|
|
@@ -1,577 +1,677 @@
|
|
|
package forms_test
|
|
|
|
|
|
import (
|
|
|
- "encoding/base64"
|
|
|
"testing"
|
|
|
|
|
|
+ "github.com/go-test/deep"
|
|
|
"github.com/porter-dev/porter/internal/forms"
|
|
|
- "github.com/porter-dev/porter/internal/kubernetes"
|
|
|
"github.com/porter-dev/porter/internal/models"
|
|
|
- "github.com/porter-dev/porter/internal/repository/test"
|
|
|
-)
|
|
|
-
|
|
|
-func TestPopulateServiceAccountBasic(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClusterCAWithData), false)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
-
|
|
|
- // create a new form
|
|
|
- form := forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- }
|
|
|
-
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.SA)
|
|
|
- decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
- t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != "x509" {
|
|
|
- t.Errorf("service account auth mechanism is not x509")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
- t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientCertificateData), string(decodedStr))
|
|
|
- }
|
|
|
+ "gorm.io/gorm"
|
|
|
|
|
|
- if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
- t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientKeyData), string(decodedStr))
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountClusterDataAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClusterCAWithoutData), false)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
-
|
|
|
- // create a new form
|
|
|
- form := forms.ClusterCADataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- ClusterCAData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
- }
|
|
|
-
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
- decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
- t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != "x509" {
|
|
|
- t.Errorf("service account auth mechanism is not x509")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
- t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientCertificateData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
- t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientKeyData), string(decodedStr))
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountClusterLocalhostAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClusterLocalhost), false)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
-
|
|
|
- // create a new form
|
|
|
- form := forms.ClusterLocalhostAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- ClusterHostname: "host.docker.internal",
|
|
|
- }
|
|
|
-
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
- decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].Server != "https://host.docker.internal:30000" {
|
|
|
- t.Errorf("service account cluster server is incorrect: expected %s, got %s\n",
|
|
|
- "https://host.docker.internal:30000", sa.Clusters[0].Server)
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != "x509" {
|
|
|
- t.Errorf("service account auth mechanism is not x509")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
- t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientCertificateData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
- t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientKeyData), string(decodedStr))
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountClientCertAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClientWithoutCertData), false)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
-
|
|
|
- // create a new form
|
|
|
- form := forms.ClientCertDataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- ClientCertData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
- }
|
|
|
-
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
- decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
- t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != "x509" {
|
|
|
- t.Errorf("service account auth mechanism is not x509")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
- t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientCertificateData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
- t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientKeyData), string(decodedStr))
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountClientCertAndKeyActions(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClientWithoutCertAndKeyData), false)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
-
|
|
|
- // create a new form
|
|
|
- form := forms.ClientCertDataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- ClientCertData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
- }
|
|
|
-
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- keyForm := forms.ClientKeyDataAction{
|
|
|
- ServiceAccountActionResolver: form.ServiceAccountActionResolver,
|
|
|
- ClientKeyData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
- }
|
|
|
-
|
|
|
- err = keyForm.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
-
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(keyForm.ServiceAccountActionResolver.SA)
|
|
|
- decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
- t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != "x509" {
|
|
|
- t.Errorf("service account auth mechanism is not x509")
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
- t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientCertificateData), string(decodedStr))
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
- t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.ClientKeyData), string(decodedStr))
