Search in sources :

Example 1 with RoleBindingOperator

use of io.strimzi.operator.common.operator.resource.RoleBindingOperator in project strimzi-kafka-operator by strimzi.

the class KafkaAssemblyOperatorRbacScopeTest method testRolesDeployedWhenNamespaceRbacScope.

/**
 * This test checks that when STRIMZI_RBAC_SCOPE feature is set to 'NAMESPACE', the cluster operator only
 * deploys and binds to Roles
 */
@Test
public void testRolesDeployedWhenNamespaceRbacScope(VertxTestContext context) {
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(clusterName).withNamespace(namespace).endMetadata().withNewSpec().withNewKafka().withReplicas(3).endKafka().withNewZookeeper().withReplicas(3).endZookeeper().withNewEntityOperator().withNewUserOperator().endUserOperator().withNewTopicOperator().endTopicOperator().endEntityOperator().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    // Mock the CRD Operator for Kafka resources
    CrdOperator mockKafkaOps = supplier.kafkaOperator;
    when(mockKafkaOps.getAsync(eq(namespace), eq(clusterName))).thenReturn(Future.succeededFuture(kafka));
    when(mockKafkaOps.get(eq(namespace), eq(clusterName))).thenReturn(kafka);
    when(mockKafkaOps.updateStatusAsync(any(), any(Kafka.class))).thenReturn(Future.succeededFuture());
    // Mock the operations for RoleBindings
    RoleBindingOperator mockRoleBindingOps = supplier.roleBindingOperations;
    // Capture the names of reconciled rolebindings and their patched state
    ArgumentCaptor<String> roleBindingNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<RoleBinding> roleBindingCaptor = ArgumentCaptor.forClass(RoleBinding.class);
    when(mockRoleBindingOps.reconcile(any(), eq(namespace), roleBindingNameCaptor.capture(), roleBindingCaptor.capture())).thenReturn(Future.succeededFuture());
    KafkaAssemblyOperatorRolesSubset kao = new KafkaAssemblyOperatorRolesSubset(vertx, new PlatformFeaturesAvailability(false, kubernetesVersion), certManager, passwordGenerator, supplier, configNamespaceRbacScope);
    Checkpoint async = context.checkpoint();
    kao.reconcile(new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, namespace, clusterName)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> roleBindingNames = roleBindingNameCaptor.getAllValues();
        List<RoleBinding> roleBindings = roleBindingCaptor.getAllValues();
        assertThat(roleBindingNames, hasSize(2));
        assertThat(roleBindings, hasSize(2));
        // Check all RoleBindings, easier to index by order applied
        assertThat(roleBindingNames.get(0), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(0), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName("test-instance-entity-operator").build()));
        assertThat(roleBindingNames.get(1), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(1), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName("test-instance-entity-operator").build()));
        verify(supplier.clusterRoleBindingOperator, never()).reconcile(any(), anyString(), any());
        async.flag();
    })));
}
Also used : VertxTestContext(io.vertx.junit5.VertxTestContext) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) ArgumentMatchers.eq(org.mockito.ArgumentMatchers.eq) Role(io.fabric8.kubernetes.api.model.rbac.Role) CertManager(io.strimzi.certs.CertManager) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) TypeSafeDiagnosingMatcher(org.hamcrest.TypeSafeDiagnosingMatcher) AfterAll(org.junit.jupiter.api.AfterAll) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) ArgumentCaptor(org.mockito.ArgumentCaptor) ExtendWith(org.junit.jupiter.api.extension.ExtendWith) KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils) BeforeAll(org.junit.jupiter.api.BeforeAll) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Matchers.hasSize(org.hamcrest.Matchers.hasSize) ResourceUtils(io.strimzi.operator.cluster.ResourceUtils) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) Description(org.hamcrest.Description) KubernetesVersion(io.strimzi.operator.KubernetesVersion) KafkaVersion(io.strimzi.operator.cluster.model.KafkaVersion) Vertx(io.vertx.core.Vertx) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Mockito.when(org.mockito.Mockito.when) VertxExtension(io.vertx.junit5.VertxExtension) Future(io.vertx.core.Future) Mockito.verify(org.mockito.Mockito.verify) Test(org.junit.jupiter.api.Test) RoleRef(io.fabric8.kubernetes.api.model.rbac.RoleRef) Reconciliation(io.strimzi.operator.common.Reconciliation) List(java.util.List) Mockito.never(org.mockito.Mockito.never) PasswordGenerator(io.strimzi.operator.common.PasswordGenerator) Matcher(org.hamcrest.Matcher) Checkpoint(io.vertx.junit5.Checkpoint) Matchers.is(org.hamcrest.Matchers.is) EntityOperator(io.strimzi.operator.cluster.model.EntityOperator) Kafka(io.strimzi.api.kafka.model.Kafka) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) ClusterOperatorConfig(io.strimzi.operator.cluster.ClusterOperatorConfig) MockCertManager(io.strimzi.operator.common.operator.MockCertManager) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Kafka(io.strimzi.api.kafka.model.Kafka) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Checkpoint(io.vertx.junit5.Checkpoint) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) Reconciliation(io.strimzi.operator.common.Reconciliation) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Test(org.junit.jupiter.api.Test)

