2022-06-10 20:56:15 +00:00
|
|
|
// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
|
2020-09-16 14:19:51 +00:00
|
|
|
// SPDX-License-Identifier: Apache-2.0
|
2020-07-09 19:30:59 +00:00
|
|
|
|
2021-06-22 15:23:19 +00:00
|
|
|
package testlib
|
2020-07-09 19:30:59 +00:00
|
|
|
|
|
|
|
import (
|
2020-09-22 00:55:04 +00:00
|
|
|
"context"
|
2020-10-14 20:41:16 +00:00
|
|
|
"crypto/rand"
|
2020-12-08 01:39:51 +00:00
|
|
|
"encoding/base64"
|
2020-10-14 20:41:16 +00:00
|
|
|
"encoding/hex"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
2020-08-12 21:29:46 +00:00
|
|
|
"io/ioutil"
|
|
|
|
"os"
|
2020-07-09 19:30:59 +00:00
|
|
|
"testing"
|
2020-09-22 00:55:04 +00:00
|
|
|
"time"
|
2020-07-09 19:30:59 +00:00
|
|
|
|
|
|
|
"github.com/stretchr/testify/require"
|
2021-02-23 01:23:11 +00:00
|
|
|
authorizationv1 "k8s.io/api/authorization/v1"
|
2020-09-22 00:55:04 +00:00
|
|
|
corev1 "k8s.io/api/core/v1"
|
2020-12-15 17:49:45 +00:00
|
|
|
rbacv1 "k8s.io/api/rbac/v1"
|
2021-07-15 18:32:15 +00:00
|
|
|
k8serrors "k8s.io/apimachinery/pkg/api/errors"
|
2020-09-22 00:55:04 +00:00
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
2020-07-09 19:30:59 +00:00
|
|
|
"k8s.io/client-go/kubernetes"
|
|
|
|
"k8s.io/client-go/rest"
|
|
|
|
"k8s.io/client-go/tools/clientcmd"
|
2020-08-11 17:14:57 +00:00
|
|
|
aggregatorclient "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset"
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2021-09-20 19:47:39 +00:00
|
|
|
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/typed/apiextensions/v1"
|
|
|
|
|
2021-02-16 19:00:08 +00:00
|
|
|
auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
|
2021-03-11 00:57:15 +00:00
|
|
|
"go.pinniped.dev/generated/latest/apis/concierge/login/v1alpha1"
|
2021-02-16 19:00:08 +00:00
|
|
|
configv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
|
|
|
|
idpv1alpha1 "go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
|
|
|
|
conciergeclientset "go.pinniped.dev/generated/latest/client/concierge/clientset/versioned"
|
|
|
|
supervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
|
2022-06-10 20:56:15 +00:00
|
|
|
virtualsupervisorclientset "go.pinniped.dev/generated/latest/client/supervisor/virtual/clientset/versioned"
|
2021-01-13 01:27:41 +00:00
|
|
|
"go.pinniped.dev/internal/groupsuffix"
|
2021-01-19 18:50:22 +00:00
|
|
|
"go.pinniped.dev/internal/kubeclient"
|
2020-08-27 13:12:34 +00:00
|
|
|
|
|
|
|
// Import to initialize client auth plugins - the kubeconfig that we use for
|
|
|
|
// testing may use gcloud, az, oidc, etc.
|
|
|
|
_ "k8s.io/client-go/plugin/pkg/client/auth"
|
2020-07-09 19:30:59 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func NewClientConfig(t *testing.T) *rest.Config {
|
|
|
|
t.Helper()
|
|
|
|
|
2020-07-24 15:40:08 +00:00
|
|
|
return newClientConfigWithOverrides(t, &clientcmd.ConfigOverrides{})
|
|
|
|
}
|
|
|
|
|
2020-09-15 15:00:38 +00:00
|
|
|
func NewClientsetForKubeConfig(t *testing.T, kubeConfig string) kubernetes.Interface {
|
|
|
|
t.Helper()
|
2020-12-15 00:41:11 +00:00
|
|
|
return newClientsetWithConfig(t, NewRestConfigFromKubeconfig(t, kubeConfig))
|
|
|
|
}
|
2020-09-15 15:00:38 +00:00
|
|
|
|
2020-12-15 00:41:11 +00:00
|
|
|
func NewRestConfigFromKubeconfig(t *testing.T, kubeConfig string) *rest.Config {
|
2020-09-15 15:00:38 +00:00
|
|
|
kubeConfigFile, err := ioutil.TempFile("", "pinniped-cli-test-*")
|
|
|
|
require.NoError(t, err)
|
2021-03-11 00:57:15 +00:00
|
|
|
defer func() {
|
|
|
|
require.NoError(t, os.Remove(kubeConfigFile.Name()))
|
|
|
|
}()
|
2020-09-15 15:00:38 +00:00
|
|
|
|
|
|
|
_, err = kubeConfigFile.Write([]byte(kubeConfig))
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
restConfig, err := clientcmd.BuildConfigFromFlags("", kubeConfigFile.Name())
|
|
|
|
require.NoError(t, err)
|
2020-12-15 00:41:11 +00:00
|
|
|
return restConfig
|
2020-09-15 15:00:38 +00:00
|
|
|
}
|
|
|
|
|
2020-08-12 21:29:46 +00:00
|
|
|
func NewClientsetWithCertAndKey(t *testing.T, clientCertificateData, clientKeyData string) kubernetes.Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
2020-08-24 15:52:47 +00:00
|
|
|
return newClientsetWithConfig(t, newAnonymousClientRestConfigWithCertAndKeyAdded(t, clientCertificateData, clientKeyData))
|
2020-08-12 21:29:46 +00:00
|
|
|
}
|
|
|
|
|
2021-01-13 01:27:41 +00:00
|
|
|
func NewKubernetesClientset(t *testing.T) kubernetes.Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
2021-02-19 18:21:10 +00:00
|
|
|
return NewKubeclient(t, NewClientConfig(t)).Kubernetes
|
2021-01-13 01:27:41 +00:00
|
|
|
}
|
|
|
|
|
2020-10-30 20:09:14 +00:00
