deploy/test/e2e/project_management_test.go at master

hanzoai/deploy

Fork 0

mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00

Files

T

41536738c8 refactor(cd): hard-fork - rename CRD API group argoproj.io -> deploy.hanzo.ai (#1 )

* feat(api): hard-fork CRD API group argoproj.io -> deploy.hanzo.ai

Hanzo CD hard-fork, phase 1.1. Single source of truth is
pkg/apis/application/register.go's Group constant (Application/AppProject/
ApplicationSet all derive their FullName from it); every other Go call-site
that hardcoded the literal group string is updated to match: the 3 generated
informer GVRs, the app-of-apps nested-Application detector in types.go, the
resource-tree Application-kind cache populator, the 3 NotFound error
constructors in server/application, and the applicationset-controller's
leader-election Lease name/ID (kept in lockstep across Go source + RBAC
resourceNames, or leader election would get RBAC-denied on startup).

CRD YAMLs (application/appproject/applicationset) and every RBAC apiGroups
rule that actually governs our 3 CRDs are repointed to deploy.hanzo.ai, across
both manifests/base/* (namespaced Roles) and manifests/cluster-rbac/* (cluster
scope). Two adjacent things that share the "argoproj.io" string but are NOT
ours are deliberately left untouched: gitops-engine's health-check dispatch
for Argo Workflows' `Workflow` kind, and argocd-server-clusterrole's second
apiGroups block granting read on Argo Workflows' `workflows` resource — both
belong to a separate, unrelated Argoproj-family project we are not forking.

Also untouched, per explicit scope: annotation/label keys (argocd.argoproj.io/*)
and finalizers (*.argoproj.io) that track already-applied live resources, and
argocd-cm.yaml's resource.customizations.ignoreResourceUpdates keys (a narrow
app-of-apps diffing nicety, not build- or RBAC-relevant).

CGO_ENABLED=0 go build ./... verified green.

* ci: wire canonical hanzo.yml + cicd.yml (Hanzo CD image build)

Phase 1.3. Follows the same one-way pattern every hanzo/lux/zoo repo uses:
hanzo.yml declares the image (root Dockerfile -> ghcr.io/hanzoai/deploy) and a
fast go-build sanity test (the multi-stage Dockerfile build is the slow, real
gate); cicd.yml is the ~10-line trigger shim importing hanzoai/ci's reusable
build workflow on the arc pool, secrets from KMS only.

No `deploy:` block yet, matching the hanzoai/cms build-only-first-cutover
pattern: this repo's own live hanzo-cd namespace runs the whole Hanzo fleet's
GitOps, so the prod image/CRD swap is a deliberate separate action (see the
[HELD] universe PR), never an automatic rollout on merge. Every PR/push still
builds and pushes an immutable ghcr.io/hanzoai/deploy:sha-<7>-amd64 image.

* feat(ui): rebrand Argo CD -> Hanzo CD (title, favicon, logo, sidebar)

Phase 1.2. User-facing "Argo CD"/"ArgoCD" text replaced with "Hanzo CD"
across the login page, help modal, settings screens, version-info panel,
sync-options warning, fullscreen-logs title, app.tsx page titles, and
index.html's <title>/noscript text (dropped the now-wrong upstream CLI
doc link rather than invent a hanzo.ai URL that doesn't exist).

Logo/favicon assets replaced with the canonical Hanzo mark (never
hand-drawn, copied from ~/work/hanzo/logo/dist): the two real usages of
Argo's logo collapse onto one Hanzo glyph (mono + white variants) at the
same 5 call sites (login icon + footer, login.scss $logoPath/
$logoNegativePath, sidebar text-logo), preserving the existing CSS
invert() filters so both the light login panel and dark sidebar still
render correctly. Old argologo.svg/argo_o.svg/argo.png deleted (no
longer referenced). favicon-{16x16,32x32}.png added at
ui/src/assets/favicon/ (index.html's links to that path were previously
dead - the directory didn't exist in this checkout). package.json name
argo-cd-ui -> hanzo-cd-ui.

