Error if rolebinding exists with different role reference in namespace (#2579)

* added unit test for setup role binding method * changes to throw an error in case of mismatch in cluster role name * changes to add a check for role kind
2022-10-27 14:10:38 +05:30
parent ee790b3e1e
commit 3a9e5ab65d
3 changed files with 92 additions and 1 deletions
@@ -0,0 +1,81 @@
+package utils
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/api/rbac/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes/fake"
+
+	fv1 "github.com/fission/fission/pkg/apis/core/v1"
+	"github.com/fission/fission/pkg/utils/loggerfactory"
+)
+
+const (
+	namespace      string = "testns"
+	serviceAccount string = "testSA"
+	clusterRole    string = "testClusterRole"
+	rolebinding    string = "testRolebinding"
+)
+
+func TestSetupRoleBinding(t *testing.T) {
+	ctx := context.Background()
+	logger := loggerfactory.GetLogger()
+	kubernetesClient := fake.NewSimpleClientset()
+
+	//case 1 => when role binding doesn't exists
+	_, err := createServiceAccount(ctx, kubernetesClient)
+	if err != nil {
+		t.Fatalf("Error creating service account: %s", err.Error())
+	}
+	_, err = createClusterRole(ctx, clusterRole, kubernetesClient)
+	if err != nil {
+		t.Fatalf("Error creating cluster role: %s", err.Error())
+	}
+	err = SetupRoleBinding(ctx, logger, kubernetesClient, rolebinding, namespace, clusterRole, fv1.ClusterRole, serviceAccount, namespace)
+	assert.Nil(t, err, "error should be nil and new role binding will get created")
+
+	//case 2 => rolebinding exists but service account doesn't exists
+	err = kubernetesClient.CoreV1().ServiceAccounts(namespace).Delete(ctx, serviceAccount, metav1.DeleteOptions{})
+	if err != nil {
+		t.Fatalf("Error deleting service account: %s", err.Error())
+	}
+	err = SetupRoleBinding(ctx, logger, kubernetesClient, rolebinding, namespace, clusterRole, fv1.ClusterRole, serviceAccount, namespace)
+	assert.Nil(t, err, "error should be nil and service account should add in rolebinding")
+
+	//case 3 => rolebinding, cluster role and service account, all exists
+	err = SetupRoleBinding(ctx, logger, kubernetesClient, rolebinding, namespace, clusterRole, fv1.ClusterRole, serviceAccount, namespace)
+	assert.Nil(t, err, "error should be nil and nothing to add")
+
+	//case 4 => This must fail, if there is change in cluster-role-name
+	err = SetupRoleBinding(ctx, logger, kubernetesClient, rolebinding, namespace, "invalid-cluster-name", fv1.ClusterRole, serviceAccount, namespace)
+	assert.NotNil(t, err)
+	assert.Equal(t, err.Error(), fmt.Sprintf("rolebinding %s in namespace %s exists with different roleref, retry by deleting existing rolebinding", rolebinding, namespace))
+}
+
+func createClusterRole(ctx context.Context, clusterRole string, kubernetesClient *fake.Clientset) (*v1.ClusterRole, error) {
+	objRole := MakeClusterRoleObj(clusterRole)
+	var err error
+	objRole, err = kubernetesClient.RbacV1().ClusterRoles().Create(ctx, objRole, metav1.CreateOptions{})
+	return objRole, err
+}
+
+func createServiceAccount(ctx context.Context, kubernetesClient *fake.Clientset) (*corev1.ServiceAccount, error) {
+	objSA := MakeSAObj(serviceAccount, namespace)
+	var err error
+	objSA, err = kubernetesClient.CoreV1().ServiceAccounts(namespace).Create(ctx, objSA, metav1.CreateOptions{})
+	return objSA, err
+}
+
+// MakeClusterRoleObj returns a ClusterRole object
+func MakeClusterRoleObj(clusterRoleName string) *v1.ClusterRole {
+	return &v1.ClusterRole{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: clusterRoleName,
+		},
+	}
+}