|
|
|
func NewSupervisorClientset(t *testing.T) supervisorclientset.Interface {
|
2020-07-24 15:40:08 +00:00
|
|
|
t.Helper()
|
|
|
|
|
2021-02-19 18:21:10 +00:00
|
|
|
return NewKubeclient(t, NewClientConfig(t)).PinnipedSupervisor
|
2020-08-12 21:29:46 +00:00
|
|
|
}
|
|
|
|
|
2022-06-10 20:56:15 +00:00
|
|
|
func NewAnonymousVirtualSupervisorClientset(t *testing.T) virtualsupervisorclientset.Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
return NewKubeclient(t, NewAnonymousClientRestConfig(t)).PinnipedSupervisorVirtual
|
|
|
|
}
|
|
|
|
|
|
|
|
func NewVirtualSupervisorClientset(t *testing.T) virtualsupervisorclientset.Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
return NewKubeclient(t, NewClientConfig(t)).PinnipedSupervisorVirtual
|
|
|
|
}
|
|
|
|
|
2020-10-30 20:09:14 +00:00
|
|
|
func NewConciergeClientset(t *testing.T) conciergeclientset.Interface {
|
2020-08-12 21:29:46 +00:00
|
|
|
t.Helper()
|
|
|
|
|
2021-02-19 18:21:10 +00:00
|
|
|
return NewKubeclient(t, NewClientConfig(t)).PinnipedConcierge
|
2020-10-30 20:09:14 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func NewAnonymousConciergeClientset(t *testing.T) conciergeclientset.Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
2021-02-19 18:21:10 +00:00
|
|
|
return NewKubeclient(t, NewAnonymousClientRestConfig(t)).PinnipedConcierge
|
2020-08-12 21:29:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func NewAggregatedClientset(t *testing.T) aggregatorclient.Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
return aggregatorclient.NewForConfigOrDie(NewClientConfig(t))
|
2020-07-24 15:40:08 +00:00
|
|
|
}
|
|
|
|
|
2021-09-20 19:47:39 +00:00
|
|
|
func NewAPIExtensionsV1Client(t *testing.T) apiextensionsv1.ApiextensionsV1Interface {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
return apiextensionsv1.NewForConfigOrDie(NewClientConfig(t))
|
|
|
|
}
|
|
|
|
|
2020-07-24 15:40:08 +00:00
|
|
|
func newClientConfigWithOverrides(t *testing.T, overrides *clientcmd.ConfigOverrides) *rest.Config {
|
|
|
|
t.Helper()
|
|
|
|
|
2020-07-09 19:30:59 +00:00
|
|
|
loader := clientcmd.NewDefaultClientConfigLoadingRules()
|
2020-07-24 15:40:08 +00:00
|
|
|
clientConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loader, overrides)
|
2020-07-09 19:30:59 +00:00
|
|
|
config, err := clientConfig.ClientConfig()
|
|
|
|
require.NoError(t, err)
|
|
|
|
return config
|
|
|
|
}
|
|
|
|
|
2020-08-12 21:29:46 +00:00
|
|
|
func newClientsetWithConfig(t *testing.T, config *rest.Config) kubernetes.Interface {
|
2020-07-24 15:40:08 +00:00
|
|
|
t.Helper()
|
|
|
|
|
2020-07-27 12:52:36 +00:00
|
|
|
result, err := kubernetes.NewForConfig(config)
|
|
|
|
require.NoError(t, err, "unexpected failure from kubernetes.NewForConfig()")
|
|
|
|
return result
|
2020-07-09 19:30:59 +00:00
|
|
|
}
|
2020-07-23 15:05:21 +00:00
|
|
|
|
2020-08-12 21:29:46 +00:00
|
|
|
// Returns a rest.Config without any user authentication info.
|
2021-02-19 18:21:10 +00:00
|
|
|
func NewAnonymousClientRestConfig(t *testing.T) *rest.Config {
|
2020-07-23 15:05:21 +00:00
|
|
|
t.Helper()
|
|
|
|
|
2021-10-20 11:59:24 +00:00
|
|
|
return kubeclient.SecureAnonymousClientConfig(NewClientConfig(t))
|
2020-07-23 15:05:21 +00:00
|
|
|
}
|
2020-08-11 17:14:57 +00:00
|
|
|
|
2020-08-12 21:29:46 +00:00
|
|
|
// Starting with an anonymous client config, add a cert and key to use for authentication in the API server.
|
2020-08-24 15:52:47 +00:00
|
|
|
func newAnonymousClientRestConfigWithCertAndKeyAdded(t *testing.T, clientCertificateData, clientKeyData string) *rest.Config {
|
2020-08-11 17:14:57 +00:00
|
|
|
t.Helper()
|
|
|
|
|
2021-02-19 18:21:10 +00:00
|
|
|
config := NewAnonymousClientRestConfig(t)
|
2020-08-24 15:52:47 +00:00
|
|
|
config.CertData = []byte(clientCertificateData)
|
|
|
|
config.KeyData = []byte(clientKeyData)
|
|
|
|
return config
|
2020-08-11 17:14:57 +00:00
|
|
|
}
|
2020-09-22 00:55:04 +00:00
|
|
|
|
2021-08-18 04:14:38 +00:00
|
|
|
func NewKubeclientOptions(t *testing.T, config *rest.Config) []kubeclient.Option {
|
2021-01-19 18:50:22 +00:00
|
|
|
t.Helper()
|
2021-08-18 04:14:38 +00:00
|
|
|
|
|
|
|
return []kubeclient.Option{
|
2021-01-13 01:27:41 +00:00
|
|
|
kubeclient.WithConfig(config),
|
2021-08-18 04:14:38 +00:00
|
|
|
kubeclient.WithMiddleware(groupsuffix.New(IntegrationEnv(t).APIGroupSuffix)),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func NewKubeclient(t *testing.T, config *rest.Config) *kubeclient.Client {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
client, err := kubeclient.New(NewKubeclientOptions(t, config)...)
