mirror of
https://github.com/kubevela/kubevela.git
synced 2026-08-19 04:26:39 +00:00
* Merge commit from fork * fix: prevent unbounded read in Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x) * fix: bound remote Terraform clone and invalidate cache on rejection Follow-up hardening for GHSA-fmgp-q6jx-gg3x. Bound the clone of the attacker-supplied repository: shallow Depth:1, a 2-minute fetch timeout via PlainCloneContext, and post-clone caps on the retained tree size (64 MiB) and file count, rejecting and removing a clone that exceeds them. Invalidate the clone cache: re-clone when the recorded remote URL changes, and remove the cache on a failed clone or a rejected read so a corrected repository is re-fetched instead of a poisoned or stale tree being reused. Validate the module name before building the cache path, and log clone, rejection, and eviction events. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: resolve gosec G304 lint failure in Terraform module cache check (#7190) Wrap the cache remote marker read in filepath.Clean, the same pattern other os.ReadFile call sites in this repo use to satisfy gosec. The path is built from filepath.Join and a constant suffix, with the module name validated beforehand, so behavior is unchanged. The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge because the advisory workflow did not run the full lint job. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Chore: bump actions/cache to v4 in CI workflows GitHub has closed down actions/cache v1 and v2. Any job pinned to the old SHA (704facf57e6136b1bc63b828d79edcd491f0ee84) is now automatically failed at job setup, before any step runs. On this branch that broke check-diff, check-windows, and unit-tests (each failing in a few seconds with no logs). Bump the three references in go.yml and unit-test.yml to actions/cache@v4, matching the version already used on master, so these jobs can run again. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Chore: install envtest binaries via setup-envtest in unit tests The RyanSiu1995/kubebuilder-action step fetched kube-apiserver and kubectl from the kubernetes-release and kubebuilder-tools storage buckets, which have since been retired. Those downloads now return small 404 error pages that get saved as the binaries, so envtest cannot start the control plane (exec format error) and the unit-test BeforeSuite panics. Replace that step with the official prebuilt setup-envtest, which pulls the matching envtest bundle (etcd, kube-apiserver, kubectl) for Kubernetes 1.26.1 from the current controller-runtime release index and exports its path through KUBEBUILDER_ASSETS. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Chore: pin cache action and harden envtest install per review Address automated review feedback on the CI changes: - Pin actions/cache to a commit SHA (v4.3.0, 0057852) in go.yml and unit-test.yml instead of the mutable v4 tag, matching how every other action in these workflows is pinned. - Add curl -f to the setup-envtest download so an HTTP error fails the step immediately instead of saving an error page as the binary. - Verify the downloaded setup-envtest against a known SHA-256 before running it. - Capture the envtest asset path into a variable and fail fast when it is empty or not a directory, rather than letting a failed command substitution slip through and surface later as a confusing make test error. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: load 0.2.0 helm test chart from local file instead of dead repo The helm helper test fixture pointed version 0.2.0 at https://charts.kubevela.net/example/autoscalertrait-0.1.0.tgz, but that host no longer resolves. Once the unit-test suite could run again, "Test getValues from chart" failed with "cannot load chart from chart repo". Point the 0.2.0 entry at the local autoscalertrait-0.2.0.tgz that already ships in testdata, matching how master resolves this chart, so the test no longer depends on an external network endpoint. