gitlab-org--gitlab-foss/spec/lib/gitlab/kubernetes/kube_client_spec.rb

604 lines
17 KiB
Ruby

# frozen_string_literal: true
require 'spec_helper'
RSpec.describe Gitlab::Kubernetes::KubeClient do
include StubRequests
include KubernetesHelpers
let(:api_url) { 'https://kubernetes.example.com/prefix' }
let(:kubeclient_options) { { auth_options: { bearer_token: 'xyz' } } }
let(:client) { described_class.new(api_url, **kubeclient_options) }
before do
stub_kubeclient_discover(api_url)
end
def method_call(client, method_name)
case method_name
when /\A(get_|delete_)/
client.public_send(method_name)
when /\A(create_|update_|patch_)/
client.public_send(method_name, {})
else
raise "Unknown method name #{method_name}"
end
end
shared_examples 'a Kubeclient' do
it 'is a Kubeclient::Client' do
is_expected.to be_an_instance_of Kubeclient::Client
end
it 'has the kubeclient options' do
expect(subject.auth_options).to eq({ bearer_token: 'xyz' })
end
end
shared_examples 'redirection not allowed' do |method_name|
context 'api_url is redirected' do
before do
redirect_url = 'https://not-under-our-control.example.com/api/v1/pods'
stub_request(:get, %r{\A#{api_url}/})
.to_return(status: 302, headers: { location: redirect_url })
stub_request(:get, redirect_url)
.to_return(status: 200, body: '{}')
end
it 'does not follow redirects' do
expect { method_call(client, method_name) }.to raise_error(Kubeclient::HttpError)
end
end
end
shared_examples 'dns rebinding not allowed' do |method_name|
it 'does not allow DNS rebinding' do
stub_dns(api_url, ip_address: '8.8.8.8')
client
stub_dns(api_url, ip_address: '192.168.2.120')
expect { method_call(client, method_name) }.to raise_error(ArgumentError, /is blocked/)
end
end
describe '.graceful_request' do
context 'successful' do
before do
allow(client).to receive(:foo).and_return(true)
end
it 'returns connected status and foo response' do
result = described_class.graceful_request(1) { client.foo }
expect(result).to eq({ status: :connected, response: true })
end
end
context 'errored' do
using RSpec::Parameterized::TableSyntax
where(:error, :connection_status, :error_status) do
SocketError | :unreachable | :connection_error
OpenSSL::X509::CertificateError | :authentication_failure | :authentication_error
StandardError | :unknown_failure | :unknown_error
Kubeclient::HttpError.new(408, "timed out", nil) | :unreachable | :http_error
Kubeclient::HttpError.new(408, "timeout", nil) | :unreachable | :http_error
Kubeclient::HttpError.new(408, "", nil) | :authentication_failure | :http_error
end
with_them do
before do
allow(client).to receive(:foo).and_raise(error)
end
it 'returns error status' do
result = described_class.graceful_request(1) { client.foo }
expect(result).to eq({ status: connection_status, connection_error: error_status })
end
end
end
end
describe '#initialize' do
shared_examples 'local address' do
it 'blocks local addresses' do
expect { client }.to raise_error(Gitlab::UrlBlocker::BlockedUrlError)
end
context 'when local requests are allowed' do
before do
stub_application_setting(allow_local_requests_from_web_hooks_and_services: true)
end
it 'allows local addresses' do
expect { client }.not_to raise_error
end
end
end
context 'localhost address' do
let(:api_url) { 'http://localhost:22' }
it_behaves_like 'local address'
end
context 'private network address' do
let(:api_url) { 'http://192.168.1.2:3003' }
it_behaves_like 'local address'
end
it 'falls back to default options, but allows overriding' do
client = described_class.new(api_url)
defaults = Gitlab::Kubernetes::KubeClient::DEFAULT_KUBECLIENT_OPTIONS
expect(client.kubeclient_options[:timeouts]).to eq(defaults[:timeouts])
client = Gitlab::Kubernetes::KubeClient.new(api_url, timeouts: { read: 7 })
expect(client.kubeclient_options[:timeouts][:read]).to eq(7)
expect(client.kubeclient_options[:timeouts][:open]).to eq(defaults[:timeouts][:open])
end
end
describe '#core_client' do
subject { client.core_client }
it_behaves_like 'a Kubeclient'
it 'has the core API endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/api\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1')
end
end
describe '#rbac_client' do
subject { client.rbac_client }
it_behaves_like 'a Kubeclient'
it 'has the RBAC API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/rbac.authorization.k8s.io\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1')
end
end
describe '#extensions_client' do
subject { client.extensions_client }
it_behaves_like 'a Kubeclient'
it 'has the extensions API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/extensions\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1beta1')