|
2021-01-19 18:50:22 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
return client
|
|
|
|
}
|
|
|
|
|
2020-10-30 19:02:21 +00:00
|
|
|
// CreateTestWebhookAuthenticator creates and returns a test WebhookAuthenticator in $PINNIPED_TEST_CONCIERGE_NAMESPACE, which will be
|
2020-09-22 00:55:04 +00:00
|
|
|
// automatically deleted at the end of the current test's lifetime. It returns a corev1.TypedLocalObjectReference which
|
2020-10-30 19:02:21 +00:00
|
|
|
// describes the test webhook authenticator within the test namespace.
|
|
|
|
func CreateTestWebhookAuthenticator(ctx context.Context, t *testing.T) corev1.TypedLocalObjectReference {
|
2020-09-22 00:55:04 +00:00
|
|
|
t.Helper()
|
2020-09-24 22:51:43 +00:00
|
|
|
testEnv := IntegrationEnv(t)
|
2020-09-22 00:55:04 +00:00
|
|
|
|
2020-10-30 20:09:14 +00:00
|
|
|
client := NewConciergeClientset(t)
|
2021-02-09 18:59:32 +00:00
|
|
|
webhooks := client.AuthenticationV1alpha1().WebhookAuthenticators()
|
2020-09-22 00:55:04 +00:00
|
|
|
|
2021-03-05 01:25:43 +00:00
|
|
|
createContext, cancel := context.WithTimeout(ctx, time.Minute)
|
2020-09-22 00:55:04 +00:00
|
|
|
defer cancel()
|
2020-09-22 16:23:34 +00:00
|
|
|
|
2020-10-30 19:02:21 +00:00
|
|
|
webhook, err := webhooks.Create(createContext, &auth1alpha1.WebhookAuthenticator{
|
2020-12-02 21:32:54 +00:00
|
|
|
ObjectMeta: testObjectMeta(t, "webhook"),
|
|
|
|
Spec: testEnv.TestWebhook,
|
2020-09-22 00:55:04 +00:00
|
|
|
}, metav1.CreateOptions{})
|
2020-10-30 16:39:26 +00:00
|
|
|
require.NoError(t, err, "could not create test WebhookAuthenticator")
|
2021-03-23 15:33:05 +00:00
|
|
|
t.Logf("created test WebhookAuthenticator %s", webhook.Name)
|
2020-09-22 00:55:04 +00:00
|
|
|
|
|
|
|
t.Cleanup(func() {
|
2020-09-22 15:02:32 +00:00
|
|
|
t.Helper()
|
2021-03-23 15:33:05 +00:00
|
|
|
t.Logf("cleaning up test WebhookAuthenticator %s", webhook.Name)
|
2021-03-05 01:25:43 +00:00
|
|
|
deleteCtx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
2020-09-22 00:55:04 +00:00
|
|
|
defer cancel()
|
2020-10-30 19:02:21 +00:00
|
|
|
err := webhooks.Delete(deleteCtx, webhook.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoErrorf(t, err, "could not cleanup test WebhookAuthenticator %s/%s", webhook.Namespace, webhook.Name)
|
2020-09-22 00:55:04 +00:00
|
|
|
})
|
|
|
|
|
|
|
|
return corev1.TypedLocalObjectReference{
|
2021-02-05 01:02:59 +00:00
|
|
|
APIGroup: &auth1alpha1.SchemeGroupVersion.Group,
|
2020-10-30 16:39:26 +00:00
|
|
|
Kind: "WebhookAuthenticator",
|
2020-10-30 19:02:21 +00:00
|
|
|
Name: webhook.Name,
|
2020-09-22 00:55:04 +00:00
|
|
|
}
|
|
|
|
}
|
2020-10-14 20:41:16 +00:00
|
|
|
|
2020-12-15 18:25:31 +00:00
|
|
|
// CreateTestJWTAuthenticatorForCLIUpstream creates and returns a test JWTAuthenticator in
|
2020-12-08 01:39:51 +00:00
|
|
|
// $PINNIPED_TEST_CONCIERGE_NAMESPACE, which will be automatically deleted at the end of the current
|
|
|
|
// test's lifetime. It returns a corev1.TypedLocalObjectReference which describes the test JWT
|
|
|
|
// authenticator within the test namespace.
|
|
|
|
//
|
2021-04-07 19:56:09 +00:00
|
|
|
// CreateTestJWTAuthenticatorForCLIUpstream gets the OIDC issuer info from IntegrationEnv().CLIUpstreamOIDC.
|
2020-12-15 18:25:31 +00:00
|
|
|
func CreateTestJWTAuthenticatorForCLIUpstream(ctx context.Context, t *testing.T) corev1.TypedLocalObjectReference {
|
|
|
|
t.Helper()
|
|
|
|
testEnv := IntegrationEnv(t)
|
|
|
|
spec := auth1alpha1.JWTAuthenticatorSpec{
|
2021-04-07 19:56:09 +00:00
|
|
|
Issuer: testEnv.CLIUpstreamOIDC.Issuer,
|
|
|
|
Audience: testEnv.CLIUpstreamOIDC.ClientID,
|
2020-12-16 02:09:44 +00:00
|
|
|
// The default UsernameClaim is "username" but the upstreams that we use for
|
|
|
|
// integration tests won't necessarily have that claim, so use "sub" here.