Left alone, deliberately: the two Kubernetes resource-kind icon sets
under ui/src/assets/images/resources/ (unrelated to branding), and
upstream doc/project links (argoproj.io, argo-cd.readthedocs.io) since
we have no equivalent hanzo.ai docs to point to yet - except the login
footer logo's outbound link, which now points to hanzo.ai instead of
argoproj.io (a Hanzo-branded mark linking to the upstream project it
was forked from read as an obvious leftover).

* feat(module): rename Go module github.com/argoproj/argo-cd/v3 -> github.com/hanzoai/deploy

Phase 2. No version suffix on the new path (org policy: never publish our
own Go modules above v1.x.x / with a v2+ suffix) — this fork starts a fresh
v0/v1 module identity rather than carrying the v3 the upstream fork point
had reached.

Mechanical, symmetric rewrite: 704 .go files (import statements only; two
disjoint substitutions applied specific-first so the nested gitops-engine
module path never double-matches), plus go.mod (module line, the
gitops-engine require+replace pair, version reset to v0.0.0-... since a
suffix-less path can't carry a v3 semver), gitops-engine/go.mod, Makefile
(ldflags PACKAGE + 2 TEST_MODULE filters), .golangci.yaml, .goreleaser.yaml,
.mockery.yaml (+ gitops-engine's), Procfile, the codegen/proto generation
scripts (hack/generate-proto.sh, update-codegen.sh, update-openapi.sh), and
20 .proto files' go_package options. Also one OpenTelemetry tracer name
string in gitops-engine/pkg/sync/sync_context.go (a cosmestic label, not an
import, but worth keeping consistent).

CGO_ENABLED=0 go build ./... verified green for both the root module and
the nested gitops-engine module; go vet clean on both; go mod tidy run
(network available) to reconcile go.sum, dependency set unchanged.

Left alone, deliberately: doc-only mentions (docs/snyk/*.html scan reports,
gitops-engine/README.md), a comment-only reference in
.github/workflows/release.yaml, and one Renovate bot config line — none are
build- or codegen-load-bearing. Also left alone: comments citing upstream
GitHub issue URLs (github.com/argoproj/argo-cd/issues/NNNNN) and a handful
of test fixtures using "https://github.com/argoproj/argo-cd.git" as a
representative example repo URL — both are accurate historical/test-data
references, not stale self-references.

