@@ -29,14 +29,16 @@ import (
2929
3030 "github.com/fluxcd/pkg/apis/kustomize"
3131 "github.com/fluxcd/pkg/apis/meta"
32+ "github.com/fluxcd/pkg/auth"
3233 "github.com/fluxcd/pkg/runtime/conditions"
3334 "github.com/fluxcd/pkg/testserver"
3435 sourcev1 "github.com/fluxcd/source-controller/api/v1"
3536
3637 kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
38+ "github.com/fluxcd/kustomize-controller/internal/decryptor"
3739)
3840
39- func TestKustomizationReconciler_InvalidCELExpression (t * testing.T ) {
41+ func TestKustomizationReconciler_ConfigurationError (t * testing.T ) {
4042 g := NewWithT (t )
4143 id := "invalid-config-" + randStringRunes (5 )
4244 revision := "v1.0.0"
@@ -72,53 +74,143 @@ data: {}
7274 err = applyGitRepository (repositoryName , artifact , revision )
7375 g .Expect (err ).NotTo (HaveOccurred ())
7476
75- kustomizationKey := types.NamespacedName {
76- Name : fmt .Sprintf ("invalid-config-%s" , randStringRunes (5 )),
77- Namespace : id ,
78- }
79- kustomization := & kustomizev1.Kustomization {
80- ObjectMeta : metav1.ObjectMeta {
81- Name : kustomizationKey .Name ,
82- Namespace : kustomizationKey .Namespace ,
83- },
84- Spec : kustomizev1.KustomizationSpec {
85- Interval : metav1.Duration {Duration : 2 * time .Minute },
86- Path : "./" ,
87- SourceRef : kustomizev1.CrossNamespaceSourceReference {
88- Name : repositoryName .Name ,
89- Namespace : repositoryName .Namespace ,
90- Kind : sourcev1 .GitRepositoryKind ,
77+ t .Run ("invalid cel expression" , func (t * testing.T ) {
78+ g := NewWithT (t )
79+
80+ kustomizationKey := types.NamespacedName {
81+ Name : fmt .Sprintf ("invalid-config-%s" , randStringRunes (5 )),
82+ Namespace : id ,
83+ }
84+ kustomization := & kustomizev1.Kustomization {
85+ ObjectMeta : metav1.ObjectMeta {
86+ Name : kustomizationKey .Name ,
87+ Namespace : kustomizationKey .Namespace ,
9188 },
92- TargetNamespace : id ,
93- Prune : true ,
94- Timeout : & metav1.Duration {Duration : time .Second },
95- Wait : true ,
96- HealthCheckExprs : []kustomize.CustomHealthCheck {{
97- APIVersion : "v1" ,
98- Kind : "ConfigMap" ,
99- HealthCheckExpressions : kustomize.HealthCheckExpressions {
100- InProgress : "foo." ,
101- Current : "true" ,
89+ Spec : kustomizev1.KustomizationSpec {
90+ TargetNamespace : id ,
91+ Interval : metav1.Duration {Duration : 2 * time .Minute },
92+ SourceRef : kustomizev1.CrossNamespaceSourceReference {
93+ Name : repositoryName .Name ,
94+ Namespace : repositoryName .Namespace ,
95+ Kind : sourcev1 .GitRepositoryKind ,
10296 },
103- }},
104- },
105- }
97+ Prune : true ,
98+ Timeout : & metav1.Duration {Duration : time .Second },
99+ Wait : true ,
100+ HealthCheckExprs : []kustomize.CustomHealthCheck {{
101+ APIVersion : "v1" ,
102+ Kind : "ConfigMap" ,
103+ HealthCheckExpressions : kustomize.HealthCheckExpressions {
104+ InProgress : "foo." ,
105+ Current : "true" ,
106+ },
107+ }},
108+ },
109+ }
106110
107- err = k8sClient .Create (context .Background (), kustomization )
108- g .Expect (err ).NotTo (HaveOccurred ())
111+ err = k8sClient .Create (context .Background (), kustomization )
112+ g .Expect (err ).NotTo (HaveOccurred ())
109113
110- g .Eventually (func () bool {
111- _ = k8sClient .Get (context .Background (), client .ObjectKeyFromObject (kustomization ), resultK )
112- return conditions .IsFalse (resultK , meta .ReadyCondition )
113- }, timeout , time .Second ).Should (BeTrue ())
114- logStatus (t , resultK )
114+ g .Eventually (func () bool {
115+ _ = k8sClient .Get (context .Background (), client .ObjectKeyFromObject (kustomization ), resultK )
116+ return conditions .IsFalse (resultK , meta .ReadyCondition )
117+ }, timeout , time .Second ).Should (BeTrue ())
115118
116- g .Expect (resultK .Status .ObservedGeneration ).To (Equal (resultK .GetGeneration ()))
119+ g .Expect (resultK .Status .ObservedGeneration ).To (Equal (resultK .GetGeneration ()))
117120
118- g .Expect (conditions .IsTrue (resultK , meta .StalledCondition )).To (BeTrue ())
119- for _ , cond := range []string {meta .ReadyCondition , meta .StalledCondition } {
120- g .Expect (conditions .GetReason (resultK , cond )).To (Equal (meta .InvalidCELExpressionReason ))
121- g .Expect (conditions .GetMessage (resultK , cond )).To (ContainSubstring (
