k8s-io 1.0.1

data/spec/config/incluster_config_spec.rb

@@ -0,0 +1,162 @@
+# frozen_string_literal: true
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'spec_helper'
+require 'config/matchers'
+require 'helpers/file_fixtures'
+
+require 'kubernetes/config/incluster_config'
+
+# rubocop:disable Metrics/BlockLength
+describe Kubernetes::InClusterConfig do
+  describe '#configure' do
+    let(:incluster_config) do
+      described_class.new.tap do |c|
+        c.instance_variable_set(
+          :@env,
+          Kubernetes::InClusterConfig::SERVICE_HOST_ENV_NAME => 'localhost',
+          Kubernetes::InClusterConfig::SERVICE_PORT_ENV_NAME => '443'
+        )
+        c.instance_variable_set(
+          :@ca_cert,
+          Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+        )
+        c.instance_variable_set(
+          :@token_file,
+          Kubernetes::Testing.file_fixture('tokens/token').to_s
+        )
+        c.instance_variable_set(
+          :@token_refresh_period,
+          5
+        )
+      end
+    end
+
+    it 'configures configuration' do
+      expected = Kubernetes::Configuration.new do |c|
+        c.scheme = 'https'
+        c.host = 'localhost:443'
+        c.ssl_ca_cert = Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+        c.api_key['authorization'] = 'Bearer token1'
+      end
+      actual = Kubernetes::Configuration.new
+
+      incluster_config.configure(actual)
+      expect(actual).to be_same_configuration_as(expected)
+
+      old_expired_at = incluster_config.token_expires_at
+      incluster_config.instance_variable_set(
+        :@token_file,
+        Kubernetes::Testing.file_fixture('tokens/token2').to_s
+      )
+      allow(Time).to receive(:now).and_return(Time.now + 5)
+      actual.api_key_with_prefix('authorization')
+
+      expected.api_key['authorization'] = 'Bearer token2'
+      expect(actual).to be_same_configuration_as(expected)
+      expect(incluster_config.token_expires_at).to be > old_expired_at
+    end
+  end
+
+  describe '#validate' do
+    let(:incluster_config) do
+      described_class.new.tap do |c|
+        c.instance_variable_set(
+          :@env,
+          Kubernetes::InClusterConfig::SERVICE_HOST_ENV_NAME => 'localhost',
+          Kubernetes::InClusterConfig::SERVICE_PORT_ENV_NAME => '443'
+        )
+        c.instance_variable_set(
+          :@ca_cert,
+          Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+        )
+        c.instance_variable_set(
+          :@token_file,
+          Kubernetes::Testing.file_fixture('tokens/token').to_s
+        )
+      end
+    end
+
+    context 'if valid environment' do
+      it 'shold not raise ConfigError' do
+        expect { incluster_config.validate }.not_to raise_error
+      end
+    end
+
+    context 'if SERVICE_HOST_ENV_NAME env variable is not set' do
+      it 'raises ConfigError' do
+        env_key = Kubernetes::InClusterConfig::SERVICE_HOST_ENV_NAME
+        incluster_config.env[env_key] = nil
+
+        expect { incluster_config.validate }.to raise_error(
+          Kubernetes::ConfigError
+        )
+      end
+    end
+
+    context 'if SERVICE_PORT_ENV_NAME env variable is not set' do
+      it 'raises ConfigError' do
+        env_key = Kubernetes::InClusterConfig::SERVICE_PORT_ENV_NAME
+        incluster_config.env[env_key] = nil
+
+        expect { incluster_config.validate }.to raise_error(
+          Kubernetes::ConfigError
+        )
+      end
+    end
+
+    context 'if ca_cert file is not exist' do
+      it 'shold raise ConfigError' do
+        incluster_config.instance_variable_set(:@ca_cert, 'certs/no_ca.crt')
+
+        expect { incluster_config.validate }.to raise_error(
+          Kubernetes::ConfigError
+        )
+      end
+    end
+
+    context 'if token file is not exist' do
+      it 'shold raise ConfigError' do
+        incluster_config.instance_variable_set(:@token_file, 'tokens/no_token')
+
+        expect { incluster_config.validate }.to raise_error(
+          Kubernetes::ConfigError
+        )
+      end
+    end
+  end
+
+  describe '#ca_cert' do
+    let(:incluster_config) { described_class.new }
+
+    it 'shold return "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"' do