|
2020-12-16 17:42:19 +00:00
|
|
|
Claims: auth1alpha1.JWTTokenClaims{Username: "sub"},
|
2020-12-15 18:25:31 +00:00
|
|
|
}
|
|
|
|
// If the test upstream does not have a CA bundle specified, then don't configure one in the
|
|
|
|
// JWTAuthenticator. Leaving TLSSpec set to nil will result in OIDC discovery using the OS's root
|
|
|
|
// CA store.
|
2021-04-07 19:56:09 +00:00
|
|
|
if testEnv.CLIUpstreamOIDC.CABundle != "" {
|
2020-12-15 18:25:31 +00:00
|
|
|
spec.TLS = &auth1alpha1.TLSSpec{
|
2021-04-07 19:56:09 +00:00
|
|
|
CertificateAuthorityData: base64.StdEncoding.EncodeToString([]byte(testEnv.CLIUpstreamOIDC.CABundle)),
|
2020-12-15 18:25:31 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return CreateTestJWTAuthenticator(ctx, t, spec)
|
|
|
|
}
|
|
|
|
|
|
|
|
// CreateTestJWTAuthenticator creates and returns a test JWTAuthenticator in
|
|
|
|
// $PINNIPED_TEST_CONCIERGE_NAMESPACE, which will be automatically deleted at the end of the current
|
|
|
|
// test's lifetime. It returns a corev1.TypedLocalObjectReference which describes the test JWT
|
|
|
|
// authenticator within the test namespace.
|
|
|
|
func CreateTestJWTAuthenticator(ctx context.Context, t *testing.T, spec auth1alpha1.JWTAuthenticatorSpec) corev1.TypedLocalObjectReference {
|
2020-12-08 01:39:51 +00:00
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
client := NewConciergeClientset(t)
|
2021-02-09 18:59:32 +00:00
|
|
|
jwtAuthenticators := client.AuthenticationV1alpha1().JWTAuthenticators()
|
2020-12-08 01:39:51 +00:00
|
|
|
|
2021-03-05 01:25:43 +00:00
|
|
|
createContext, cancel := context.WithTimeout(ctx, time.Minute)
|
2020-12-08 01:39:51 +00:00
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
jwtAuthenticator, err := jwtAuthenticators.Create(createContext, &auth1alpha1.JWTAuthenticator{
|
|
|
|
ObjectMeta: testObjectMeta(t, "jwt-authenticator"),
|
2020-12-15 18:25:31 +00:00
|
|
|
Spec: spec,
|
2020-12-08 01:39:51 +00:00
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err, "could not create test JWTAuthenticator")
|
2021-03-23 15:33:05 +00:00
|
|
|
t.Logf("created test JWTAuthenticator %s", jwtAuthenticator.Name)
|
2020-12-08 01:39:51 +00:00
|
|
|
|
|
|
|
t.Cleanup(func() {
|
|
|
|
t.Helper()
|
|
|
|
t.Logf("cleaning up test JWTAuthenticator %s/%s", jwtAuthenticator.Namespace, jwtAuthenticator.Name)
|
2021-03-05 01:25:43 +00:00
|
|
|
deleteCtx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
2020-12-08 01:39:51 +00:00
|
|
|
defer cancel()
|
|
|
|
err := jwtAuthenticators.Delete(deleteCtx, jwtAuthenticator.Name, metav1.DeleteOptions{})
|
2021-03-23 15:33:05 +00:00
|
|
|
require.NoErrorf(t, err, "could not cleanup test JWTAuthenticator %s", jwtAuthenticator.Name)
|
2020-12-08 01:39:51 +00:00
|
|
|
})
|
|
|
|
|
|
|
|
return corev1.TypedLocalObjectReference{
|
2021-02-05 01:02:59 +00:00
|
|
|
APIGroup: &auth1alpha1.SchemeGroupVersion.Group,
|
2020-12-08 01:39:51 +00:00
|
|
|
Kind: "JWTAuthenticator",
|
|
|
|
Name: jwtAuthenticator.Name,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
// CreateTestFederationDomain creates and returns a test FederationDomain in
|
2020-10-14 20:41:16 +00:00
|
|
|
// $PINNIPED_TEST_SUPERVISOR_NAMESPACE, which will be automatically deleted at the end of the
|
2021-04-07 19:56:09 +00:00
|
|
|
// current test's lifetime.
|
2020-10-15 13:09:49 +00:00
|
|
|
// If the provided issuer is not the empty string, then it will be used for the
|
2020-12-16 22:27:09 +00:00
|
|
|
// FederationDomain.Spec.Issuer field. Else, a random issuer will be generated.