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: point addon CLI tests at the live KubeVela registry The addon listing and status tests registered https://addons.kubevela.net, which no longer resolves, so the three "addon in the registry" cases failed once the suite could run again. Point them at https://kubevela.github.io/catalog/official, the registry that master already uses for these same tests. The only difference between this file and master was this URL (the assertions are identical), and that host still serves the addons the assertions expect. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Chore: re-trigger CI for stuck e2e jobs Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: run release-1.9 e2e jobs on GitHub-hosted runners The e2e-tests and e2e-multi-cluster-tests jobs targeted self-hosted runners, which GitHub does not assign to pull requests from forks. The jobs sat queued until the 24h ceiling and were cancelled, so they never ran on this PR (the original run shows no runner assigned and zero steps executed). Switch both to ubuntu-22.04, the GitHub-hosted runner that release-1.10 and master already use for these jobs, where the same fork-based backport runs them successfully. These workflows are self-contained (they install their own tools and create the kind cluster inline), so no other change is needed. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: wait for flux controllers before enabling the terraform e2e addon The e2e post-hook enabled the terraform addon right after fluxcd. The terraform addon's controller is a flux HelmRelease that needs the flux source-controller and helm-controller pods running to reconcile, but flux readiness was only checked after every addon had been enabled. On the GitHub-hosted runner (slower than the self-hosted one this hook was written for) the terraform addon enable timed out after 600s waiting on a reconcile that could not happen until flux was up. Add the flux-system readiness checks before the terraform addon enable so flux is reconciling before the addon that depends on it is applied. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: enable terraform e2e addon with terraform-controller 0.8.0 The terraform addon enable timed out after 600s on the GitHub-hosted runner. A previous attempt that waited for the flux controllers to be Ready before enabling the addon did not help: the run logs confirm source-controller and helm-controller were Ready and the terraform addon still timed out, so flux readiness was not the cause. Revert that wait. The real difference from master, where this addon enables cleanly, is the terraform-controller chart: release-1.9 pinned 0.2.11 from charts.kubevela.net, while master uses 0.8.0 from kubevela.github.io/charts with the ghcr image. Backport that chart version and image override so the addon controller becomes healthy in time. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix: do not log or persist credentials embedded in Terraform module remote URLs GetTerraformConfigurationFromRemote logged the raw remote URL and wrote it to the .remote-url cache marker. An authenticated Git URL such as https://user:token@host/repo.git embeds credentials in its userinfo, so the raw value leaked secrets into controller logs and onto disk. Strip any embedded userinfo with a new redactURLCredentials helper before the URL is logged or recorded, and compare against the stripped form when checking the cache marker so cache reuse still works. scp-style SSH URLs authenticate with keys and carry no secret, so they pass through unchanged. See GHSA-fmgp-q6jx-gg3x. Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com> * Fix: discover traits from a reachable registry in the e2e raw-url test The e2e registry test discovered traits from oss://registry.kubevela.net, whose TLS certificate expired in May 2025, so e2e-tests failed with a certificate verification error. The default-registry listing test hits the same expired endpoint. Match release-1.10: point raw-url discovery at the GitHub-hosted registry, and disable the default-registry listing until the default registry is updated. Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>
