From 8878dd83fb1b3bba54adde9d26ace80c0061be3f Mon Sep 17 00:00:00 2001 From: Camila Macedo Date: Sat, 14 Sep 2024 18:24:22 +0100 Subject: [PATCH] e2e-tests: add tests to ensure webhooks outside of the manager namespace --- test/e2e/v4/plugin_cluster_test.go | 104 +++++++++++------- .../.github/workflows/lint.yml | 0 .../.github/workflows/test-e2e.yml | 0 .../.github/workflows/test.yml | 0 4 files changed, 66 insertions(+), 38 deletions(-) rename testdata/{project-v4-multigroup-with-plugins => project-v4-multigroup}/.github/workflows/lint.yml (100%) rename testdata/{project-v4-multigroup-with-plugins => project-v4-multigroup}/.github/workflows/test-e2e.yml (100%) rename testdata/{project-v4-multigroup-with-plugins => project-v4-multigroup}/.github/workflows/test.yml (100%) diff --git a/test/e2e/v4/plugin_cluster_test.go b/test/e2e/v4/plugin_cluster_test.go index 2a9082365d3..690f9f62d9f 100644 --- a/test/e2e/v4/plugin_cluster_test.go +++ b/test/e2e/v4/plugin_cluster_test.go @@ -66,37 +66,37 @@ var _ = Describe("kubebuilder", func() { By("removing controller image and working dir") kbc.Destroy() }) - It("should generate a runnable project", func() { - kbc.IsRestricted = false - GenerateV4(kbc) - Run(kbc, true, false, true, false) - }) - It("should generate a runnable project with the Installer", func() { - kbc.IsRestricted = false - GenerateV4(kbc) - Run(kbc, false, true, true, false) - }) - It("should generate a runnable project without metrics exposed", func() { - kbc.IsRestricted = false - GenerateV4WithoutMetrics(kbc) - Run(kbc, true, false, false, false) - }) - It("should generate a runnable project with metrics protected by network policies", func() { - kbc.IsRestricted = false - GenerateV4WithNetworkPoliciesWithoutWebhooks(kbc) - Run(kbc, false, false, true, true) - }) + //It("should generate a runnable project", func() { + // kbc.IsRestricted = false + // GenerateV4(kbc) + // Run(kbc, true, false, true, false) + //}) + //It("should generate a runnable project with the Installer", func() { + // kbc.IsRestricted = false + // GenerateV4(kbc) + // Run(kbc, false, true, true, false) + //}) + //It("should generate a runnable project without metrics exposed", func() { + // kbc.IsRestricted = false + // GenerateV4WithoutMetrics(kbc) + // Run(kbc, true, false, false, false) + //}) + //It("should generate a runnable project with metrics protected by network policies", func() { + // kbc.IsRestricted = false + // GenerateV4WithNetworkPoliciesWithoutWebhooks(kbc) + // Run(kbc, false, false, true, true) + //}) It("should generate a runnable project with webhooks and metrics protected by network policies", func() { kbc.IsRestricted = false GenerateV4WithNetworkPolicies(kbc) Run(kbc, true, false, true, true) }) - It("should generate a runnable project with the manager running "+ - "as restricted and without webhooks", func() { - kbc.IsRestricted = true - GenerateV4WithoutWebhooks(kbc) - Run(kbc, false, false, true, false) - }) + //It("should generate a runnable project with the manager running "+ + // "as restricted and without webhooks", func() { + // kbc.IsRestricted = true + // GenerateV4WithoutWebhooks(kbc) + // Run(kbc, false, false, true, false) + //}) }) }) @@ -312,26 +312,54 @@ func Run(kbc *utils.TestContext, hasWebhook, isToUseInstaller, hasMetrics bool, ExpectWithOffset(1, count).To(BeNumerically("==", 5)) } - if hasWebhook && hasNetworkPolicies { + if hasWebhook { By("validating that webhooks from namespace without the label will fail") - - // Define the namespace name and CR sample file path namespace := "test-namespace-without-webhook-label" - sampleFile := "path/to/your/sample-file.yaml" - // Create the namespace By("creating a namespace without the webhook: enabled label") _, err := kbc.Kubectl.Command("create", "namespace", namespace) Expect(err).NotTo(HaveOccurred(), "namespace should be created successfully") - // Apply the Custom Resource in the new namespace and expect it to fail - By("applying the CR in the namespace without the webhook: enabled label and expecting it to fail") - EventuallyWithOffset(1, func() error { - _, err = kbc.Kubectl.Apply(false, "-n", namespace, "-f", sampleFile) - return err - }, time.Minute, time.Second).Should(HaveOccurred(), "applying the CR should fail due to webhook call timeout") + if hasNetworkPolicies { + By("applying the CR in the namespace without the webhook: enabled label and expecting it to fail") + EventuallyWithOffset(1, func() error { + _, err = kbc.Kubectl.Apply(false, "-n", namespace, "-f", sampleFile) + return err + }, time.Minute, time.Second).ShouldNot(HaveOccurred(), "should apply the CR") + + By("validating that mutating webhooks will not work due missing webhook namespace label") + cnt, err := kbc.Kubectl.Get( + false, + "-n", namespace, + "-f", sampleFile, + "-o", "go-template={{ .spec.count }}") + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + + count, err := strconv.Atoi(cnt) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, count).To(BeNumerically("==", 1), + "the mutating webhook should set the count to 1 since namespace has no label") + } else { + By("applying the CR in a namespace without the webhook: should work without network policies") + EventuallyWithOffset(1, func() error { + _, err := kbc.Kubectl.Apply(false, "-n", namespace, "-f", sampleFile) + return err + }, 2*time.Minute, time.Second).ShouldNot(HaveOccurred(), "applying the CR should not fail without network policies") + + By("validating that mutating webhooks are working fine outside of the manager's namespace") + cnt, err := kbc.Kubectl.Get( + false, + "-n", namespace, + "-f", sampleFile, + "-o", "go-template={{ .spec.count }}") + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + + count, err := strconv.Atoi(cnt) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, count).To(BeNumerically("==", 5), + "the mutating webhook should set the count to 5") + } - // Cleanup: Remove the namespace By("removing the namespace") _, err = kbc.Kubectl.Command("delete", "namespace", namespace) Expect(err).NotTo(HaveOccurred(), "namespace should be removed successfully") diff --git a/testdata/project-v4-multigroup-with-plugins/.github/workflows/lint.yml b/testdata/project-v4-multigroup/.github/workflows/lint.yml similarity index 100% rename from testdata/project-v4-multigroup-with-plugins/.github/workflows/lint.yml rename to testdata/project-v4-multigroup/.github/workflows/lint.yml diff --git a/testdata/project-v4-multigroup-with-plugins/.github/workflows/test-e2e.yml b/testdata/project-v4-multigroup/.github/workflows/test-e2e.yml similarity index 100% rename from testdata/project-v4-multigroup-with-plugins/.github/workflows/test-e2e.yml rename to testdata/project-v4-multigroup/.github/workflows/test-e2e.yml diff --git a/testdata/project-v4-multigroup-with-plugins/.github/workflows/test.yml b/testdata/project-v4-multigroup/.github/workflows/test.yml similarity index 100% rename from testdata/project-v4-multigroup-with-plugins/.github/workflows/test.yml rename to testdata/project-v4-multigroup/.github/workflows/test.yml