|
|
|
|
func CreateTestFederationDomain(ctx context.Context, t *testing.T, issuer string, certSecretName string, expectStatus configv1alpha1.FederationDomainStatusCondition) *configv1alpha1.FederationDomain {
|
2020-10-14 20:41:16 +00:00
|
|
|
t.Helper()
|
|
|
|
testEnv := IntegrationEnv(t)
|
|
|
|
|
2021-03-05 01:25:43 +00:00
|
|
|
createContext, cancel := context.WithTimeout(ctx, time.Minute)
|
2020-10-14 20:41:16 +00:00
|
|
|
defer cancel()
|
|
|
|
|
2020-10-15 13:09:49 +00:00
|
|
|
if issuer == "" {
|
2020-12-15 17:47:04 +00:00
|
|
|
issuer = fmt.Sprintf("http://test-issuer-%s.pinniped.dev", RandHex(t, 8))
|
2020-10-15 13:09:49 +00:00
|
|
|
}
|
2020-10-14 20:41:16 +00:00
|
|
|
|
2020-12-17 19:34:49 +00:00
|
|
|
federationDomains := NewSupervisorClientset(t).ConfigV1alpha1().FederationDomains(testEnv.SupervisorNamespace)
|
|
|
|
federationDomain, err := federationDomains.Create(createContext, &configv1alpha1.FederationDomain{
|
2020-12-02 21:32:54 +00:00
|
|
|
ObjectMeta: testObjectMeta(t, "oidc-provider"),
|
2020-12-16 22:27:09 +00:00
|
|
|
Spec: configv1alpha1.FederationDomainSpec{
|
2020-11-02 22:55:29 +00:00
|
|
|
Issuer: issuer,
|
2020-12-16 22:27:09 +00:00
|
|
|
TLS: &configv1alpha1.FederationDomainTLSSpec{SecretName: certSecretName},
|
2020-10-14 20:41:16 +00:00
|
|
|
},
|
|
|
|
}, metav1.CreateOptions{})
|
2020-12-16 22:27:09 +00:00
|
|
|
require.NoError(t, err, "could not create test FederationDomain")
|
2020-12-17 19:34:49 +00:00
|
|
|
t.Logf("created test FederationDomain %s/%s", federationDomain.Namespace, federationDomain.Name)
|
2020-10-14 20:41:16 +00:00
|
|
|
|
|
|
|
t.Cleanup(func() {
|
|
|
|
t.Helper()
|
2020-12-17 19:34:49 +00:00
|
|
|
t.Logf("cleaning up test FederationDomain %s/%s", federationDomain.Namespace, federationDomain.Name)
|
2021-03-05 01:25:43 +00:00
|
|
|
deleteCtx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
2020-10-14 20:41:16 +00:00
|
|
|
defer cancel()
|
2020-12-17 19:34:49 +00:00
|
|
|
err := federationDomains.Delete(deleteCtx, federationDomain.Name, metav1.DeleteOptions{})
|
2020-10-15 13:09:49 +00:00
|
|
|
notFound := k8serrors.IsNotFound(err)
|
|
|
|
// It's okay if it is not found, because it might have been deleted by another part of this test.
|
|
|
|
if !notFound {
|
2020-12-17 19:34:49 +00:00
|
|
|
require.NoErrorf(t, err, "could not cleanup test FederationDomain %s/%s", federationDomain.Namespace, federationDomain.Name)
|
2020-10-15 13:09:49 +00:00
|
|
|
}
|
2020-10-14 20:41:16 +00:00
|
|
|
})
|
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
// If we're not expecting any particular status, just return the new FederationDomain immediately.
|
2020-12-02 21:32:54 +00:00
|
|
|
if expectStatus == "" {
|
2020-12-17 19:34:49 +00:00
|
|
|
return federationDomain
|
2020-12-02 21:32:54 +00:00
|
|
|
}
|
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
// Wait for the FederationDomain to enter the expected phase (or time out).
|
|
|
|
var result *configv1alpha1.FederationDomain
|
2021-06-16 22:51:23 +00:00
|
|
|
RequireEventuallyf(t, func(requireEventually *require.Assertions) {
|
2020-12-02 21:32:54 +00:00
|
|
|
var err error
|
2020-12-17 19:34:49 +00:00
|
|
|
result, err = federationDomains.Get(ctx, federationDomain.Name, metav1.GetOptions{})
|
2021-06-16 22:51:23 +00:00
|
|
|
requireEventually.NoError(err)
|
|
|
|
requireEventually.Equal(expectStatus, result.Status.Status)
|
|
|
|
|
|
|
|
// If the FederationDomain was successfully created, ensure all secrets are present before continuing
|
|
|
|
if expectStatus == configv1alpha1.SuccessFederationDomainStatusCondition {
|
|
|
|
requireEventually.NotEmpty(result.Status.Secrets.JWKS.Name, "expected status.secrets.jwks.name not to be empty")
|
|
|
|
requireEventually.NotEmpty(result.Status.Secrets.TokenSigningKey.Name, "expected status.secrets.tokenSigningKey.name not to be empty")
|
|
|
|
requireEventually.NotEmpty(result.Status.Secrets.StateSigningKey.Name, "expected status.secrets.stateSigningKey.name not to be empty")
|
|
|
|
requireEventually.NotEmpty(result.Status.Secrets.StateEncryptionKey.Name, "expected status.secrets.stateEncryptionKey.name not to be empty")
|
|
|
|
}
|
2020-12-16 22:27:09 +00:00
|
|
|
}, 60*time.Second, 1*time.Second, "expected the FederationDomain to have status %q", expectStatus)
|
2020-12-17 19:34:49 +00:00
|
|
|
return federationDomain
|
2020-10-14 20:41:16 +00:00
|
|
|
}
|
|
|
|
|
2021-06-30 15:50:22 +00:00
|
|
|
func RandBytes(t *testing.T, numBytes int) []byte {
|
2020-12-15 17:47:04 +00:00
|
|
|
buf := make([]byte, numBytes)
|
|
|
|
_, err := io.ReadFull(rand.Reader, buf)
|
2020-12-02 21:32:54 +00:00
|
|
|
require.NoError(t, err)
|
2021-06-30 15:50:22 +00:00
|
|
|
return buf
|
|
|
|
}
|
|
|
|
|
|
|
|
func RandHex(t *testing.T, numBytes int) string {
|
|
|
|
return hex.EncodeToString(RandBytes(t, numBytes))
|