544 lines
17 KiB
Go
544 lines
17 KiB
Go
/*
|
|
Copyright 2021 The KubeVela Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package cli
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"crypto/tls"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/fatih/color"
|
|
"github.com/gosuri/uitable"
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
"k8s.io/helm/pkg/tlsutil"
|
|
"sigs.k8s.io/yaml"
|
|
|
|
"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
|
|
pkgaddon "github.com/oam-dev/kubevela/pkg/addon"
|
|
"github.com/oam-dev/kubevela/pkg/oam/util"
|
|
"github.com/oam-dev/kubevela/pkg/utils/common"
|
|
)
|
|
|
|
var _ = Describe("Output of listing addons tests", func() {
|
|
// Output of function listAddons to test
|
|
var actualTable *uitable.Table
|
|
|
|
// getRowsByName extracts every rows with its NAME matching name
|
|
getRowsByName := func(name string) []*uitable.Row {
|
|
matchedRows := []*uitable.Row{}
|
|
for _, row := range actualTable.Rows {
|
|
// Check column NAME(0) = name
|
|
if row.Cells[0].Data == name {
|
|
matchedRows = append(matchedRows, row)
|
|
}
|
|
}
|
|
return matchedRows
|
|
}
|
|
|
|
BeforeEach(func() {
|
|
// Prepare KubeVela registry
|
|
reg := &pkgaddon.Registry{
|
|
Name: "KubeVela",
|
|
Helm: &pkgaddon.HelmSource{
|
|
URL: "https://kubevela.github.io/catalog/official",
|
|
},
|
|
}
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.AddRegistry(context.Background(), *reg)).To(Succeed())
|
|
})
|
|
|
|
AfterEach(func() {
|
|
// Delete KubeVela registry
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.DeleteRegistry(context.Background(), "KubeVela")).To(Succeed())
|
|
})
|
|
|
|
JustBeforeEach(func() {
|
|
// Print addon list to table for later comparison
|
|
ret, err := listAddons(context.Background(), k8sClient, "")
|
|
Expect(err).Should(BeNil())
|
|
actualTable = ret
|
|
})
|
|
|
|
When("there is no addons installed", func() {
|
|
It("should not have any enabled addon", func() {
|
|
Expect(actualTable.Rows).ToNot(HaveLen(0))
|
|
for idx, row := range actualTable.Rows {
|
|
// Skip header
|
|
if idx == 0 {
|
|
continue
|
|
}
|
|
// Check column STATUS(4) = disabled
|
|
Expect(row.Cells[4].Data).To(Equal("-"))
|
|
}
|
|
})
|
|
})
|
|
|
|
When("there is locally installed addons", func() {
|
|
BeforeEach(func() {
|
|
// Install fluxcd locally
|
|
fluxcd := v1beta1.Application{}
|
|
err := yaml.Unmarshal([]byte(fluxcdYaml), &fluxcd)
|
|
Expect(err).Should(BeNil())
|
|
Expect(k8sClient.Create(context.Background(), &fluxcd)).Should(SatisfyAny(BeNil(), util.AlreadyExistMatcher{}))
|
|
})
|
|
|
|
It("should print fluxcd addon as local", func() {
|
|
matchedRows := getRowsByName("fluxcd")
|
|
Expect(matchedRows).ToNot(HaveLen(0))
|
|
// Only use first row (local first), check column REGISTRY(1) = local
|
|
Expect(matchedRows[0].Cells[1].Data).To(Equal("local"))
|
|
Eventually(func() error {
|
|
matchedRows = getRowsByName("fluxcd")
|
|
// Check column STATUS(4) = enabled
|
|
if matchedRows[0].Cells[4].Data != "enabled" {
|
|
return fmt.Errorf("fluxcd is not enabled yet")
|
|
}
|
|
// Check column AVAILABLE-VERSIONS(3) = 1.1.0
|
|
if versionString := matchedRows[0].Cells[3].Data; versionString != fmt.Sprintf("[%s]", color.New(color.Bold, color.FgGreen).Sprintf("1.1.0")) {
|
|
return fmt.Errorf("fluxcd version string is incorrect: %s", versionString)
|
|
}
|
|
return nil
|
|
}, 30*time.Second, 1000*time.Millisecond).Should(BeNil())
|
|
})
|
|
|
|
It("should print fluxcd in the registry as disabled", func() {
|
|
matchedRows := getRowsByName("fluxcd")
|
|
// There should be a local one and a registry one
|
|
Expect(len(matchedRows)).To(Equal(2))
|
|
// The registry one should be disabled
|
|
Expect(matchedRows[1].Cells[1].Data).To(Equal("KubeVela"))
|
|
Expect(matchedRows[1].Cells[4].Data).To(Equal("-"))
|
|
})
