Skip to content

Commit 6c476d9

Browse files
djoshydjoshy
committed
add units for global pull secret clone mechanism
1 parent 81339f7 commit 6c476d9

File tree

6 files changed

+85
-15
lines changed

6 files changed

+85
-15
lines changed

‎pkg/controller/build/buildrequest/buildrequestopts_test.go

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,24 @@ import (
1111
corev1 "k8s.io/api/core/v1"
1212
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1313
"k8s.io/apimachinery/pkg/runtime"
14+
15+
mcfgv1 "github.com/openshift/api/machineconfiguration/v1"
1416
)
1517

1618
func TestBuildRequestOpts(t *testing.T) {
1719
testCases := []struct {
18-
name string
19-
addlObjects []runtime.Object
20-
addlAsserts func(*testing.T, BuildRequestOpts)
20+
name string
21+
addlObjects []runtime.Object
22+
addlObjectSetup func(*testing.T, *fixtures.ObjectsForTest)
23+
addlAsserts func(*testing.T, BuildRequestOpts)
2124
}{
2225
{
2326
name: "no entitlement data",
2427
addlAsserts: func(t *testing.T, brOpts BuildRequestOpts) {
2528
assert.False(t, brOpts.HasEtcPkiRpmGpgKeys)
2629
assert.False(t, brOpts.HasEtcYumReposDConfigs)
2730
assert.False(t, brOpts.HasEtcPkiEntitlementKeys)
31+
assert.False(t, brOpts.hasUserDefinedBaseImagePullSecret)
2832
},
2933
},
3034
{
@@ -41,6 +45,7 @@ func TestBuildRequestOpts(t *testing.T) {
4145
assert.False(t, brOpts.HasEtcPkiRpmGpgKeys)
4246
assert.False(t, brOpts.HasEtcYumReposDConfigs)
4347
assert.True(t, brOpts.HasEtcPkiEntitlementKeys)
48+
assert.False(t, brOpts.hasUserDefinedBaseImagePullSecret)
4449
},
4550
},
4651
{
@@ -57,6 +62,7 @@ func TestBuildRequestOpts(t *testing.T) {
5762
assert.False(t, brOpts.HasEtcPkiRpmGpgKeys)
5863
assert.True(t, brOpts.HasEtcYumReposDConfigs)
5964
assert.False(t, brOpts.HasEtcPkiEntitlementKeys)
65+
assert.False(t, brOpts.hasUserDefinedBaseImagePullSecret)
6066
},
6167
},
6268
{
@@ -73,6 +79,7 @@ func TestBuildRequestOpts(t *testing.T) {
7379
assert.True(t, brOpts.HasEtcPkiRpmGpgKeys)
7480
assert.False(t, brOpts.HasEtcYumReposDConfigs)
7581
assert.False(t, brOpts.HasEtcPkiEntitlementKeys)
82+
assert.False(t, brOpts.hasUserDefinedBaseImagePullSecret)
7683
},
7784
},
7885
{
@@ -101,6 +108,16 @@ func TestBuildRequestOpts(t *testing.T) {
101108
assert.True(t, brOpts.HasEtcPkiRpmGpgKeys)
102109
assert.True(t, brOpts.HasEtcYumReposDConfigs)
103110
assert.True(t, brOpts.HasEtcPkiEntitlementKeys)
111+
assert.False(t, brOpts.hasUserDefinedBaseImagePullSecret)
112+
},
113+
},
114+
{
115+
name: "with user defined base image pull secret",
116+
addlObjectSetup: func(t *testing.T, lobj *fixtures.ObjectsForTest) {
117+
lobj.MachineOSConfig.Spec.BaseImagePullSecret = &mcfgv1.ImageSecretObjectReference{Name: fixtures.BaseImagePullSecretName}
118+
},
119+
addlAsserts: func(t *testing.T, brOpts BuildRequestOpts) {
120+
assert.True(t, brOpts.hasUserDefinedBaseImagePullSecret)
104121
},
105122
},
106123
}
@@ -115,6 +132,10 @@ func TestBuildRequestOpts(t *testing.T) {
115132

