kubectl-mcp-server 1.15.0__py3-none-any.whl → 1.17.0__py3-none-any.whl

tests/test_ecosystem.py

@@ -0,0 +1,331 @@
+"""
+Unit tests for ecosystem tools (GitOps, Cert-Manager, Policy, Backup).
+
+This module tests the CRD detector and all ecosystem toolsets.
+"""
+
+import pytest
+from unittest.mock import patch, MagicMock
+import subprocess
+
+
+class TestCRDDetector:
+    """Tests for the CRD auto-discovery framework."""
+
+    @pytest.mark.unit
+    def test_crd_detector_imports(self):
+        """Test that CRD detector module can be imported."""
+        from kubectl_mcp_tool.crd_detector import (
+            CRD_GROUPS,
+            detect_crds,
+            crd_exists,
+            get_enabled_toolsets,
+            get_crd_status_summary,
+            FeatureNotInstalledError,
+            require_crd,
+            require_any_crd,
+        )
+        assert CRD_GROUPS is not None
+        assert callable(detect_crds)
+        assert callable(crd_exists)
+        assert callable(get_enabled_toolsets)
+        assert callable(get_crd_status_summary)
+        assert issubclass(FeatureNotInstalledError, Exception)
+        assert callable(require_crd)
+        assert callable(require_any_crd)
+
+    @pytest.mark.unit
+    def test_crd_groups_structure(self):
+        """Test that CRD_GROUPS has expected structure."""
+        from kubectl_mcp_tool.crd_detector import CRD_GROUPS
+
+        expected_groups = ["flux", "argocd", "certmanager", "kyverno", "gatekeeper", "velero"]
+        for group in expected_groups:
+            assert group in CRD_GROUPS, f"Expected group '{group}' in CRD_GROUPS"
+            assert isinstance(CRD_GROUPS[group], list), f"CRD_GROUPS['{group}'] should be a list"
+            assert len(CRD_GROUPS[group]) > 0, f"CRD_GROUPS['{group}'] should not be empty"
+
+    @pytest.mark.unit
+    def test_detect_crds_with_mocked_kubectl(self):
+        """Test CRD detection with mocked kubectl."""
+        from kubectl_mcp_tool.crd_detector import detect_crds, _crd_cache
+
+        # Clear cache before test
+        _crd_cache.clear()
+
+        mock_output = """NAME                                     CREATED AT
+applications.argoproj.io                 2024-01-01T00:00:00Z
+certificates.cert-manager.io             2024-01-01T00:00:00Z
+"""
+        with patch("subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(
+                returncode=0,
+                stdout=mock_output
+            )
+            result = detect_crds(force_refresh=True)
+
+            assert isinstance(result, dict)
+            assert "argocd" in result
+            assert "certmanager" in result
+
+    @pytest.mark.unit
+    def test_detect_crds_handles_kubectl_failure(self):
+        """Test CRD detection handles kubectl failure gracefully."""
+        from kubectl_mcp_tool.crd_detector import detect_crds, _crd_cache
+
+        _crd_cache.clear()
+
+        with patch("subprocess.run") as mock_run:
+            mock_run.side_effect = subprocess.SubprocessError("Command failed")
+            result = detect_crds(force_refresh=True)
+
+            assert isinstance(result, dict)
+            # All groups should be False when kubectl fails
+            for value in result.values():
+                assert value is False
+
+    @pytest.mark.unit
+    def test_feature_not_installed_error(self):
+        """Test FeatureNotInstalledError exception."""
+        from kubectl_mcp_tool.crd_detector import FeatureNotInstalledError
+
+        error = FeatureNotInstalledError("velero", ["backups.velero.io"])
+        assert "velero" in str(error)
+        assert "backups.velero.io" in str(error)
+        assert error.toolset == "velero"
+        assert "backups.velero.io" in error.required_crds
+
+    @pytest.mark.unit
+    def test_get_crd_status_summary(self):
+        """Test CRD status summary generation."""
+        from kubectl_mcp_tool.crd_detector import get_crd_status_summary, _crd_cache
+
+        _crd_cache.clear()
+
+        with patch("subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(
+                returncode=0,
+                stdout="applications.argoproj.io 2024-01-01T00:00:00Z\n"
+            )
+            summary = get_crd_status_summary()
+
+            # Summary returns a dict with crd_groups and enabled_toolsets
+            assert isinstance(summary, dict)
+            assert "crd_groups" in summary
+            assert "enabled_toolsets" in summary
+
+
+class TestGitOpsTools:
+    """Tests for GitOps toolset (Flux and ArgoCD)."""