|
|
})
|
|
})
|
|
|
|
var _ = Describe("Addon status or info", func() {
|
|
|
|
Context("when verbose is enabled", func() {
|
|
BeforeEach(func() {
|
|
verboseStatus = true
|
|
})
|
|
|
|
When("addon is not installed locally, also not in registry", func() {
|
|
It("should return an error, saying not found", func() {
|
|
addonName := "some-nonexistent-addon"
|
|
_, _, err := generateAddonInfo(k8sClient, addonName)
|
|
Expect(err).ShouldNot(BeNil())
|
|
})
|
|
})
|
|
|
|
When("addon is not installed locally, but in registry", func() {
|
|
// Prepare KubeVela registry
|
|
BeforeEach(func() {
|
|
reg := &pkgaddon.Registry{
|
|
Name: "KubeVela",
|
|
Helm: &pkgaddon.HelmSource{
|
|
URL: "https://kubevela.github.io/catalog/official",
|
|
},
|
|
}
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.AddRegistry(context.Background(), *reg)).To(Succeed())
|
|
})
|
|
|
|
AfterEach(func() {
|
|
// Delete KubeVela registry
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.DeleteRegistry(context.Background(), "KubeVela")).To(Succeed())
|
|
})
|
|
|
|
It("should display addon name and disabled status, registry name, available versions, dependencies, and parameters(optional)", func() {
|
|
addonName := "velaux"
|
|
res, _, err := generateAddonInfo(k8sClient, addonName)
|
|
Expect(err).Should(BeNil())
|
|
// Should include disabled status, like:
|
|
// velaux: disabled
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", addonName) + ": " + color.New(color.Faint).Sprintf("%s", statusDisabled),
|
|
))
|
|
// Should include registry name, like:
|
|
// ==> Registry Name
|
|
// KubeVela
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", "Registry Name") + "\n" +
|
|
"KubeVela",
|
|
))
|
|
// Should include available versions, like:
|
|
// ==> Available Versions
|
|
// [v2.6.3]
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", "vailable Versions") + "\n" +
|
|
"[",
|
|
))
|
|
// Should include dependencies, like:
|
|
// ==> Dependencies ✔
|
|
// []
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", "Dependencies ") + color.GreenString("✔") + "\n" +
|
|
"[]",
|
|
))
|
|
// Should include parameters, like:
|
|
// ==> Parameters
|
|
// -> serviceAccountName: Specify the serviceAccountName for apiserver
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", "Parameters") + "\n" +
|
|
color.New(color.FgCyan).Sprintf("-> "),
|
|
))
|
|
})
|
|
})
|
|
|
|
When("addon is installed locally, and also in registry", func() {
|
|
fluxcd := v1beta1.Application{}
|
|
err := yaml.Unmarshal([]byte(fluxcdRemoteYaml), &fluxcd)
|
|
Expect(err).Should(BeNil())
|
|
|
|
BeforeEach(func() {
|
|
// Prepare KubeVela registry
|
|
reg := &pkgaddon.Registry{
|
|
Name: "KubeVela",
|
|
Helm: &pkgaddon.HelmSource{
|
|
URL: "https://kubevela.github.io/catalog/official",
|
|
},
|
|
}
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.AddRegistry(context.Background(), *reg)).To(Succeed())
|
|
})
|
|
|
|
AfterEach(func() {
|
|
// Delete fluxcd
|
|
Expect(k8sClient.Delete(context.Background(), &fluxcd)).To(Succeed())
|
|
// Delete KubeVela registry
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.DeleteRegistry(context.Background(), "KubeVela")).To(Succeed())
|
|
})
|
|
|
|
JustBeforeEach(func() {
|
|
// Install fluxcd locally
|
|
Expect(k8sClient.Create(context.Background(), &fluxcd)).Should(SatisfyAny(BeNil(), util.AlreadyExistMatcher{}))
|
|
})
|
|
|
|
It("should display addon name and enabled status, installed clusters, registry name, available versions, dependencies, and parameters(optional)", func() {
|
|
addonName := "fluxcd"
|
|
Eventually(func() error {
|
|
res, _, err := generateAddonInfo(k8sClient, addonName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
// Should include enabled status, like:
|
|
// fluxcd: enabled (1.1.0)
|
|
if !strings.Contains(res,
|
|
color.New(color.Bold).Sprintf("%s", addonName),
|
|
) {
|
|
return fmt.Errorf("addon name incorrect, %s", res)
|
|
}
|
|
|
|
// We cannot really get installed clusters in this test environment.
