mirror of
https://github.com/stakater/Reloader.git
synced 2026-08-27 14:37:17 +00:00
remove csi tests from e2e suite
This commit is contained in:
Safwan
@@ -1,95 +0,0 @@
|
||||
package csi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
kubeClient kubernetes.Interface
|
||||
csiClient csiclient.Interface
|
||||
restConfig *rest.Config
|
||||
testNamespace string
|
||||
ctx context.Context
|
||||
testEnv *utils.TestEnvironment
|
||||
)
|
||||
|
||||
func TestCSI(t *testing.T) {
|
||||
RegisterFailHandler(Fail)
|
||||
RunSpecs(t, "CSI SecretProviderClass E2E Suite")
|
||||
}
|
||||
|
||||
// SynchronizedBeforeSuite ensures only process 1 deploys Reloader.
|
||||
// Process 1 also checks prerequisites (CSI driver, Vault) and calls Skip if
|
||||
// they are not installed — Ginkgo propagates the skip to all processes.
|
||||
var _ = SynchronizedBeforeSuite(
|
||||
// Process 1 only: check prerequisites, create namespace, deploy Reloader.
|
||||
func() []byte {
|
||||
setupEnv, err := utils.SetupTestEnvironment(context.Background(), "reloader-csi-test")
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup test environment")
|
||||
// Ensure the namespace is deleted even if DeployAndWait fails, so
|
||||
// orphaned namespaces don't accumulate on long-lived clusters.
|
||||
DeferCleanup(setupEnv.CleanupOnFailure)
|
||||
|
||||
if !utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) {
|
||||
Skip("CSI secrets store driver not installed - skipping CSI suite")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(context.Background(), setupEnv.KubeClient) {
|
||||
Skip("Vault CSI provider not installed - skipping CSI suite")
|
||||
}
|
||||
|
||||
Expect(setupEnv.DeployAndWait(map[string]string{
|
||||
"reloader.reloadStrategy": "annotations",
|
||||
"reloader.watchGlobally": "false",
|
||||
"reloader.enableCSIIntegration": "true",
|
||||
})).To(Succeed(), "Failed to deploy Reloader")
|
||||
|
||||
data, err := json.Marshal(utils.SharedEnvData{
|
||||
Namespace: setupEnv.Namespace,
|
||||
ReleaseName: setupEnv.ReleaseName,
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
return data
|
||||
},
|
||||
// All processes (including #1): connect to the shared environment.
|
||||
func(data []byte) {
|
||||
var shared utils.SharedEnvData
|
||||
Expect(json.Unmarshal(data, &shared)).To(Succeed())
|
||||
|
||||
var err error
|
||||
testEnv, err = utils.SetupSharedTestEnvironment(context.Background(), shared.Namespace, shared.ReleaseName)
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment")
|
||||
|
||||
kubeClient = testEnv.KubeClient
|
||||
csiClient = testEnv.CSIClient
|
||||
restConfig = testEnv.RestConfig
|
||||
testNamespace = testEnv.Namespace
|
||||
ctx = testEnv.Ctx
|
||||
},
|
||||
)
|
||||
|
||||
var _ = SynchronizedAfterSuite(
|
||||
// All processes: cancel the per-process context.
|
||||
func() {
|
||||
if testEnv != nil {
|
||||
testEnv.Cancel()
|
||||
}
|
||||
},
|
||||
// Process 1 only (runs last): undeploy Reloader and delete namespace.
