djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The impersonation controller should sync when any secret of type kubernetes.io/tls changes in the namespace

Browse Source
This commit is contained in:
Joshua Casey 2023-07-19 16:15:41 -05:00
parent c78db66665
commit 3e57716f0e
2 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
internal/controller/impersonatorconfig/impersonator_config.go
View File

@ -17,6 +17,7 @@ import (
"time" "time"
"github.com/go-logr/logr" "github.com/go-logr/logr"
corev1 "k8s.io/api/core/v1"
v1 "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/api/equality" "k8s.io/apimachinery/pkg/api/equality"
k8serrors "k8s.io/apimachinery/pkg/api/errors" k8serrors "k8s.io/apimachinery/pkg/api/errors"
@ -161,7 +162,16 @@ func NewImpersonatorConfigController(
withInformer( withInformer(
secretsInformer, secretsInformer,
pinnipedcontroller.SimpleFilterWithSingletonQueue(func(obj metav1.Object) bool { pinnipedcontroller.SimpleFilterWithSingletonQueue(func(obj metav1.Object) bool {
return obj.GetNamespace() == namespace && secretNames.Has(obj.GetName()) secret, ok := obj.(*corev1.Secret)
if !ok {
return false
}
if secret.GetNamespace() != namespace {
return false
}
return secretNames.Has(secret.GetName()) || secret.Type == corev1.SecretTypeTLS
}), }),
controllerlib.InformerOption{}, controllerlib.InformerOption{},
), ),

14
internal/controller/impersonatorconfig/impersonator_config_test.go
View File

@ -1,4 +1,4 @@
// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved. // Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0 // SPDX-License-Identifier: Apache-2.0
package impersonatorconfig package impersonatorconfig
@ -184,7 +184,7 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
when("watching Secret objects", func() { when("watching Secret objects", func() {
var subject controllerlib.Filter var subject controllerlib.Filter
var target1, target2, target3, wrongNamespace1, wrongNamespace2, wrongName, unrelated *corev1.Secret var target1, target2, target3, wrongNamespace1, wrongNamespace2, wrongName, unrelated, typeTLS, typeTLSWrongNamespace *corev1.Secret
it.Before(func() { it.Before(func() {
subject = secretsInformerFilter subject = secretsInformerFilter
@ -195,6 +195,8 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
wrongNamespace2 = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: caSecretName, Namespace: "wrong-namespace"}} wrongNamespace2 = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: caSecretName, Namespace: "wrong-namespace"}}
wrongName = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "wrong-name", Namespace: installedInNamespace}} wrongName = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "wrong-name", Namespace: installedInNamespace}}
unrelated = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "wrong-name", Namespace: "wrong-namespace"}} unrelated = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "wrong-name", Namespace: "wrong-namespace"}}
typeTLS = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "any-name", Namespace: installedInNamespace}, Type: corev1.SecretTypeTLS}
typeTLSWrongNamespace = &corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "any-name", Namespace: "wrong-namespace"}, Type: corev1.SecretTypeTLS}
}) })
when("one of the target Secrets changes", func() { when("one of the target Secrets changes", func() {
@ -211,6 +213,10 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
r.True(subject.Update(target3, unrelated)) r.True(subject.Update(target3, unrelated))
r.True(subject.Update(unrelated, target3)) r.True(subject.Update(unrelated, target3))
r.True(subject.Delete(target3)) r.True(subject.Delete(target3))
r.True(subject.Add(typeTLS))
r.True(subject.Update(typeTLS, unrelated))
r.True(subject.Update(unrelated, typeTLS))
r.True(subject.Delete(typeTLS))
}) })
}) })
@ -224,6 +230,10 @@ func TestImpersonatorConfigControllerOptions(t *testing.T) {
r.False(subject.Update(wrongNamespace2, unrelated)) r.False(subject.Update(wrongNamespace2, unrelated))
r.False(subject.Update(unrelated, wrongNamespace2)) r.False(subject.Update(unrelated, wrongNamespace2))
r.False(subject.Delete(wrongNamespace2)) r.False(subject.Delete(wrongNamespace2))
r.False(subject.Add(typeTLSWrongNamespace))
r.False(subject.Update(typeTLSWrongNamespace, unrelated))
r.False(subject.Update(unrelated, typeTLSWrongNamespace))
r.False(subject.Delete(typeTLSWrongNamespace))
}) })
}) })