Example 2 with RoleBindingOperator

use of io.strimzi.operator.common.operator.resource.RoleBindingOperator in project strimzi-kafka-operator by strimzi.

the class KafkaAssemblyOperatorRbacScopeTest method testRolesDeployedWhenNamespaceRbacScopeAndMultiWatchNamespace.

/**
 * This test checks that when STRIMZI_RBAC_SCOPE feature is set to 'NAMESPACE', the cluster operator
 * binds to ClusterRoles when it can't use Roles due to cross namespace permissions
 */
@Test
public void testRolesDeployedWhenNamespaceRbacScopeAndMultiWatchNamespace(VertxTestContext context) {
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(clusterName).withNamespace(namespace).endMetadata().withNewSpec().withNewKafka().withReplicas(3).endKafka().withNewZookeeper().withReplicas(3).endZookeeper().withNewEntityOperator().withNewUserOperator().withWatchedNamespace("other-ns").endUserOperator().withNewTopicOperator().withWatchedNamespace("another-ns").endTopicOperator().endEntityOperator().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    // Mock the CRD Operator for Kafka resources
    CrdOperator mockKafkaOps = supplier.kafkaOperator;
    when(mockKafkaOps.getAsync(eq(namespace), eq(clusterName))).thenReturn(Future.succeededFuture(kafka));
    when(mockKafkaOps.get(eq(namespace), eq(clusterName))).thenReturn(kafka);
    when(mockKafkaOps.updateStatusAsync(any(), any(Kafka.class))).thenReturn(Future.succeededFuture());
    // Mock the operations for Roles
    RoleOperator mockRoleOps = supplier.roleOperations;
    // Capture the names of reconciled Roles and their patched state
    ArgumentCaptor<String> roleNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<Role> roleCaptor = ArgumentCaptor.forClass(Role.class);
    when(mockRoleOps.reconcile(any(), anyString(), roleNameCaptor.capture(), roleCaptor.capture())).thenReturn(Future.succeededFuture());
    // Mock the operations for RoleBindings
    RoleBindingOperator mockRoleBindingOps = supplier.roleBindingOperations;
    // Capture the names of reconciled RoleBindings and their patched state
    ArgumentCaptor<String> roleBindingNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<RoleBinding> roleBindingCaptor = ArgumentCaptor.forClass(RoleBinding.class);
    when(mockRoleBindingOps.reconcile(any(), anyString(), roleBindingNameCaptor.capture(), roleBindingCaptor.capture())).thenReturn(Future.succeededFuture());
    KafkaAssemblyOperatorRolesSubset kao = new KafkaAssemblyOperatorRolesSubset(vertx, new PlatformFeaturesAvailability(false, kubernetesVersion), certManager, passwordGenerator, supplier, configNamespaceRbacScope);
    Checkpoint async = context.checkpoint();
    kao.reconcile(new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, namespace, clusterName)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> roleBindingNames = roleBindingNameCaptor.getAllValues();
        List<RoleBinding> roleBindings = roleBindingCaptor.getAllValues();
        assertThat(roleBindingNames, hasSize(4));
        assertThat(roleBindings, hasSize(4));
        // Check all RoleBindings, easier to index by order applied
        assertThat(roleBindingNames.get(0), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(0).getMetadata().getNamespace(), is("another-ns"));
        assertThat(roleBindings.get(0), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        assertThat(roleBindingNames.get(1), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(1).getMetadata().getNamespace(), is("test-ns"));
        assertThat(roleBindings.get(1), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        assertThat(roleBindingNames.get(2), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(2).getMetadata().getNamespace(), is("other-ns"));
