kyverno/pkg/utils/annotations_test.go

package utils

import (
	"testing"

	kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
	engineapi "github.com/kyverno/kyverno/pkg/engine/api"
	"github.com/kyverno/kyverno/pkg/logging"
	"github.com/mattbaird/jsonpatch"
	"gotest.tools/assert"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)

func newPolicyResponse(rule string, patches []jsonpatch.JsonPatchOperation, status engineapi.RuleStatus) engineapi.PolicyResponse {
	return engineapi.PolicyResponse{
		Rules: []engineapi.RuleResponse{
			*engineapi.NewRuleResponse(rule, engineapi.Mutation, "", status).WithPatches(patches...),
		},
	}
}

func newEngineResponse(policy, rule string, patchesStr []jsonpatch.JsonPatchOperation, status engineapi.RuleStatus, annotation map[string]interface{}) engineapi.EngineResponse {
	p := &kyvernov1.ClusterPolicy{
		ObjectMeta: metav1.ObjectMeta{
			Name: policy,
		},
	}
	policyResponse := newPolicyResponse(rule, patchesStr, status)
	response := engineapi.NewEngineResponse(unstructured.Unstructured{}, p, nil).WithPolicyResponse(policyResponse)
	response.PatchedResource = unstructured.Unstructured{
		Object: map[string]interface{}{
			"metadata": map[string]interface{}{
				"annotations": annotation,
			},
		},
	}
	return response
}

func Test_empty_annotation(t *testing.T) {
	patchStr := jsonpatch.JsonPatchOperation{
		Operation: "replace",
		Path:      "/spec/containers/0/imagePullPolicy",
		Value:     "IfNotPresent",
	}
	engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []jsonpatch.JsonPatchOperation{patchStr}, engineapi.RuleStatusPass, nil)
	annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
	expectedPatches := `{"op":"add","path":"/metadata/annotations","value":{"policies.kyverno.io/last-applied-patches":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}}`
	assert.Equal(t, annPatches[0].Json(), expectedPatches)
}

func Test_exist_annotation(t *testing.T) {
	annotation := map[string]interface{}{
		"test": "annotation",
	}
	patchStr := jsonpatch.JsonPatchOperation{
		Operation: "replace",
		Path:      "/spec/containers/0/imagePullPolicy",
		Value:     "IfNotPresent",
	}
	engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []jsonpatch.JsonPatchOperation{patchStr}, engineapi.RuleStatusPass, annotation)
	annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
	expectedPatches := `{"op":"add","path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}`
	assert.Equal(t, annPatches[0].Json(), expectedPatches)
}

func Test_exist_kyverno_annotation(t *testing.T) {
	annotation := map[string]interface{}{
		"policies.kyverno.patches": "old-annotation",
	}
	patchStr := jsonpatch.JsonPatchOperation{
		Operation: "replace",
		Path:      "/spec/containers/0/imagePullPolicy",
		Value:     "IfNotPresent",
	}
	engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []jsonpatch.JsonPatchOperation{patchStr}, engineapi.RuleStatusPass, annotation)
	annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
	expectedPatches := `{"op":"add","path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}`
	assert.Equal(t, annPatches[0].Json(), expectedPatches)
}

func Test_annotation_nil_patch(t *testing.T) {
	annotation := map[string]interface{}{
		"policies.kyverno.patches": "old-annotation",
	}
	engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, engineapi.RuleStatusPass, annotation)
	annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
	assert.Assert(t, annPatches == nil)
	engineResponseNew := newEngineResponse("mutate-container", "default-imagepullpolicy", []jsonpatch.JsonPatchOperation{}, engineapi.RuleStatusPass, annotation)
	annPatchesNew := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponseNew}, logging.GlobalLogger())
	assert.Assert(t, annPatchesNew == nil)
}

func Test_annotation_failed_Patch(t *testing.T) {
	annotation := map[string]interface{}{
		"policies.kyverno.patches": "old-annotation",
	}
	engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, engineapi.RuleStatusFail, annotation)
	annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
	assert.Assert(t, annPatches == nil)
}

func Test_exist_patches(t *testing.T) {
	annotation := map[string]interface{}{
		"policies.kyverno.io/patches": "present",
	}
	patchStr := jsonpatch.JsonPatchOperation{
		Operation: "replace",
		Path:      "/spec/containers/0/imagePullPolicy",
		Value:     "IfNotPresent",
	}
	engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []jsonpatch.JsonPatchOperation{patchStr}, engineapi.RuleStatusPass, annotation)
	annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
	expectedPatches1 := `{"op":"remove","path":"/metadata/annotations/policies.kyverno.io~1patches"}`
	expectedPatches2 := `{"op":"add","path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}`
	assert.Equal(t, annPatches[0].Json(), expectedPatches1)
	assert.Equal(t, annPatches[1].Json(), expectedPatches2)
}