---------

Co-authored-by: Hanzo Dev <[email protected]>

2026-07-29 18:27:58 -07:00

835 lines

33 KiB

Go

Raw Permalink Blame History

 package e2e
 import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/fields"
 	"github.com/hanzoai/deploy/pkg/apis/application/v1alpha1"
 	"github.com/hanzoai/deploy/test/e2e/fixture"
 	"github.com/hanzoai/deploy/util/argo"
 )
 func assertProjHasEvent(t *testing.T, a *v1alpha1.AppProject, message string, reason string) {
 	t.Helper()
 	list, err := fixture.KubeClientset.CoreV1().Events(fixture.TestNamespace()).List(t.Context(), metav1.ListOptions{
 		FieldSelector: fields.SelectorFromSet(map[string]string{
 			"involvedObject.name":      a.Name,
 			"involvedObject.uid":       string(a.UID),
 			"involvedObject.namespace": fixture.TestNamespace(),
 		}).String(),
 	})
 	require.NoError(t, err)
 	for i := range list.Items {
 		event := list.Items[i]
 		if event.Reason == reason && strings.Contains(event.Message, message) {
 			return
 		}
 	}
 	t.Errorf("Unable to find event with reason=%s; message=%s", reason, message)
 }
 func TestProjectCreation(t *testing.T) {
 	ctx := fixture.EnsureCleanState(t)
 	projectName := "proj-" + ctx.GetName()
 	_, err := fixture.RunCli("proj", "create", projectName,
 		"--description", "Test description",
 		"-d", "https://192.168.99.100:8443,default",
 		"-d", "https://192.168.99.100:8443,service",
 		"-s", "https://github.com/argoproj/argo-cd.git",
 		"--orphaned-resources")
 	require.NoError(t, err)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.Destinations, 2)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.Destinations[0].Server)
 	assert.Equal(t, "default", proj.Spec.Destinations[0].Namespace)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.Destinations[1].Server)
 	assert.Equal(t, "service", proj.Spec.Destinations[1].Namespace)
 	assert.Len(t, proj.Spec.SourceRepos, 1)
 	assert.Equal(t, "https://github.com/argoproj/argo-cd.git", proj.Spec.SourceRepos[0])
 	assert.NotNil(t, proj.Spec.OrphanedResources)
 	assert.False(t, proj.Spec.OrphanedResources.IsWarn())
 	assertProjHasEvent(t, proj, "create", argo.EventReasonResourceCreated)
 	// create a manifest with the same name to upsert
 	newDescription := "Upserted description"
 	proj.Spec.Description = newDescription
 	proj.ResourceVersion = ""
 	data, err := json.Marshal(proj)
 	stdinString := string(data)
 	require.NoError(t, err)
 	// fail without upsert flag
 	_, err = fixture.RunCliWithStdin(stdinString, false, "proj", "create",
 		"-f", "-")
 	require.Error(t, err)
 	// succeed with the upsert flag
 	_, err = fixture.RunCliWithStdin(stdinString, false, "proj", "create",
 		"-f", "-", "--upsert")
 	require.NoError(t, err)
 	proj, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, newDescription, proj.Spec.Description)
 }
 func TestProjectDeletion(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err)
 	_, err = fixture.RunCli("proj", "delete", projectName)
 	require.NoError(t, err)
 	_, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	assert.True(t, errors.IsNotFound(err))
 	assertProjHasEvent(t, proj, "delete", argo.EventReasonResourceDeleted)
 }
 func TestSetProject(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err)
 	_, err = fixture.RunCli("proj", "set", projectName,
 		"--description", "updated description",
 		"-d", "https://192.168.99.100:8443,default",
 		"-d", "https://192.168.99.100:8443,service",
 		"--orphaned-resources-warn=false")
 	require.NoError(t, err)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.Destinations, 2)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.Destinations[0].Server)
 	assert.Equal(t, "default", proj.Spec.Destinations[0].Namespace)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.Destinations[1].Server)
 	assert.Equal(t, "service", proj.Spec.Destinations[1].Namespace)
 	assert.NotNil(t, proj.Spec.OrphanedResources)
 	assert.False(t, proj.Spec.OrphanedResources.IsWarn())
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestAddProjectDestination(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	_, err = fixture.RunCli("proj", "add-destination", projectName,
 		"https://192.168.99.100:8443",
 		"test1",
 	)
 	require.NoError(t, err, "Unable to add project destination")
 	_, err = fixture.RunCli("proj", "add-destination", projectName,
 		"https://192.168.99.100:8443",
 		"test1",
 	)