+
+    @pytest.mark.unit
+    def test_gitops_tools_import(self):
+        """Test that GitOps tools can be imported."""
+        from kubectl_mcp_tool.tools.gitops import register_gitops_tools
+        assert callable(register_gitops_tools)
+
+    @pytest.mark.unit
+    def test_gitops_tools_register(self, mock_all_kubernetes_apis):
+        """Test that GitOps tools register correctly."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        import asyncio
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test")
+
+        async def get_tools():
+            return await server.server.list_tools()
+
+        tools = asyncio.run(get_tools())
+        tool_names = {t.name for t in tools}
+
+        gitops_tools = [
+            "gitops_apps_list_tool", "gitops_app_get_tool", "gitops_app_sync_tool",
+            "gitops_app_status_tool", "gitops_sources_list_tool", "gitops_source_get_tool",
+            "gitops_detect_engine_tool"
+        ]
+        for tool in gitops_tools:
+            assert tool in tool_names, f"GitOps tool '{tool}' not registered"
+
+    @pytest.mark.unit
+    def test_gitops_non_destructive_mode(self, mock_all_kubernetes_apis):
+        """Test that GitOps sync is blocked in non-destructive mode."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test", non_destructive=True)
+
+        # Server should initialize with non_destructive=True
+        assert server.non_destructive is True
+
+
+class TestCertManagerTools:
+    """Tests for Cert-Manager toolset."""
+
+    @pytest.mark.unit
+    def test_certs_tools_import(self):
+        """Test that Cert-Manager tools can be imported."""
+        from kubectl_mcp_tool.tools.certs import register_certs_tools
+        assert callable(register_certs_tools)
+
+    @pytest.mark.unit
+    def test_certs_tools_register(self, mock_all_kubernetes_apis):
+        """Test that Cert-Manager tools register correctly."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        import asyncio
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test")
+
+        async def get_tools():
+            return await server.server.list_tools()
+
+        tools = asyncio.run(get_tools())
+        tool_names = {t.name for t in tools}
+
+        certs_tools = [
+            "certs_list_tool", "certs_get_tool", "certs_issuers_list_tool", "certs_issuer_get_tool",
+            "certs_renew_tool", "certs_status_explain_tool", "certs_challenges_list_tool",
+            "certs_requests_list_tool", "certs_detect_tool"
+        ]
+        for tool in certs_tools:
+            assert tool in tool_names, f"Cert-Manager tool '{tool}' not registered"
+
+
+class TestPolicyTools:
+    """Tests for Policy toolset (Kyverno and Gatekeeper)."""
+
+    @pytest.mark.unit
+    def test_policy_tools_import(self):
+        """Test that Policy tools can be imported."""
+        from kubectl_mcp_tool.tools.policy import register_policy_tools
+        assert callable(register_policy_tools)
+
+    @pytest.mark.unit
+    def test_policy_tools_register(self, mock_all_kubernetes_apis):
+        """Test that Policy tools register correctly."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        import asyncio
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test")
+
+        async def get_tools():
+            return await server.server.list_tools()
+
+        tools = asyncio.run(get_tools())
+        tool_names = {t.name for t in tools}
+
+        policy_tools = [
+            "policy_list_tool", "policy_get_tool", "policy_violations_list_tool",
+            "policy_explain_denial_tool", "policy_audit_tool", "policy_detect_tool"
+        ]
+        for tool in policy_tools:
+            assert tool in tool_names, f"Policy tool '{tool}' not registered"
+
+
+class TestBackupTools:
+    """Tests for Backup toolset (Velero)."""
+
+    @pytest.mark.unit
+    def test_backup_tools_import(self):
+        """Test that Backup tools can be imported."""
+        from kubectl_mcp_tool.tools.backup import register_backup_tools
+        assert callable(register_backup_tools)
+
+    @pytest.mark.unit
+    def test_backup_tools_register(self, mock_all_kubernetes_apis):
+        """Test that Backup tools register correctly."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        import asyncio
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test")
+
+        async def get_tools():
+            return await server.server.list_tools()
+
+        tools = asyncio.run(get_tools())
+        tool_names = {t.name for t in tools}
+
+        backup_tools = [
+            "backup_list_tool", "backup_get_tool", "backup_create_tool", "backup_delete_tool",
+            "restore_list_tool", "restore_create_tool", "restore_get_tool",
+            "backup_locations_list_tool", "backup_schedules_list_tool",
+            "backup_schedule_create_tool", "backup_detect_tool"
+        ]
+        for tool in backup_tools:
+            assert tool in tool_names, f"Backup tool '{tool}' not registered"
+
+    @pytest.mark.unit
+    def test_backup_non_destructive_mode(self, mock_all_kubernetes_apis):
+        """Test that backup operations are blocked in non-destructive mode."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test", non_destructive=True)
+
+        # Server should initialize with non_destructive=True
+        assert server.non_destructive is True
+
+
+class TestEcosystemToolsIntegration:
+    """Integration tests for ecosystem tools."""
