Examples with WorkspaceServiceAccountConfigurator org.eclipse.che.workspace.infrastructure.kubernetes.namespace.configurator.WorkspaceServiceAccountConfigurator used on opensource projects

Example 1 with WorkspaceServiceAccountConfigurator

use of org.eclipse.che.workspace.infrastructure.kubernetes.namespace.configurator.WorkspaceServiceAccountConfigurator in project che-server by eclipse-che.

the class KubernetesNamespaceFactoryTest method shouldPrepareWorkspaceServiceAccountIfItIsConfiguredAndNamespaceIsNotPredefined.

@Test
public void shouldPrepareWorkspaceServiceAccountIfItIsConfiguredAndNamespaceIsNotPredefined() throws Exception {
    // given
    var serviceAccountCfg = spy(new WorkspaceServiceAccountConfigurator("serviceAccount", "", clientFactory));
    namespaceFactory = spy(new KubernetesNamespaceFactory("<username>-che", true, true, true, NAMESPACE_LABELS, NAMESPACE_ANNOTATIONS, Set.of(serviceAccountCfg), clientFactory, cheClientFactory, userManager, preferenceManager, pool));
    KubernetesNamespace toReturnNamespace = mock(KubernetesNamespace.class);
    prepareNamespace(toReturnNamespace);
    when(toReturnNamespace.getName()).thenReturn("workspace123");
    doReturn(toReturnNamespace).when(namespaceFactory).doCreateNamespaceAccess(any(), any());
    KubernetesWorkspaceServiceAccount serviceAccount = mock(KubernetesWorkspaceServiceAccount.class);
    doReturn(serviceAccount).when(serviceAccountCfg).doCreateServiceAccount(any(), any());
    // when
    RuntimeIdentity identity = new RuntimeIdentityImpl("workspace123", null, USER_ID, "workspace123");
    namespaceFactory.getOrCreate(identity);
    // then
    verify(serviceAccountCfg).doCreateServiceAccount("workspace123", "workspace123");
    verify(serviceAccount).prepare();
}

Example 2 with WorkspaceServiceAccountConfigurator

use of org.eclipse.che.workspace.infrastructure.kubernetes.namespace.configurator.WorkspaceServiceAccountConfigurator in project che-server by eclipse-che.

the class KubernetesNamespaceFactoryTest method shouldBindToAllConfiguredClusterRoles.

@Test
public void shouldBindToAllConfiguredClusterRoles() throws Exception {
    // given
    var serviceAccountConfigurator = new WorkspaceServiceAccountConfigurator("serviceAccount", "cr2, cr3", clientFactory);
    namespaceFactory = spy(new KubernetesNamespaceFactory("<username>-che", true, true, true, NAMESPACE_LABELS, NAMESPACE_ANNOTATIONS, Set.of(serviceAccountConfigurator), clientFactory, cheClientFactory, userManager, preferenceManager, pool));
    KubernetesNamespace toReturnNamespace = mock(KubernetesNamespace.class);
    prepareNamespace(toReturnNamespace);
    when(toReturnNamespace.getName()).thenReturn("workspace123");
    doReturn(toReturnNamespace).when(namespaceFactory).doCreateNamespaceAccess(any(), any());
    when(k8sClient.supportsApiPath(eq("/apis/metrics.k8s.io"))).thenReturn(true);
    when(cheClientFactory.create()).thenReturn(k8sClient);
    when(clientFactory.create(any())).thenReturn(k8sClient);
    // pre-create the cluster roles
    Stream.of("cr1", "cr2", "cr3").forEach(cr -> k8sClient.rbac().clusterRoles().createOrReplace(new ClusterRoleBuilder().withNewMetadata().withName(cr).endMetadata().build()));
    // when
    RuntimeIdentity identity = new RuntimeIdentityImpl("workspace123", null, USER_ID, "workspace123");
    namespaceFactory.getOrCreate(identity);
    // then
    ServiceAccountList sas = k8sClient.serviceAccounts().inNamespace("workspace123").list();
    assertEquals(sas.getItems().size(), 1);
    assertEquals(sas.getItems().get(0).getMetadata().getName(), "serviceAccount");
    RoleList roles = k8sClient.rbac().roles().inNamespace("workspace123").list();
    assertEquals(roles.getItems().stream().map(r -> r.getMetadata().getName()).collect(Collectors.toSet()), Sets.newHashSet("workspace-configmaps", "workspace-view", "workspace-metrics", "workspace-secrets", "exec"));
    RoleBindingList bindings = k8sClient.rbac().roleBindings().inNamespace("workspace123").list();
    assertEquals(bindings.getItems().stream().map(r -> r.getMetadata().getName()).collect(Collectors.toSet()), Sets.newHashSet("serviceAccount-metrics", "serviceAccount-cluster0", "serviceAccount-cluster1", "serviceAccount-configmaps", "serviceAccount-view", "serviceAccount-exec", "serviceAccount-secrets"));
}