 	require.ErrorContains(t, err, "already defined")
 	_, err = fixture.RunCli("proj", "add-destination", projectName,
 		"!*",
 		"test1",
 	)
 	require.ErrorContains(t, err, "server has an invalid format, '!*'")
 	_, err = fixture.RunCli("proj", "add-destination", projectName,
 		"https://192.168.99.100:8443",
 		"!*",
 	)
 	require.ErrorContains(t, err, "namespace has an invalid format, '!*'")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.Destinations, 1)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.Destinations[0].Server)
 	assert.Equal(t, "test1", proj.Spec.Destinations[0].Namespace)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestAddProjectDestinationWithName(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	_, err = fixture.RunCli("proj", "add-destination", projectName,
 		"in-cluster",
 		"test1",
 		"--name",
 	)
 	require.NoError(t, err, "Unable to add project destination")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.Destinations, 1)
 	assert.Empty(t, proj.Spec.Destinations[0].Server)
 	assert.Equal(t, "in-cluster", proj.Spec.Destinations[0].Name)
 	assert.Equal(t, "test1", proj.Spec.Destinations[0].Namespace)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestRemoveProjectDestination(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(t.Context(), &v1alpha1.AppProject{
 		ObjectMeta: metav1.ObjectMeta{Name: projectName},
 		Spec: v1alpha1.AppProjectSpec{
 			Destinations: []v1alpha1.ApplicationDestination{{
 				Server:    "https://192.168.99.100:8443",
 				Namespace: "test",
 			}},
 		},
 	}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	_, err = fixture.RunCli("proj", "remove-destination", projectName,
 		"https://192.168.99.100:8443",
 		"test",
 	)
 	require.NoError(t, err, "Unable to remove project destination")
 	_, err = fixture.RunCli("proj", "remove-destination", projectName,
 		"https://192.168.99.100:8443",
 		"test1",
 	)
 	require.ErrorContains(t, err, "does not exist")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err, "Unable to get project")
 	assert.Equal(t, projectName, proj.Name)
 	assert.Empty(t, proj.Spec.Destinations)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestAddProjectSource(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	_, err = fixture.RunCli("proj", "add-source", projectName, "https://github.com/argoproj/argo-cd.git")
 	require.NoError(t, err, "Unable to add project source")
 	_, err = fixture.RunCli("proj", "add-source", projectName, "https://github.com/argoproj/argo-cd.git")
 	require.NoError(t, err)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.SourceRepos, 1)
 	assert.Equal(t, "https://github.com/argoproj/argo-cd.git", proj.Spec.SourceRepos[0])
 }
 func TestRemoveProjectSource(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(t.Context(), &v1alpha1.AppProject{
 		ObjectMeta: metav1.ObjectMeta{Name: projectName},
 		Spec: v1alpha1.AppProjectSpec{
 			SourceRepos: []string{"https://github.com/argoproj/argo-cd.git"},
 		},
 	}, metav1.CreateOptions{})
 	require.NoError(t, err)
 	_, err = fixture.RunCli("proj", "remove-source", projectName, "https://github.com/argoproj/argo-cd.git")
 	require.NoError(t, err)
 	_, err = fixture.RunCli("proj", "remove-source", projectName, "https://github.com/argoproj/argo-cd.git")
 	require.NoError(t, err)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Empty(t, proj.Spec.SourceRepos)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestUseJWTToken(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	appName := "app-" + strconv.FormatInt(time.Now().Unix(), 10)
 	roleName := "roleTest"
 	roleName2 := "roleTest2"
 	testApp := &v1alpha1.Application{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: appName,
 		},
 		Spec: v1alpha1.ApplicationSpec{
 			Source: &v1alpha1.ApplicationSource{
 				RepoURL: fixture.RepoURL(fixture.RepoURLTypeFile),
 				Path:    "guestbook",
 			},
 			Destination: v1alpha1.ApplicationDestination{
 				Server:    v1alpha1.KubernetesInternalAPIServerAddr,
 				Namespace: fixture.TestNamespace(),
 			},
 			Project: projectName,
 		},
 	}
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(t.Context(), &v1alpha1.AppProject{
 		ObjectMeta: metav1.ObjectMeta{Name: projectName},
 		Spec: v1alpha1.AppProjectSpec{
 			Destinations: []v1alpha1.ApplicationDestination{{
 				Server:    v1alpha1.KubernetesInternalAPIServerAddr,
 				Namespace: fixture.TestNamespace(),
