Skip to content

Commit 12b4841

Browse files
lucian-tosalucian-tosa
committed
Test webhook validations
1 parent 003aa9c commit 12b4841

File tree

3 files changed

+176
-161
lines changed

3 files changed

+176
-161
lines changed

‎docker/mongodb-kubernetes-tests/tests/mixed/crd_validation.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ def test_mongodbmulti_crd_is_valid(crd_api: ApiextensionsV1Api):
3838
resource = crd_api.read_custom_resource_definition("mongodbmulticluster.mongodb.com")
3939
assert crd_has_expected_conditions(resource)
4040

41+
4142
@mark.e2e_crd_validation
4243
def test_clustermongodbrole_crd_is_valid(crd_api: ApiextensionsV1Api):
4344
resource = crd_api.read_custom_resource_definition("clustermongodbrole.mongodb.com")

‎docker/mongodb-kubernetes-tests/tests/webhooks/e2e_mongodb_roles_validation_webhook.py‎

Lines changed: 165 additions & 161 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
from kubernetes.client.rest import ApiException
44
from kubetester.kubetester import fixture as yaml_fixture
55
from kubetester.mongodb import MongoDB
6+
from kubetester.mongodb_role import ClusterMongoDBRole
67
from kubetester.operator import Operator
78
from pytest import fixture
89

@@ -14,200 +15,186 @@ def mdb(namespace: str, custom_mdb_version: str) -> MongoDB:
1415
return resource
1516

1617

18+
@fixture(scope="function")
19+
def mdbr() -> ClusterMongoDBRole:
20+
resource = ClusterMongoDBRole.from_yaml(
21+
yaml_fixture("cluster_mongodb_role_base.yaml"), namespace="", cluster_scoped=True
22+
)
23+
return resource
24+
25+
1726
@pytest.mark.e2e_mongodb_roles_validation_webhook
1827
def test_wait_for_webhook(namespace: str, default_operator: Operator):
1928
default_operator.wait_for_webhook()
2029

2130

2231
# Basic testing for invalid empty values
2332
@pytest.mark.e2e_mongodb_roles_validation_webhook
24-
def test_empty_role_name(mdb: MongoDB):
25-
mdb["spec"]["security"]["roles"] = [
26-
{
27-
"role": "",
28-
"db": "admin",
29-
"privileges": [
30-
{
31-
"actions": ["insert"],
32-
"resource": {"collection": "foo", "db": "admin"},
33-
}
34-
],
35-
}
36-
]
37-
with pytest.raises(
38-
client.rest.ApiException,
39-
match="Error validating role - Cannot create a role with an empty name",
40-
):
41-
mdb.create()
33+
def test_empty_role_name(mdb: MongoDB, mdbr: ClusterMongoDBRole):
34+
role = {
35+
"role": "",
36+
"db": "admin",
37+
"privileges": [
38+
{
39+
"actions": ["insert"],
40+
"resource": {"collection": "foo", "db": "admin"},
41+
}
42+
],
43+
}
44+
45+
err_msg = "Error validating role - Cannot create a role with an empty name"
46+
47+
_assert_role_error(mdb, mdbr, role, err_msg)
4248

4349

4450
@pytest.mark.e2e_mongodb_roles_validation_webhook
45-
def test_empty_db_name(mdb: MongoDB):
46-
mdb["spec"]["security"]["roles"] = [
47-
{
48-
"role": "role",
49-
"db": "",
50-
"privileges": [
51-
{
52-
"actions": ["insert"],
53-
"resource": {"collection": "foo", "db": "admin"},
54-
}
55-
],
56-
}
57-
]
58-
with pytest.raises(
59-
client.rest.ApiException,
60-
match="Error validating role - Cannot create a role with an empty db",
61-
):
62-
mdb.create()
51+
def test_empty_db_name(mdb: MongoDB, mdbr: ClusterMongoDBRole):
52+
role = {
53+
"role": "role",
54+
"db": "",
55+
"privileges": [
56+
{
57+
"actions": ["insert"],
58+
"resource": {"collection": "foo", "db": "admin"},
59+
}
60+
],
61+
}
62+
63+
err_msg = "Error validating role - Cannot create a role with an empty db"
64+
65+
_assert_role_error(mdb, mdbr, role, err_msg)
6366

6467

6568
@pytest.mark.e2e_mongodb_roles_validation_webhook
66-
def test_inherited_role_empty_name(mdb: MongoDB):
67-
mdb["spec"]["security"]["roles"] = [
68-
{
69-
"role": "role",
70-
"db": "admin",
71-
"privileges": [
72-
{
73-
"actions": ["insert"],
74-
"resource": {"collection": "foo", "db": "admin"},
75-
}
76-
],
77-
"roles": [{"db": "admin", "role": ""}],
78-
}
79-
]
80-
with pytest.raises(
81-
client.rest.ApiException,
82-
match="Error validating role - Cannot inherit from a role with an empty name",
83-
):
84-
mdb.create()
69+
def test_inherited_role_empty_name(mdb: MongoDB, mdbr: ClusterMongoDBRole):
70+
role = {
71+
"role": "role",
72+
"db": "admin",
73+
"privileges": [
74+
{
75+
"actions": ["insert"],
76+
"resource": {"collection": "foo", "db": "admin"},
77+
}
78+
],
79+
"roles": [{"db": "admin", "role": ""}],
80+
}
81+
82+
err_msg = "Error validating role - Cannot inherit from a role with an empty name"
83+
84+
_assert_role_error(mdb, mdbr, role, err_msg)
8585