Example 3 with WorkspaceServiceAccountConfigurator

use of org.eclipse.che.workspace.infrastructure.kubernetes.namespace.configurator.WorkspaceServiceAccountConfigurator in project che-server by eclipse-che.

the class KubernetesNamespaceFactoryTest method shouldCreateAndBindCredentialsSecretRole.

@Test
public void shouldCreateAndBindCredentialsSecretRole() throws Exception {
    // given
    var serviceAccountConfigurator = new WorkspaceServiceAccountConfigurator("serviceAccount", "cr2, cr3", clientFactory);
    namespaceFactory = spy(new KubernetesNamespaceFactory("<username>-che", true, true, true, NAMESPACE_LABELS, NAMESPACE_ANNOTATIONS, Set.of(serviceAccountConfigurator), clientFactory, cheClientFactory, userManager, preferenceManager, pool));
    KubernetesNamespace toReturnNamespace = mock(KubernetesNamespace.class);
    prepareNamespace(toReturnNamespace);
    when(toReturnNamespace.getName()).thenReturn("workspace123");
    doReturn(toReturnNamespace).when(namespaceFactory).doCreateNamespaceAccess(any(), any());
    when(clientFactory.create(any())).thenReturn(k8sClient);
    when(cheClientFactory.create()).thenReturn(k8sClient);
    // when
    RuntimeIdentity identity = new RuntimeIdentityImpl("workspace123", null, USER_ID, "workspace123");
    namespaceFactory.getOrCreate(identity);
    // then
    Optional<Role> roleOptional = k8sClient.rbac().roles().inNamespace("workspace123").list().getItems().stream().filter(r -> r.getMetadata().getName().equals(SECRETS_ROLE_NAME)).findAny();
    assertTrue(roleOptional.isPresent());
    PolicyRule rule = roleOptional.get().getRules().get(0);
    assertEquals(rule.getResources(), singletonList("secrets"));
    assertEquals(rule.getResourceNames(), singletonList(CREDENTIALS_SECRET_NAME));
    assertEquals(rule.getApiGroups(), singletonList(""));
    assertEquals(rule.getVerbs(), Arrays.asList("get", "patch"));
    assertTrue(k8sClient.rbac().roleBindings().inNamespace("workspace123").list().getItems().stream().anyMatch(rb -> rb.getMetadata().getName().equals("serviceAccount-secrets")));
}

Example 4 with WorkspaceServiceAccountConfigurator

use of org.eclipse.che.workspace.infrastructure.kubernetes.namespace.configurator.WorkspaceServiceAccountConfigurator in project devspaces-images by redhat-developer.

the class KubernetesNamespaceFactoryTest method shouldCreateExecAndViewRolesAndBindings.

