mirror of
https://github.com/open-cluster-management-io/ocm.git
synced 2026-08-23 22:26:49 +00:00
* 🐛 Apply TLS profile to spoke agent serving endpoints The spoke agent binaries (klusterlet-agent, registration-agent, work-agent) receive --tls-min-version and --tls-cipher-suites flags from the klusterlet operator via deployment template rendering, but do not wire them to their own library-go GenericAPIServer serving endpoint on port 8443. Add ApplyTLSToCommand to all three spoke agent command constructors (NewKlusterletAgentCmd, NewRegistrationAgent, NewWorkAgent) so the TLS flags are consumed by the PersistentPreRunE hook and applied to the serving config. This matches the pattern already used by all hub component commands (registration-controller, placement, work, addon-manager, grpc-server). Signed-off-by: Tesshu Flower <tflower@redhat.com> * 🐛 Apply TLS profile to operator serving endpoints via ConfigMap The cluster-manager operator (hub) and klusterlet operator (spoke) serve a health/metrics endpoint on port 8443 via library-go's GenericAPIServer. Unlike the hub controllers and spoke agents they manage, these operator binaries do not receive --tls-min-version and --tls-cipher-suites flags from their deployment manifests -- no external component injects those flags into the operator pods. Instead, the operators have direct access to the ocm-tls-profile ConfigMap in their namespace at startup: - The cluster-manager operator reads it in RunClusterManagerOperator via StartTLSConfigMapWatcher and calls os.Exit(0) on changes to restart. - The klusterlet operator has a tls-profile-sync sidecar that writes the ConfigMap from the local OCP APIServer TLS profile and triggers pod restarts. Add ApplyTLSFromConfigMapToCommand to both operator commands. This installs a PersistentPreRunE hook that reads the ocm-tls-profile ConfigMap once (using an in-cluster kube client) before library-go's StartController creates the server, writes a minimal GenericOperatorConfig YAML to /tmp, and sets --config to point at it. This ensures the server's TLS config is set correctly from the first request, using the same restart-on-change mechanism already in place. The ConfigMap is optional: if not found (upstream deployments without the ACM sidecar) or if the in-cluster config is unavailable (local dev), the hook is a no-op and library-go defaults apply. Also add ApplyTLSToCommand call-site comments to the three spoke agent commands explaining the difference: agents receive TLS flags from their deployment manifests (injected by the klusterlet operator), while the operator itself reads the ConfigMap directly. Signed-off-by: Tesshu Flower <tflower@redhat.com> --------- Signed-off-by: Tesshu Flower <tflower@redhat.com>
125 lines
3.1 KiB
Go
125 lines
3.1 KiB
Go
package hub
|
|
|
|
import (
|
|
"io"
|
|
"testing"
|
|
)
|
|
|
|
func TestNewHubOperatorCmd(t *testing.T) {
|
|
cmd := NewHubOperatorCmd()
|
|
|
|
if cmd == nil {
|
|
t.Fatal("NewHubOperatorCmd() returned nil")
|
|
}
|
|
|
|
// Test command properties
|
|
if cmd.Use != "hub" {
|
|
t.Errorf("Expected Use to be 'hub', got %q", cmd.Use)
|
|
}
|
|
|
|
if cmd.Short != "Start the cluster manager operator" {
|
|
t.Errorf("Expected Short to be 'Start the cluster manager operator', got %q", cmd.Short)
|
|
}
|
|
|
|
// Test that flags are added
|
|
flags := cmd.Flags()
|
|
if flags == nil {
|
|
t.Error("Expected flags to be set")
|
|
}
|
|
|
|
// Verify command is runnable (has RunE or Run set)
|
|
if cmd.RunE == nil && cmd.Run == nil {
|
|
t.Error("Expected command to have RunE or Run set")
|
|
}
|
|
}
|
|
|
|
func TestHubOperatorFlags(t *testing.T) {
|
|
cmd := NewHubOperatorCmd()
|
|
flags := cmd.Flags()
|
|
|
|
// Test that specific flags are present
|
|
expectedFlags := map[string]string{
|
|
"skip-remove-crds": "bool",
|
|
"control-plane-node-label-selector": "string",
|
|
"deployment-replicas": "int32",
|
|
"enable-sync-labels": "bool",
|
|
"image-pull-secret-name": "string",
|
|
}
|
|
|
|
for flagName, flagType := range expectedFlags {
|
|
flag := flags.Lookup(flagName)
|
|
if flag == nil {
|
|
t.Errorf("Expected flag %q to be present", flagName)
|
|
continue
|
|
}
|
|
|
|
switch flagType {
|
|
case "bool":
|
|
if flag.Value.Type() != "bool" {
|
|
t.Errorf("Expected flag %q to be bool type, got %q", flagName, flag.Value.Type())
|
|
}
|
|
case "string":
|
|
if flag.Value.Type() != "string" {
|
|
t.Errorf("Expected flag %q to be string type, got %q", flagName, flag.Value.Type())
|
|
}
|
|
case "int32":
|
|
if flag.Value.Type() != "int32" {
|
|
t.Errorf("Expected flag %q to be int32 type, got %q", flagName, flag.Value.Type())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestHubOperatorFlagDefaults(t *testing.T) {
|
|
cmd := NewHubOperatorCmd()
|
|
flags := cmd.Flags()
|
|
|
|
// Test default values
|
|
tests := []struct {
|
|
flagName string
|
|
expectedDefault string
|
|
}{
|
|
{"skip-remove-crds", "false"},
|
|
{"control-plane-node-label-selector", "node-role.kubernetes.io/master="},
|
|
{"deployment-replicas", "0"},
|
|
{"enable-sync-labels", "false"},
|
|
{"image-pull-secret-name", "open-cluster-management-image-pull-credentials"},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
flag := flags.Lookup(test.flagName)
|
|
if flag == nil {
|
|
t.Errorf("Flag %q not found", test.flagName)
|
|
continue
|
|
}
|
|
|
|
if flag.DefValue != test.expectedDefault {
|
|
t.Errorf("Flag %q default value: expected %q, got %q", test.flagName, test.expectedDefault, flag.DefValue)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestHubOperatorTLSFromConfigMapWiring(t *testing.T) {
|
|
cmd := NewHubOperatorCmd()
|
|
|
|
// ApplyTLSFromConfigMapToCommand should have set PersistentPreRunE.
|
|
if cmd.PersistentPreRunE == nil {
|
|
t.Error("Expected PersistentPreRunE to be set by ApplyTLSFromConfigMapToCommand")
|
|
}
|
|
}
|
|
|
|
func TestHubOperatorCommandExecution(t *testing.T) {
|
|
cmd := NewHubOperatorCmd()
|
|
|
|
// Test command execution with help flag
|
|
cmd.SetArgs([]string{"--help"})
|
|
cmd.SilenceUsage = true
|
|
cmd.SilenceErrors = true
|
|
cmd.SetOut(io.Discard)
|
|
cmd.SetErr(io.Discard)
|
|
err := cmd.Execute()
|
|
if err != nil {
|
|
t.Errorf("Command execution with --help failed: %v", err)
|
|
}
|
|
}
|