+      expect(incluster_config.ca_cert).to eq(
+        '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
+      )
+    end
+  end
+
+  describe '#token_file' do
+    let(:incluster_config) { described_class.new }
+
+    it 'shold return "/var/run/secrets/kubernetes.io/serviceaccount/token"' do
+      expect(incluster_config.token_file).to eq(
+        '/var/run/secrets/kubernetes.io/serviceaccount/token'
+      )
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/spec/config/kube_config_spec.rb

@@ -0,0 +1,321 @@
+# frozen_string_literal: true
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'base64'
+require 'config/matchers'
+require 'fixtures/config/kube_config_hash'
+require 'helpers/file_fixtures'
+require 'spec_helper'
+
+require 'kubernetes/config/kube_config'
+require 'kubernetes/loader'
+
+# rubocop:disable Metrics/BlockLength
+describe Kubernetes::KubeConfig do
+  file = Kubernetes::Testing.file_fixture('config/config').to_s
+  let(:kube_config) { described_class.new(file, TEST_KUBE_CONFIG) }
+
+  describe '#configure' do
+    context 'if non user context is given' do
+      it 'configures non user configuration' do
+        expected = Kubernetes::Configuration.new do |c|
+          c.scheme = 'http'
+          c.host = 'test-host:80'
+        end
+        actual = Kubernetes::Configuration.new
+
+        kube_config.configure(actual, 'no_user')
+        expect(actual).to be_same_configuration_as(expected)
+      end
+    end
+
+    context 'if empty user context is given' do
+      it 'configures non user configuration' do
+        expected = Kubernetes::Configuration.new do |c|
+          c.scheme = 'http'
+          c.host = 'test-host:80'
+        end
+        actual = Kubernetes::Configuration.new
+
+        kube_config.configure(actual, 'empty_user')
+        expect(actual).to be_same_configuration_as(expected)
+      end
+    end
+
+    context 'if ssl context is given' do
+      it 'configures ssl configuration' do
+        expected = Kubernetes::Configuration.new do |c|
+          c.scheme = 'https'
+          c.host = 'test-host:443'
+          c.ssl_ca_cert =
+            Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+          c.cert_file =
+            Kubernetes::Testing.file_fixture('certs/client.crt').to_s
+          c.key_file =
+            Kubernetes::Testing.file_fixture('certs/client.key').to_s
+          c.verify_ssl = true
+        end
+        actual = Kubernetes::Configuration.new
+
+        kube_config.configure(actual, 'context_ssl')
+        expect(actual).to be_same_configuration_as(expected)
+      end
+    end
+
+    context 'if ssl no-verify context is given' do
+      it 'configures ssl configuration' do
+        expected = Kubernetes::Configuration.new do |c|
+          c.scheme = 'https'
+          c.host = 'test-host:443'
+          c.ssl_ca_cert =
+            Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+          c.cert_file =
+            Kubernetes::Testing.file_fixture('certs/client.crt').to_s
+          c.key_file =
+            Kubernetes::Testing.file_fixture('certs/client.key').to_s
+          c.verify_ssl = false
+          c.verify_ssl_host = false
+        end
+        actual = Kubernetes::Configuration.new
+
+        kube_config.configure(actual, 'context_insecure')
+        expect(actual).to be_same_configuration_as(expected)
+        expect(actual.verify_ssl_host).to be_falsey
+        expect(actual.verify_ssl).to be_falsey
+      end
+    end
+
+    context 'if simple token context is given' do
+      it 'configures ssl configuration' do
+        expected = Kubernetes::Configuration.new do |c|
+          c.scheme = 'https'
+          c.host = 'test-host:443'
+          c.ssl_ca_cert = Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+          c.api_key['authorization'] = "Bearer #{TEST_DATA_BASE64}"
+        end
+        actual = Kubernetes::Configuration.new
+
+        kube_config.configure(actual, 'context_token')
+        expect(actual).to be_same_configuration_as(expected)
+      end
+    end
+  end
+
+  describe '#config' do
+    context 'if config hash is not given when it is initialized' do
+      file = Kubernetes::Testing.file_fixture('config/empty').to_s
+      let(:kube_config) { described_class.new(file) }
+