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountTokenDataAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
- tokenData := "abcdefghijklmnop"
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(BearerTokenWithoutData), false)
|
|
|
+ ints "github.com/porter-dev/porter/internal/models/integrations"
|
|
|
+)
|
|
|
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
+func TestClusterLocal(t *testing.T) {
|
|
|
+ tester := &tester{
|
|
|
+ dbFileName: "./cluster_local.db",
|
|
|
}
|
|
|
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
+ setupTestEnv(tester, t)
|
|
|
+ initUser(tester, t)
|
|
|
+ initProject(tester, t)
|
|
|
+ defer cleanup(tester, t)
|
|
|
|
|
|
- // create a new form
|
|
|
- form := forms.TokenDataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- TokenData: tokenData,
|
|
|
+ // create cluster candidate
|
|
|
+ ccForm := &forms.CreateClusterCandidatesForm{
|
|
|
+ ProjectID: tester.initProjects[0].ID,
|
|
|
+ Kubeconfig: ClusterCAWithData,
|
|
|
+ IsLocal: true,
|
|
|
}
|
|
|
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+ ccs, err := ccForm.ToClusterCandidates(true)
|
|
|
|
|
|
if err != nil {
|
|
|
t.Fatalf("%v\n", err)
|
|
|
}
|
|
|
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != models.Bearer {
|
|
|
- t.Errorf("service account auth mechanism is not %s\n", models.Bearer)
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.Token) != tokenData {
|
|
|
- t.Errorf("service account token data is wrong: expected %s, got %s\n",
|
|
|
- tokenData, sa.Token)
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountGCPKeyDataAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
- gcpKeyData := []byte(`{"key": "data"}`)
|
|
|
+ var cc *models.ClusterCandidate
|
|
|
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
+ for _, _cc := range ccs {
|
|
|
+ cc, err = tester.repo.Cluster.CreateClusterCandidate(_cc)
|
|
|
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(GCPPlugin), false)
|
|
|
+ if err != nil {
|
|
|
+ t.Fatalf("%v\n", err)
|
|
|
+ }
|
|
|
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
+ cc, err = tester.repo.Cluster.ReadClusterCandidate(cc.ID)
|
|
|
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+ if err != nil {
|
|
|
+ t.Fatalf("%v\n", err)
|
|
|
+ }
|
|
|
}
|
|
|
|
|
|
- // create a new form
|
|
|
- form := forms.GCPKeyDataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- GCPKeyData: string(gcpKeyData),
|
|
|
+ form := &forms.ResolveClusterForm{
|
|
|
+ Resolver: &models.ClusterResolverAll{},
|
|
|
+ ClusterCandidateID: cc.ID,
|
|
|
+ ProjectID: tester.initProjects[0].ID,
|
|
|
+ UserID: tester.initUsers[0].ID,
|
|
|
}
|
|
|
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+ // resolve integration (should be kube with local)
|
|
|
+ err = form.ResolveIntegration(*tester.repo)
|
|
|
|
|
|
if err != nil {
|
|
|
t.Fatalf("%v\n", err)
|
|
|
}
|
|
|
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+ expIntegration := &ints.KubeIntegration{
|
|
|
+ Mechanism: ints.KubeLocal,
|
|
|
+ UserID: tester.initUsers[0].ID,
|
|
|
+ ProjectID: tester.initProjects[0].ID,
|
|
|
+ Kubeconfig: cc.Kubeconfig,
|
|
|
}
|
|
|
|
|
|
- if sa.Integration != models.GCP {
|
|
|
- t.Errorf("service account auth mechanism is not %s\n", models.GCP)
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.GCPKeyData) != string(gcpKeyData) {
|
|
|
- t.Errorf("service account token data is wrong: expected %s, got %s\n",
|
|
|
- string(sa.GCPKeyData), string(gcpKeyData))
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestPopulateServiceAccountAWSKeyDataAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
-
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(AWSEKSGetTokenExec), false)
|
|
|
+ // make sure integration is equal, read integration from DB
|
|
|
+ gotIntegration, err := tester.repo.KubeIntegration.ReadKubeIntegration(form.IntegrationID)
|
|
|
|
|
|
if err != nil {
|
|
|
t.Fatalf("%v\n", err)
|
|
|
}
|
|
|
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
+ // reset got integration model
|
|
|
+ gotIntegration.Model = gorm.Model{}
|
|
|
|
|
|
- // create a new form
|
|
|
- form := forms.AWSDataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- AWSAccessKeyID: "ALSDKJFADSF",
|
|
|
- AWSSecretAccessKey: "ASDLFKJALSDKFJ",
|
|
|
- AWSClusterID: "cluster-test",
|
|
|
+ if diff := deep.Equal(expIntegration, gotIntegration); diff != nil {
|
|
|
+ t.Errorf("incorrect integration")
|
|
|
+ t.Error(diff)
|
|
|
}
|
|
|
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+ // resolve cluster
|
|
|
+ gotCluster, err := form.ResolveCluster(*tester.repo)
|
|
|
|
|
|
if err != nil {
|
|
|
t.Fatalf("%v\n", err)
|
|
|
}
|
|
|
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != models.AWS {
|
|
|
- t.Errorf("service account auth mechanism is not %s\n", models.AWS)
|
|
|
+ expCluster := &models.Cluster{
|
|
|
+ AuthMechanism: models.Local,
|
|
|
+ ProjectID: 1,
|
|
|
+ Name: "cluster-test",
|
|
|
+ Server: "https://localhost",
|
|
|
+ KubeIntegrationID: 1,
|
|
|
+ CertificateAuthorityData: []byte("-----BEGIN CER"),
|
|
|
}
|
|
|
|
|
|
- if string(sa.AWSAccessKeyID) != "ALSDKJFADSF" {
|
|
|
- t.Errorf("service account aws access key id is wrong: expected %s, got %s\n",
|
|
|
- "ALSDKJFADSF", sa.AWSAccessKeyID)
|
|
|
- }
|
|
|
+ gotCluster.Model = gorm.Model{}
|
|
|
|
|
|
- if string(sa.AWSSecretAccessKey) != "ASDLFKJALSDKFJ" {
|
|
|
- t.Errorf("service account aws access secret key is wrong: expected %s, got %s\n",
|
|
|
- "ASDLFKJALSDKFJ", sa.AWSSecretAccessKey)