122- "failed to create custom status evaluator for healthchecks[0]: failed to parse the expression InProgress: failed to parse the CEL expression 'foo.': ERROR: <input>:1:5: Syntax error: no viable alternative at input '.'" ))
123- }
121+ g .Expect (conditions .IsTrue (resultK , meta .StalledCondition )).To (BeTrue ())
122+ for _ , cond := range []string {meta .ReadyCondition , meta .StalledCondition } {
123+ g .Expect (conditions .GetReason (resultK , cond )).To (Equal (meta .InvalidCELExpressionReason ))
124+ g .Expect (conditions .GetMessage (resultK , cond )).To (ContainSubstring (
125+ "failed to create custom status evaluator for healthchecks[0]: failed to parse the expression InProgress: failed to parse the CEL expression 'foo.': ERROR: <input>:1:5: Syntax error: no viable alternative at input '.'" ))
126+ }
127+ })
128+
129+ t .Run ("object level workload identity feature gate disabled" , func (t * testing.T ) {
130+ g := NewWithT (t )
131+
132+ kustomizationKey := types.NamespacedName {
133+ Name : fmt .Sprintf ("invalid-config-%s" , randStringRunes (5 )),
134+ Namespace : id ,
135+ }
136+ kustomization := & kustomizev1.Kustomization {
137+ ObjectMeta : metav1.ObjectMeta {
138+ Name : kustomizationKey .Name ,
139+ Namespace : kustomizationKey .Namespace ,
140+ },
141+ Spec : kustomizev1.KustomizationSpec {
142+ TargetNamespace : id ,
143+ Interval : metav1.Duration {Duration : 2 * time .Minute },
144+ SourceRef : kustomizev1.CrossNamespaceSourceReference {
145+ Name : repositoryName .Name ,
146+ Namespace : repositoryName .Namespace ,
147+ Kind : sourcev1 .GitRepositoryKind ,
148+ },
149+ Prune : true ,
150+ Decryption : & kustomizev1.Decryption {
151+ Provider : decryptor .DecryptionProviderSOPS ,
152+ ServiceAccountName : "foo" ,
153+ },
154+ },
155+ }
156+
157+ err = k8sClient .Create (context .Background (), kustomization )
158+ g .Expect (err ).NotTo (HaveOccurred ())
159+
160+ g .Eventually (func () bool {
161+ _ = k8sClient .Get (context .Background (), client .ObjectKeyFromObject (kustomization ), resultK )
162+ return conditions .IsFalse (resultK , meta .ReadyCondition )
163+ }, timeout , time .Second ).Should (BeTrue ())
164+
165+ // In this case the controller does not update the observed generation
166+ // because if the feature gate is enabled then the generation of the
167+ // object can be properly observed.
168+ g .Expect (resultK .Status .ObservedGeneration ).To (Equal (int64 (- 1 )))
169+
170+ g .Expect (conditions .IsTrue (resultK , meta .StalledCondition )).To (BeTrue ())
171+ for _ , cond := range []string {meta .ReadyCondition , meta .StalledCondition } {
172+ g .Expect (conditions .GetReason (resultK , cond )).To (Equal (meta .FeatureGateDisabledReason ))
173+ g .Expect (conditions .GetMessage (resultK , cond )).To (ContainSubstring (
174+ "to use spec.decryption.serviceAccountName for decryption authentication please enable the ObjectLevelWorkloadIdentity feature gate in the controller" ))
175+ }
176+ })
177+
178+ t .Run ("object level workload identity feature gate enabled" , func (t * testing.T ) {
179+ g := NewWithT (t )
180+
181+ t .Setenv (auth .EnvVarEnableObjectLevelWorkloadIdentity , "true" )
182+
183+ kustomizationKey := types.NamespacedName {
184+ Name : fmt .Sprintf ("invalid-config-%s" , randStringRunes (5 )),
185+ Namespace : id ,
186+ }
187+ kustomization := & kustomizev1.Kustomization {
188+ ObjectMeta : metav1.ObjectMeta {
189+ Name : kustomizationKey .Name ,
190+ Namespace : kustomizationKey .Namespace ,
191+ },
192+ Spec : kustomizev1.KustomizationSpec {
193+ TargetNamespace : id ,
194+ Interval : metav1.Duration {Duration : 2 * time .Minute },
195+ SourceRef : kustomizev1.CrossNamespaceSourceReference {
196+ Name : repositoryName .Name ,
197+ Namespace : repositoryName .Namespace ,
198+ Kind : sourcev1 .GitRepositoryKind ,
199+ },
200+ Prune : true ,
201+ Decryption : & kustomizev1.Decryption {
202+ Provider : decryptor .DecryptionProviderSOPS ,
203+ ServiceAccountName : "foo" ,
204+ },
205+ },
206+ }
207+
208+ err = k8sClient .Create (context .Background (), kustomization )
209+ g .Expect (err ).NotTo (HaveOccurred ())
210+
211+ g .Eventually (func () bool {
212+ _ = k8sClient .Get (context .Background (), client .ObjectKeyFromObject (kustomization ), resultK )
213+ return conditions .IsTrue (resultK , meta .ReadyCondition )
214+ }, timeout , time .Second ).Should (BeTrue ())
215+ })
124216}
0 commit comments