 			}},
 			SourceRepos: []string{"*"},
 		},
 	}, metav1.CreateOptions{})
 	require.NoError(t, err)
 	_, err = fixture.AppClientset.ArgoprojV1alpha1().Applications(fixture.TestNamespace()).Create(t.Context(), testApp, metav1.CreateOptions{})
 	require.NoError(t, err)
 	_, err = fixture.RunCli("proj", "role", "create", projectName, roleName)
 	require.NoError(t, err)
 	roleGetResult, err := fixture.RunCli("proj", "role", "get", projectName, roleName)
 	require.NoError(t, err)
 	assert.True(t, strings.HasSuffix(roleGetResult, "ID  ISSUED-AT  EXPIRES-AT"))
 	_, err = fixture.RunCli("proj", "role", "create-token", projectName, roleName)
 	require.NoError(t, err)
 	// Create second role with kubectl, to test that it will not affect 1st role
 	_, err = fixture.Run("", "kubectl", "patch", "appproject", projectName, "--type", "merge",
 		"-n", fixture.TestNamespace(),
 		"-p", fmt.Sprintf(`{"spec":{"roles":[{"name":%q},{"name":%q}]}}`, roleName, roleName2))
 	require.NoError(t, err)
 	_, err = fixture.RunCli("proj", "role", "create-token", projectName, roleName2)
 	require.NoError(t, err)
 	for _, action := range []string{"get", "update", "sync", "create", "override", "*"} {
 		_, err = fixture.RunCli("proj", "role", "add-policy", projectName, roleName, "-a", action, "-o", "*", "-p", "allow")
 		require.NoError(t, err)
 	}
 	newProj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Len(t, newProj.Status.JWTTokensByRole[roleName].Items, 1)
 	assert.ElementsMatch(t, newProj.Status.JWTTokensByRole[roleName].Items, newProj.Spec.Roles[0].JWTTokens)
 	roleGetResult, err = fixture.RunCli("proj", "role", "get", projectName, roleName)
 	require.NoError(t, err)
 	assert.Contains(t, roleGetResult, strconv.FormatInt(newProj.Status.JWTTokensByRole[roleName].Items[0].IssuedAt, 10))
 	_, err = fixture.RunCli("proj", "role", "delete-token", projectName, roleName, strconv.FormatInt(newProj.Status.JWTTokensByRole[roleName].Items[0].IssuedAt, 10))
 	require.NoError(t, err)
 	newProj, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Nil(t, newProj.Status.JWTTokensByRole[roleName].Items)
 	assert.Nil(t, newProj.Spec.Roles[0].JWTTokens)
 }
 func TestAddOrphanedIgnore(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	_, err = fixture.RunCli("proj", "add-orphaned-ignore", projectName,
 		"group",
 		"kind",
 		"--name",
 		"name",
 	)
 	require.NoError(t, err, "Unable to add resource to orphaned ignore")
 	_, err = fixture.RunCli("proj", "add-orphaned-ignore", projectName,
 		"group",
 		"kind",
 		"--name",
 		"name",
 	)
 	require.ErrorContains(t, err, "already defined")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.OrphanedResources.Ignore, 1)
 	assert.Equal(t, "group", proj.Spec.OrphanedResources.Ignore[0].Group)
 	assert.Equal(t, "kind", proj.Spec.OrphanedResources.Ignore[0].Kind)
 	assert.Equal(t, "name", proj.Spec.OrphanedResources.Ignore[0].Name)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestRemoveOrphanedIgnore(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(t.Context(), &v1alpha1.AppProject{
 		ObjectMeta: metav1.ObjectMeta{Name: projectName},
 		Spec: v1alpha1.AppProjectSpec{
 			OrphanedResources: &v1alpha1.OrphanedResourcesMonitorSettings{
 				Warn:   new(true),
 				Ignore: []v1alpha1.OrphanedResourceKey{{Group: "group", Kind: "kind", Name: "name"}},
 			},
 		},
 	}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	_, err = fixture.RunCli("proj", "remove-orphaned-ignore", projectName,
 		"group",
 		"kind",
 		"--name",
 		"name",
 	)
 	require.NoError(t, err, "Unable to remove resource from orphaned ignore list")
 	_, err = fixture.RunCli("proj", "remove-orphaned-ignore", projectName,
 		"group",
 		"kind",
 		"--name",
 		"name",
 	)
 	require.ErrorContains(t, err, "does not exist")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err, "Unable to get project")
 	assert.Equal(t, projectName, proj.Name)
 	assert.Empty(t, proj.Spec.OrphanedResources.Ignore)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func createAndConfigGlobalProject(ctx context.Context, testName string) error {
 	// Create global project
 	projectGlobalName := "proj-g-" + testName
 	_, err := fixture.RunCli("proj", "create", projectGlobalName,
 		"--description", "Test description",
 		"-d", "https://192.168.99.100:8443,default",
 		"-d", "https://192.168.99.100:8443,service",