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.AWSClusterID) != "cluster-test" {
|
|
|
- t.Errorf("service account aws cluster id is wrong: expected %s, got %s\n",
|
|
|
- "cluster-test", sa.AWSClusterID)
|
|
|
+ if diff := deep.Equal(expCluster, gotCluster); diff != nil {
|
|
|
+ t.Errorf("incorrect cluster")
|
|
|
+ t.Error(diff)
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func TestPopulateServiceAccountOIDCAction(t *testing.T) {
|
|
|
- // create the in-memory repository
|
|
|
- repo := test.NewRepository(true)
|
|
|
-
|
|
|
- // create a new project
|
|
|
- repo.Project.CreateProject(&models.Project{
|
|
|
- Name: "test-project",
|
|
|
- })
|
|
|
+// func TestPopulateServiceAccountBasic(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
|
|
|
- // create a ServiceAccountCandidate from a kubeconfig
|
|
|
- saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(OIDCAuthWithoutData), false)
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- for _, saCandidate := range saCandidates {
|
|
|
- repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
- }
|
|
|
-
|
|
|
- // create a new form
|
|
|
- form := forms.OIDCIssuerDataAction{
|
|
|
- ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
- ServiceAccountCandidateID: 1,
|
|
|
- },
|
|
|
- OIDCIssuerCAData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
- }
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClusterCAWithData), false)
|
|
|
|
|
|
- err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
|
|
|
- if err != nil {
|
|
|
- t.Fatalf("%v\n", err)
|
|
|
- }
|
|
|
-
|
|
|
- sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
-
|
|
|
- if len(sa.Clusters) != 1 {
|
|
|
- t.Fatalf("cluster not written\n")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
- t.Errorf("service account ID of joined cluster is not 1")
|
|
|
- }
|
|
|
-
|
|
|
- if sa.Integration != models.OIDC {
|
|
|
- t.Errorf("service account auth mechanism is not %s\n", models.OIDC)
|
|
|
- }
|
|
|
-
|
|
|
- if string(sa.OIDCCertificateAuthorityData) != "LS0tLS1CRUdJTiBDRVJ=" {
|
|
|
- t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
- string(sa.OIDCCertificateAuthorityData), "LS0tLS1CRUdJTiBDRVJ=")
|
|
|
- }
|
|
|
-}
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.SA)
|
|
|
+// decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
+// t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != "x509" {
|
|
|
+// t.Errorf("service account auth mechanism is not x509")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientCertificateData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientKeyData), string(decodedStr))
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountClusterDataAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClusterCAWithoutData), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.ClusterCADataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// ClusterCAData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+// decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
+// t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != "x509" {
|
|
|
+// t.Errorf("service account auth mechanism is not x509")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientCertificateData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientKeyData), string(decodedStr))
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountClusterLocalhostAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClusterLocalhost), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.ClusterLocalhostAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// ClusterHostname: "host.docker.internal",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+// decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].Server != "https://host.docker.internal:30000" {
|
|
|
+// t.Errorf("service account cluster server is incorrect: expected %s, got %s\n",
|
|
|
+// "https://host.docker.internal:30000", sa.Clusters[0].Server)
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != "x509" {
|
|
|
+// t.Errorf("service account auth mechanism is not x509")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientCertificateData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientKeyData), string(decodedStr))
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountClientCertAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClientWithoutCertData), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.ClientCertDataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// ClientCertData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+// decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
+// t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != "x509" {
|
|
|
+// t.Errorf("service account auth mechanism is not x509")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientCertificateData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientKeyData), string(decodedStr))
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountClientCertAndKeyActions(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(ClientWithoutCertAndKeyData), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.ClientCertDataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// ClientCertData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// keyForm := forms.ClientKeyDataAction{
|
|
|
+// ServiceAccountActionResolver: form.ServiceAccountActionResolver,
|
|
|
+// ClientKeyData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = keyForm.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(keyForm.ServiceAccountActionResolver.SA)