2020-12-02 21:32:54 +00:00
|
|
|
}
|
|
|
|
|
2020-12-18 23:10:17 +00:00
|
|
|
func CreateTestSecret(t *testing.T, namespace string, baseName string, secretType corev1.SecretType, stringData map[string]string) *corev1.Secret {
|
2020-12-02 21:32:54 +00:00
|
|
|
t.Helper()
|
2021-01-13 01:27:41 +00:00
|
|
|
client := NewKubernetesClientset(t)
|
2021-03-05 01:25:43 +00:00
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
2020-12-02 21:32:54 +00:00
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
created, err := client.CoreV1().Secrets(namespace).Create(ctx, &corev1.Secret{
|
|
|
|
ObjectMeta: testObjectMeta(t, baseName),
|
2020-12-18 23:28:56 +00:00
|
|
|
Type: secretType,
|
2020-12-02 21:32:54 +00:00
|
|
|
StringData: stringData,
|
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
t.Cleanup(func() {
|
2020-12-15 18:26:33 +00:00
|
|
|
t.Logf("cleaning up test Secret %s/%s", created.Namespace, created.Name)
|
2020-12-02 21:32:54 +00:00
|
|
|
err := client.CoreV1().Secrets(namespace).Delete(context.Background(), created.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
})
|
|
|
|
t.Logf("created test Secret %s", created.Name)
|
|
|
|
return created
|
|
|
|
}
|
|
|
|
|
|
|
|
func CreateClientCredsSecret(t *testing.T, clientID string, clientSecret string) *corev1.Secret {
|
|
|
|
t.Helper()
|
|
|
|
env := IntegrationEnv(t)
|
|
|
|
return CreateTestSecret(t,
|
|
|
|
env.SupervisorNamespace,
|
2020-12-15 18:26:33 +00:00
|
|
|
"client-creds",
|
2020-12-02 21:32:54 +00:00
|
|
|
"secrets.pinniped.dev/oidc-client",
|
|
|
|
map[string]string{
|
|
|
|
"clientID": clientID,
|
|
|
|
"clientSecret": clientSecret,
|
|
|
|
},
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
func CreateTestOIDCIdentityProvider(t *testing.T, spec idpv1alpha1.OIDCIdentityProviderSpec, expectedPhase idpv1alpha1.OIDCIdentityProviderPhase) *idpv1alpha1.OIDCIdentityProvider {
|
2020-12-02 21:32:54 +00:00
|
|
|
t.Helper()
|
|
|
|
env := IntegrationEnv(t)
|
|
|
|
client := NewSupervisorClientset(t)
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
|
|
|
|
defer cancel()
|
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
// Create the OIDCIdentityProvider using GenerateName to get a random name.
|
|
|
|
upstreams := client.IDPV1alpha1().OIDCIdentityProviders(env.SupervisorNamespace)
|
2020-12-02 21:32:54 +00:00
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
created, err := upstreams.Create(ctx, &idpv1alpha1.OIDCIdentityProvider{
|
2021-04-06 17:10:01 +00:00
|
|
|
ObjectMeta: testObjectMeta(t, "upstream-oidc-idp"),
|
2020-12-02 21:32:54 +00:00
|
|
|
Spec: spec,
|
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
// Always clean this up after this point.
|
|
|
|
t.Cleanup(func() {
|
2020-12-16 22:27:09 +00:00
|
|
|
t.Logf("cleaning up test OIDCIdentityProvider %s/%s", created.Namespace, created.Name)
|
2020-12-02 21:32:54 +00:00
|
|
|
err := upstreams.Delete(context.Background(), created.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
})
|
2020-12-16 22:27:09 +00:00
|
|
|
t.Logf("created test OIDCIdentityProvider %s", created.Name)
|
2020-12-02 21:32:54 +00:00
|
|
|
|
2020-12-16 22:27:09 +00:00
|
|
|
// Wait for the OIDCIdentityProvider to enter the expected phase (or time out).
|
|
|
|
var result *idpv1alpha1.OIDCIdentityProvider
|
2021-06-16 22:51:23 +00:00
|
|
|
RequireEventuallyf(t, func(requireEventually *require.Assertions) {
|
2020-12-02 21:32:54 +00:00
|
|
|
var err error
|
|
|
|
result, err = upstreams.Get(ctx, created.Name, metav1.GetOptions{})
|
2021-06-16 22:51:23 +00:00
|
|
|
requireEventually.NoErrorf(err, "error while getting OIDCIdentityProvider %s/%s", created.Namespace, created.Name)
|
|
|
|
requireEventually.Equal(expectedPhase, result.Status.Phase)
|
2021-05-17 19:57:34 +00:00
|
|
|
}, 60*time.Second, 1*time.Second, "expected the OIDCIdentityProvider to go into phase %s, OIDCIdentityProvider was: %s", expectedPhase, Sdump(result))
|
2020-12-02 21:32:54 +00:00
|
|
|
return result
|
|
|
|
}
|
|
|
|
|
2021-04-06 17:10:01 +00:00
|
|
|
func CreateTestLDAPIdentityProvider(t *testing.T, spec idpv1alpha1.LDAPIdentityProviderSpec, expectedPhase idpv1alpha1.LDAPIdentityProviderPhase) *idpv1alpha1.LDAPIdentityProvider {
|
|
|
|
t.Helper()
|
|
|
|
env := IntegrationEnv(t)
|
|
|
|
client := NewSupervisorClientset(t)
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
|
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
// Create the LDAPIdentityProvider using GenerateName to get a random name.
|
|
|
|
upstreams := client.IDPV1alpha1().LDAPIdentityProviders(env.SupervisorNamespace)
|
|
|
|
|
|
|
|
created, err := upstreams.Create(ctx, &idpv1alpha1.LDAPIdentityProvider{
|
|
|
|
ObjectMeta: testObjectMeta(t, "upstream-ldap-idp"),
|
|
|
|
Spec: spec,
|
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
// Always clean this up after this point.
