github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-08-08 23:37:11 +00:00
Code Issues Projects Releases Wiki Activity

integration: ctb: apiserversigner test to use certbeta api

Browse Source
This commit is contained in:
Stanislav Láznička
2024-11-06 13:13:53 +01:00
parent ccd2d4d62a
commit 0cd2976cab
1 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
test/integration/clustertrustbundles/apiserversigner_test.go
View File

@@ -30,7 +30,7 @@ import (
"testing"
"time"
"k8s.io/api/certificates/v1alpha1"
"k8s.io/api/certificates/v1beta1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/unstructuredscheme"
"k8s.io/apimachinery/pkg/runtime/schema"
@@ -47,9 +47,6 @@ import (
)
func TestClusterTrustBundlesPublisherController(t *testing.T) {
// KUBE_APISERVER_SERVE_REMOVED_APIS_FOR_ONE_RELEASE allows for APIs pending removal to not block tests
// TODO: Remove this line once certificates v1alpha1 types to be removed in 1.32 are fully removed
t.Setenv("KUBE_APISERVER_SERVE_REMOVED_APIS_FOR_ONE_RELEASE", "true")
ctx := ktesting.Init(t)
certBytes := mustMakeCertificate(t, &x509.Certificate{
@@ -73,7 +70,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
"--disable-admission-plugins", "ServiceAccount",
"--authorization-mode=RBAC",
"--feature-gates", "ClusterTrustBundle=true",
fmt.Sprintf("--runtime-config=%s=true", v1alpha1.SchemeGroupVersion),
fmt.Sprintf("--runtime-config=%s=true", v1beta1.SchemeGroupVersion),
}
storageConfig := framework.SharedEtcd()
server := kubeapiservertesting.StartTestServerOrDie(t, nil, apiServerFlags, storageConfig)
@@ -108,12 +105,12 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
unrelatedPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: unrelatedSigner})
// set up a signer that's completely unrelated to the controller to check
// it's not anyhow handled by it
unrelatedCTB, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().Create(ctx,
&v1alpha1.ClusterTrustBundle{
unrelatedCTB, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().Create(ctx,
&v1beta1.ClusterTrustBundle{
ObjectMeta: metav1.ObjectMeta{
Name: "test.test:unrelated:0",
},
Spec: v1alpha1.ClusterTrustBundleSpec{
Spec: v1beta1.ClusterTrustBundleSpec{
SignerName: "test.test/unrelated",
TrustBundle: string(unrelatedPEM),
},
@@ -127,11 +124,11 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
waitUntilSingleKASSignerCTB(ctx, t, clientSet, certPEM)
t.Log("check that the controller deletes any additional bundles for the same signer")
if _, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().Create(ctx, &v1alpha1.ClusterTrustBundle{
if _, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().Create(ctx, &v1beta1.ClusterTrustBundle{
ObjectMeta: metav1.ObjectMeta{
Name: "kubernetes.io:kube-apiserver-serving:testname",
},
Spec: v1alpha1.ClusterTrustBundleSpec{
Spec: v1beta1.ClusterTrustBundleSpec{
SignerName: "kubernetes.io/kube-apiserver-serving",
TrustBundle: string(certPEM),
},
@@ -152,7 +149,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
})
differentSignerPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: differentSigner})
ctbList, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
ctbList, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
FieldSelector: "spec.signerName=kubernetes.io/kube-apiserver-serving",
})
if err != nil || len(ctbList.Items) != 1 {
@@ -162,13 +159,13 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
ctbToUpdate := ctbList.Items[0].DeepCopy()
ctbToUpdate.Spec.TrustBundle = string(differentSignerPEM)
if _, err = clientSet.CertificatesV1alpha1().ClusterTrustBundles().Update(ctx, ctbToUpdate, metav1.UpdateOptions{}); err != nil {
if _, err = clientSet.CertificatesV1beta1().ClusterTrustBundles().Update(ctx, ctbToUpdate, metav1.UpdateOptions{}); err != nil {
t.Fatalf("failed to update ctb with new PEM bundle: %v", err)
}
waitUntilSingleKASSignerCTB(ctx, t, clientSet, certPEM)
unrelatedCTB, err = clientSet.CertificatesV1alpha1().ClusterTrustBundles().Get(ctx, unrelatedCTB.Name, metav1.GetOptions{})
unrelatedCTB, err = clientSet.CertificatesV1beta1().ClusterTrustBundles().Get(ctx, unrelatedCTB.Name, metav1.GetOptions{})
if err != nil {
t.Fatalf("failed to get the unrelated CTB back: %v", err)
}
@@ -184,7 +181,7 @@ func TestClusterTrustBundlesPublisherController(t *testing.T) {
func waitUntilSingleKASSignerCTB(ctx context.Context, t *testing.T, clientSet *clientset.Clientset, caPEM []byte) {
err := wait.PollUntilContextTimeout(ctx, 200*time.Millisecond, 30*time.Second, true, func(ctx context.Context) (done bool, err error) {
ctbList, err := clientSet.CertificatesV1alpha1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
ctbList, err := clientSet.CertificatesV1beta1().ClusterTrustBundles().List(ctx, metav1.ListOptions{
FieldSelector: "spec.signerName=kubernetes.io/kube-apiserver-serving",
})