mirror of
https://github.com/kubernetes-sigs/kustomize.git
synced 2026-05-24 07:47:02 +00:00
f649b62629
- Removed RoleBinding and Webhook specific code in the namespacetransformer. That code was attempting to perform the task of the namereference - Updated namereference transformer configuration to suppport the Webhooks. - Prevent the namereference from wiping out the namespace value if no referral candidate was selected - Added unit tests.
229 lines
4.2 KiB
Go
229 lines
4.2 KiB
Go
// Copyright 2019 The Kubernetes Authors.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package main_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"sigs.k8s.io/kustomize/v3/pkg/kusttest"
|
|
plugins_test "sigs.k8s.io/kustomize/v3/pkg/plugins/test"
|
|
)
|
|
|
|
func TestNamespaceTransformer1(t *testing.T) {
|
|
tc := plugins_test.NewEnvForTest(t).Set()
|
|
defer tc.Reset()
|
|
|
|
tc.BuildGoPlugin(
|
|
"builtin", "", "NamespaceTransformer")
|
|
|
|
th := kusttest_test.NewKustTestPluginHarness(t, "/app")
|
|
|
|
rm := th.LoadAndRunTransformer(`
|
|
apiVersion: builtin
|
|
kind: NamespaceTransformer
|
|
metadata:
|
|
name: notImportantHere
|
|
namespace: test
|
|
fieldSpecs:
|
|
- path: metadata/namespace
|
|
create: true
|
|
`, `
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cm1
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cm2
|
|
namespace: foo
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: svc1
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: ns1
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: default
|
|
namespace: system
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: service-account
|
|
namespace: system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: manager-rolebinding
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: default
|
|
namespace: system
|
|
- kind: ServiceAccount
|
|
name: service-account
|
|
namespace: system
|
|
- kind: ServiceAccount
|
|
name: another
|
|
namespace: random
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1beta1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
name: example
|
|
webhooks:
|
|
- name: example1
|
|
clientConfig:
|
|
service:
|
|
name: svc1
|
|
namespace: system
|
|
- name: example2
|
|
clientConfig:
|
|
service:
|
|
name: svc2
|
|
namespace: system
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: crd
|
|
`)
|
|
|
|
// Import note: The namespace transformer is in charge of
|
|
// the metadata.namespace field. The namespace transformer SHOULD
|
|
// NOT modify neither the "namespace" subfield within the
|
|
// ClusterRoleBinding.subjects field nor the "namespace"
|
|
// subfield in the ValidatingWebhookConfiguration.webhooks field.
|
|
// This is the role of the namereference Transformer to handle
|
|
// object reference changes (prefix/suffix and namespace).
|
|
// For use cases involving simultaneous change of name and namespace,
|
|
// refer to namespaces tests in pkg/target test suites.
|
|
th.AssertActualEqualsExpected(rm, `
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cm1
|
|
namespace: test
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: cm2
|
|
namespace: test
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: svc1
|
|
namespace: test
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: ns1
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: default
|
|
namespace: test
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: service-account
|
|
namespace: test
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: manager-rolebinding
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: default
|
|
namespace: system
|
|
- kind: ServiceAccount
|
|
name: service-account
|
|
namespace: system
|
|
- kind: ServiceAccount
|
|
name: another
|
|
namespace: random
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1beta1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
name: example
|
|
webhooks:
|
|
- clientConfig:
|
|
service:
|
|
name: svc1
|
|
namespace: system
|
|
name: example1
|
|
- clientConfig:
|
|
service:
|
|
name: svc2
|
|
namespace: system
|
|
name: example2
|
|
---
|
|
apiVersion: apiextensions.k8s.io/v1beta1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: crd
|
|
`)
|
|
}
|
|
|
|
func TestNamespaceTransformerClusterLevelKinds(t *testing.T) {
|
|
tc := plugins_test.NewEnvForTest(t).Set()
|
|
defer tc.Reset()
|
|
|
|
tc.BuildGoPlugin(
|
|
"builtin", "", "NamespaceTransformer")
|
|
|
|
th := kusttest_test.NewKustTestPluginHarness(t, "/app")
|
|
|
|
const noChangeExpected = `
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: ns1
|
|
---
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: crd1
|
|
---
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cr1
|
|
---
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: crb1
|
|
---
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: pv1
|
|
`
|
|
rm := th.LoadAndRunTransformer(`
|
|
apiVersion: builtin
|
|
kind: NamespaceTransformer
|
|
metadata:
|
|
name: notImportantHere
|
|
namespace: test
|
|
fieldSpecs:
|
|
- path: metadata/namespace
|
|
create: true
|
|
`, noChangeExpected)
|
|
|
|
th.AssertActualEqualsExpected(rm, noChangeExpected)
|
|
}
|