|
|
|
|
t.Cleanup(func() {
|
|
|
|
t.Logf("cleaning up test LDAPIdentityProvider %s/%s", created.Namespace, created.Name)
|
|
|
|
err := upstreams.Delete(context.Background(), created.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
})
|
|
|
|
t.Logf("created test LDAPIdentityProvider %s", created.Name)
|
|
|
|
|
|
|
|
// Wait for the LDAPIdentityProvider to enter the expected phase (or time out).
|
|
|
|
var result *idpv1alpha1.LDAPIdentityProvider
|
2021-06-16 22:51:23 +00:00
|
|
|
RequireEventuallyf(t,
|
|
|
|
func(requireEventually *require.Assertions) {
|
|
|
|
var err error
|
|
|
|
result, err = upstreams.Get(ctx, created.Name, metav1.GetOptions{})
|
|
|
|
requireEventually.NoErrorf(err, "error while getting LDAPIdentityProvider %s/%s", created.Namespace, created.Name)
|
|
|
|
requireEventually.Equalf(expectedPhase, result.Status.Phase, "LDAPIdentityProvider is not in phase %s: %v", expectedPhase, Sdump(result))
|
|
|
|
},
|
2021-05-20 20:39:48 +00:00
|
|
|
2*time.Minute, // it takes 1 minute for a failed LDAP TLS connection test to timeout before it tries using StartTLS, so wait longer than that
|
|
|
|
1*time.Second,
|
2021-06-16 22:51:23 +00:00
|
|
|
"expected the LDAPIdentityProvider to go into phase %s",
|
|
|
|
expectedPhase,
|
|
|
|
)
|
2021-04-06 17:10:01 +00:00
|
|
|
return result
|
|
|
|
}
|
|
|
|
|
2021-07-07 16:23:32 +00:00
|
|
|
func CreateTestActiveDirectoryIdentityProvider(t *testing.T, spec idpv1alpha1.ActiveDirectoryIdentityProviderSpec, expectedPhase idpv1alpha1.ActiveDirectoryIdentityProviderPhase) *idpv1alpha1.ActiveDirectoryIdentityProvider {
|
|
|
|
t.Helper()
|
|
|
|
env := IntegrationEnv(t)
|
|
|
|
client := NewSupervisorClientset(t)
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
|
|
|
|
defer cancel()
|
|
|
|
|
2021-07-08 22:00:04 +00:00
|
|
|
// Create the ActiveDirectoryIdentityProvider using GenerateName to get a random name.
|
2021-07-07 16:23:32 +00:00
|
|
|
upstreams := client.IDPV1alpha1().ActiveDirectoryIdentityProviders(env.SupervisorNamespace)
|
|
|
|
|
|
|
|
created, err := upstreams.Create(ctx, &idpv1alpha1.ActiveDirectoryIdentityProvider{
|
|
|
|
ObjectMeta: testObjectMeta(t, "upstream-ad-idp"),
|
|
|
|
Spec: spec,
|
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
// Always clean this up after this point.
|
|
|
|
t.Cleanup(func() {
|
|
|
|
t.Logf("cleaning up test ActiveDirectoryIdentityProvider %s/%s", created.Namespace, created.Name)
|
|
|
|
err := upstreams.Delete(context.Background(), created.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
})
|
|
|
|
t.Logf("created test ActiveDirectoryIdentityProvider %s", created.Name)
|
|
|
|
|
2021-09-03 00:17:15 +00:00
|
|
|
// Wait for the ActiveDirectoryIdentityProvider to enter the expected phase (or time out).
|
2021-07-07 16:23:32 +00:00
|
|
|
var result *idpv1alpha1.ActiveDirectoryIdentityProvider
|
|
|
|
RequireEventuallyf(t,
|
|
|
|
func(requireEventually *require.Assertions) {
|
|
|
|
var err error
|
|
|
|
result, err = upstreams.Get(ctx, created.Name, metav1.GetOptions{})
|
|
|
|
requireEventually.NoErrorf(err, "error while getting ActiveDirectoryIdentityProvider %s/%s", created.Namespace, created.Name)
|
|
|
|
requireEventually.Equalf(expectedPhase, result.Status.Phase, "ActiveDirectoryIdentityProvider is not in phase %s: %v", expectedPhase, Sdump(result))
|
|
|
|
},
|
|
|
|
2*time.Minute, // it takes 1 minute for a failed LDAP TLS connection test to timeout before it tries using StartTLS, so wait longer than that
|
|
|
|
1*time.Second,
|
|
|
|
"expected the ActiveDirectoryIdentityProvider to go into phase %s",
|
|
|
|
expectedPhase,
|
|
|
|
)
|
|
|
|
return result
|
|
|
|
}
|
|
|
|
|
2020-12-15 17:49:45 +00:00
|
|
|
func CreateTestClusterRoleBinding(t *testing.T, subject rbacv1.Subject, roleRef rbacv1.RoleRef) *rbacv1.ClusterRoleBinding {
|
|
|
|
t.Helper()
|
2021-01-13 01:27:41 +00:00
|
|
|
client := NewKubernetesClientset(t)
|
2021-03-05 01:25:43 +00:00
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
2020-12-15 17:49:45 +00:00
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
// Create the ClusterRoleBinding using GenerateName to get a random name.
