-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add validating webhook for private key retrieval option (#68)
- Add e2e tests - Add webhook test
- Loading branch information
1 parent
c219192
commit 293d154
Showing
53 changed files
with
1,608 additions
and
126 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| name: E2E Tests | ||
|
|
||
| # Trigger the workflow on pull requests and direct pushes to any branch | ||
| on: | ||
| push: | ||
| pull_request: | ||
|
|
||
| jobs: | ||
| test: | ||
| name: ${{ matrix.os }} | ||
| runs-on: ${{ matrix.os }} | ||
| strategy: | ||
| matrix: | ||
| os: | ||
| - ubuntu-latest | ||
| - macos-latest | ||
| # Pull requests from the same repository won't trigger this checks as they were already triggered by the push | ||
| if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository) | ||
| steps: | ||
| - name: Clone the code | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: '~1.22' | ||
| - name: Install Helm and Kubectl | ||
| if: matrix.os == 'macos-latest' | ||
| run: | | ||
| brew install helm | ||
| brew install kubectl | ||
| - name: Setup Minikube cluster | ||
| if: matrix.os != 'macos-latest' | ||
| uses: medyagh/setup-minikube@latest | ||
| # This step is needed as the following one tries to remove | ||
| # kustomize for each test but has no permission to do so | ||
| - name: Remove pre-installed kustomize | ||
| if: matrix.os != 'macos-latest' | ||
| run: sudo rm -f /usr/local/bin/kustomize | ||
| - name: Perform the E2E test | ||
| if: matrix.os != 'macos-latest' | ||
| run: | | ||
| chmod -R +x scripts | ||
| export "GITHUB_PRIVATE_KEY=${{ secrets.GH_TEST_APP_PK }}" | ||
| export "GH_APP_ID=${{ secrets.GH_APP_ID }}" | ||
| export "GH_INSTALL_ID=${{ secrets.GH_INSTALL_ID }}" | ||
| export "VAULT_ADDR=http://vault.default:8200" | ||
| export "VAULT_ROLE_AUDIENCE=githubapp" | ||
| export "VAULT_ROLE=githubapp" | ||
| eval $(minikube docker-env) | ||
| # Run tests | ||
| make test-e2e || true | ||
| # debug | ||
| #docker images | ||
| #kubectl -n github-app-operator-system describe po | ||
| #kubectl -n github-app-operator-system describe deploy | ||
| #echo 'kubectl get mutatingwebhookconfiguration cert-manager-webhook -o jsonpath={.webhooks[*].clientConfig.caBundle}' | ||
| #kubectl get mutatingwebhookconfiguration cert-manager-webhook -o jsonpath={.webhooks[*].clientConfig.caBundle} | ||
| #kubectl -n cert-manager describe deploy,po | ||
| #echo "######### gh operator logs ##########" | ||
| #kubectl -n github-app-operator-system logs deploy/github-app-operator-controller-manager | ||
| #echo "######### cert-manager-webhook logs ##########" | ||
| #kubectl -n cert-manager logs deploy/cert-manager-webhook | ||
| - name: Report failure | ||
| uses: nashmaniac/[email protected] | ||
| # Only report failures of pushes (PRs have are visible through the Checks section) to the default branch | ||
| if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| with: | ||
| title: 🐛 Unit tests failed on ${{ matrix.os }} for ${{ github.sha }} | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| labels: kind/bug | ||
| body: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
|
|
||
| # Image URL to use all building/pushing image targets | ||
| IMG ?= controller:latest | ||
| IMG ?= samirtahir91076/github-app-operator:latest | ||
| # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary. | ||
| ENVTEST_K8S_VERSION = 1.29.0 | ||
|
|
||
|
|
@@ -62,7 +62,11 @@ vet: ## Run go vet against code. | |
|
|
||
| .PHONY: test | ||
| test: manifests generate fmt vet envtest ## Run tests. | ||
| KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v -E '/e2e|v1|utils|cmd|test_helpers|vault') -coverprofile cover.out | ||
| KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v -E '/e2e|v1|utils|cmd|test_helpers|vault') -v -ginkgo.v -coverprofile cover.out | ||
|
|
||
| .PHONY: test-webhooks | ||
| test-webhooks: manifests generate fmt vet envtest ## Run tests. | ||
| KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./api/v1/ -v -ginkgo.v -coverprofile cover.out | ||
|
|
||
| # Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors. | ||
| .PHONY: test-e2e # Run the e2e tests against a Kind k8s instance that is spun up. | ||