8686

8787
@pytest.mark.e2e_mongodb_roles_validation_webhook
88-
def test_inherited_role_empty_db(mdb: MongoDB):
89-
mdb["spec"]["security"]["roles"] = [
90-
{
91-
"role": "role",
92-
"db": "admin",
93-
"privileges": [
94-
{
95-
"actions": ["insert"],
96-
"resource": {"collection": "foo", "db": "admin"},
97-
}
98-
],
99-
"roles": [{"db": "", "role": "role"}],
100-
}
101-
]
102-
with pytest.raises(
103-
client.rest.ApiException,
104-
match="Error validating role - Cannot inherit from a role with an empty db",
105-
):
106-
mdb.create()
88+
def test_inherited_role_empty_db(mdb: MongoDB, mdbr: ClusterMongoDBRole):
89+
role = {
90+
"role": "role",
91+
"db": "admin",
92+
"privileges": [
93+
{
94+
"actions": ["insert"],
95+
"resource": {"collection": "foo", "db": "admin"},
96+
}
97+
],
98+
"roles": [{"db": "", "role": "role"}],
99+
}
100+
101+
err_msg = "Error validating role - Cannot inherit from a role with an empty db"
102+
103+
_assert_role_error(mdb, mdbr, role, err_msg)
107104

108105

109106
# Testing for invalid authentication Restrictions
110107
@pytest.mark.e2e_mongodb_roles_validation_webhook
111-
def test_invalid_client_source(mdb: MongoDB):
112-
mdb["spec"]["security"]["roles"] = [
113-
{
114-
"role": "role",
115-
"db": "admin",
116-
"privileges": [
117-
{
118-
"actions": ["insert"],
119-
"resource": {"collection": "foo", "db": "admin"},
120-
}
121-
],
122-
"authenticationRestrictions": [{"clientSource": ["355.127.0.1"]}],
123-
}
124-
]
125-
with pytest.raises(
126-
client.rest.ApiException,
127-
match="Error validating role - AuthenticationRestriction is invalid - clientSource 355.127.0.1 is neither a valid IP address nor a valid CIDR range",
128-
):
129-
mdb.create()
108+
def test_invalid_client_source(mdb: MongoDB, mdbr: ClusterMongoDBRole):
109+
role = {
110+
"role": "role",
111+
"db": "admin",
112+
"privileges": [
113+
{
114+
"actions": ["insert"],
115+
"resource": {"collection": "foo", "db": "admin"},
116+
}
117+
],
118+
"authenticationRestrictions": [{"clientSource": ["355.127.0.1"]}],
119+
}
120+
121+
err_msg = "Error validating role - AuthenticationRestriction is invalid - clientSource 355.127.0.1 is neither a valid IP address nor a valid CIDR range"
122+
123+
_assert_role_error(mdb, mdbr, role, err_msg)
130124

131125

132126
@pytest.mark.e2e_mongodb_roles_validation_webhook
133-
def test_invalid_server_address(mdb: MongoDB):
134-
mdb["spec"]["security"]["roles"] = [
135-
{
136-
"role": "role",
137-
"db": "admin",
138-
"privileges": [
139-
{
140-
"actions": ["insert"],
141-
"resource": {"collection": "foo", "db": "admin"},
142-
}
143-
],
144-
"authenticationRestrictions": [{"serverAddress": ["355.127.0.1"]}],
145-
}
146-
]
147-
with pytest.raises(
148-
client.rest.ApiException,
149-
match="Error validating role - AuthenticationRestriction is invalid - serverAddress 355.127.0.1 is neither a valid IP address nor a valid CIDR range",
150-
):
151-
mdb.create()
127+
def test_invalid_server_address(mdb: MongoDB, mdbr: ClusterMongoDBRole):
128+
role = {
129+
"role": "role",
130+
"db": "admin",
131+
"privileges": [
132+
{
133+
"actions": ["insert"],
134+
"resource": {"collection": "foo", "db": "admin"},
135+
}
136+
],
137+
"authenticationRestrictions": [{"serverAddress": ["355.127.0.1"]}],
138+
}
139+
140+
err_msg = "Error validating role - AuthenticationRestriction is invalid - serverAddress 355.127.0.1 is neither a valid IP address nor a valid CIDR range"
141+
142+
_assert_role_error(mdb, mdbr, role, err_msg)
152143