        assertThat(roleBindings.get(2), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        assertThat(roleBindingNames.get(3), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(3).getMetadata().getNamespace(), is("test-ns"));
        assertThat(roleBindings.get(3), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        List<String> roleNames = roleNameCaptor.getAllValues();
        List<Role> roles = roleCaptor.getAllValues();
        assertThat(roleNames, hasSize(3));
        assertThat(roles, hasSize(3));
        // Check all Roles, easier to index by order applied
        assertThat(roleNames.get(0), is("test-instance-entity-operator"));
        assertThat(roles.get(0).getMetadata().getNamespace(), is("test-ns"));
        assertThat(roleNames.get(1), is("test-instance-entity-operator"));
        assertThat(roles.get(1).getMetadata().getNamespace(), is("other-ns"));
        assertThat(roleNames.get(2), is("test-instance-entity-operator"));
        assertThat(roles.get(2).getMetadata().getNamespace(), is("another-ns"));
        async.flag();
    })));
}
Also used : VertxTestContext(io.vertx.junit5.VertxTestContext) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) ArgumentMatchers.eq(org.mockito.ArgumentMatchers.eq) Role(io.fabric8.kubernetes.api.model.rbac.Role) CertManager(io.strimzi.certs.CertManager) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) TypeSafeDiagnosingMatcher(org.hamcrest.TypeSafeDiagnosingMatcher) AfterAll(org.junit.jupiter.api.AfterAll) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) ArgumentCaptor(org.mockito.ArgumentCaptor) ExtendWith(org.junit.jupiter.api.extension.ExtendWith) KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils) BeforeAll(org.junit.jupiter.api.BeforeAll) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Matchers.hasSize(org.hamcrest.Matchers.hasSize) ResourceUtils(io.strimzi.operator.cluster.ResourceUtils) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) Description(org.hamcrest.Description) KubernetesVersion(io.strimzi.operator.KubernetesVersion) KafkaVersion(io.strimzi.operator.cluster.model.KafkaVersion) Vertx(io.vertx.core.Vertx) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Mockito.when(org.mockito.Mockito.when) VertxExtension(io.vertx.junit5.VertxExtension) Future(io.vertx.core.Future) Mockito.verify(org.mockito.Mockito.verify) Test(org.junit.jupiter.api.Test) RoleRef(io.fabric8.kubernetes.api.model.rbac.RoleRef) Reconciliation(io.strimzi.operator.common.Reconciliation) List(java.util.List) Mockito.never(org.mockito.Mockito.never) PasswordGenerator(io.strimzi.operator.common.PasswordGenerator) Matcher(org.hamcrest.Matcher) Checkpoint(io.vertx.junit5.Checkpoint) Matchers.is(org.hamcrest.Matchers.is) EntityOperator(io.strimzi.operator.cluster.model.EntityOperator) Kafka(io.strimzi.api.kafka.model.Kafka) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) ClusterOperatorConfig(io.strimzi.operator.cluster.ClusterOperatorConfig) MockCertManager(io.strimzi.operator.common.operator.MockCertManager) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Kafka(io.strimzi.api.kafka.model.Kafka) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Role(io.fabric8.kubernetes.api.model.rbac.Role) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Checkpoint(io.vertx.junit5.Checkpoint) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) Reconciliation(io.strimzi.operator.common.Reconciliation) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Test(org.junit.jupiter.api.Test)

Example 3 with RoleBindingOperator

use of io.strimzi.operator.common.operator.resource.RoleBindingOperator in project strimzi-kafka-operator by strimzi.

the class KafkaAssemblyOperatorRbacScopeTest method testRolesDeployedWhenClusterRbacScope.

