mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-05 23:46:56 +00:00
5b8ab3842b
* initial commit * variable substitution * update tests * update test * refactor engine packages for validate & generate * update vendor * update toml * support variable substitution in overlay mutation * missing update * fix indentation in logs * store context values as single JSON document using merge patches. * remove duplicate functions * fix message string * Handle processing of policies in background (#569) * remove condition check while generating mutation patch as conditions are verified in the first iteration * initial commit * background policy validation * correct message * skip non-background policy process for add/update * fix order to correct policy registration * update comment Co-authored-by: shuting <shutting06@gmail.com> * refactor Co-authored-by: shuting <shutting06@gmail.com>
99 lines
4.1 KiB
Go
99 lines
4.1 KiB
Go
package webhooks
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/nirmata/kyverno/pkg/engine/response"
|
|
"gotest.tools/assert"
|
|
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
)
|
|
|
|
func newPolicyResponse(policy, rule string, patchesStr []string, success bool) response.PolicyResponse {
|
|
var patches [][]byte
|
|
for _, p := range patchesStr {
|
|
patches = append(patches, []byte(p))
|
|
}
|
|
|
|
return response.PolicyResponse{
|
|
Policy: policy,
|
|
Rules: []response.RuleResponse{
|
|
response.RuleResponse{
|
|
Name: rule,
|
|
Patches: patches,
|
|
Success: success},
|
|
},
|
|
}
|
|
}
|
|
|
|
func newEngineResponse(policy, rule string, patchesStr []string, success bool, annotation map[string]string) response.EngineResponse {
|
|
return response.EngineResponse{
|
|
PatchedResource: unstructured.Unstructured{
|
|
Object: map[string]interface{}{
|
|
"metadata": map[string]interface{}{
|
|
"annotation": annotation,
|
|
},
|
|
},
|
|
},
|
|
PolicyResponse: newPolicyResponse(policy, rule, patchesStr, success),
|
|
}
|
|
}
|
|
|
|
func Test_empty_annotation(t *testing.T) {
|
|
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
|
|
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, true, nil)
|
|
|
|
annPatches := generateAnnotationPatches([]response.EngineResponse{engineResponse})
|
|
expectedPatches := `{"op":"add","path":"/metadata/annotations","value":{"policies.kyverno.patches":"[{\"policyname\":\"mutate-container\",\"patches\":[{\"rulename\":\"default-imagepullpolicy\",\"op\":\"replace\",\"path\":\"/spec/containers/0/imagePullPolicy\"}]}]"}}`
|
|
assert.Assert(t, string(annPatches) == expectedPatches)
|
|
}
|
|
|
|
func Test_exist_annotation(t *testing.T) {
|
|
annotation := map[string]string{
|
|
"test": "annotation",
|
|
}
|
|
|
|
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
|
|
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, true, annotation)
|
|
annPatches := generateAnnotationPatches([]response.EngineResponse{engineResponse})
|
|
|
|
expectedPatches := `{"op":"add","path":"/metadata/annotations","value":{"policies.kyverno.patches":"[{\"policyname\":\"mutate-container\",\"patches\":[{\"rulename\":\"default-imagepullpolicy\",\"op\":\"replace\",\"path\":\"/spec/containers/0/imagePullPolicy\"}]}]"}}`
|
|
assert.Assert(t, string(annPatches) == expectedPatches)
|
|
}
|
|
|
|
func Test_exist_kyverno_annotation(t *testing.T) {
|
|
annotation := map[string]string{
|
|
"policies.kyverno.patches": "old-annotation",
|
|
}
|
|
|
|
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
|
|
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, true, annotation)
|
|
annPatches := generateAnnotationPatches([]response.EngineResponse{engineResponse})
|
|
|
|
expectedPatches := `{"op":"add","path":"/metadata/annotations","value":{"policies.kyverno.patches":"[{\"policyname\":\"mutate-container\",\"patches\":[{\"rulename\":\"default-imagepullpolicy\",\"op\":\"replace\",\"path\":\"/spec/containers/0/imagePullPolicy\"}]}]"}}`
|
|
assert.Assert(t, string(annPatches) == expectedPatches)
|
|
}
|
|
|
|
func Test_annotation_nil_patch(t *testing.T) {
|
|
annotation := map[string]string{
|
|
"policies.kyverno.patches": "old-annotation",
|
|
}
|
|
|
|
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, true, annotation)
|
|
annPatches := generateAnnotationPatches([]response.EngineResponse{engineResponse})
|
|
assert.Assert(t, annPatches == nil)
|
|
|
|
engineResponseNew := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{""}, true, annotation)
|
|
annPatchesNew := generateAnnotationPatches([]response.EngineResponse{engineResponseNew})
|
|
assert.Assert(t, annPatchesNew == nil)
|
|
}
|
|
|
|
func Test_annotation_failed_Patch(t *testing.T) {
|
|
annotation := map[string]string{
|
|
"policies.kyverno.patches": "old-annotation",
|
|
}
|
|
|
|
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, false, annotation)
|
|
annPatches := generateAnnotationPatches([]response.EngineResponse{engineResponse})
|
|
|
|
assert.Assert(t, annPatches == nil)
|
|
}
|