 		"-s", "https://github.com/argoproj/argo-cd.git",
 		"--orphaned-resources")
 	if err != nil {
 		return err
 	}
 	projGlobal, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(ctx, projectGlobalName, metav1.GetOptions{})
 	if err != nil {
 		return err
 	}
 	projGlobal.Spec.NamespaceResourceBlacklist = []metav1.GroupKind{
 		{Group: "", Kind: "Service"},
 	}
 	projGlobal.Spec.NamespaceResourceWhitelist = []metav1.GroupKind{
 		{Group: "", Kind: "Deployment"},
 	}
 	projGlobal.Spec.ClusterResourceWhitelist = []v1alpha1.ClusterResourceRestrictionItem{
 		{Group: "", Kind: "Job"},
 	}
 	projGlobal.Spec.ClusterResourceBlacklist = []v1alpha1.ClusterResourceRestrictionItem{
 		{Group: "", Kind: "Pod"},
 	}
 	projGlobal.Spec.SyncWindows = v1alpha1.SyncWindows{}
 	win := &v1alpha1.SyncWindow{Kind: "deny", Schedule: "* * * * *", Duration: "1h", Applications: []string{"*"}}
 	projGlobal.Spec.SyncWindows = append(projGlobal.Spec.SyncWindows, win)
 	_, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Update(ctx, projGlobal, metav1.UpdateOptions{})
 	if err != nil {
 		return err
 	}
 	// Configure global project settings
 	globalProjectsSettings := `data:
   accounts.config-service: apiKey
   globalProjects: |
     - labelSelector:
         matchExpressions:
           - key: opt
             operator: In
             values:
               - me
               - you
       projectName: %s`
 	_, err = fixture.Run("", "kubectl", "patch", "cm", "argocd-cm",
 		"-n", fixture.TestNamespace(),
 		"-p", fmt.Sprintf(globalProjectsSettings, projGlobal.Name))
 	if err != nil {
 		return err
 	}
 	return nil
 }
 func TestGetVirtualProjectNoMatch(t *testing.T) {
 	ctx := fixture.EnsureCleanState(t)
 	err := createAndConfigGlobalProject(t.Context(), ctx.GetName())
 	require.NoError(t, err)
 	// Create project which does not match global project settings
 	projectName := "proj-" + ctx.GetName()
 	_, err = fixture.RunCli("proj", "create", projectName,
 		"--description", "Test description",
 		"-d", v1alpha1.KubernetesInternalAPIServerAddr+",*",
 		"-s", "*",
 		"--orphaned-resources")
 	require.NoError(t, err)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	// Create an app belongs to proj project
 	_, err = fixture.RunCli("app", "create", ctx.GetName(), "--repo", fixture.RepoURL(fixture.RepoURLTypeFile),
 		"--path", guestbookPath, "--project", proj.Name, "--dest-server", v1alpha1.KubernetesInternalAPIServerAddr, "--dest-namespace", ctx.DeploymentNamespace())
 	require.NoError(t, err)
 	// App trying to sync a resource which is not blacked listed anywhere
 	_, err = fixture.RunCli("app", "sync", ctx.GetName(), "--resource", "apps:Deployment:guestbook-ui", "--timeout", strconv.Itoa(10))
 	require.NoError(t, err)
 	// app trying to sync a resource which is black listed by global project
 	_, err = fixture.RunCli("app", "sync", ctx.GetName(), "--resource", ":Service:guestbook-ui", "--timeout", strconv.Itoa(10))
 	require.NoError(t, err)
 }
 func TestGetVirtualProjectMatch(t *testing.T) {
 	testCtx := fixture.EnsureCleanState(t)
 	ctx := t.Context()
 	err := createAndConfigGlobalProject(ctx, testCtx.GetName())
 	require.NoError(t, err)
 	// Create project which matches global project settings
 	projectName := "proj-" + testCtx.GetName()
 	_, err = fixture.RunCli("proj", "create", projectName,
 		"--description", "Test description",
 		"-d", v1alpha1.KubernetesInternalAPIServerAddr+",*",
 		"-s", "*",
 		"--orphaned-resources")
 	require.NoError(t, err)
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(ctx, projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	// Add a label to this project so that this project match global project selector
 	proj.Labels = map[string]string{"opt": "me"}
 	_, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Update(ctx, proj, metav1.UpdateOptions{})
 	require.NoError(t, err)
 	// Create an app belongs to proj project
 	_, err = fixture.RunCli("app", "create", testCtx.GetName(), "--repo", fixture.RepoURL(fixture.RepoURLTypeFile),
 		"--path", guestbookPath, "--project", proj.Name, "--dest-server", v1alpha1.KubernetesInternalAPIServerAddr, "--dest-namespace", testCtx.DeploymentNamespace())
 	require.NoError(t, err)
 	// App trying to sync a resource which is not blacked listed anywhere
 	_, err = fixture.RunCli("app", "sync", testCtx.GetName(), "--resource", "apps:Deployment:guestbook-ui", "--timeout", strconv.Itoa(10))