/**
 * This test checks that when STRIMZI_RBAC_SCOPE feature is set to 'CLUSTER', the cluster operator
 * binds to ClusterRoles
 */
@Test
public void testRolesDeployedWhenClusterRbacScope(VertxTestContext context) {
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(clusterName).withNamespace(namespace).endMetadata().withNewSpec().withNewKafka().withReplicas(3).endKafka().withNewZookeeper().withReplicas(3).endZookeeper().withNewEntityOperator().withNewUserOperator().endUserOperator().withNewTopicOperator().endTopicOperator().endEntityOperator().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    // Mock the CRD Operator for Kafka resources
    CrdOperator mockKafkaOps = supplier.kafkaOperator;
    when(mockKafkaOps.getAsync(eq(namespace), eq(clusterName))).thenReturn(Future.succeededFuture(kafka));
    when(mockKafkaOps.get(eq(namespace), eq(clusterName))).thenReturn(kafka);
    when(mockKafkaOps.updateStatusAsync(any(), any(Kafka.class))).thenReturn(Future.succeededFuture());
    // Mock the operations for RoleBindings
    RoleBindingOperator mockRoleBindingOps = supplier.roleBindingOperations;
    // Capture the names of reconciled rolebindings and their patched state
    ArgumentCaptor<String> roleBindingNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<RoleBinding> roleBindingCaptor = ArgumentCaptor.forClass(RoleBinding.class);
    when(mockRoleBindingOps.reconcile(any(), eq(namespace), roleBindingNameCaptor.capture(), roleBindingCaptor.capture())).thenReturn(Future.succeededFuture());
    KafkaAssemblyOperatorRolesSubset kao = new KafkaAssemblyOperatorRolesSubset(vertx, new PlatformFeaturesAvailability(false, kubernetesVersion), certManager, passwordGenerator, supplier, config);
    Checkpoint async = context.checkpoint();
    kao.reconcile(new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, namespace, clusterName)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> roleBindingNames = roleBindingNameCaptor.getAllValues();
        List<RoleBinding> roleBindings = roleBindingCaptor.getAllValues();
        assertThat(roleBindingNames, hasSize(2));
        assertThat(roleBindings, hasSize(2));
        // Check all RoleBindings, easier to index by order applied
        assertThat(roleBindingNames.get(0), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(0), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName("test-instance-entity-operator").build()));
        assertThat(roleBindingNames.get(1), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(1), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName("test-instance-entity-operator").build()));
        async.flag();
    })));
}
Also used : VertxTestContext(io.vertx.junit5.VertxTestContext) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) ArgumentMatchers.eq(org.mockito.ArgumentMatchers.eq) Role(io.fabric8.kubernetes.api.model.rbac.Role) CertManager(io.strimzi.certs.CertManager) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) TypeSafeDiagnosingMatcher(org.hamcrest.TypeSafeDiagnosingMatcher) AfterAll(org.junit.jupiter.api.AfterAll) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) ArgumentCaptor(org.mockito.ArgumentCaptor) ExtendWith(org.junit.jupiter.api.extension.ExtendWith) KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils) BeforeAll(org.junit.jupiter.api.BeforeAll) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Matchers.hasSize(org.hamcrest.Matchers.hasSize) ResourceUtils(io.strimzi.operator.cluster.ResourceUtils) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) Description(org.hamcrest.Description) KubernetesVersion(io.strimzi.operator.KubernetesVersion) KafkaVersion(io.strimzi.operator.cluster.model.KafkaVersion) Vertx(io.vertx.core.Vertx) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Mockito.when(org.mockito.Mockito.when) VertxExtension(io.vertx.junit5.VertxExtension) Future(io.vertx.core.Future) Mockito.verify(org.mockito.Mockito.verify) Test(org.junit.jupiter.api.Test) RoleRef(io.fabric8.kubernetes.api.model.rbac.RoleRef) Reconciliation(io.strimzi.operator.common.Reconciliation) List(java.util.List) Mockito.never(org.mockito.Mockito.never) PasswordGenerator(io.strimzi.operator.common.PasswordGenerator) Matcher(org.hamcrest.Matcher) Checkpoint(io.vertx.junit5.Checkpoint) Matchers.is(org.hamcrest.Matchers.is) EntityOperator(io.strimzi.operator.cluster.model.EntityOperator) Kafka(io.strimzi.api.kafka.model.Kafka) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) ClusterOperatorConfig(io.strimzi.operator.cluster.ClusterOperatorConfig) MockCertManager(io.strimzi.operator.common.operator.MockCertManager) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Kafka(io.strimzi.api.kafka.model.Kafka) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Checkpoint(io.vertx.junit5.Checkpoint) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) Reconciliation(io.strimzi.operator.common.Reconciliation) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Test(org.junit.jupiter.api.Test)

