Skip to content

Commit

Permalink
add units for global pull secret clone mechanism
Browse files Browse the repository at this point in the history
  • Loading branch information
@djoshy
djoshy committed Dec 18, 2024
1 parent e0c29a1 commit 5f33472
Show file tree
Hide file tree
Showing 4 changed files with 83 additions and 13 deletions.
27 changes: 24 additions & 3 deletions pkg/controller/build/buildrequest/buildrequestopts_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,20 +11,24 @@ import (
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"

mcfgv1 "github.com/openshift/api/machineconfiguration/v1"
)

func TestBuildRequestOpts(t *testing.T) {
testCases := []struct {
name string
addlObjects []runtime.Object
addlAsserts func(*testing.T, BuildRequestOpts)
name string
addlObjects []runtime.Object
addlObjectSetup func(*testing.T, *fixtures.ObjectsForTest)
addlAsserts func(*testing.T, BuildRequestOpts)
}{
{
name: "no entitlement data",
addlAsserts: func(t *testing.T, brOpts BuildRequestOpts) {
assert.False(t, brOpts.HasEtcPkiRpmGpgKeys)
assert.False(t, brOpts.HasEtcYumReposDConfigs)
assert.False(t, brOpts.HasEtcPkiEntitlementKeys)
assert.False(t, brOpts.HasUserDefinedBaseImagePullSecret)
},
},
{
Expand All @@ -41,6 +45,7 @@ func TestBuildRequestOpts(t *testing.T) {
assert.False(t, brOpts.HasEtcPkiRpmGpgKeys)
assert.False(t, brOpts.HasEtcYumReposDConfigs)
assert.True(t, brOpts.HasEtcPkiEntitlementKeys)
assert.False(t, brOpts.HasUserDefinedBaseImagePullSecret)
},
},
{
Expand All @@ -57,6 +62,7 @@ func TestBuildRequestOpts(t *testing.T) {
assert.False(t, brOpts.HasEtcPkiRpmGpgKeys)
assert.True(t, brOpts.HasEtcYumReposDConfigs)
assert.False(t, brOpts.HasEtcPkiEntitlementKeys)
assert.False(t, brOpts.HasUserDefinedBaseImagePullSecret)
},
},
{
Expand All @@ -73,6 +79,7 @@ func TestBuildRequestOpts(t *testing.T) {
assert.True(t, brOpts.HasEtcPkiRpmGpgKeys)
assert.False(t, brOpts.HasEtcYumReposDConfigs)
assert.False(t, brOpts.HasEtcPkiEntitlementKeys)
assert.False(t, brOpts.HasUserDefinedBaseImagePullSecret)
},
},
{
Expand Down Expand Up @@ -101,6 +108,16 @@ func TestBuildRequestOpts(t *testing.T) {
assert.True(t, brOpts.HasEtcPkiRpmGpgKeys)
assert.True(t, brOpts.HasEtcYumReposDConfigs)
assert.True(t, brOpts.HasEtcPkiEntitlementKeys)
assert.False(t, brOpts.HasUserDefinedBaseImagePullSecret)
},
},
{
name: "with user defined base image pull secret",
addlObjectSetup: func(t *testing.T, lobj *fixtures.ObjectsForTest) {
lobj.MachineOSConfig.Spec.BaseImagePullSecret = &mcfgv1.ImageSecretObjectReference{Name: fixtures.BaseImagePullSecretName}
},
addlAsserts: func(t *testing.T, brOpts BuildRequestOpts) {
assert.True(t, brOpts.HasUserDefinedBaseImagePullSecret)
},
},
}
Expand All @@ -115,6 +132,10 @@ func TestBuildRequestOpts(t *testing.T) {

kubeclient, mcfgclient, lobj, _ := fixtures.GetClientsForTestWithAdditionalObjects(t, testCase.addlObjects, []runtime.Object{})

if testCase.addlObjectSetup != nil {
testCase.addlObjectSetup(t, lobj)
}

brOpts, err := newBuildRequestOptsFromAPI(ctx, kubeclient, mcfgclient, lobj.MachineOSBuild, lobj.MachineOSConfig)
assert.NoError(t, err)

Expand Down
15 changes: 12 additions & 3 deletions pkg/controller/build/fixtures/objects.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ import (
)

const (
baseImagePullSecretName string = "base-image-pull-secret"
BaseImagePullSecretName string = "base-image-pull-secret"
finalImagePushSecretName string = "final-image-push-secret"
)

