test/e2e: add e2e test for thanosruler denylisting

test/e2e/denylist_test.go

@@ -177,3 +177,45 @@ func testDenyServiceMonitor(t *testing.T) {
 		}
 	}
 }
+
+func testDenyThanosRuler(t *testing.T) {
+	ctx := framework.NewTestCtx(t)
+	defer ctx.Cleanup(t)
+
+	operatorNamespace := ctx.CreateNamespace(t, framework.KubeClient)
+	allowedNamespaces := []string{ctx.CreateNamespace(t, framework.KubeClient), ctx.CreateNamespace(t, framework.KubeClient)}
+	deniedNamespaces := []string{ctx.CreateNamespace(t, framework.KubeClient), ctx.CreateNamespace(t, framework.KubeClient)}
+
+	ctx.SetupPrometheusRBAC(t, operatorNamespace, framework.KubeClient)
+
+	_, err := framework.CreatePrometheusOperator(operatorNamespace, *opImage, nil, deniedNamespaces, nil, nil, false, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, denied := range deniedNamespaces {
+		ctx.SetupPrometheusRBAC(t, denied, framework.KubeClient)
+		tr := framework.MakeBasicThanosRuler("denied", 1)
+		_, err = framework.MonClientV1.ThanosRulers(denied).Create(context.TODO(), tr, metav1.CreateOptions{})
+		if err != nil {
+			t.Fatalf("creating %v Prometheus instances failed (%v): %v", tr.Spec.Replicas, tr.Name, err)
+		}
+	}
+
+	for _, allowed := range allowedNamespaces {
+		ctx.SetupPrometheusRBAC(t, allowed, framework.KubeClient)
+
+		if _, err := framework.CreateThanosRulerAndWaitUntilReady(allowed, framework.MakeBasicThanosRuler("allowed", 1)); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	for _, denied := range deniedNamespaces {
+		// this is not ideal, as we cannot really find out if prometheus operator did not reconcile the denied prometheus.
+		// nevertheless it is very likely that it reconciled it as the allowed prometheus is up.
+		sts, err := framework.KubeClient.AppsV1().StatefulSets(denied).Get(context.TODO(), "thanosruler-denied", metav1.GetOptions{})
+		if !api_errors.IsNotFound(err) {
+			t.Fatalf("expected not to find a Prometheus statefulset, but did: %v/%v", sts.Namespace, sts.Name)
+		}
+	}
+}

test/e2e/main_test.go

@@ -223,6 +223,7 @@ func TestDenylist(t *testing.T) {
 	testFuncs := map[string]func(t *testing.T){
 		"Prometheus":     testDenyPrometheus,
 		"ServiceMonitor": testDenyServiceMonitor,
+		"ThanosRuler":    testDenyThanosRuler,
 	}
 
 	for name, f := range testFuncs {