Example 4 with RoleBindingOperator

use of io.strimzi.operator.common.operator.resource.RoleBindingOperator in project strimzi by strimzi.

the class KafkaAssemblyOperatorRbacScopeTest method testRolesDeployedWhenNamespaceRbacScope.

/**
 * This test checks that when STRIMZI_RBAC_SCOPE feature is set to 'NAMESPACE', the cluster operator only
 * deploys and binds to Roles
 */
@Test
public void testRolesDeployedWhenNamespaceRbacScope(VertxTestContext context) {
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(clusterName).withNamespace(namespace).endMetadata().withNewSpec().withNewKafka().withReplicas(3).endKafka().withNewZookeeper().withReplicas(3).endZookeeper().withNewEntityOperator().withNewUserOperator().endUserOperator().withNewTopicOperator().endTopicOperator().endEntityOperator().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    // Mock the CRD Operator for Kafka resources
    CrdOperator mockKafkaOps = supplier.kafkaOperator;
    when(mockKafkaOps.getAsync(eq(namespace), eq(clusterName))).thenReturn(Future.succeededFuture(kafka));
    when(mockKafkaOps.get(eq(namespace), eq(clusterName))).thenReturn(kafka);
    when(mockKafkaOps.updateStatusAsync(any(), any(Kafka.class))).thenReturn(Future.succeededFuture());
    // Mock the operations for RoleBindings
    RoleBindingOperator mockRoleBindingOps = supplier.roleBindingOperations;
    // Capture the names of reconciled rolebindings and their patched state
    ArgumentCaptor<String> roleBindingNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<RoleBinding> roleBindingCaptor = ArgumentCaptor.forClass(RoleBinding.class);
    when(mockRoleBindingOps.reconcile(any(), eq(namespace), roleBindingNameCaptor.capture(), roleBindingCaptor.capture())).thenReturn(Future.succeededFuture());
    KafkaAssemblyOperatorRolesSubset kao = new KafkaAssemblyOperatorRolesSubset(vertx, new PlatformFeaturesAvailability(false, kubernetesVersion), certManager, passwordGenerator, supplier, configNamespaceRbacScope);
    Checkpoint async = context.checkpoint();
    kao.reconcile(new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, namespace, clusterName)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> roleBindingNames = roleBindingNameCaptor.getAllValues();
        List<RoleBinding> roleBindings = roleBindingCaptor.getAllValues();
        assertThat(roleBindingNames, hasSize(2));
        assertThat(roleBindings, hasSize(2));
        // Check all RoleBindings, easier to index by order applied
        assertThat(roleBindingNames.get(0), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(0), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName("test-instance-entity-operator").build()));
        assertThat(roleBindingNames.get(1), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(1), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName("test-instance-entity-operator").build()));
        verify(supplier.clusterRoleBindingOperator, never()).reconcile(any(), anyString(), any());
        async.flag();
    })));
}
Also used : VertxTestContext(io.vertx.junit5.VertxTestContext) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) ArgumentMatchers.eq(org.mockito.ArgumentMatchers.eq) Role(io.fabric8.kubernetes.api.model.rbac.Role) CertManager(io.strimzi.certs.CertManager) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) TypeSafeDiagnosingMatcher(org.hamcrest.TypeSafeDiagnosingMatcher) AfterAll(org.junit.jupiter.api.AfterAll) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) ArgumentCaptor(org.mockito.ArgumentCaptor) ExtendWith(org.junit.jupiter.api.extension.ExtendWith) KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils) BeforeAll(org.junit.jupiter.api.BeforeAll) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Matchers.hasSize(org.hamcrest.Matchers.hasSize) ResourceUtils(io.strimzi.operator.cluster.ResourceUtils) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) Description(org.hamcrest.Description) KubernetesVersion(io.strimzi.operator.KubernetesVersion) KafkaVersion(io.strimzi.operator.cluster.model.KafkaVersion) Vertx(io.vertx.core.Vertx) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Mockito.when(org.mockito.Mockito.when) VertxExtension(io.vertx.junit5.VertxExtension) Future(io.vertx.core.Future) Mockito.verify(org.mockito.Mockito.verify) Test(org.junit.jupiter.api.Test) RoleRef(io.fabric8.kubernetes.api.model.rbac.RoleRef) Reconciliation(io.strimzi.operator.common.Reconciliation) List(java.util.List) Mockito.never(org.mockito.Mockito.never) PasswordGenerator(io.strimzi.operator.common.PasswordGenerator) Matcher(org.hamcrest.Matcher) Checkpoint(io.vertx.junit5.Checkpoint) Matchers.is(org.hamcrest.Matchers.is) EntityOperator(io.strimzi.operator.cluster.model.EntityOperator) Kafka(io.strimzi.api.kafka.model.Kafka) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) ClusterOperatorConfig(io.strimzi.operator.cluster.ClusterOperatorConfig) MockCertManager(io.strimzi.operator.common.operator.MockCertManager) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Kafka(io.strimzi.api.kafka.model.Kafka) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Checkpoint(io.vertx.junit5.Checkpoint) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) Reconciliation(io.strimzi.operator.common.Reconciliation) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Test(org.junit.jupiter.api.Test)