 	require.ErrorContains(t, err, "blocked by sync window")
 	// app trying to sync a resource which is black listed by global project
 	_, err = fixture.RunCli("app", "sync", testCtx.GetName(), "--resource", ":Service:guestbook-ui", "--timeout", strconv.Itoa(10))
 	assert.ErrorContains(t, err, "blocked by sync window")
 }
 func TestSyncWindowSyncOverrun(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	// Test adding a sync window with --sync-overrun flag
 	_, err = fixture.RunCli("proj", "windows", "add", projectName,
 		"--kind", "deny",
 		"--schedule", "0 0 * * *",
 		"--duration", "1h",
 		"--applications", "*",
 		"--sync-overrun")
 	require.NoError(t, err, "Unable to add sync window with sync overrun")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Len(t, proj.Spec.SyncWindows, 1)
 	assert.True(t, proj.Spec.SyncWindows[0].SyncOverrun, "SyncOverrun should be true after adding with flag")
 	// Test disabling sync overrun
 	_, err = fixture.RunCli("proj", "windows", "disable-sync-overrun", projectName, "0")
 	require.NoError(t, err, "Unable to disable sync overrun")
 	proj, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.False(t, proj.Spec.SyncWindows[0].SyncOverrun, "SyncOverrun should be false after disabling")
 	// Test enabling sync overrun
 	_, err = fixture.RunCli("proj", "windows", "enable-sync-overrun", projectName, "0")
 	require.NoError(t, err, "Unable to enable sync overrun")
 	proj, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.True(t, proj.Spec.SyncWindows[0].SyncOverrun, "SyncOverrun should be true after enabling")
 	// Add a second window without sync overrun to test multiple windows
 	_, err = fixture.RunCli("proj", "windows", "add", projectName,
 		"--kind", "deny",
 		"--schedule", "12 0 * * *",
 		"--duration", "2h",
 		"--applications", "*")
 	require.NoError(t, err, "Unable to add second sync window")
 	proj, err = fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Len(t, proj.Spec.SyncWindows, 2)
 	assert.True(t, proj.Spec.SyncWindows[0].SyncOverrun, "First window should still have SyncOverrun enabled")
 	assert.False(t, proj.Spec.SyncWindows[1].SyncOverrun, "Second window should not have SyncOverrun enabled")
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }
 func TestAddProjectDestinationServiceAccount(t *testing.T) {
 	fixture.EnsureCleanState(t)
 	projectName := "proj-" + strconv.FormatInt(time.Now().Unix(), 10)
 	_, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Create(
 		t.Context(), &v1alpha1.AppProject{ObjectMeta: metav1.ObjectMeta{Name: projectName}}, metav1.CreateOptions{})
 	require.NoError(t, err, "Unable to create project")
 	// Given, an existing project
 	// When, a default destination service account with all valid fields is added to it,
 	// Then, there is no error.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"test-sa",
 	)
 	require.NoError(t, err, "Unable to add project destination service account")
 	// Given, an existing project
 	// When, a default destination service account with empty namespace is added to it,
 	// Then, there is no error.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"",
 		"test-sa",
 	)
 	require.NoError(t, err, "Unable to add project destination service account")
 	// Given, an existing project,
 	// When, a default destination service account is added with a custom service account namespace,
 	// Then, there is no error.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns1",
 		"test-sa",
 		"--service-account-namespace",
 		"default",
 	)
 	require.NoError(t, err, "Unable to add project destination service account")
 	// Given, an existing project,
 	// When, a duplicate default destination service account is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "already defined")
 	// Given, an existing project,
 	// When, a duplicate default destination service account is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"asdf",
 	)
 	require.ErrorContains(t, err, "already added")
 	// Given, an existing project,
 	// When, a default destination service account with negation glob pattern for server is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"!*",
 		"test-ns",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "server has an invalid format, '!*'")
 	// Given, an existing project,
 	// When, a default destination service account with negation glob pattern for server is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"!abc",