|
|
// Might change how this test is conducted in the future.
|
|
return nil
|
|
}, 30*time.Second, 1000*time.Millisecond).Should(BeNil())
|
|
})
|
|
})
|
|
|
|
When("addon is installed locally, but not in registry", func() {
|
|
fluxcd := v1beta1.Application{}
|
|
err := yaml.Unmarshal([]byte(fluxcdYaml), &fluxcd)
|
|
Expect(err).Should(BeNil())
|
|
|
|
BeforeEach(func() {
|
|
// Delete KubeVela registry
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.DeleteRegistry(context.Background(), "KubeVela")).Should(SatisfyAny(Succeed(), util.NotFoundMatcher{}))
|
|
// Install fluxcd locally
|
|
Expect(k8sClient.Create(context.Background(), &fluxcd)).Should(SatisfyAny(BeNil(), util.AlreadyExistMatcher{}))
|
|
})
|
|
|
|
AfterEach(func() {
|
|
// Delete fluxcd
|
|
Expect(k8sClient.Delete(context.Background(), &fluxcd)).To(Succeed())
|
|
})
|
|
|
|
It("should display addon name and enabled status, installed clusters, and registry name as local, nothing more", func() {
|
|
addonName := "fluxcd"
|
|
|
|
Eventually(func() error {
|
|
res, _, err := generateAddonInfo(k8sClient, addonName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
fmt.Println(addonName, res, err)
|
|
// Should include enabled status, like:
|
|
// fluxcd: enabled (1.1.0)
|
|
if !strings.Contains(res,
|
|
color.New(color.Bold).Sprintf("%s", addonName)+": ",
|
|
) {
|
|
return fmt.Errorf("addon name and enabled status incorrect:, %s", res)
|
|
}
|
|
// We cannot really get installed clusters in this test environment.
|
|
// Might change how this test is conducted in the future.
|
|
|
|
// Should include registry name, like:
|
|
// ==> Registry Name
|
|
// local
|
|
if !strings.Contains(res,
|
|
color.New(color.Bold).Sprintf("%s", "Registry Name")+"\n"+
|
|
"local",
|
|
) {
|
|
return fmt.Errorf("registry name incorrect, %s", res)
|
|
}
|
|
return nil
|
|
}, 30*time.Second, 1000*time.Millisecond).Should(BeNil())
|
|
})
|
|
})
|
|
})
|
|
|
|
Context("when verbose is disabled", func() {
|
|
When("addon is not installed locally, but in registry", func() {
|
|
// Prepare KubeVela registry
|
|
BeforeEach(func() {
|
|
reg := &pkgaddon.Registry{
|
|
Name: "KubeVela",
|
|
Helm: &pkgaddon.HelmSource{
|
|
URL: "https://kubevela.github.io/catalog/official",
|
|
},
|
|
}
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.AddRegistry(context.Background(), *reg)).To(Succeed())
|
|
})
|
|
|
|
AfterEach(func() {
|
|
// Delete KubeVela registry
|
|
ds := pkgaddon.NewRegistryDataStore(k8sClient)
|
|
Expect(ds.DeleteRegistry(context.Background(), "KubeVela")).To(Succeed())
|
|
})
|
|
|
|
It("should display addon name and disabled status, and registry name", func() {
|
|
addonName := "dex"
|
|
res, _, err := generateAddonInfo(k8sClient, addonName)
|
|
Expect(err).Should(BeNil())
|
|
// Should include disabled status, like:
|
|
// dex: disabled
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", addonName) + ": " + color.New(color.Faint).Sprintf("%s", statusDisabled),