Example 5 with RoleBindingOperator

use of io.strimzi.operator.common.operator.resource.RoleBindingOperator in project strimzi by strimzi.

the class KafkaAssemblyOperatorRbacScopeTest method testRolesDeployedWhenNamespaceRbacScopeAndMultiWatchNamespace.

/**
 * This test checks that when STRIMZI_RBAC_SCOPE feature is set to 'NAMESPACE', the cluster operator
 * binds to ClusterRoles when it can't use Roles due to cross namespace permissions
 */
@Test
public void testRolesDeployedWhenNamespaceRbacScopeAndMultiWatchNamespace(VertxTestContext context) {
    Kafka kafka = new KafkaBuilder().withNewMetadata().withName(clusterName).withNamespace(namespace).endMetadata().withNewSpec().withNewKafka().withReplicas(3).endKafka().withNewZookeeper().withReplicas(3).endZookeeper().withNewEntityOperator().withNewUserOperator().withWatchedNamespace("other-ns").endUserOperator().withNewTopicOperator().withWatchedNamespace("another-ns").endTopicOperator().endEntityOperator().endSpec().build();
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    // Mock the CRD Operator for Kafka resources
    CrdOperator mockKafkaOps = supplier.kafkaOperator;
    when(mockKafkaOps.getAsync(eq(namespace), eq(clusterName))).thenReturn(Future.succeededFuture(kafka));
    when(mockKafkaOps.get(eq(namespace), eq(clusterName))).thenReturn(kafka);
    when(mockKafkaOps.updateStatusAsync(any(), any(Kafka.class))).thenReturn(Future.succeededFuture());
    // Mock the operations for Roles
    RoleOperator mockRoleOps = supplier.roleOperations;
    // Capture the names of reconciled Roles and their patched state
    ArgumentCaptor<String> roleNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<Role> roleCaptor = ArgumentCaptor.forClass(Role.class);
    when(mockRoleOps.reconcile(any(), anyString(), roleNameCaptor.capture(), roleCaptor.capture())).thenReturn(Future.succeededFuture());
    // Mock the operations for RoleBindings
    RoleBindingOperator mockRoleBindingOps = supplier.roleBindingOperations;
    // Capture the names of reconciled RoleBindings and their patched state
    ArgumentCaptor<String> roleBindingNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<RoleBinding> roleBindingCaptor = ArgumentCaptor.forClass(RoleBinding.class);
    when(mockRoleBindingOps.reconcile(any(), anyString(), roleBindingNameCaptor.capture(), roleBindingCaptor.capture())).thenReturn(Future.succeededFuture());
    KafkaAssemblyOperatorRolesSubset kao = new KafkaAssemblyOperatorRolesSubset(vertx, new PlatformFeaturesAvailability(false, kubernetesVersion), certManager, passwordGenerator, supplier, configNamespaceRbacScope);
    Checkpoint async = context.checkpoint();
    kao.reconcile(new Reconciliation("test-trigger", Kafka.RESOURCE_KIND, namespace, clusterName)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> roleBindingNames = roleBindingNameCaptor.getAllValues();
        List<RoleBinding> roleBindings = roleBindingCaptor.getAllValues();
        assertThat(roleBindingNames, hasSize(4));
        assertThat(roleBindings, hasSize(4));
        // Check all RoleBindings, easier to index by order applied
        assertThat(roleBindingNames.get(0), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(0).getMetadata().getNamespace(), is("another-ns"));
        assertThat(roleBindings.get(0), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        assertThat(roleBindingNames.get(1), is("test-instance-entity-topic-operator-role"));
        assertThat(roleBindings.get(1).getMetadata().getNamespace(), is("test-ns"));
        assertThat(roleBindings.get(1), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        assertThat(roleBindingNames.get(2), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(2).getMetadata().getNamespace(), is("other-ns"));
        assertThat(roleBindings.get(2), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        assertThat(roleBindingNames.get(3), is("test-instance-entity-user-operator-role"));