116133
kubeclient, mcfgclient, lobj, _ := fixtures.GetClientsForTestWithAdditionalObjects(t, testCase.addlObjects, []runtime.Object{})
117134

135+
if testCase.addlObjectSetup != nil {
136+
testCase.addlObjectSetup(t, lobj)
137+
}
138+
118139
brOpts, err := newBuildRequestOptsFromAPI(ctx, kubeclient, mcfgclient, lobj.MachineOSBuild, lobj.MachineOSConfig)
119140
assert.NoError(t, err)
120141

‎pkg/controller/build/buildrequest/machineosbuild_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ func TestMachineOSBuild(t *testing.T) {
2828
}
2929

3030
// Some of the test cases expect the hash name to be the same. This is that hash value.
31-
expectedCommonHashName := "worker-2ab43b54f9fb493af95d32937247895a"
31+
expectedCommonHashName := "worker-e945ec808b468c07f6a2cf1936c23a13"
3232

3333
testCases := []struct {
3434
name string

‎pkg/controller/build/fixtures/objects.go

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
)
1515

1616
const (
17-
baseImagePullSecretName string = "base-image-pull-secret"
17+
BaseImagePullSecretName string = "base-image-pull-secret"
1818
finalImagePushSecretName string = "final-image-push-secret"
1919
)
2020

@@ -86,7 +86,6 @@ func NewObjectBuildersForTest(poolName string) ObjectBuildersForTest {
8686

8787
moscBuilder := testhelpers.NewMachineOSConfigBuilder(moscName).
8888
WithMachineConfigPool(poolName).
89-
WithBaseImagePullSecret(baseImagePullSecretName).
9089
WithRenderedImagePushSecret(finalImagePushSecretName).
9190
WithRenderedImagePushSpec("registry.hostname.com/org/repo:latest").
9291
WithContainerfile(mcfgv1.NoArch, "FROM configs AS final\n\nRUN echo 'hi' > /etc/hi")
@@ -131,7 +130,17 @@ func defaultKubeObjects() []runtime.Object {
131130
},
132131
&corev1.Secret{
133132
ObjectMeta: metav1.ObjectMeta{
134-
Name: baseImagePullSecretName,
133+
Name: BaseImagePullSecretName,
134+
Namespace: ctrlcommon.MCONamespace,
135+
},
136+
Data: map[string][]byte{
137+
corev1.DockerConfigJsonKey: []byte(pullSecret),
138+
},
139+
Type: corev1.SecretTypeDockerConfigJson,
140+
},
141+
&corev1.Secret{
142+
ObjectMeta: metav1.ObjectMeta{
143+
Name: ctrlcommon.GlobalPullSecretCopyName,
135144
Namespace: ctrlcommon.MCONamespace,
136145
},
137146
Data: map[string][]byte{

‎pkg/operator/sync_test.go

Lines changed: 34 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -161,56 +161,73 @@ func withCABundle(caBundle string) kubeCloudConfigOption {
161161
}
162162
}
163163

164-
func TestReconcileSimpleContentAccessSecret(t *testing.T) {
164+
func TestMachineOSBuilderSecretReconciliation(t *testing.T) {
165165
masterPool := helpers.NewMachineConfigPool("master", nil, helpers.MasterSelector, "v0")
166166
workerPool := helpers.NewMachineConfigPool("worker", nil, helpers.MasterSelector, "v0")
167167
infraPool := helpers.NewMachineConfigPool("infra", nil, helpers.MasterSelector, "v0")
168168
entitlementSecret := helpers.NewOpaqueSecret(ctrlcommon.SimpleContentAccessSecretName, ctrlcommon.OpenshiftConfigManagedNamespace, "abc")
169169
workerEntitlementSecret := helpers.NewOpaqueSecretWithOwnerPool(ctrlcommon.SimpleContentAccessSecretName+"-"+workerPool.Name, ctrlcommon.MCONamespace, "abc", *workerPool)
170170
infraEntitlementSecret := helpers.NewOpaqueSecretWithOwnerPool(ctrlcommon.SimpleContentAccessSecretName+"-"+infraPool.Name, ctrlcommon.MCONamespace, "abc", *infraPool)
171171
outOfDateInfraEntitlementSecret := helpers.NewOpaqueSecretWithOwnerPool(ctrlcommon.SimpleContentAccessSecretName+"-"+infraPool.Name, ctrlcommon.MCONamespace, "123", *infraPool)
172+
globalPullSecret := helpers.NewDockerCfgJSONSecret(ctrlcommon.GlobalPullSecretName, ctrlcommon.OpenshiftConfigNamespace, "abc")
173+
outOfDateGlobalPullSecretCopy := helpers.NewDockerCfgJSONSecret(ctrlcommon.GlobalPullSecretCopyName, ctrlcommon.MCONamespace, "123")
174+
globalPullSecretCopy := helpers.NewDockerCfgJSONSecret(ctrlcommon.GlobalPullSecretCopyName, ctrlcommon.MCONamespace, "abc")
172175