+      it 'loads config' do
+        expect(kube_config.config).to eq({})
+      end
+    end
+
+    context 'if config hash is given when it is initialized' do
+      let(:given_hash) { { given: 'hash' } }
+      let(:kube_config) { described_class.new(file, given_hash) }
+
+      file = Kubernetes::Testing.file_fixture('config/empty').to_s
+
+      it 'does not load config' do
+        expect(kube_config.config).to eq(given_hash)
+      end
+    end
+  end
+
+  describe '#find_cluster' do
+    context 'if valid name is given' do
+      it 'returns cluster' do
+        expect(kube_config.find_cluster('default')['server']).to eq(
+          TEST_CLUSTER_DEFAULT['cluster']['server']
+        )
+      end
+    end
+
+    context 'if cluster does not have ca file' do
+      it 'creates temporary ca file from ca data' do
+        cluster = kube_config.find_cluster('ssl-data')
+        ca_file = cluster['certificate-authority']
+        expect(ca_file).not_to be_nil
+        File.open(ca_file) do |io|
+          expect(io.read).to eq(TEST_CERTIFICATE_AUTH)
+        end
+      end
+    end
+
+    context 'if insecure-skip-tls-verify is set to true' do
+      it 'returns verify_ssl == false' do
+        cluster = kube_config.find_cluster('ssl-data-insecure')
+
+        expect(cluster['verify_ssl']).to be_falsey
+      end
+    end
+
+    context 'if insecure-skip-tls-verify is not set' do
+      it 'returns verify_ssl == true' do
+        cluster = kube_config.find_cluster('ssl-data')
+
+        expect(cluster['verify_ssl']).to be_truthy
+      end
+    end
+  end
+
+  describe '#find_user' do
+    context 'if valid name is given' do
+      it 'returns user' do
+        expect(kube_config.find_user('simple_token')['username']).to eq(
+          TEST_USER_SIMPLE_TOKEN['user']['username']
+        )
+      end
+    end
+
+    context 'if user does not have client cert' do
+      it 'creates temporary client cert from cert data' do
+        user = kube_config.find_user('user_cert_data')
+        cert_file = user['client-certificate']
+        expect(cert_file).not_to be_nil
+        File.open(cert_file) do |io|
+          expect(io.read).to eq(TEST_CLIENT_CERT)
+        end
+      end
+    end
+
+    context 'if user does not have client key' do
+      it 'creates temporary client key from key data' do
+        user = kube_config.find_user('user_cert_data')
+        key_file = user['client-key']
+        expect(key_file).not_to be_nil
+        File.open(key_file) do |io|
+          expect(io.read).to eq(TEST_CLIENT_KEY)
+        end
+      end
+    end
+
+    context 'if user does not have token but has tokenFile' do
+      it 'reads token from file if given' do
+        user = kube_config.find_user('simple_token_file')
+
+        expect(user['authorization']).to eq('Bearer token1')
+      end
+    end
+
+    context 'if user has username and password' do
+      it 'returns basic auth token' do
+        user = kube_config.find_user('user_pass')
+
+        expect(user['authorization']).to eq(TEST_BASIC_TOKEN)
+      end
+    end
+
+    context 'if azure user' do
+      it 'returns the access token' do
+        user = kube_config.find_user('user_azure')
+
+        expect(user['authorization']).to eq(TEST_AZURE_TOKEN)
+      end
+    end
+  end
+
+  describe '#list_context_names' do
+    it 'lists context names' do
+      arr = %w[default no_user empty_user context_ssl context_insecure context_token].sort
+      expect(kube_config.list_context_names.sort).to eq(arr)
+    end
+  end
+
+  describe '#find_context' do
+    context 'if valid name is given' do
+      it 'returns context' do
+        expect(kube_config.find_context('default')['cluster']['server']).to eq(
+          TEST_CLUSTER_DEFAULT['cluster']['server']
+        )
+        expect(kube_config.find_context('default')['user']['username']).to eq(
+          TEST_USER_DEFAULT['user']['username']
+        )
+      end
+    end
+  end
+
+  describe '#current_context' do
+    it 'returns current context' do
+      expect(kube_config.current_context['cluster']['server']).to eq(
+        TEST_CLUSTER_DEFAULT['cluster']['server']
+      )
+    end
+  end
+
+  context 'load from defaults' do
+    before do
+      # Clear out everything before each run.
