invalid chars")
 	})
 	t.Run("BlankServiceAccount", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "*", Namespace: "*", DefaultServiceAccount: "  "},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		assert.Empty(t, user)
 		assert.ErrorContains(t, err, "default service account contains invalid chars")
 	})
 	t.Run("InvalidServerGlobPattern", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "[", Namespace: "dest-ns", DefaultServiceAccount: "test-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		assert.Empty(t, user)
 		assert.ErrorContains(t, err, "invalid glob pattern for destination server")
 	})
 	t.Run("InvalidNamespaceGlobPattern", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "*", Namespace: "[", DefaultServiceAccount: "test-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		assert.Empty(t, user)
 		assert.ErrorContains(t, err, "invalid glob pattern for destination namespace")
 	})
 	t.Run("FirstMatchWins", func(t *testing.T) {
 		t.Parallel()
 		project := &v1alpha1.AppProject{
 			Spec: v1alpha1.AppProjectSpec{
 				DestinationServiceAccounts: []v1alpha1.ApplicationDestinationServiceAccount{
 					{Server: "*", Namespace: "dest-ns", DefaultServiceAccount: "first-sa"},
 					{Server: "*", Namespace: "*", DefaultServiceAccount: "second-sa"},
 				},
 			},
 		}
 		app := &v1alpha1.Application{
 			Spec: v1alpha1.ApplicationSpec{
 				Destination: v1alpha1.ApplicationDestination{
 					Server:    "https://cluster-api.example.com",
 					Namespace: "dest-ns",
 				},
 			},
 		}
 		cluster := &v1alpha1.Cluster{Server: "https://cluster-api.example.com"}
 		user, err := DeriveServiceAccountToImpersonate(project, app, cluster)
 		require.NoError(t, err)
 		assert.Equal(t, "system:serviceaccount:dest-ns:first-sa", user)
 	})
 }

281 lines 8.8 KiB Go Raw Permalink Blame History

281 lines

8.8 KiB

Go

Raw Permalink Blame History