173176
cases := []struct {
174177
name string
175178
mcoSecrets []*corev1.Secret
179+
ocSecrets []*corev1.Secret
176180
ocManagedSecrets []*corev1.Secret
177181
expectedMCOSecrets []corev1.Secret
178182
layeredMCPs []*mcfgv1.MachineConfigPool
179183
}{
180184
{
181185
name: "no entitlement secret on cluster, with opted-in pool",
186+
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
182187
ocManagedSecrets: []*corev1.Secret{},
183188
mcoSecrets: []*corev1.Secret{},
184-
expectedMCOSecrets: []corev1.Secret{},
185189
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
190+
expectedMCOSecrets: []corev1.Secret{*globalPullSecretCopy.DeepCopy()},
186191
},
187192
{
188193
name: "entitlement secret on cluster, with opted-in pool",
194+
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
189195
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
190196
mcoSecrets: []*corev1.Secret{},
191197
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
192-
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy()},
198+
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy(), *globalPullSecretCopy.DeepCopy()},
193199
},
194200
{
195201
name: "entitlement secret on cluster, with multiple opted-in pools",
202+
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
196203
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
197204
mcoSecrets: []*corev1.Secret{},
198205
layeredMCPs: []*mcfgv1.MachineConfigPool{workerPool.DeepCopy(), infraPool.DeepCopy()},
199-
expectedMCOSecrets: []corev1.Secret{*workerEntitlementSecret.DeepCopy(), *infraEntitlementSecret.DeepCopy()},
206+
expectedMCOSecrets: []corev1.Secret{*workerEntitlementSecret.DeepCopy(), *infraEntitlementSecret.DeepCopy(), *globalPullSecretCopy.DeepCopy()},
200207
},
201208
{
202-
name: "entitlement and cloned secret on cluster, with no opted-in pools",
209+
name: "entitlement, cloned secret and global pull secret copy on cluster, with no opted-in pools",
210+
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
203211
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
204-
mcoSecrets: []*corev1.Secret{infraEntitlementSecret.DeepCopy()},
212+
mcoSecrets: []*corev1.Secret{infraEntitlementSecret.DeepCopy(), globalPullSecretCopy.DeepCopy()},
205213
layeredMCPs: []*mcfgv1.MachineConfigPool{},
206214
expectedMCOSecrets: []corev1.Secret{},
207215
},
208216
{
209217
name: "entitlement and cloned secret on cluster, with an outdated cloned secret",
218+
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
210219
ocManagedSecrets: []*corev1.Secret{entitlementSecret.DeepCopy()},
211220
mcoSecrets: []*corev1.Secret{outOfDateInfraEntitlementSecret.DeepCopy()},
212221
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
213-
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy()},
222+
expectedMCOSecrets: []corev1.Secret{*infraEntitlementSecret.DeepCopy(), *globalPullSecretCopy.DeepCopy()},
223+
},
224+
{
225+
name: "outdated global pull secret copy on cluster",
226+
ocSecrets: []*corev1.Secret{globalPullSecret.DeepCopy()},
227+
ocManagedSecrets: []*corev1.Secret{},
228+
mcoSecrets: []*corev1.Secret{outOfDateGlobalPullSecretCopy.DeepCopy()},
229+
layeredMCPs: []*mcfgv1.MachineConfigPool{infraPool.DeepCopy()},
230+
expectedMCOSecrets: []corev1.Secret{*globalPullSecretCopy.DeepCopy()},
214231
},
215232
}
216233
for _, tc := range cases {
@@ -222,6 +239,7 @@ func TestReconcileSimpleContentAccessSecret(t *testing.T) {
222239
sharedInformerFactory := informers.NewSharedInformerFactory(kubeClient, 0)
223240
mcoSecretInformer := sharedInformerFactory.Core().V1().Secrets()
224241
ocManagedSecretInformer := sharedInformerFactory.Core().V1().Secrets()
242+
ocSecretInformer := sharedInformerFactory.Core().V1().Secrets()
225243

