From f6029e4281bd688ba4744ca54c404c848f2e69a1 Mon Sep 17 00:00:00 2001 From: Patrick Ohly Date: Tue, 6 Sep 2022 15:52:59 +0200 Subject: [PATCH] test: add helper code for running apiserver inside unit test This runs etcd and an apiserver using it inside the test process. The caller can either use the ClientSet or the config file. More options might get added in the future. Co-author: Antonio Ojea --- test/utils/apiserver/kubeconfig.go | 62 ++++++++++++++++ test/utils/apiserver/testapiserver.go | 101 ++++++++++++++++++++++++++ 2 files changed, 163 insertions(+) create mode 100644 test/utils/apiserver/kubeconfig.go create mode 100644 test/utils/apiserver/testapiserver.go diff --git a/test/utils/apiserver/kubeconfig.go b/test/utils/apiserver/kubeconfig.go new file mode 100644 index 00000000000..a491726b414 --- /dev/null +++ b/test/utils/apiserver/kubeconfig.go @@ -0,0 +1,62 @@ +/* +Copyright 2022 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package apiserver + +import ( + "k8s.io/client-go/rest" + clientcmdapi "k8s.io/client-go/tools/clientcmd/api" +) + +// CreateKubeConfig converts a [rest.Config] into a [clientcmdapi.Config] +// which then can be written to a file with [clientcmd.WriteToFile]. +func CreateKubeConfig(clientCfg *rest.Config) *clientcmdapi.Config { + clusterNick := "cluster" + userNick := "user" + contextNick := "context" + + config := clientcmdapi.NewConfig() + + credentials := clientcmdapi.NewAuthInfo() + credentials.Token = clientCfg.BearerToken + credentials.TokenFile = clientCfg.BearerTokenFile + credentials.ClientCertificate = clientCfg.TLSClientConfig.CertFile + if len(credentials.ClientCertificate) == 0 { + credentials.ClientCertificateData = clientCfg.TLSClientConfig.CertData + } + credentials.ClientKey = clientCfg.TLSClientConfig.KeyFile + if len(credentials.ClientKey) == 0 { + credentials.ClientKeyData = clientCfg.TLSClientConfig.KeyData + } + config.AuthInfos[userNick] = credentials + + cluster := clientcmdapi.NewCluster() + cluster.Server = clientCfg.Host + cluster.CertificateAuthority = clientCfg.CAFile + if len(cluster.CertificateAuthority) == 0 { + cluster.CertificateAuthorityData = clientCfg.CAData + } + cluster.InsecureSkipTLSVerify = clientCfg.Insecure + config.Clusters[clusterNick] = cluster + + context := clientcmdapi.NewContext() + context.Cluster = clusterNick + context.AuthInfo = userNick + config.Contexts[contextNick] = context + config.CurrentContext = contextNick + + return config +} diff --git a/test/utils/apiserver/testapiserver.go b/test/utils/apiserver/testapiserver.go new file mode 100644 index 00000000000..b2b294134f9 --- /dev/null +++ b/test/utils/apiserver/testapiserver.go @@ -0,0 +1,101 @@ +/* +Copyright 2022 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package apiserver + +import ( + "path" + "testing" + + "github.com/google/uuid" + "k8s.io/apiserver/pkg/server/dynamiccertificates" + etcdserver "k8s.io/apiserver/pkg/storage/etcd3/testserver" + "k8s.io/apiserver/pkg/storage/storagebackend" + clientset "k8s.io/client-go/kubernetes" + "k8s.io/client-go/rest" + "k8s.io/client-go/tools/clientcmd" + "k8s.io/client-go/util/cert" + kubeapiservertesting "k8s.io/kubernetes/cmd/kube-apiserver/app/testing" +) + +// TestAPIServer provides access to a running apiserver instance. +type TestAPIServer struct { + // ClientSet is already initialized to access the apiserver as admin. + ClientSet clientset.Interface + + // KubeConfigFile is the absolute path for a kube.config file that + // grants admin access to the apiserver. + KubeConfigFile string +} + +// StartAPIServer runs etcd and apiserver in the background in the same +// process. All resources get released automatically when the test +// completes. If startup fails, the test gets aborted. +func StartAPITestServer(t *testing.T) TestAPIServer { + cfg := etcdserver.NewTestConfig(t) + etcdClient := etcdserver.RunEtcd(t, cfg) + storageConfig := storagebackend.NewDefaultConfig(path.Join(uuid.New().String(), "registry"), nil) + storageConfig.Transport.ServerList = etcdClient.Endpoints() + + server := kubeapiservertesting.StartTestServerOrDie(t, nil, []string{}, storageConfig) + t.Cleanup(server.TearDownFn) + + clientSet := clientset.NewForConfigOrDie(server.ClientConfig) + + kubeConfigFile := writeKubeConfigForWardleServerToKASConnection(t, server.ClientConfig) + + return TestAPIServer{ + ClientSet: clientSet, + KubeConfigFile: kubeConfigFile, + } +} + +func writeKubeConfigForWardleServerToKASConnection(t *testing.T, kubeClientConfig *rest.Config) string { + // write a kubeconfig out for starting other API servers with delegated auth. remember, no in-cluster config + // the loopback client config uses a loopback cert with different SNI. We need to use the "real" + // cert, so we'll hope we aren't hacked during a unit test and instead load it from the server we started. + wardleToKASKubeClientConfig := rest.CopyConfig(kubeClientConfig) + + servingCerts, _, err := cert.GetServingCertificatesForURL(wardleToKASKubeClientConfig.Host, "") + if err != nil { + t.Fatal(err) + } + encodedServing, err := cert.EncodeCertificates(servingCerts...) + if err != nil { + t.Fatal(err) + } + wardleToKASKubeClientConfig.CAData = encodedServing + + for _, v := range servingCerts { + t.Logf("Client: Server public key is %v\n", dynamiccertificates.GetHumanCertDetail(v)) + } + certs, err := cert.ParseCertsPEM(wardleToKASKubeClientConfig.CAData) + if err != nil { + t.Fatal(err) + } + for _, curr := range certs { + t.Logf("CA bundle %v\n", dynamiccertificates.GetHumanCertDetail(curr)) + } + + adminKubeConfig := CreateKubeConfig(wardleToKASKubeClientConfig) + tmpDir := t.TempDir() + kubeConfigFile := path.Join(tmpDir, "kube.config") + if err := clientcmd.WriteToFile(*adminKubeConfig, kubeConfigFile); err != nil { + t.Fatal(err) + } + + return kubeConfigFile +}