|
|
))
|
|
// Should include registry name, like:
|
|
// ==> Registry Name
|
|
// KubeVela
|
|
Expect(res).To(ContainSubstring(
|
|
color.New(color.Bold).Sprintf("%s", "Registry Name") + "\n" +
|
|
"KubeVela",
|
|
))
|
|
})
|
|
It("should report addon not exist in any registry name", func() {
|
|
addonName := "not-exist"
|
|
_, _, err := generateAddonInfo(k8sClient, addonName)
|
|
Expect(err.Error()).Should(BeEquivalentTo("addon 'not-exist' not found in cluster or any registry"))
|
|
})
|
|
})
|
|
})
|
|
})
|
|
|
|
var _ = Describe("Addon push command", func() {
|
|
var c common.Args
|
|
var (
|
|
testTarballPath = "../../pkg/addon/testdata/charts/sample-1.0.1.tgz"
|
|
testServerCertPath = "../../pkg/addon/testdata/tls/server.crt"
|
|
testServerKeyPath = "../../pkg/addon/testdata/tls/server.key"
|
|
testServerCAPath = "../../pkg/addon/testdata/tls/server_ca.crt"
|
|
testClientCAPath = "../../pkg/addon/testdata/tls/client_ca.crt"
|
|
testClientCertPath = "../../pkg/addon/testdata/tls/client.crt"
|
|
testClientKeyPath = "../../pkg/addon/testdata/tls/client.key"
|
|
)
|
|
var (
|
|
statusCode int
|
|
body string
|
|
tmp string
|
|
)
|
|
var ts *httptest.Server
|
|
var err error
|
|
|
|
AfterEach(func() {
|
|
ts.Close()
|
|
_ = os.RemoveAll(tmp)
|
|
err = deleteAddonRegistry(context.TODO(), c, "helm-push-test")
|
|
Expect(err).To(Succeed())
|
|
})
|
|
|
|
Context("plain old HTTP Server", func() {
|
|
BeforeEach(func() {
|
|
c.SetClient(k8sClient)
|
|
c.SetConfig(cfg)
|
|
|
|
statusCode = 201
|
|
body = "{\"success\": true}"
|
|
ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(statusCode)
|
|
w.Write([]byte(body))
|
|
}))
|
|
|
|
// Create new Helm home w/ test repo
|
|
tmp, err = os.MkdirTemp("", "helm-push-test")
|
|
Expect(err).To(Succeed())
|
|
|
|
// Add our helm repo to addon registry
|
|
err = addAddonRegistry(context.TODO(), c, pkgaddon.Registry{
|
|
Name: "helm-push-test",
|
|
Helm: &pkgaddon.HelmSource{
|
|
URL: ts.URL,
|
|
},
|
|
})
|
|
Expect(err).To(Succeed())
|
|
|
|
_ = os.Setenv("HELM_REPO_USERNAME", "myuser")
|
|
_ = os.Setenv("HELM_REPO_PASSWORD", "mypass")
|
|
_ = os.Setenv("HELM_REPO_CONTEXT_PATH", "/x/y/z")
|
|
})
|
|
|
|
It("Not enough args", func() {
|
|
args := []string{}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).ShouldNot(Succeed(), "expecting error with missing args, instead got nil")
|
|
})
|
|
|
|
It("Bad chart path", func() {
|
|
args := []string{"/this/this/not/a/chart", "helm-push-test"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).ShouldNot(Succeed(), "expecting error with bad chart path, instead got nil")
|
|
})
|
|
|
|
It("Bad repo name", func() {
|
|
args := []string{testTarballPath, "this-is-not-a-valid-repo"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).ShouldNot(Succeed(), "expecting error with bad repo name, instead got nil")
|
|
})
|
|
|
|
It("Valid tar, repo name", func() {
|
|
