github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-04 18:00:08 +00:00
Code Issues Projects Releases Wiki Activity

add e2e test

Browse Source
This commit is contained in:
Cao Shufeng 2018-02-14 15:10:20 +08:00
parent e87c2c9f27
commit 440aab5b86
1 changed files with 131 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

179
test/e2e/auth/audit.go
View File

@ -26,12 +26,14 @@ import (
apiv1 "k8s.io/api/core/v1" apiv1 "k8s.io/api/core/v1"
extensions "k8s.io/api/extensions/v1beta1" extensions "k8s.io/api/extensions/v1beta1"
apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1" apiextensionsv1beta1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1beta1"
"k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset" apiextensionclientset "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
"k8s.io/apiextensions-apiserver/test/integration/testserver" "k8s.io/apiextensions-apiserver/test/integration/testserver"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/wait" "k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apiserver/pkg/apis/audit/v1beta1" "k8s.io/apiserver/pkg/apis/audit/v1beta1"
clientset "k8s.io/client-go/kubernetes"
restclient "k8s.io/client-go/rest"
"k8s.io/kubernetes/test/e2e/framework" "k8s.io/kubernetes/test/e2e/framework"
imageutils "k8s.io/kubernetes/test/utils/image" imageutils "k8s.io/kubernetes/test/utils/image"
@ -63,9 +65,19 @@ var _ = SIGDescribe("Advanced Audit", func() {
config, err := framework.LoadConfig() config, err := framework.LoadConfig()
framework.ExpectNoError(err, "failed to load config") framework.ExpectNoError(err, "failed to load config")
apiExtensionClient, err := clientset.NewForConfig(config) apiExtensionClient, err := apiextensionclientset.NewForConfig(config)
framework.ExpectNoError(err, "failed to initialize apiExtensionClient") framework.ExpectNoError(err, "failed to initialize apiExtensionClient")
By("Creating a kubernetes client that impersonates an unauthorized anonymous user")
config, err = framework.LoadConfig()
framework.ExpectNoError(err)
config.Impersonate = restclient.ImpersonationConfig{
UserName: "system:anonymous",
Groups: []string{"system:unauthenticated"},
}
anonymousClient, err := clientset.NewForConfig(config)
framework.ExpectNoError(err)
testCases := []struct { testCases := []struct {
action func() action func()
events []auditEvent events []auditEvent
@ -118,6 +130,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -129,6 +142,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -140,6 +154,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseStarted, v1beta1.StageResponseStarted,
@ -151,6 +166,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -162,6 +178,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequestResponse, v1beta1.LevelRequestResponse,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -173,6 +190,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, { }, {
v1beta1.LevelRequestResponse, v1beta1.LevelRequestResponse,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -184,6 +202,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, { }, {
v1beta1.LevelRequestResponse, v1beta1.LevelRequestResponse,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -195,6 +214,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, },
}, },
}, },
@ -239,6 +259,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -250,6 +271,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -261,6 +283,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseStarted, v1beta1.StageResponseStarted,
@ -272,6 +295,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequest, v1beta1.LevelRequest,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -283,6 +307,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelRequestResponse, v1beta1.LevelRequestResponse,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -294,6 +319,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, { }, {
v1beta1.LevelRequestResponse, v1beta1.LevelRequestResponse,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -305,6 +331,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, { }, {
v1beta1.LevelRequestResponse, v1beta1.LevelRequestResponse,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -316,6 +343,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
true, true,
true, true,
"allow",
}, },
}, },
}, },
@ -366,6 +394,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -377,6 +406,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -388,6 +418,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseStarted, v1beta1.StageResponseStarted,
@ -399,6 +430,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -410,6 +442,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -421,6 +454,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -432,6 +466,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -443,6 +478,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, },
}, },
}, },