|
|
@@ -194,10 +198,11 @@ HELMIFY ?= $(LOCALBIN)/helmify | |
| .PHONY: helmify | ||
| helmify: $(HELMIFY) ## Download helmify locally if necessary. | ||
| $(HELMIFY): $(LOCALBIN) | ||
| test -s $(LOCALBIN)/helmify || GOBIN=$(LOCALBIN) go install github.com/arttor/helmify/cmd/[email protected].5 | ||
| test -s $(LOCALBIN)/helmify || GOBIN=$(LOCALBIN) go install github.com/arttor/helmify/cmd/[email protected].14 | ||
|
|
||
| helm: manifests kustomize helmify | ||
| $(KUSTOMIZE) build config/default | $(HELMIFY) charts/github-app-operator | ||
| cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG} | ||
| $(KUSTOMIZE) build config/default | $(HELMIFY) -cert-manager-as-subchart charts/github-app-operator | ||
| ################################## | ||
|
|
||
| # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| /* | ||
| Copyright 2024. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package v1 | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "k8s.io/apimachinery/pkg/runtime" | ||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| logf "sigs.k8s.io/controller-runtime/pkg/log" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook" | ||
| "sigs.k8s.io/controller-runtime/pkg/webhook/admission" | ||
| ) | ||
|
|
||
| // log is for logging in this package. | ||
| var githubapplog = logf.Log.WithName("githubapp-resource") | ||
|
|
||
| // SetupWebhookWithManager will setup the manager to manage the webhooks | ||
| func (r *GithubApp) SetupWebhookWithManager(mgr ctrl.Manager) error { | ||
| return ctrl.NewWebhookManagedBy(mgr). | ||
| For(r). | ||
| Complete() | ||
| } | ||
|
|
||
| // TODO(user): EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! | ||
|
|
||
| // TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation. | ||
| // NOTE: The 'path' attribute must follow a specific pattern and should not be modified directly here. | ||
| // Modifying the path for an invalid path can cause API server errors; failing to locate the webhook. | ||
| // +kubebuilder:webhook:path=/validate-githubapp-samir-io-v1-githubapp,mutating=false,failurePolicy=fail,sideEffects=None,groups=githubapp.samir.io,resources=githubapps,verbs=create;update,versions=v1,name=vgithubapp.kb.io,admissionReviewVersions=v1 | ||
|
|
||
| var _ webhook.Validator = &GithubApp{} | ||
|
|
||
| // ValidateCreate implements webhook.Validator so a webhook will be registered for the type | ||
| func (r *GithubApp) ValidateCreate() (admission.Warnings, error) { | ||
| githubapplog.Info("validate create", "name", r.Name) | ||
|
|
||
| // Ensure only one of googlePrivateKeySecret, privateKeySecret, or vaultPrivateKey is specified | ||
| err := validateGithubAppSpec(r) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return nil, nil | ||
| } | ||
|
|
||
| // ValidateUpdate implements webhook.Validator so a webhook will be registered for the type | ||
| func (r *GithubApp) ValidateUpdate(old runtime.Object) (admission.Warnings, error) { | ||
| githubapplog.Info("validate update", "name", r.Name) | ||
|
|
||
| // Ensure only one of googlePrivateKeySecret, privateKeySecret, or vaultPrivateKey is specified | ||
| err := validateGithubAppSpec(r) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return nil, nil | ||
| } | ||
|
|
||
| // ValidateDelete implements webhook.Validator so a webhook will be registered for the type | ||
| func (r *GithubApp) ValidateDelete() (admission.Warnings, error) { | ||
| githubapplog.Info("validate delete", "name", r.Name) | ||
|
|
||
| // TODO(user): fill in your validation logic upon object deletion. | ||
| return nil, nil | ||
| } | ||
|
|
||
| // validateGithubAppSpec validates that only one of googlePrivateKeySecret, privateKeySecret, or vaultPrivateKey is specified | ||
| func validateGithubAppSpec(r *GithubApp) error { | ||
| count := 0 | ||
|
|
||
| if r.Spec.GcpPrivateKeySecret != "" { | ||
| count++ | ||
| } | ||
| if r.Spec.PrivateKeySecret != "" { | ||
| count++ | ||
| } | ||
| if r.Spec.VaultPrivateKey != nil { | ||
| count++ | ||
| } | ||
|
|
||
| if count != 1 { | ||
| return fmt.Errorf("exactly one of googlePrivateKeySecret, privateKeySecret, or vaultPrivateKey must be specified") | ||
| } | ||
|
|
||
| return nil | ||
| } |
Oops, something went wrong.