+
+    @pytest.mark.unit
+    def test_all_ecosystem_tools_have_descriptions(self, mock_all_kubernetes_apis):
+        """Test that all ecosystem tools have descriptions."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        import asyncio
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test")
+
+        async def get_tools():
+            return await server.server.list_tools()
+
+        tools = asyncio.run(get_tools())
+
+        ecosystem_prefixes = ["gitops_", "certs_", "policy_", "backup_", "restore_"]
+        ecosystem_tools = [t for t in tools if any(t.name.startswith(p) for p in ecosystem_prefixes)]
+
+        tools_without_description = [
+            t.name for t in ecosystem_tools
+            if not t.description or len(t.description.strip()) == 0
+        ]
+        assert not tools_without_description, f"Ecosystem tools without descriptions: {tools_without_description}"
+
+    @pytest.mark.unit
+    def test_ecosystem_tool_count(self, mock_all_kubernetes_apis):
+        """Test that correct number of ecosystem tools are registered."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        import asyncio
+
+        with patch("kubectl_mcp_tool.mcp_server.MCPServer._check_dependencies", return_value=True):
+            server = MCPServer(name="test")
+
+        async def get_tools():
+            return await server.server.list_tools()
+
+        tools = asyncio.run(get_tools())
+
+        # Filter ecosystem tools, but exclude backup_resource which is in operations.py
+        ecosystem_tool_names = [
+            "gitops_apps_list_tool", "gitops_app_get_tool", "gitops_app_sync_tool",
+            "gitops_app_status_tool", "gitops_sources_list_tool", "gitops_source_get_tool",
+            "gitops_detect_engine_tool",
+            "certs_list_tool", "certs_get_tool", "certs_issuers_list_tool", "certs_issuer_get_tool",
+            "certs_renew_tool", "certs_status_explain_tool", "certs_challenges_list_tool",
+            "certs_requests_list_tool", "certs_detect_tool",
+            "policy_list_tool", "policy_get_tool", "policy_violations_list_tool",
+            "policy_explain_denial_tool", "policy_audit_tool", "policy_detect_tool",
+            "backup_list_tool", "backup_get_tool", "backup_create_tool", "backup_delete_tool",
+            "restore_list_tool", "restore_create_tool", "restore_get_tool",
+            "backup_locations_list_tool", "backup_schedules_list_tool",
+            "backup_schedule_create_tool", "backup_detect_tool"
+        ]
+        tool_names = {t.name for t in tools}
+        ecosystem_tools = [name for name in ecosystem_tool_names if name in tool_names]
+
+        # 7 GitOps + 9 Certs + 6 Policy + 11 Backup = 33 ecosystem tools
+        assert len(ecosystem_tools) == 33, f"Expected 33 ecosystem tools, got {len(ecosystem_tools)}"

tests/test_mcp_integration.py

@@ -0,0 +1,251 @@
+"""Integration tests for MCP server with safety, observability, and config modules."""
+
+import pytest
+import os
+import tempfile
+from unittest.mock import patch, MagicMock
+
+
+class TestMCPServerIntegration:
+    """Test MCP server integration with safety, observability, and config modules."""