        assertThat(roleBindings.get(3).getMetadata().getNamespace(), is("test-ns"));
        assertThat(roleBindings.get(3), hasRoleRef(new RoleRefBuilder().withApiGroup("rbac.authorization.k8s.io").withKind("Role").withName(EntityOperator.getRoleName(clusterName)).build()));
        List<String> roleNames = roleNameCaptor.getAllValues();
        List<Role> roles = roleCaptor.getAllValues();
        assertThat(roleNames, hasSize(3));
        assertThat(roles, hasSize(3));
        // Check all Roles, easier to index by order applied
        assertThat(roleNames.get(0), is("test-instance-entity-operator"));
        assertThat(roles.get(0).getMetadata().getNamespace(), is("test-ns"));
        assertThat(roleNames.get(1), is("test-instance-entity-operator"));
        assertThat(roles.get(1).getMetadata().getNamespace(), is("other-ns"));
        assertThat(roleNames.get(2), is("test-instance-entity-operator"));
        assertThat(roles.get(2).getMetadata().getNamespace(), is("another-ns"));
        async.flag();
    })));
}
Also used : VertxTestContext(io.vertx.junit5.VertxTestContext) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) ArgumentMatchers.eq(org.mockito.ArgumentMatchers.eq) Role(io.fabric8.kubernetes.api.model.rbac.Role) CertManager(io.strimzi.certs.CertManager) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) TypeSafeDiagnosingMatcher(org.hamcrest.TypeSafeDiagnosingMatcher) AfterAll(org.junit.jupiter.api.AfterAll) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) ArgumentCaptor(org.mockito.ArgumentCaptor) ExtendWith(org.junit.jupiter.api.extension.ExtendWith) KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils) BeforeAll(org.junit.jupiter.api.BeforeAll) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Matchers.hasSize(org.hamcrest.Matchers.hasSize) ResourceUtils(io.strimzi.operator.cluster.ResourceUtils) MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat) Description(org.hamcrest.Description) KubernetesVersion(io.strimzi.operator.KubernetesVersion) KafkaVersion(io.strimzi.operator.cluster.model.KafkaVersion) Vertx(io.vertx.core.Vertx) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Mockito.when(org.mockito.Mockito.when) VertxExtension(io.vertx.junit5.VertxExtension) Future(io.vertx.core.Future) Mockito.verify(org.mockito.Mockito.verify) Test(org.junit.jupiter.api.Test) RoleRef(io.fabric8.kubernetes.api.model.rbac.RoleRef) Reconciliation(io.strimzi.operator.common.Reconciliation) List(java.util.List) Mockito.never(org.mockito.Mockito.never) PasswordGenerator(io.strimzi.operator.common.PasswordGenerator) Matcher(org.hamcrest.Matcher) Checkpoint(io.vertx.junit5.Checkpoint) Matchers.is(org.hamcrest.Matchers.is) EntityOperator(io.strimzi.operator.cluster.model.EntityOperator) Kafka(io.strimzi.api.kafka.model.Kafka) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) ClusterOperatorConfig(io.strimzi.operator.cluster.ClusterOperatorConfig) MockCertManager(io.strimzi.operator.common.operator.MockCertManager) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Kafka(io.strimzi.api.kafka.model.Kafka) KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder) RoleOperator(io.strimzi.operator.common.operator.resource.RoleOperator) ArgumentMatchers.anyString(org.mockito.ArgumentMatchers.anyString) Role(io.fabric8.kubernetes.api.model.rbac.Role) ResourceOperatorSupplier(io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier) Checkpoint(io.vertx.junit5.Checkpoint) PlatformFeaturesAvailability(io.strimzi.operator.PlatformFeaturesAvailability) CrdOperator(io.strimzi.operator.common.operator.resource.CrdOperator) Reconciliation(io.strimzi.operator.common.Reconciliation) RoleBinding(io.fabric8.kubernetes.api.model.rbac.RoleBinding) RoleBindingOperator(io.strimzi.operator.common.operator.resource.RoleBindingOperator) RoleRefBuilder(io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder) Test(org.junit.jupiter.api.Test)