@ -492,6 +528,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -503,6 +540,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -514,6 +552,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseStarted, v1beta1.StageResponseStarted,
@ -525,6 +564,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -536,6 +576,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -547,6 +588,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -558,6 +600,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, { }, {
v1beta1.LevelMetadata, v1beta1.LevelMetadata,
v1beta1.StageResponseComplete, v1beta1.StageResponseComplete,
@ -569,6 +612,7 @@ var _ = SIGDescribe("Advanced Audit", func() {
namespace, namespace,
false, false,
false, false,
"allow",
}, },
}, },
}, },
@ -581,50 +625,87 @@ var _ = SIGDescribe("Advanced Audit", func() {
}, },
[]auditEvent{ []auditEvent{
{ {
level: v1beta1.LevelRequestResponse, level: v1beta1.LevelRequestResponse,
stage: v1beta1.StageResponseComplete, stage: v1beta1.StageResponseComplete,
requestURI: "/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions", requestURI: "/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions",
verb: "create", verb: "create",
code: 201, code: 201,
user: auditTestUser, user: auditTestUser,
resource: "customresourcedefinitions", resource: "customresourcedefinitions",
requestObject: true, requestObject: true,
responseObject: true, responseObject: true,
authorizeDecision: "allow",
}, { }, {
level: v1beta1.LevelMetadata, level: v1beta1.LevelMetadata,
stage: v1beta1.StageResponseComplete, stage: v1beta1.StageResponseComplete,
requestURI: fmt.Sprintf("/apis/%s/v1beta1/%s", crdNamespace, crdName), requestURI: fmt.Sprintf("/apis/%s/v1beta1/%s", crdNamespace, crdName),
verb: "create", verb: "create",
code: 201, code: 201,
user: auditTestUser, user: auditTestUser,
resource: crdName, resource: crdName,
requestObject: false, requestObject: false,
responseObject: false, responseObject: false,
authorizeDecision: "allow",
}, { }, {
level: v1beta1.LevelRequestResponse, level: v1beta1.LevelRequestResponse,
stage: v1beta1.StageResponseComplete, stage: v1beta1.StageResponseComplete,
requestURI: fmt.Sprintf("/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/%s", crd.Name), requestURI: fmt.Sprintf("/apis/apiextensions.k8s.io/v1beta1/customresourcedefinitions/%s", crd.Name),
verb: "delete", verb: "delete",
code: 200, code: 200,
user: auditTestUser, user: auditTestUser,
resource: "customresourcedefinitions", resource: "customresourcedefinitions",
requestObject: false, requestObject: false,
responseObject: true, responseObject: true,
authorizeDecision: "allow",
}, { }, {
level: v1beta1.LevelMetadata, level: v1beta1.LevelMetadata,
stage: v1beta1.StageResponseComplete, stage: v1beta1.StageResponseComplete,
requestURI: fmt.Sprintf("/apis/%s/v1beta1/%s/setup-instance", crdNamespace, crdName), requestURI: fmt.Sprintf("/apis/%s/v1beta1/%s/setup-instance", crdNamespace, crdName),
verb: "delete", verb: "delete",
code: 200, code: 200,
user: auditTestUser, user: auditTestUser,
resource: crdName, resource: crdName,
requestObject: false, requestObject: false,
responseObject: false, responseObject: false,
authorizeDecision: "allow",
}, },
}, },
}, },
} }
// test authorizer annotations, RBAC is required.
annotationTestCases := []struct {
action func()
events []auditEvent
}{
// get a pod with unauthorized user
{
func() {
_, err := anonymousClient.CoreV1().Pods(namespace).Get("another-audit-pod", metav1.GetOptions{})
expectForbidden(err)
},
[]auditEvent{
{
level: v1beta1.LevelRequest,
stage: v1beta1.StageResponseComplete,
requestURI: fmt.Sprintf("/api/v1/namespaces/%s/pods/another-audit-pod", namespace),
verb: "get",
code: 403,
user: auditTestUser,
resource: "pods",
namespace: namespace,
requestObject: false,
responseObject: false,
authorizeDecision: "forbid",
},
},
},
}
if framework.IsRBACEnabled(f) {
testCases = append(testCases, annotationTestCases...)
}
expectedEvents := []auditEvent{} expectedEvents := []auditEvent{}
for _, t := range testCases { for _, t := range testCases {
t.action() t.action()
@ -647,16 +728,17 @@ var _ = SIGDescribe("Advanced Audit", func() {
}) })
type auditEvent struct { type auditEvent struct {
level v1beta1.Level level v1beta1.Level
stage v1beta1.Stage stage v1beta1.Stage
requestURI string requestURI string
verb string verb string
code int32 code int32
user string user string
resource string resource string
namespace string namespace string
requestObject bool requestObject bool
responseObject bool responseObject bool
authorizeDecision string
} }
// Search the audit log for the expected audit lines. // Search the audit log for the expected audit lines.
@ -725,5 +807,6 @@ func parseAuditLine(line string) (auditEvent, error) {
if e.RequestObject != nil { if e.RequestObject != nil {
event.requestObject = true event.requestObject = true
} }
event.authorizeDecision = e.Annotations["authorization.k8s.io/decision"]
return event, nil return event, nil
} }