end
end
describe '#istio_client' do
subject { client.istio_client }
it_behaves_like 'a Kubeclient'
it 'has the Istio API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/networking.istio.io\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1alpha3')
end
end
describe '#knative_client' do
subject { client.knative_client }
it_behaves_like 'a Kubeclient'
it 'has the extensions API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/serving.knative.dev\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1alpha1')
end
end
describe '#networking_client' do
subject { client.networking_client }
it_behaves_like 'a Kubeclient'
it 'has the networking API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/networking.k8s.io\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1')
end
end
describe '#cilium_networking_client' do
subject { client.cilium_networking_client }
it_behaves_like 'a Kubeclient'
it 'has the cilium API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/cilium.io\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v2')
end
end
describe '#metrics_client' do
subject { client.metrics_client }
it_behaves_like 'a Kubeclient'
it 'has the metrics API group endpoint' do
expect(subject.api_endpoint.to_s).to match(%r{\/apis\/metrics.k8s.io\Z})
end
it 'has the api_version' do
expect(subject.instance_variable_get(:@api_version)).to eq('v1beta1')
end
end
describe 'core API' do
let(:core_client) { client.core_client }
[
:get_nodes,
:get_pods,
:get_secrets,
:get_config_map,
:get_pod,
:get_namespace,
:get_secret,
:get_service,
:get_service_account,
:delete_namespace,
:delete_pod,
:delete_service_account,
:create_config_map,
:create_namespace,
:create_pod,
:create_secret,
:create_service_account,
:update_config_map,
:update_secret,
:update_service_account
].each do |method|
describe "##{method}" do
include_examples 'redirection not allowed', method
include_examples 'dns rebinding not allowed', method
it 'delegates to the core client' do
expect(client).to delegate_method(method).to(:core_client)
end
it 'responds to the method' do
expect(client).to respond_to method
end
end
end
end
describe 'rbac API group' do
let(:rbac_client) { client.rbac_client }
[
:create_role,
:get_role,
:update_role,
:delete_role_binding,
:update_role_binding,
:update_cluster_role_binding
].each do |method|
describe "##{method}" do
include_examples 'redirection not allowed', method
include_examples 'dns rebinding not allowed', method
it 'delegates to the rbac client' do
expect(client).to delegate_method(method).to(:rbac_client)
end
it 'responds to the method' do
expect(client).to respond_to method
end
end
end
end
describe '#get_deployments' do
let(:extensions_client) { client.extensions_client }
let(:apps_client) { client.apps_client }
include_examples 'redirection not allowed', 'get_deployments'
include_examples 'dns rebinding not allowed', 'get_deployments'
it 'delegates to the extensions client' do
expect(extensions_client).to receive(:get_deployments)
client.get_deployments
end
context 'extensions does not have deployments for Kubernetes 1.16+ clusters' do
before do
WebMock
.stub_request(:get, api_url + '/apis/extensions/v1beta1')
.to_return(kube_response(kube_1_16_extensions_v1beta1_discovery_body))
end
it 'delegates to the apps client' do
expect(apps_client).to receive(:get_deployments)
client.get_deployments
end
end
end
describe '#get_ingresses' do
let(:extensions_client) { client.extensions_client }
let(:networking_client) { client.networking_client }
include_examples 'redirection not allowed', 'get_ingresses'
include_examples 'dns rebinding not allowed', 'get_ingresses'
it 'delegates to the extensions client' do
expect(extensions_client).to receive(:get_ingresses)
client.get_ingresses
end
context 'extensions does not have deployments for Kubernetes 1.22+ clusters' do
before do
WebMock
.stub_request(:get, api_url + '/apis/extensions/v1beta1')
.to_return(kube_response(kube_1_22_extensions_v1beta1_discovery_body))
end
it 'delegates to the apps client' do
expect(networking_client).to receive(:get_ingresses)
client.get_ingresses
end
end
end
describe '#patch_ingress' do
let(:extensions_client) { client.extensions_client }
let(:networking_client) { client.networking_client }
include_examples 'redirection not allowed', 'patch_ingress'
include_examples 'dns rebinding not allowed', 'patch_ingress'
it 'delegates to the extensions client' do
expect(extensions_client).to receive(:patch_ingress)
client.patch_ingress
end
context 'extensions does not have ingress for Kubernetes 1.22+ clusters' do
before do
WebMock
.stub_request(:get, api_url + '/apis/extensions/v1beta1')