Expand Down Expand Up @@ -86,7 +86,6 @@ func NewObjectBuildersForTest(poolName string) ObjectBuildersForTest {

moscBuilder := testhelpers.NewMachineOSConfigBuilder(moscName).
WithMachineConfigPool(poolName).
WithBaseImagePullSecret(baseImagePullSecretName).
WithRenderedImagePushSecret(finalImagePushSecretName).
WithRenderedImagePushSpec("registry.hostname.com/org/repo:latest").
WithContainerfile(mcfgv1.NoArch, "FROM configs AS final\n\nRUN echo 'hi' > /etc/hi")
Expand Down Expand Up @@ -131,7 +130,17 @@ func defaultKubeObjects() []runtime.Object {
},
&corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: baseImagePullSecretName,
Name: BaseImagePullSecretName,
Namespace: ctrlcommon.MCONamespace,
},
Data: map[string][]byte{
corev1.DockerConfigJsonKey: []byte(pullSecret),
},
Type: corev1.SecretTypeDockerConfigJson,
},
&corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: ctrlcommon.GlobalPullSecretCopyName,
Namespace: ctrlcommon.MCONamespace,
},
Data: map[string][]byte{
Expand Down
41 changes: 34 additions & 7 deletions pkg/operator/sync_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -161,56 +161,73 @@ func withCABundle(caBundle string) kubeCloudConfigOption {
}
}

func TestReconcileSimpleContentAccessSecret(t *testing.T) {
func TestMachineOSBuilderSecretReconciliation(t *testing.T) {
masterPool := helpers.NewMachineConfigPool("master", nil, helpers.MasterSelector, "v0")
workerPool := helpers.NewMachineConfigPool("worker", nil, helpers.MasterSelector, "v0")
infraPool := helpers.NewMachineConfigPool("infra", nil, helpers.MasterSelector, "v0")
entitlementSecret := helpers.NewOpaqueSecret(ctrlcommon.SimpleContentAccessSecretName, ctrlcommon.OpenshiftConfigManagedNamespace, "abc")
workerEntitlementSecret := helpers.NewOpaqueSecret(ctrlcommon.SimpleContentAccessSecretName+"-"+workerPool.Name, ctrlcommon.MCONamespace, "abc")
infraEntitlementSecret := helpers.NewOpaqueSecret(ctrlcommon.SimpleContentAccessSecretName+"-"+infraPool.Name, ctrlcommon.MCONamespace, "abc")
outOfDateInfraEntitlementSecret := helpers.NewOpaqueSecret(ctrlcommon.SimpleContentAccessSecretName+"-"+infraPool.Name, ctrlcommon.MCONamespace, "123")
globalPullSecret := helpers.NewDockerCfgJSONSecret(ctrlcommon.GlobalPullSecretName, ctrlcommon.OpenshiftConfigNamespace, "abc")
outOfDateGlobalPullSecretCopy := helpers.NewDockerCfgJSONSecret(ctrlcommon.GlobalPullSecretCopyName, ctrlcommon.MCONamespace, "123")
globalPullSecretCopy := helpers.NewDockerCfgJSONSecret(ctrlcommon.GlobalPullSecretCopyName, ctrlcommon.MCONamespace, "abc")