+      ENV['HOME'] = nil
+      ENV['KUBECONFIG'] = nil
+      ENV['KUBERNETES_SERVICE_HOST'] = nil
+      ENV['KUBERNETES_SERVICE_PORT'] = nil
+
+      # Suppress warnings
+      warn_level = $VERBOSE
+      $VERBOSE = nil
+      Kubernetes::InClusterConfig::SERVICE_TOKEN_FILENAME =
+        '/non/existent/file/token'
+      Kubernetes::InClusterConfig::SERVICE_CA_CERT_FILENAME =
+        '/non/existent/file/ca.crt'
+      $VERBOSE = warn_level
+    end
+
+    it 'loads from KUBECONFIG' do
+      ENV['KUBECONFIG'] =
+        Kubernetes::Testing.file_fixture('config/config_2').to_s
+      ENV['HOME'] = Kubernetes::Testing.file_fixture('config').to_s
+      config = Kubernetes::Configuration.default_config
+
+      expect(config.host).to eq('other:8080')
+    end
+
+    it 'loads from HOME' do
+      ENV['HOME'] = Kubernetes::Testing.file_fixture('config').to_s
+      config = Kubernetes::Configuration.default_config
+
+      expect(config.host).to eq('firstconfig:8080')
+    end
+
+    it 'loads from cluster' do
+      ENV['KUBERNETES_SERVICE_HOST'] = 'kubernetes'
+      ENV['KUBERNETES_SERVICE_PORT'] = '8888'
+
+      # Suppress warnings
+      warn_level = $VERBOSE
+      $VERBOSE = nil
+
+      # Override constants for token and cert locations
+      stub_const('Kubernetes::InClusterConfig::SERVICE_TOKEN_FILENAME',
+                 Kubernetes::Testing.file_fixture('config/config').to_s)
+      stub_const('Kubernetes::InClusterConfig::SERVICE_CA_CERT_FILENAME',
+                 Kubernetes::Testing.file_fixture('certs/ca.crt').to_s)
+      $VERBOSE = warn_level
+
+      config = Kubernetes::Configuration.default_config
+
+      expect(config.host).to eq('kubernetes:8888')
+    end
+
+    it 'defaults to localhost' do
+      config = Kubernetes::Configuration.default_config
+
+      expect(config.host).to eq('localhost:8080')
+    end
+  end
+end
+# rubocop:enable Metrics/BlockLength

data/spec/config/matchers.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+RSpec::Matchers.define :be_same_configuration_as do |expected|
+  match do |actual|
+    to_h = proc do |configuration|
+      {}.tap do |hash|
+        configuration.instance_variables.each do |var|
+          value = configuration.instance_variable_get(var)
+          hash[var.to_s.tr('@', '')] = value if value.is_a?(Hash) || value.is_a?(String)
+        end
+      end
+    end
+    to_h.call(actual) == to_h.call(expected)
+  end
+end

data/spec/fixtures/config/kube_config_hash.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'base64'
+require 'helpers/file_fixtures'
+
+TEST_TOKEN_FILE = Kubernetes::Testing.file_fixture('tokens/token')
+
+TEST_DATA = 'test-data'
+TEST_DATA_BASE64 = Base64.strict_encode64(TEST_DATA)
+
+TEST_HOST = 'http://test-host'
+TEST_USERNAME = 'me'
+TEST_PASSWORD = 'pass'
+# token for me:pass
+TEST_BASIC_TOKEN = 'Basic bWU6cGFzcw=='
+TEST_AZURE_TOKEN = 'Bearer some-token'
+
+TEST_SSL_HOST = 'https://test-host'
+TEST_CERTIFICATE_AUTH = 'cert-auth'
+TEST_CERTIFICATE_AUTH_BASE64 = Base64.strict_encode64(TEST_CERTIFICATE_AUTH)
+TEST_CLIENT_KEY = 'client-key'
+TEST_CLIENT_KEY_BASE64 = Base64.strict_encode64(TEST_CLIENT_KEY)
+TEST_CLIENT_CERT = 'client-cert'
+TEST_CLIENT_CERT_BASE64 = Base64.strict_encode64(TEST_CLIENT_CERT)
+
+TEST_CONTEXT_DEFAULT = {
+  'name' => 'default',
+  'context' => {
+    'cluster' => 'default',
+    'user' => 'default'
+  }
+}.freeze
+TEST_CONTEXT_NO_USER = {
+  'name' => 'no_user',
+  'context' => {