.to_return(kube_response(kube_1_22_extensions_v1beta1_discovery_body))
end
it 'delegates to the apps client' do
expect(networking_client).to receive(:patch_ingress)
client.patch_ingress
end
end
end
describe 'istio API group' do
let(:istio_client) { client.istio_client }
[
:create_gateway,
:get_gateway,
:update_gateway
].each do |method|
describe "##{method}" do
include_examples 'redirection not allowed', method
include_examples 'dns rebinding not allowed', method
it 'delegates to the istio client' do
expect(client).to delegate_method(method).to(:istio_client)
end
it 'responds to the method' do
expect(client).to respond_to method
end
end
end
end
describe 'networking API group' do
let(:networking_client) { client.networking_client }
[
:create_network_policy,
:get_network_policies,
:get_network_policy,
:update_network_policy,
:delete_network_policy
].each do |method|
describe "##{method}" do
include_examples 'redirection not allowed', method
include_examples 'dns rebinding not allowed', method
it 'delegates to the networking client' do
expect(client).to delegate_method(method).to(:networking_client)
end
it 'responds to the method' do
expect(client).to respond_to method
end
end
end
end
describe 'cilium API group' do
let(:cilium_networking_client) { client.cilium_networking_client }
[
:create_cilium_network_policy,
:get_cilium_network_policies,
:get_cilium_network_policy,
:update_cilium_network_policy,
:delete_cilium_network_policy
].each do |method|
describe "##{method}" do
include_examples 'redirection not allowed', method
include_examples 'dns rebinding not allowed', method
it 'delegates to the cilium client' do
expect(client).to delegate_method(method).to(:cilium_networking_client)
end
it 'responds to the method' do
expect(client).to respond_to method
end
end
end
end
describe 'non-entity methods' do
it 'does not proxy for non-entity methods' do
expect(client).not_to respond_to :proxy_url
end
it 'throws an error' do
expect { client.proxy_url }.to raise_error(NoMethodError)
end
end
describe '#get_pod_log' do
let(:core_client) { client.core_client }
it 'is delegated to the core client' do
expect(client).to delegate_method(:get_pod_log).to(:core_client)
end
end
describe '#watch_pod_log' do
let(:core_client) { client.core_client }
it 'is delegated to the core client' do
expect(client).to delegate_method(:watch_pod_log).to(:core_client)
end
end
shared_examples 'create_or_update method using put' do
let(:update_method) { "update_#{resource_type}" }
it 'calls the update method' do
expect(client).to receive(update_method).with(resource)
subject
end
end
shared_examples 'create_or_update method' do
let(:get_method) { "get_#{resource_type}" }
let(:update_method) { "update_#{resource_type}" }
let(:create_method) { "create_#{resource_type}" }
context 'resource exists' do
before do
expect(client).to receive(get_method).and_return(resource)
end
it 'calls the update method' do
expect(client).to receive(update_method).with(resource)
subject
end
end
context 'resource does not exist' do
before do
expect(client).to receive(get_method).and_raise(Kubeclient::ResourceNotFoundError.new(404, 'Not found', nil))
end
it 'calls the create method' do
expect(client).to receive(create_method).with(resource)
subject
end
end
end
describe '#create_or_update_cluster_role_binding' do
let(:resource_type) { 'cluster_role_binding' }
let(:resource) do
::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
end
subject { client.create_or_update_cluster_role_binding(resource) }
it_behaves_like 'create_or_update method using put'
end
describe '#create_or_update_role_binding' do
let(:resource_type) { 'role_binding' }
let(:resource) do
::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
end
subject { client.create_or_update_role_binding(resource) }
it_behaves_like 'create_or_update method using put'
end
describe '#create_or_update_service_account' do
let(:resource_type) { 'service_account' }
let(:resource) do
::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
end
subject { client.create_or_update_service_account(resource) }
it_behaves_like 'create_or_update method'
end
describe '#create_or_update_secret' do
let(:resource_type) { 'secret' }
let(:resource) do
::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
end
subject { client.create_or_update_secret(resource) }
it_behaves_like 'create_or_update method'
end
describe 'methods that do not exist on any client' do
it 'throws an error' do
expect { client.non_existent_method }.to raise_error(NoMethodError)
end
it 'returns false for respond_to' do
expect(client.respond_to?(:non_existent_method)).to be_falsey
end
end
end