args := []string{testTarballPath, "helm-push-test"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).Should(Succeed())
|
|
})
|
|
|
|
It("Valid tar, repo URL", func() {
|
|
args := []string{testTarballPath, ts.URL}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).Should(Succeed())
|
|
})
|
|
|
|
It("Trigger 409, already exists", func() {
|
|
statusCode = 409
|
|
body = "{\"error\": \"package already exists\"}"
|
|
args := []string{testTarballPath, "helm-push-test"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).ShouldNot(Succeed(), "expecting error with 409, instead got nil")
|
|
})
|
|
|
|
It("Unable to parse JSON response body", func() {
|
|
statusCode = 500
|
|
body = "duiasnhioasd"
|
|
args := []string{testTarballPath, "helm-push-test"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).ShouldNot(Succeed(), "expecting error with bad response body, instead got nil")
|
|
})
|
|
})
|
|
|
|
Context("TLS Enabled Server", func() {
|
|
BeforeEach(func() {
|
|
c.SetClient(k8sClient)
|
|
c.SetConfig(cfg)
|
|
|
|
statusCode = 201
|
|
body = "{\"success\": true}"
|
|
ts = httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(statusCode)
|
|
_, _ = w.Write([]byte(body))
|
|
}))
|
|
serverCert, err := tls.LoadX509KeyPair(testServerCertPath, testServerKeyPath)
|
|
Expect(err).To(Succeed(), "failed to load certificate and key")
|
|
|
|
clientCaCertPool, err := tlsutil.CertPoolFromFile(testClientCAPath)
|
|
Expect(err).To(Succeed(), "load server CA file failed")
|
|
|
|
ts.TLS = &tls.Config{
|
|
ClientCAs: clientCaCertPool,
|
|
ClientAuth: tls.RequireAndVerifyClientCert,
|
|
Certificates: []tls.Certificate{serverCert},
|
|
Rand: rand.Reader,
|
|
}
|
|
ts.StartTLS()
|
|
|
|
// Create new Helm home w/ test repo
|
|
tmp, err = os.MkdirTemp("", "helm-push-test")
|
|
Expect(err).To(Succeed())
|
|
|
|
// Add our helm repo to addon registry
|
|
err = addAddonRegistry(context.TODO(), c, pkgaddon.Registry{
|
|
Name: "helm-push-test",
|
|
Helm: &pkgaddon.HelmSource{
|
|
URL: ts.URL,
|
|
},
|
|
})
|
|
Expect(err).To(Succeed())
|
|
|
|
_ = os.Setenv("HELM_REPO_USERNAME", "myuser")
|
|
_ = os.Setenv("HELM_REPO_PASSWORD", "mypass")
|
|
_ = os.Setenv("HELM_REPO_CONTEXT_PATH", "/x/y/z")
|
|
})
|
|
|
|
It("no cert provided", func() {
|
|
_ = os.Unsetenv("HELM_REPO_CA_FILE")
|
|
_ = os.Unsetenv("HELM_REPO_CERT_FILE")
|
|
_ = os.Unsetenv("HELM_REPO_KEY_FILE")
|
|
args := []string{testTarballPath, "helm-push-test"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).ShouldNot(Succeed(), "expected non nil error but got nil when run cmd without certificate option")
|
|
})
|
|
|
|
It("with cert", func() {
|
|
_ = os.Setenv("HELM_REPO_CA_FILE", testServerCAPath)
|
|
_ = os.Setenv("HELM_REPO_CERT_FILE", testClientCertPath)
|
|
_ = os.Setenv("HELM_REPO_KEY_FILE", testClientKeyPath)
|
|
args := []string{testTarballPath, "helm-push-test"}
|
|
cmd := NewAddonPushCommand(c)
|
|
cmd.SetArgs(args)
|
|
err := cmd.RunE(cmd, args)
|
|
Expect(err).Should(Succeed())
|
|
})
|
|
})
|
|
})
|