 		"test-ns",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "server has an invalid format, '!abc'")
 	// Given, an existing project,
 	// When, a default destination service account with negation glob pattern for namespace is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"!*",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "namespace has an invalid format, '!*'")
 	// Given, an existing project,
 	// When, a default destination service account with negation glob pattern for namespace is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"!abc",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "namespace has an invalid format, '!abc'")
 	// Given, an existing project,
 	// When, a default destination service account with empty service account is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"",
 	)
 	require.ErrorContains(t, err, "defaultServiceAccount has an invalid format, ''")
 	// Given, an existing project,
 	// When, a default destination service account with service account having just white spaces is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"   ",
 	)
 	require.ErrorContains(t, err, "defaultServiceAccount has an invalid format, '   '")
 	// Given, an existing project,
 	// When, a default destination service account with service account having backwards slash char is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"test\\sa",
 	)
 	require.ErrorContains(t, err, "defaultServiceAccount has an invalid format, 'test\\\\sa'")
 	// Given, an existing project,
 	// When, a default destination service account with service account having forward slash char is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"test/sa",
 	)
 	require.ErrorContains(t, err, "defaultServiceAccount has an invalid format, 'test/sa'")
 	// Given, an existing project,
 	// When, a default destination service account with service account having square braces char is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"[test-sa]",
 	)
 	require.ErrorContains(t, err, "defaultServiceAccount has an invalid format, '[test-sa]'")
 	// Given, an existing project,
 	// When, a default destination service account with service account having curly braces char is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"test-ns",
 		"{test-sa}",
 	)
 	require.ErrorContains(t, err, "defaultServiceAccount has an invalid format, '{test-sa}'")
 	// Given, an existing project,
 	// When, a default destination service account with service account having curly braces char is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"[[ech*",
 		"test-ns",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "server has an invalid format, '[[ech*'")
 	// Given, an existing project,
 	// When, a default destination service account with service account having curly braces char is added,
 	// Then, there is an error with appropriate message.
 	_, err = fixture.RunCli("proj", "add-destination-service-account", projectName,
 		"https://192.168.99.100:8443",
 		"[[ech*",
 		"test-sa",
 	)
 	require.ErrorContains(t, err, "namespace has an invalid format, '[[ech*'")
 	proj, err := fixture.AppClientset.ArgoprojV1alpha1().AppProjects(fixture.TestNamespace()).Get(t.Context(), projectName, metav1.GetOptions{})
 	require.NoError(t, err)
 	assert.Equal(t, projectName, proj.Name)
 	assert.Len(t, proj.Spec.DestinationServiceAccounts, 3)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.DestinationServiceAccounts[0].Server)
 	assert.Equal(t, "test-ns", proj.Spec.DestinationServiceAccounts[0].Namespace)
 	assert.Equal(t, "test-sa", proj.Spec.DestinationServiceAccounts[0].DefaultServiceAccount)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.DestinationServiceAccounts[1].Server)
 	assert.Empty(t, proj.Spec.DestinationServiceAccounts[1].Namespace)
 	assert.Equal(t, "test-sa", proj.Spec.DestinationServiceAccounts[1].DefaultServiceAccount)
 	assert.Equal(t, "https://192.168.99.100:8443", proj.Spec.DestinationServiceAccounts[2].Server)
 	assert.Equal(t, "test-ns1", proj.Spec.DestinationServiceAccounts[2].Namespace)
 	assert.Equal(t, "default:test-sa", proj.Spec.DestinationServiceAccounts[2].DefaultServiceAccount)
 	assertProjHasEvent(t, proj, "update", argo.EventReasonResourceUpdated)
 }

835 lines 33 KiB Go Raw Permalink Blame History

835 lines

33 KiB

Go

Raw Permalink Blame History