153144

154145
# Testing for invalid privileges
155146
@pytest.mark.e2e_mongodb_roles_validation_webhook
156-
def test_invalid_cluster_and_db_collection(mdb: MongoDB):
157-
mdb["spec"]["security"]["roles"] = [
158-
{
159-
"role": "role",
160-
"db": "admin",
161-
"privileges": [
162-
{
163-
"actions": ["insert"],
164-
"resource": {"collection": "foo", "db": "admin", "cluster": True},
165-
}
166-
],
167-
}
168-
]
169-
with pytest.raises(
170-
client.rest.ApiException,
171-
match="Error validating role - Privilege is invalid - Cluster: true is not compatible with setting db/collection",
172-
):
173-
mdb.create()
147+
def test_invalid_cluster_and_db_collection(mdb: MongoDB, mdbr: ClusterMongoDBRole):
148+
role = {
149+
"role": "role",
150+
"db": "admin",
151+
"privileges": [
152+
{
153+
"actions": ["insert"],
154+
"resource": {"collection": "foo", "db": "admin", "cluster": True},
155+
}
156+
],
157+
}
158+
159+
err_msg = (
160+
"Error validating role - Privilege is invalid - Cluster: true is not compatible with setting db/collection"
161+
)
162+
163+
_assert_role_error(mdb, mdbr, role, err_msg)
174164

175165

176166
@pytest.mark.e2e_mongodb_roles_validation_webhook
177-
def test_invalid_cluster_not_true(mdb: MongoDB):
178-
mdb["spec"]["security"]["roles"] = [
179-
{
180-
"role": "role",
181-
"db": "admin",
182-
"privileges": [{"actions": ["insert"], "resource": {"cluster": False}}],
183-
}
184-
]
185-
with pytest.raises(
186-
client.rest.ApiException,
187-
match="Error validating role - Privilege is invalid - The only valid value for privilege.cluster, if set, is true",
188-
):
189-
mdb.create()
167+
def test_invalid_cluster_not_true(mdb: MongoDB, mdbr: ClusterMongoDBRole):
168+
role = {
169+
"role": "role",
170+
"db": "admin",
171+
"privileges": [{"actions": ["insert"], "resource": {"cluster": False}}],
172+
}
173+
174+
err_msg = (
175+
"Error validating role - Privilege is invalid - The only valid value for privilege.cluster, if set, is true"
176+
)
177+
178+
_assert_role_error(mdb, mdbr, role, err_msg)
190179

191180

192181
@pytest.mark.e2e_mongodb_roles_validation_webhook
193-
def test_invalid_action(mdb: MongoDB):
194-
mdb["spec"]["security"]["roles"] = [
195-
{
196-
"role": "role",
197-
"db": "admin",
198-
"privileges": [
199-
{
200-
"actions": ["insertFoo"],
201-
"resource": {"collection": "foo", "db": "admin"},
202-
}
203-
],
204-
}
205-
]
206-
with pytest.raises(
207-
client.rest.ApiException,
208-
match="Error validating role - Privilege is invalid - Actions are not valid - insertFoo is not a valid db action",
209-
):
210-
mdb.create()
182+
def test_invalid_action(mdb: MongoDB, mdbr: ClusterMongoDBRole):
183+
role = {
184+
"role": "role",
185+
"db": "admin",
186+
"privileges": [
187+
{
188+
"actions": ["insertFoo"],
189+
"resource": {"collection": "foo", "db": "admin"},
190+
}
191+
],
192+
}
193+
err_msg = (
194+
"Error validating role - Privilege is invalid - Actions are not valid - insertFoo is not a valid db action"
195+
)
196+
197+
_assert_role_error(mdb, mdbr, role, err_msg)
211198

212199

213200
@pytest.mark.e2e_mongodb_roles_validation_webhook
@@ -235,3 +222,20 @@ def test_roles_and_role_refs(mdb: MongoDB):
235222
match="At most one of roles or roleRefs can be non-empty",
236223
):
237224
mdb.create()
225+
226+
227+
def _assert_role_error(mdb: MongoDB, mdbr: ClusterMongoDBRole, role, err_msg):
228+
mdb["spec"]["security"]["roles"] = [role]
229+
230+
with pytest.raises(
231+
client.rest.ApiException,
232+
match=err_msg,
233+
):
234+
mdb.create()
235+
236+
mdbr["spec"] = role
237+
with pytest.raises(
238+
client.rest.ApiException,
239+
match=err_msg,
240+
):
241+
mdbr.create()

‎docker/mongodb-kubernetes-tests/tests/webhooks/fixtures/cluster_mongodb_role_base.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: mongodb.com/v1
2+
kind: ClusterMongoDBRole
3+
metadata:
4+
name: test-customrole
5+
spec:
6+
role: ""
7+
db: ""
8+
roles: []
9+
privileges: []
10+
authenticationRestrictions: []

0 commit comments

Comments
 (0)