+    'cluster' => 'default'
+  }
+}.freeze
+TEST_CONTEXT_EMPTY_USER = {
+  'name' => 'empty_user',
+  'context' => {
+    'cluster' => 'default',
+    'user' => ''
+  }
+}.freeze
+TEST_CONTEXT_SSL = {
+  'name' => 'context_ssl',
+  'context' => {
+    'cluster' => 'ssl-file',
+    'user' => 'user_cert_file'
+  }
+}.freeze
+TEST_CONTEXT_INSECURE = {
+  'name' => 'context_insecure',
+  'context' => {
+    'cluster' => 'ssl-data-insecure',
+    'user' => 'user_cert_file'
+  }
+}.freeze
+TEST_CONTEXT_TOKEN = {
+  'name' => 'context_token',
+  'context' => {
+    'cluster' => 'ssl-file',
+    'user' => 'simple_token'
+  }
+}.freeze
+
+TEST_CLUSTER_DEFAULT = {
+  'name' => 'default',
+  'cluster' => {
+    'server' => TEST_HOST
+  }
+}.freeze
+TEST_CLUSTER_SSL_FILE = {
+  'name' => 'ssl-file',
+  'cluster' => {
+    'server' => TEST_SSL_HOST,
+    'certificate-authority' =>
+      Kubernetes::Testing.file_fixture('certs/ca.crt').to_s
+  }
+}.freeze
+TEST_CLUSTER_SSL_DATA = {
+  'name' => 'ssl-data',
+  'cluster' => {
+    'server' => TEST_SSL_HOST,
+    'certificate-authority-data' => TEST_CERTIFICATE_AUTH_BASE64
+  }
+}.freeze
+TEST_CLUSTER_INSECURE = {
+  'name' => 'ssl-data-insecure',
+  'cluster' => {
+    'server' => TEST_SSL_HOST,
+    'certificate-authority' =>
+      Kubernetes::Testing.file_fixture('certs/ca.crt').to_s,
+    'insecure-skip-tls-verify' => true
+  }
+}.freeze
+
+TEST_USER_DEFAULT = {
+  'name' => 'default',
+  'user' => {
+    'token' => TEST_DATA_BASE64
+  }
+}.freeze
+TEST_USER_SIMPLE_TOKEN = {
+  'name' => 'simple_token',
+  'user' => {
+    'token' => TEST_DATA_BASE64,
+    'username' => TEST_USERNAME, # should be ignored
+    'password' => TEST_PASSWORD # should be ignored
+  }
+}.freeze
+TEST_USER_SIMPLE_TOKEN_FILE = {
+  'name' => 'simple_token_file',
+  'user' => {
+    'tokenFile' => TEST_TOKEN_FILE,
+    'username' => TEST_USERNAME, # should be ignored
+    'password' => TEST_PASSWORD # should be ignored
+  }
+}.freeze
+TEST_USER_USER_PASS = {
+  'name' => 'user_pass',
+  'user' => {
+    'username' => TEST_USERNAME, # should be ignored
+    'password' => TEST_PASSWORD # should be ignored
+  }
+}.freeze
+TEST_USER_CERT_DATA = {
+  'name' => 'user_cert_data',
+  'user' => {
+    'token' => TEST_DATA_BASE64,
+    'client-certificate-data' => TEST_CLIENT_CERT_BASE64,
+    'client-key-data' => TEST_CLIENT_KEY_BASE64
+  }
+}.freeze
+TEST_USER_CERT_FILE = {
+  'name' => 'user_cert_file',
+  'user' => {
+    'client-certificate' =>
+      Kubernetes::Testing.file_fixture('certs/client.crt').to_s,
+    'client-key' => Kubernetes::Testing.file_fixture('certs/client.key').to_s
+  }
+}.freeze
+
+TEST_USER_AZURE = {
+  'name' => 'user_azure',
+  'user' => {
+    'auth-provider' => {
+      'name' => 'azure',
+      'config' => {
+        'access-token' => 'some-token'
+      }
+    }
+  }
+}.freeze
+
+TEST_KUBE_CONFIG = {
+  'current-context' => 'no_user',
+  'contexts' => [
+    TEST_CONTEXT_DEFAULT,
+    TEST_CONTEXT_NO_USER,
+    TEST_CONTEXT_EMPTY_USER,
+    TEST_CONTEXT_SSL,
+    TEST_CONTEXT_TOKEN,
+    TEST_CONTEXT_INSECURE
+  ],
+  'clusters' => [
+    TEST_CLUSTER_DEFAULT,
+    TEST_CLUSTER_SSL_FILE,
+    TEST_CLUSTER_SSL_DATA,
+    TEST_CLUSTER_INSECURE
+  ],
+  'users' => [
+    TEST_USER_DEFAULT,
+    TEST_USER_SIMPLE_TOKEN,
+    TEST_USER_SIMPLE_TOKEN_FILE,
+    TEST_USER_USER_PASS,
+    TEST_USER_CERT_DATA,
+    TEST_USER_CERT_FILE,
+    TEST_USER_AZURE
+  ]
+}.freeze