|
|
|
+// decodedStr, _ := base64.StdEncoding.DecodeString("LS0tLS1CRUdJTiBDRVJ=")
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.Clusters[0].CertificateAuthorityData) != string(decodedStr) {
|
|
|
+// t.Errorf("cluster ca data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.Clusters[0].CertificateAuthorityData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != "x509" {
|
|
|
+// t.Errorf("service account auth mechanism is not x509")
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientCertificateData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientCertificateData), string(decodedStr))
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.ClientKeyData) != string(decodedStr) {
|
|
|
+// t.Errorf("service account cert data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.ClientKeyData), string(decodedStr))
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountTokenDataAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+// tokenData := "abcdefghijklmnop"
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(BearerTokenWithoutData), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.TokenDataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// TokenData: tokenData,
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != models.Bearer {
|
|
|
+// t.Errorf("service account auth mechanism is not %s\n", models.Bearer)
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.Token) != tokenData {
|
|
|
+// t.Errorf("service account token data is wrong: expected %s, got %s\n",
|
|
|
+// tokenData, sa.Token)
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountGCPKeyDataAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+// gcpKeyData := []byte(`{"key": "data"}`)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(GCPPlugin), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.GCPKeyDataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// GCPKeyData: string(gcpKeyData),
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != models.GCP {
|
|
|
+// t.Errorf("service account auth mechanism is not %s\n", models.GCP)
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.GCPKeyData) != string(gcpKeyData) {
|
|
|
+// t.Errorf("service account token data is wrong: expected %s, got %s\n",
|
|
|
+// string(sa.GCPKeyData), string(gcpKeyData))
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountAWSKeyDataAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(AWSEKSGetTokenExec), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.AWSDataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// AWSAccessKeyID: "ALSDKJFADSF",
|
|
|
+// AWSSecretAccessKey: "ASDLFKJALSDKFJ",
|
|
|
+// AWSClusterID: "cluster-test",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != models.AWS {
|
|
|
+// t.Errorf("service account auth mechanism is not %s\n", models.AWS)
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.AWSAccessKeyID) != "ALSDKJFADSF" {
|
|
|
+// t.Errorf("service account aws access key id is wrong: expected %s, got %s\n",
|
|
|
+// "ALSDKJFADSF", sa.AWSAccessKeyID)
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.AWSSecretAccessKey) != "ASDLFKJALSDKFJ" {
|
|
|
+// t.Errorf("service account aws access secret key is wrong: expected %s, got %s\n",
|
|
|
+// "ASDLFKJALSDKFJ", sa.AWSSecretAccessKey)
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.AWSClusterID) != "cluster-test" {
|
|
|
+// t.Errorf("service account aws cluster id is wrong: expected %s, got %s\n",
|
|
|
+// "cluster-test", sa.AWSClusterID)
|
|
|
+// }
|
|
|
+// }
|
|
|
+
|
|
|
+// func TestPopulateServiceAccountOIDCAction(t *testing.T) {
|
|
|
+// // create the in-memory repository
|
|
|
+// repo := test.NewRepository(true)
|
|
|
+
|
|
|
+// // create a new project
|
|
|
+// repo.Project.CreateProject(&models.Project{
|
|
|
+// Name: "test-project",
|
|
|
+// })
|
|
|
+
|
|
|
+// // create a ServiceAccountCandidate from a kubeconfig
|
|
|
+// saCandidates, err := kubernetes.GetServiceAccountCandidates([]byte(OIDCAuthWithoutData), false)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// for _, saCandidate := range saCandidates {
|
|
|
+// repo.ServiceAccount.CreateServiceAccountCandidate(saCandidate)
|
|
|
+// }
|
|
|
+
|
|
|
+// // create a new form
|
|
|
+// form := forms.OIDCIssuerDataAction{
|
|
|
+// ServiceAccountActionResolver: &forms.ServiceAccountActionResolver{
|
|
|
+// ServiceAccountCandidateID: 1,
|
|
|
+// },
|
|
|
+// OIDCIssuerCAData: "LS0tLS1CRUdJTiBDRVJ=",
|
|
|
+// }
|
|
|
+
|
|
|
+// err = form.PopulateServiceAccount(repo.ServiceAccount)
|
|
|
+
|
|
|
+// if err != nil {
|
|
|
+// t.Fatalf("%v\n", err)
|
|
|
+// }
|
|
|
+
|
|
|
+// sa, err := repo.ServiceAccount.CreateServiceAccount(form.ServiceAccountActionResolver.SA)
|
|
|
+
|
|
|
+// if len(sa.Clusters) != 1 {
|
|
|
+// t.Fatalf("cluster not written\n")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Clusters[0].ServiceAccountID != 1 {
|
|
|
+// t.Errorf("service account ID of joined cluster is not 1")
|
|
|
+// }
|
|
|
+
|
|
|
+// if sa.Integration != models.OIDC {
|
|
|
+// t.Errorf("service account auth mechanism is not %s\n", models.OIDC)
|
|
|
+// }
|
|
|
+
|
|
|
+// if string(sa.OIDCCertificateAuthorityData) != "LS0tLS1CRUdJTiBDRVJ=" {
|
|
|
+// t.Errorf("service account key data and input do not match: expected %s, got %s\n",
|
|
|
+// string(sa.OIDCCertificateAuthorityData), "LS0tLS1CRUdJTiBDRVJ=")
|
|
|
+// }
|
|
|
+// }
|
|
|
|
|
|
const ClusterCAWithData string = `
|
|
|
apiVersion: v1
|
Alexander Belanger