226244
// Add secrets to informer and client
227245
for _, secret := range tc.mcoSecrets {
@@ -234,6 +252,11 @@ func TestReconcileSimpleContentAccessSecret(t *testing.T) {
234252
_, err := kubeClient.CoreV1().Secrets(ctrlcommon.OpenshiftConfigManagedNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
235253
assert.NoError(t, err)
236254
}
255+
for _, secret := range tc.ocSecrets {
256+
ocSecretInformer.Informer().GetIndexer().Add(secret)
257+
_, err := kubeClient.CoreV1().Secrets(ctrlcommon.OpenshiftConfigNamespace).Create(context.TODO(), secret, metav1.CreateOptions{})
258+
assert.NoError(t, err)
259+
}
237260

238261
// Create MCO specific clients
239262
mcfgClient := fakeclientmachineconfigv1.NewSimpleClientset()
@@ -250,11 +273,15 @@ func TestReconcileSimpleContentAccessSecret(t *testing.T) {
250273
kubeClient: kubeClient,
251274
mcpLister: mcpInformer.Lister(),
252275
mcoSecretLister: mcoSecretInformer.Lister(),
276+
ocSecretLister: ocSecretInformer.Lister(),
253277
ocManagedSecretLister: ocManagedSecretInformer.Lister(),
254278
}
255279
err := optr.reconcileSimpleContentAccessSecrets(tc.layeredMCPs)
256280
assert.NoError(t, err)
257281

282+
err = optr.reconcileGlobalPullSecretCopy(tc.layeredMCPs)
283+
assert.NoError(t, err)
284+
258285
// Verify secrets in MCO namespace are as expected
259286
secrets, err := kubeClient.CoreV1().Secrets(ctrlcommon.MCONamespace).List(context.TODO(), metav1.ListOptions{})
260287
assert.NoError(t, err)

‎test/helpers/helpers.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,19 @@ func NewOpaqueSecretWithOwnerPool(name, namespace, content string, pool mcfgv1.M
226226
}
227227
}
228228

229+
func NewDockerCfgJSONSecret(name, namespace, content string) *corev1.Secret {
230+
return &corev1.Secret{
231+
ObjectMeta: metav1.ObjectMeta{
232+
Name: name,
233+
Namespace: namespace,
234+
},
235+
Data: map[string][]byte{
236+
".dockerconfigjson": []byte(content),
237+
},
238+
Type: corev1.SecretTypeDockerConfigJson,
239+
}
240+
}
241+
229242
// CreateMachineConfigFromIgnitionWithMetadata returns a MachineConfig object from an Ignition config, name, and role label
230243
func CreateMachineConfigFromIgnitionWithMetadata(ignCfg interface{}, name, role string) *mcfgv1.MachineConfig {
231244
return &mcfgv1.MachineConfig{

‎test/helpers/machineosconfigbuilder.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ func NewMachineOSConfigBuilder(name string) *MachineOSConfigBuilder {
2828
ImageBuilder: mcfgv1.MachineOSImageBuilder{
2929
ImageBuilderType: mcfgv1.MachineOSImageBuilderType("PodImageBuilder"),
3030
},
31-
BaseImagePullSecret: &mcfgv1.ImageSecretObjectReference{},
31+
BaseImagePullSecret: nil,
3232
RenderedImagePushSecret: mcfgv1.ImageSecretObjectReference{},
3333
},
3434
},

0 commit comments

Comments
 (0)