cases := []struct {
name string
mcoSecrets []*corev1.Secret
ocSecrets []*corev1.Secret
ocManagedSecrets []*corev1.Secret
expectedMCOSecrets []corev1.Secret
layeredMCPs []*mcfgv1.MachineConfigPool
}{
{
name: "no entitlement secret on cluster, with opted-in pool",
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
ocManagedSecrets: []*corev1.Secret{},
mcoSecrets: []*corev1.Secret{},
expectedMCOSecrets: []corev1.Secret{},
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*globalPullSecretCopy.DeepCopy()},
},
{
name: "entitlement secret on cluster, with opted-in pool",
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
mcoSecrets: []*corev1.Secret{},
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy(), *globalPullSecretCopy.DeepCopy()},
},
{
name: "entitlement secret on cluster, with multiple opted-in pools",
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
mcoSecrets: []*corev1.Secret{},
layeredMCPs: []*mcfgv1.MachineConfigPool{workerPool.DeepCopy(), infraPool.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*workerEntitlementSecret.DeepCopy(), *infraEntitlementSecret.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*workerEntitlementSecret.DeepCopy(), *infraEntitlementSecret.DeepCopy(), *globalPullSecretCopy.DeepCopy()},
},
{
name: "entitlement and cloned secret on cluster, with no opted-in pools",
name: "entitlement, cloned secret and global pull secret copy on cluster, with no opted-in pools",
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
mcoSecrets: []*corev1.Secret{infraEntitlementSecret.DeepCopy()},
mcoSecrets: []*corev1.Secret{infraEntitlementSecret.DeepCopy(), globalPullSecretCopy.DeepCopy()},
layeredMCPs: []*mcfgv1.MachineConfigPool{},
expectedMCOSecrets: []corev1.Secret{},
},
{
name: "entitlement and cloned secret on cluster, with an outdated cloned secret",
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
mcoSecrets: []*corev1.Secret{outOfDateInfraEntitlementSecret.DeepCopy()},
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy(), *globalPullSecretCopy.DeepCopy()},
},
{
name: "outdated global pull secret copy on cluster",
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
ocManagedSecrets: []*corev1.Secret{},
mcoSecrets: []*corev1.Secret{outOfDateGlobalPullSecretCopy.DeepCopy()},
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
expectedMCOSecrets: []corev1.Secret{*globalPullSecretCopy.DeepCopy()},
},
}
for _, tc := range cases {
Expand All @@ -222,6 +239,7 @@ func TestReconcileSimpleContentAccessSecret(t *testing.T) {
sharedInformerFactory := informers.NewSharedInformerFactory(kubeClient, 0)
mcoSecretInformer := sharedInformerFactory.Core().V1().Secrets()
ocManagedSecretInformer := sharedInformerFactory.Core().V1().Secrets()
ocSecretInformer := sharedInformerFactory.Core().V1().Secrets()

// Add secrets to informer and client
for _, secret := range tc.mcoSecrets {
Expand All @@ -234,6 +252,11 @@ func TestReconcileSimpleContentAccessSecret(t *testing.T) {
_, err := kubeClient.CoreV1().Secrets(ctrlcommon.OpenshiftConfigManagedNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
assert.NoError(t, err)
}
for _, secret := range tc.ocSecrets {
ocSecretInformer.Informer().GetIndexer().Add(secret)
_, err := kubeClient.CoreV1().Secrets(ctrlcommon.OpenshiftConfigNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
assert.NoError(t, err)
}

// Create MCO specific clients
mcfgClient := fakeclientmachineconfigv1.NewSimpleClientset()
Expand All @@ -250,11 +273,15 @@ func TestReconcileSimpleContentAccessSecret(t *testing.T) {
kubeClient: kubeClient,
mcpLister: mcpInformer.Lister(),
mcoSecretLister: mcoSecretInformer.Lister(),
ocSecretLister: ocSecretInformer.Lister(),
ocManagedSecretLister: ocManagedSecretInformer.Lister(),
}
err := optr.reconcileSimpleContentAccessSecrets(tc.layeredMCPs)
assert.NoError(t, err)

err = optr.reconcileGlobalPullSecretCopy(tc.layeredMCPs)
assert.NoError(t, err)

// Verify secrets in MCO namespace are as expected
secrets, err := kubeClient.CoreV1().Secrets(ctrlcommon.MCONamespace).List(context.TODO(), metav1.ListOptions{})
assert.NoError(t, err)
Expand Down
13 changes: 13 additions & 0 deletions test/helpers/helpers.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,19 @@ func NewOpaqueSecret(name, namespace, content string) *corev1.Secret {
}
}

func NewDockerCfgJSONSecret(name, namespace, content string) *corev1.Secret {
return &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: name,
Namespace: namespace,
},
Data: map[string][]byte{
".dockerconfigjson": []byte(content),
},
Type: corev1.SecretTypeDockerConfigJson,
}
}

// CreateMachineConfigFromIgnitionWithMetadata returns a MachineConfig object from an Ignition config, name, and role label
func CreateMachineConfigFromIgnitionWithMetadata(ignCfg interface{}, name, role string) *mcfgv1.MachineConfig {
return &mcfgv1.MachineConfig{
Expand Down

0 comments on commit 5f33472

Please sign in to comment.