From e427d2f22a703e977bec45e861980b46d7381dd9 Mon Sep 17 00:00:00 2001
From: Andrew Keesler <akeesler@vmware.com>
Date: Mon, 14 Jun 2021 17:18:46 -0400
Subject: [PATCH] test/cmd: kubectl and exec plugins don't fight for stdin

Signed-off-by: Andrew Keesler <akeesler@vmware.com>
---
 test/cmd/apps.sh           |  3 ++
 test/cmd/authentication.sh | 87 +++++++++++++++++++++++++++++++++++++-
 test/cmd/legacy-script.sh  |  1 +
 3 files changed, 90 insertions(+), 1 deletion(-)

diff --git a/test/cmd/apps.sh b/test/cmd/apps.sh
index 8232c907881..e8ab6f8c670 100755
--- a/test/cmd/apps.sh
+++ b/test/cmd/apps.sh
@@ -432,6 +432,9 @@ run_deployment_tests() {
   kubectl set env deployment nginx-deployment --from=secret/test-set-env-secret "${kube_flags[@]:?}"
   # Remove specific env of deployment
   kubectl set env deployment nginx-deployment env-
+  # Assert that we cannot use standard input for both resource and environment variable
+  output_message="$(echo SOME_ENV_VAR_KEY=SOME_ENV_VAR_VAL | kubectl set env -f - - "${kube_flags[@]:?}" 2>&1 || true)"
+  kube::test::if_has_string "${output_message}" 'standard input cannot be used for multiple arguments'
   # Clean up
   kubectl delete deployment nginx-deployment "${kube_flags[@]:?}"
   kubectl delete configmap test-set-env-config "${kube_flags[@]:?}"
diff --git a/test/cmd/authentication.sh b/test/cmd/authentication.sh
index be1f36268f4..b6542ba55cc 100644
--- a/test/cmd/authentication.sh
+++ b/test/cmd/authentication.sh
@@ -92,7 +92,6 @@ users:
   user:
     exec:
       apiVersion: client.authentication.k8s.io/v1beta1
-      # Any invalid exec credential plugin will do to demonstrate
       command: echo
       args:
         - '{"apiVersion":"client.authentication.k8s.io/v1beta1","status":{"token":"admin-token"}}'
@@ -132,3 +131,89 @@ EOF
   set +o nounset
   set +o errexit
 }
+
+run_exec_credentials_interactive_tests() {
+  set -o nounset
+  set -o errexit
+
+  kube::log::status "Testing kubectl with configured interactive exec credentials plugin"
+
+  cat > "${TMPDIR:-/tmp}"/always_interactive_exec_plugin.yaml << EOF
+apiVersion: v1
+clusters:
+- cluster:
+  name: test
+contexts:
+- context:
+    cluster: test
+    user: always_interactive_token_user
+  name: test
+current-context: test
+kind: Config
+preferences: {}
+users:
+- name: always_interactive_token_user
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      command: echo
+      args:
+        - '{"apiVersion":"client.authentication.k8s.io/v1beta1","status":{"token":"admin-token"}}'
+      interactiveMode: Always
+EOF
+
+  ### The exec credential plugin should not be run if it kubectl already uses standard input
+  # Pre-condition: The kubectl command requires standard input
+
+  some_resource='{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"some-resource"}}'
+
+  # Declare map from kubectl command to standard input data
+  declare -A kubectl_commands
+  kubectl_commands["apply -f -"]="$some_resource"
+  kubectl_commands["set env deployment/some-deployment -"]="SOME_ENV_VAR_KEY=SOME_ENV_VAR_VAL"
+  kubectl_commands["replace -f - --force"]="$some_resource"
+
+  failure=
+  for kubectl_command in "${!kubectl_commands[@]}"; do
+    # Use a separate bash script for the command here so that script(1) will not get confused with kubectl flags
+    script_file="${TMPDIR:-/tmp}/test-cmd-exec-credentials-script-file.sh"
+    cat <<EOF >"$script_file"
+#!/usr/bin/env bash
+set -o errexit
+set -o nounset
+set -o pipefail
+kubectl ${kube_flags_without_token[*]:?} --kubeconfig=${TMPDIR:-/tmp}/always_interactive_exec_plugin.yaml ${kubectl_command} 2>&1 || true
+EOF
+    chmod +x "$script_file"
+
+    # Run kubectl as child of script(1) so kubectl will always run with a PTY
+    # Dynamically build script(1) command so that we can conditionally add flags on Linux
+    script_command="script -q /dev/null"
+    if [[ "$(uname)" == "Linux" ]]; then script_command="${script_command} -c"; fi
+    script_command="${script_command} ${script_file}"
+
+    # Specify SHELL env var when we call script(1) since it is picky about the format of the env var
+    shell="$(which bash)"
+
+    kube::log::status "Running command '$script_command' (kubectl command: '$kubectl_command') with input '${kubectl_commands[$kubectl_command]}'"
+    output=$(echo "${kubectl_commands[$kubectl_command]}" | SHELL="$shell" $script_command)
+
+    if [[ "${output}" =~ "used by stdin resource manifest reader" ]]; then
+      kube::log::status "exec credential plugin not run because kubectl already uses standard input"
+    else
+      kube::log::status "Unexpected output when running kubectl command that uses standard input. Output: ${output}"
+      failure=yup
+    fi
+  done
+
+  if [[ -n "$failure" ]]; then
+    exit 1
+  fi
+
+  # Post-condition: None
+
+  rm "${TMPDIR:-/tmp}"/always_interactive_exec_plugin.yaml
+
+  set +o nounset
+  set +o errexit
+}
\ No newline at end of file
diff --git a/test/cmd/legacy-script.sh b/test/cmd/legacy-script.sh
index 3dd3ed3d017..9b9bcd7aa71 100755
--- a/test/cmd/legacy-script.sh
+++ b/test/cmd/legacy-script.sh
@@ -775,6 +775,7 @@ runTests() {
   ########################
 
   record_command run_exec_credentials_tests
+  record_command run_exec_credentials_interactive_tests
 
   ########################
   # authorization.k8s.io #