Aggregations

Role (io.fabric8.kubernetes.api.model.rbac.Role)6 RoleBinding (io.fabric8.kubernetes.api.model.rbac.RoleBinding)6 RoleRef (io.fabric8.kubernetes.api.model.rbac.RoleRef)6 RoleRefBuilder (io.fabric8.kubernetes.api.model.rbac.RoleRefBuilder)6 Kafka (io.strimzi.api.kafka.model.Kafka)6 KafkaBuilder (io.strimzi.api.kafka.model.KafkaBuilder)6 CertManager (io.strimzi.certs.CertManager)6 KubernetesVersion (io.strimzi.operator.KubernetesVersion)6 PlatformFeaturesAvailability (io.strimzi.operator.PlatformFeaturesAvailability)6 ClusterOperatorConfig (io.strimzi.operator.cluster.ClusterOperatorConfig)6 KafkaVersionTestUtils (io.strimzi.operator.cluster.KafkaVersionTestUtils)6 ResourceUtils (io.strimzi.operator.cluster.ResourceUtils)6 EntityOperator (io.strimzi.operator.cluster.model.EntityOperator)6 KafkaVersion (io.strimzi.operator.cluster.model.KafkaVersion)6 ResourceOperatorSupplier (io.strimzi.operator.cluster.operator.resource.ResourceOperatorSupplier)6 PasswordGenerator (io.strimzi.operator.common.PasswordGenerator)6 Reconciliation (io.strimzi.operator.common.Reconciliation)6 MockCertManager (io.strimzi.operator.common.operator.MockCertManager)6 CrdOperator (io.strimzi.operator.common.operator.resource.CrdOperator)6 RoleBindingOperator (io.strimzi.operator.common.operator.resource.RoleBindingOperator)6