|
||||
func() {
|
||||
if testEnv != nil {
|
||||
err := testEnv.Cleanup()
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to cleanup test environment")
|
||||
}
|
||||
GinkgoWriter.Println("CSI E2E Suite cleanup complete")
|
||||
},
|
||||
)
|
||||
@@ -1,330 +0,0 @@
|
||||
package csi
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var _ = Describe("CSI SecretProviderClass Tests", Label("csi"), Serial, func() {
|
||||
var (
|
||||
deploymentName string
|
||||
configMapName string
|
||||
spcName string
|
||||
vaultSecretPath string
|
||||
adapter *utils.DeploymentAdapter
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
deploymentName = utils.RandName("deploy")
|
||||
configMapName = utils.RandName("cm")
|
||||
spcName = utils.RandName("spc")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test"))
|
||||
adapter = utils.NewDeploymentAdapter(kubeClient)
|
||||
})
|
||||
|
||||
AfterEach(func() {
|
||||
_ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
_ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName)
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
})
|
||||
|
||||
Context("Real Vault Integration Tests", func() {
|
||||
It("should reload when Vault secret changes", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with CSI volume and SPC reload annotation")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName)
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion)
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Println("CSI driver synced new secret version")
|
||||
|
||||
By("Waiting for Deployment to be reloaded by Reloader")
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded after Vault secret change")
|
||||
})
|
||||
|
||||
It("should handle multiple Vault secret updates", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "password",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with CSI volume")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("First update to Vault secret")
|
||||
initialVersion, _ := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for first CSI sync")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for first reload")
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue())
|
||||
|
||||
By("Getting annotation value after first reload")
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
firstReloadValue := deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
Expect(firstReloadValue).NotTo(BeEmpty())
|
||||
|
||||
By("Waiting for Deployment to stabilize")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the NEW SPCPS after first reload (new pod = new SPCPS)")
|
||||
newSpcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("New SPCPS after first reload: %s\n", newSpcpsName)
|
||||
|
||||
By("Second update to Vault secret")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v3"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for second reload with different annotation value")
|
||||
Eventually(func() string {
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
}, utils.ReloadTimeout).ShouldNot(Equal(firstReloadValue), "Annotation should change after second Vault secret update")
|
||||
})
|
||||
})
|
||||
|
||||
Context("Typed Auto Annotation Tests", func() {
|
||||
It("should reload only SPC changes with secretproviderclass auto annotation, not ConfigMap", func() {
|
||||
By("Creating a ConfigMap")
|
||||
_, err := utils.CreateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName,
|
||||
map[string]string{"key": "initial"}, nil,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err = utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"token": "token-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "token",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with ConfigMap envFrom AND CSI volume, but only SPC auto annotation")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithConfigMapEnvFrom(configMapName),
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the ConfigMap (should NOT trigger reload)")
|
||||
err = utils.UpdateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment was NOT reloaded for ConfigMap change")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ShortTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeFalse(), "SPC auto annotation should not trigger reload for ConfigMap changes")
|
||||
|
||||
By("Finding the SPCPS")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting SPCPS version before Vault update")
|
||||
initialVersion, _ := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
|
||||
By("Updating the Vault secret (should trigger reload)")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"token": "token-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment WAS reloaded for Vault secret change")
|
||||
reloaded, err = adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "SPC auto annotation should trigger reload for Vault secret changes")
|
||||
})
|
||||
|
||||
It("should reload for both ConfigMap and SPC when using combined auto=true", func() {
|
||||
By("Creating a ConfigMap")
|
||||
_, err := utils.CreateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName,
|
||||
map[string]string{"key": "initial"}, nil,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err = utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"secret": "secret-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "secret",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with ConfigMap envFrom AND CSI volume with combined auto=true")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithConfigMapEnvFrom(configMapName),
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildAutoTrueAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the ConfigMap (should trigger reload with auto=true)")
|
||||
err = utils.UpdateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment WAS reloaded for ConfigMap change")
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Combined auto=true should trigger reload for ConfigMap changes")
|
||||
|
||||
By("Waiting for Deployment to stabilize")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting current annotation value")
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
firstReloadValue := deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
|
||||
By("Finding the NEW SPCPS after ConfigMap reload (new pod = new SPCPS)")
|
||||
newSpcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("New SPCPS after ConfigMap reload: %s\n", newSpcpsName)
|
||||
|
||||
By("Updating the Vault secret (should also trigger reload with auto=true)")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"secret": "secret-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment WAS reloaded for Vault secret change")
|
||||
Eventually(func() string {
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
}, utils.ReloadTimeout).ShouldNot(Equal(firstReloadValue),
|
||||
"Combined auto=true should trigger reload for Vault secret changes",
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
Reference in New Issue
Block a user