@Test
public void shouldCreateExecAndViewRolesAndBindings() throws Exception {
    // given
    namespaceFactory = spy(new KubernetesNamespaceFactory("<username>-che", true, true, true, NAMESPACE_LABELS, NAMESPACE_ANNOTATIONS, Set.of(new WorkspaceServiceAccountConfigurator("serviceAccount", "", clientFactory)), clientFactory, cheClientFactory, userManager, preferenceManager, pool));
    KubernetesNamespace toReturnNamespace = mock(KubernetesNamespace.class);
    prepareNamespace(toReturnNamespace);
    when(toReturnNamespace.getName()).thenReturn("workspace123");
    doReturn(toReturnNamespace).when(namespaceFactory).doCreateNamespaceAccess(any(), any());
    when(k8sClient.supportsApiPath(eq("/apis/metrics.k8s.io"))).thenReturn(true);
    when(clientFactory.create(any())).thenReturn(k8sClient);
    when(cheClientFactory.create()).thenReturn(k8sClient);
    // when
    RuntimeIdentity identity = new RuntimeIdentityImpl("workspace123", null, USER_ID, "workspace123");
    namespaceFactory.getOrCreate(identity);
    // then
    ServiceAccountList sas = k8sClient.serviceAccounts().inNamespace("workspace123").list();
    assertEquals(sas.getItems().size(), 1);
    assertEquals(sas.getItems().get(0).getMetadata().getName(), "serviceAccount");
    RoleList roles = k8sClient.rbac().roles().inNamespace("workspace123").list();
    assertEquals(roles.getItems().stream().map(r -> r.getMetadata().getName()).collect(Collectors.toSet()), Sets.newHashSet("workspace-configmaps", "workspace-view", "workspace-metrics", "workspace-secrets", "exec"));
    Role role1 = roles.getItems().get(0);
    Role role2 = roles.getItems().get(1);
    assertFalse(role1.getRules().containsAll(role2.getRules()) && role2.getRules().containsAll(role1.getRules()), "exec and view roles should not be the same");
    RoleBindingList bindings = k8sClient.rbac().roleBindings().inNamespace("workspace123").list();
    assertEquals(bindings.getItems().stream().map(r -> r.getMetadata().getName()).collect(Collectors.toSet()), Sets.newHashSet("serviceAccount-metrics", "serviceAccount-view", "serviceAccount-exec", "serviceAccount-configmaps", "serviceAccount-secrets"));
}

Example 5 with WorkspaceServiceAccountConfigurator

use of org.eclipse.che.workspace.infrastructure.kubernetes.namespace.configurator.WorkspaceServiceAccountConfigurator in project devspaces-images by redhat-developer.

the class KubernetesNamespaceFactoryTest method shouldCreateAndBindCredentialsSecretRole.

@Test
public void shouldCreateAndBindCredentialsSecretRole() throws Exception {
    // given
    var serviceAccountConfigurator = new WorkspaceServiceAccountConfigurator("serviceAccount", "cr2, cr3", clientFactory);
    namespaceFactory = spy(new KubernetesNamespaceFactory("<username>-che", true, true, true, NAMESPACE_LABELS, NAMESPACE_ANNOTATIONS, Set.of(serviceAccountConfigurator), clientFactory, cheClientFactory, userManager, preferenceManager, pool));
    KubernetesNamespace toReturnNamespace = mock(KubernetesNamespace.class);
    prepareNamespace(toReturnNamespace);
    when(toReturnNamespace.getName()).thenReturn("workspace123");
    doReturn(toReturnNamespace).when(namespaceFactory).doCreateNamespaceAccess(any(), any());
    when(clientFactory.create(any())).thenReturn(k8sClient);
    when(cheClientFactory.create()).thenReturn(k8sClient);
    // when
    RuntimeIdentity identity = new RuntimeIdentityImpl("workspace123", null, USER_ID, "workspace123");
    namespaceFactory.getOrCreate(identity);
    // then
    Optional<Role> roleOptional = k8sClient.rbac().roles().inNamespace("workspace123").list().getItems().stream().filter(r -> r.getMetadata().getName().equals(SECRETS_ROLE_NAME)).findAny();
    assertTrue(roleOptional.isPresent());
    PolicyRule rule = roleOptional.get().getRules().get(0);
    assertEquals(rule.getResources(), singletonList("secrets"));
    assertEquals(rule.getResourceNames(), singletonList(CREDENTIALS_SECRET_NAME));
    assertEquals(rule.getApiGroups(), singletonList(""));
    assertEquals(rule.getVerbs(), Arrays.asList("get", "patch"));
    assertTrue(k8sClient.rbac().roleBindings().inNamespace("workspace123").list().getItems().stream().anyMatch(rb -> rb.getMetadata().getName().equals("serviceAccount-secrets")));
}