E2E testing

Author: lucian-tosa

.evergreen-tasks.yml

@@ -254,6 +254,11 @@ tasks:
     commands:
       - func: "e2e_test"
 
+  - name: e2e_mongodb_custom_roles
+    tags: [ "patch-run" ]
+    commands:
+      - func: "e2e_test"
+
   - name: e2e_replica_set_recovery
     tags: [ "patch-run" ]
     commands:
@@ -644,7 +649,7 @@ tasks:
     commands:
       - func: "e2e_test"
 
-  - name: e2e_replica_set_custom_roles
+  - name: e2e_replica_set_ldap_custom_roles
     tags: [ "patch-run" ]
     commands:
       - func: "e2e_test"

.evergreen.yml

@@ -729,7 +729,7 @@ task_groups:
       - e2e_replica_set_ldap_user_to_dn_mapping
       # e2e_replica_set_ldap_agent_auth
       - e2e_replica_set_ldap_agent_client_certs
-      - e2e_replica_set_custom_roles
+      - e2e_replica_set_ldap_custom_roles
       - e2e_replica_set_update_roles_no_privileges
       - e2e_replica_set_ldap_group_dn
       - e2e_replica_set_ldap_group_dn_with_x509_agent
@@ -906,6 +906,7 @@ task_groups:
       - e2e_tls_x509_configure_all_options_sc
       - e2e_tls_x509_sc
       - e2e_meko_mck_upgrade
+      - e2e_mongodb_custom_roles
 
     <<: *teardown_group
 

docker/mongodb-kubernetes-tests/kubeobject/customobject.py

@@ -145,7 +145,7 @@ def _reload_if_needed(self):
             self.reload()
 
     @classmethod
-    def from_yaml(cls, yaml_file, name=None, namespace=None):
+    def from_yaml(cls, yaml_file, name=None, namespace=None, cluster_scoped=False):
         """Creates a `CustomObject` from a yaml file. In this case, `name` and
         `namespace` are optional in this function's signature, because they
         might be passed as part of the `yaml_file` document.
@@ -161,22 +161,23 @@ def from_yaml(cls, yaml_file, name=None, namespace=None):
                 "or exist in the `metadata` section of the yaml document."
             )
 
-        if (namespace is None or namespace == "") and "namespace" not in doc["metadata"]:
-            raise ValueError(
-                "`namespace` needs to be passed as part of the function call "
-                "or exist in the `metadata` section of the yaml document."
-            )
+        if not cluster_scoped:
+            if (namespace is None or namespace == "") and "namespace" not in doc["metadata"]:
+                raise ValueError(
+                    "`namespace` needs to be passed as part of the function call "
+                    "or exist in the `metadata` section of the yaml document."
+                )
+
+            if namespace is None:
+                namespace = doc["metadata"]["namespace"]
+            else:
+                doc["metadata"]["namespace"] = namespace
 
         if name is None:
             name = doc["metadata"]["name"]
         else:
             doc["metadata"]["name"] = name
 
-        if namespace is None:
-            namespace = doc["metadata"]["namespace"]
-        else:
-            doc["metadata"]["namespace"] = namespace
-
         kind = doc["kind"]
         api_version = doc["apiVersion"]
         if "/" in api_version:

docker/mongodb-kubernetes-tests/kubetester/mongodb_role.py

@@ -0,0 +1,60 @@
+from typing import Optional
+
+from kubeobject import CustomObject
+from kubetester.mongodb import MongoDBCommon, Phase, in_desired_state
+
+ClusterMongoDBRoleKind = "ClusterMongoDBRole"
+
+
+class ClusterMongoDBRole(CustomObject, MongoDBCommon):
+    def __init__(self, *args, **kwargs):
+        with_defaults = {
+            "plural": "clustermongodbroles",
+            "kind": "ClusterMongoDBRole",
+            "group": "mongodb.com",
+            "version": "v1",
+        }
+        with_defaults.update(kwargs)
+        super(ClusterMongoDBRole, self).__init__(*args, **with_defaults)
+
+    def assert_reaches_phase(self, phase: Phase, msg_regexp=None, timeout=None, ignore_errors=False):
+        return self.wait_for(
+            lambda s: in_desired_state(
+                current_state=self.get_status_phase(),
+                desired_state=phase,
+                current_generation=self.get_generation(),
+                observed_generation=self.get_status_observed_generation(),
+                current_message=self.get_status_message(),
+                msg_regexp=msg_regexp,
+                ignore_errors=ignore_errors,
+            ),
+            timeout,
+            should_raise=True,
+        )
+
+    def get_name(self) -> str:
+        return self["metadata"]["name"]
+
+    def get_role_name(self):
+        return self["spec"]["role"]
+
+    def get_role(self):
+        return self["spec"]
+
+    def get_status_phase(self) -> Optional[Phase]:
+        try:
+            return Phase[self["status"]["phase"]]
+        except KeyError:
+            return None
+
+    def get_status_message(self) -> Optional[str]:
+        try:
+            return self["status"]["msg"]
+        except KeyError:
+            return None
+
+    def get_status_observed_generation(self) -> Optional[int]:
+        try:
+            return self["status"]["observedGeneration"]
+        except KeyError:
+            return None

docker/mongodb-kubernetes-tests/tests/authentication/fixtures/cluster-mongodb-role.yaml

@@ -0,0 +1,28 @@
+apiVersion: mongodb.com/v1
+kind: ClusterMongoDBRole
+metadata:
+  name: test-customrole
+spec:
+  role: "test-customrole"
+  db: "admin"
+  roles:
+    - db: "admin"
+      role: "root"
+  privileges:
+    - resource:
+        db: "admin"
+        collection: "system.users"
+      actions:
+        - "find"
+        - "update"
+    - resource:
+        db: "admin"
+        collection: "system.roles"
+      actions:
+        - "find"
+        - "update"
+  authenticationRestrictions:
+    - clientSource:
+        - "127.0.0.0/8"
+      serverAddress:
+        - "10.0.0.0/8"