|
|
|
|
clusterRoles := client.RbacV1().ClusterRoleBindings()
|
|
|
|
|
|
|
|
created, err := clusterRoles.Create(ctx, &rbacv1.ClusterRoleBinding{
|
|
|
|
ObjectMeta: testObjectMeta(t, "cluster-role"),
|
|
|
|
Subjects: []rbacv1.Subject{subject},
|
|
|
|
RoleRef: roleRef,
|
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
t.Logf("created test ClusterRoleBinding %s", created.Name)
|
|
|
|
|
|
|
|
t.Cleanup(func() {
|
|
|
|
t.Logf("cleaning up test ClusterRoleBinding %s", created.Name)
|
|
|
|
err := clusterRoles.Delete(context.Background(), created.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
})
|
|
|
|
return created
|
|
|
|
}
|
|
|
|
|
2021-03-11 00:57:15 +00:00
|
|
|
func CreateTokenCredentialRequest(ctx context.Context, t *testing.T, spec v1alpha1.TokenCredentialRequestSpec) (*v1alpha1.TokenCredentialRequest, error) {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
client := NewAnonymousConciergeClientset(t)
|
|
|
|
|
|
|
|
ctx, cancel := context.WithTimeout(ctx, time.Minute)
|
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
return client.LoginV1alpha1().TokenCredentialRequests().Create(ctx,
|
|
|
|
&v1alpha1.TokenCredentialRequest{Spec: spec}, metav1.CreateOptions{},
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
2021-03-11 20:10:16 +00:00
|
|
|
func CreatePod(ctx context.Context, t *testing.T, name, namespace string, spec corev1.PodSpec) *corev1.Pod {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
client := NewKubernetesClientset(t)
|
|
|
|
pods := client.CoreV1().Pods(namespace)
|
|
|
|
|
2021-07-26 16:18:43 +00:00
|
|
|
const podCreateTimeout = 2 * time.Minute
|
|
|
|
ctx, cancel := context.WithTimeout(ctx, podCreateTimeout+time.Second)
|
2021-03-11 20:10:16 +00:00
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
created, err := pods.Create(ctx, &corev1.Pod{ObjectMeta: testObjectMeta(t, name), Spec: spec}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
t.Logf("created test Pod %s", created.Name)
|
|
|
|
|
|
|
|
t.Cleanup(func() {
|
|
|
|
t.Logf("cleaning up test Pod %s", created.Name)
|
|
|
|
err := pods.Delete(context.Background(), created.Name, metav1.DeleteOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
})
|
|
|
|
|
|
|
|
var result *corev1.Pod
|
2021-06-16 22:51:23 +00:00
|
|
|
RequireEventuallyf(t, func(requireEventually *require.Assertions) {
|
2021-03-11 20:10:16 +00:00
|
|
|
var err error
|
|
|
|
result, err = pods.Get(ctx, created.Name, metav1.GetOptions{})
|
2021-06-16 22:51:23 +00:00
|
|
|
requireEventually.NoError(err)
|
|
|
|
requireEventually.Equal(corev1.PodRunning, result.Status.Phase)
|
2021-07-26 16:18:43 +00:00
|
|
|
}, podCreateTimeout, 1*time.Second, "expected the Pod to go into phase %s", corev1.PodRunning)
|
2021-03-11 20:10:16 +00:00
|
|
|
return result
|
|
|
|
}
|
|
|
|
|
2021-08-18 04:14:38 +00:00
|
|
|
func CreateNamespace(ctx context.Context, t *testing.T, name string) *corev1.Namespace {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
adminClient := NewKubernetesClientset(t)
|
|
|
|
|
|
|
|
ctx, cancel := context.WithTimeout(ctx, time.Minute)
|
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
namespace, err := adminClient.CoreV1().Namespaces().Create(ctx, &corev1.Namespace{
|
|
|
|
ObjectMeta: metav1.ObjectMeta{GenerateName: name + "-integration-test-"},
|
|
|
|
}, metav1.CreateOptions{})
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
t.Cleanup(func() {
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
|
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
t.Logf("cleaning up test namespace %s", namespace.Name)
|
|
|
|
require.NoError(t, adminClient.CoreV1().Namespaces().Delete(ctx, namespace.Name, metav1.DeleteOptions{}))
|
|
|
|
})
|
|
|
|
|
|
|
|
return namespace
|
|
|
|
}
|
|
|
|
|
2021-02-23 01:23:11 +00:00
|
|
|
func WaitForUserToHaveAccess(t *testing.T, user string, groups []string, shouldHaveAccessTo *authorizationv1.ResourceAttributes) {
|
|
|
|
t.Helper()
|
|
|
|
client := NewKubernetesClientset(t)
|
2021-03-05 01:25:43 +00:00
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
|
2021-02-23 01:23:11 +00:00
|
|
|
defer cancel()
|
|
|
|
|
|
|
|
RequireEventuallyWithoutError(t, func() (bool, error) {
|
|
|
|
subjectAccessReview, err := client.AuthorizationV1().SubjectAccessReviews().Create(ctx,
|
|
|
|
&authorizationv1.SubjectAccessReview{
|
|
|
|
Spec: authorizationv1.SubjectAccessReviewSpec{
|
|
|
|
ResourceAttributes: shouldHaveAccessTo,
|
|
|
|
User: user,
|
|
|
|
Groups: groups,
|
|
|
|
}}, metav1.CreateOptions{})
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
return subjectAccessReview.Status.Allowed, nil
|
2021-03-05 01:25:43 +00:00
|
|
|
}, time.Minute, 500*time.Millisecond)
|
2021-02-23 01:23:11 +00:00
|
|
|
}
|
|
|
|
|
2020-12-02 21:32:54 +00:00
|
|
|
func testObjectMeta(t *testing.T, baseName string) metav1.ObjectMeta {
|
|
|
|
return metav1.ObjectMeta{
|
|
|
|
GenerateName: fmt.Sprintf("test-%s-", baseName),
|
|
|
|
Labels: map[string]string{"pinniped.dev/test": ""},
|
|
|
|
Annotations: map[string]string{"pinniped.dev/testName": t.Name()},
|
2020-10-14 20:41:16 +00:00
|
|
|
}
|
|
|
|
}
|