+
+    def test_import_mcp_server(self):
+        """Test that MCP server can be imported without errors."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        assert MCPServer is not None
+
+    def test_mcp_server_init_default(self):
+        """Test MCP server initialization with defaults."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        from kubectl_mcp_tool.safety import SafetyMode, get_safety_mode, set_safety_mode
+
+        # Reset to normal mode
+        set_safety_mode(SafetyMode.NORMAL)
+
+        server = MCPServer("test-server")
+        assert server.name == "test-server"
+        assert get_safety_mode() == SafetyMode.NORMAL
+
+    def test_mcp_server_init_read_only(self):
+        """Test MCP server initialization with read-only mode."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        from kubectl_mcp_tool.safety import SafetyMode, get_safety_mode, set_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        server = MCPServer("test-server", read_only=True)
+        assert server.name == "test-server"
+        assert get_safety_mode() == SafetyMode.READ_ONLY
+        assert server.non_destructive is True
+
+    def test_mcp_server_init_disable_destructive(self):
+        """Test MCP server initialization with disable-destructive mode."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        from kubectl_mcp_tool.safety import SafetyMode, get_safety_mode, set_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        server = MCPServer("test-server", disable_destructive=True)
+        assert server.name == "test-server"
+        assert get_safety_mode() == SafetyMode.DISABLE_DESTRUCTIVE
+        assert server.non_destructive is True
+
+    def test_mcp_server_init_with_config_file(self):
+        """Test MCP server initialization with config file."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        from kubectl_mcp_tool.safety import SafetyMode, set_safety_mode, get_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        # Create a temporary config file with valid transport
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.toml', delete=False) as f:
+            f.write("""
+[server]
+transport = "stdio"
+port = 9000
+
+[safety]
+mode = "read-only"
+""")
+            config_file = f.name
+
+        try:
+            server = MCPServer("test-server", config_file=config_file)
+            assert server.name == "test-server"
+            assert server.config is not None
+            # Config file sets read-only mode
+            assert get_safety_mode() == SafetyMode.READ_ONLY
+        finally:
+            os.unlink(config_file)
+
+    def test_mcp_server_has_stats_collector(self):
+        """Test MCP server has stats collector initialized."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        from kubectl_mcp_tool.safety import SafetyMode, set_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        server = MCPServer("test-server")
+        assert server._stats is not None
+        # Can get stats
+        stats = server._stats.get_stats()
+        assert "uptime_seconds" in stats
+        assert "tool_calls_total" in stats
+
+    def test_mcp_server_reload_callback(self):
+        """Test MCP server registers reload callback."""
+        from kubectl_mcp_tool.mcp_server import MCPServer
+        from kubectl_mcp_tool.config import reload_config
+        from kubectl_mcp_tool.safety import SafetyMode, set_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        server = MCPServer("test-server")
+
+        # Reload config should not raise
+        # The callback is registered and will be called
+        try:
+            reload_config()
+        except Exception:
+            # Config files may not exist, which is fine
+            pass
+
+    def test_cli_parameters_read_only(self):
+        """Test CLI parameters for read-only mode."""
+        from kubectl_mcp_tool.safety import SafetyMode, set_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        # Verify the set_safety_mode works as expected
+        set_safety_mode(SafetyMode.READ_ONLY)
+        from kubectl_mcp_tool.safety import get_safety_mode
+        assert get_safety_mode() == SafetyMode.READ_ONLY
+
+    def test_cli_parameters_disable_destructive(self):
+        """Test CLI parameters for disable-destructive mode."""
+        from kubectl_mcp_tool.safety import SafetyMode, set_safety_mode, get_safety_mode
+
+        # Reset to normal mode first
+        set_safety_mode(SafetyMode.NORMAL)
+
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+        assert get_safety_mode() == SafetyMode.DISABLE_DESTRUCTIVE
+
+
+class TestMCPServerObservability:
+    """Test observability integration in MCP server."""
+
+    def test_stats_collector_integration(self):
+        """Test stats collector is available in MCP server."""
+        from kubectl_mcp_tool.observability import get_stats_collector
+
+        stats = get_stats_collector()
+        assert stats is not None
+
+        # Record some calls
+        stats.record_tool_call("integration_test_tool", success=True, duration=0.1)
+        tool_stats = stats.get_tool_stats("integration_test_tool")
+        assert tool_stats is not None
+        assert tool_stats["calls"] >= 1
+        assert tool_stats["errors"] == 0
+
+    def test_metrics_availability(self):
+        """Test Prometheus metrics availability check."""
+        from kubectl_mcp_tool.observability import is_prometheus_available, get_metrics
+
+        # Check availability (may or may not be installed)
+        available = is_prometheus_available()
+
+        if available:
+            metrics = get_metrics()
+            assert isinstance(metrics, str)
+
+
+class TestMCPServerConfig:
+    """Test config integration in MCP server."""
+
+    def test_load_config(self):
+        """Test config loading."""
+        from kubectl_mcp_tool.config import load_config
+
+        config = load_config()
+        assert config is not None
+        assert hasattr(config, 'server')
+        assert hasattr(config, 'safety')
+        assert hasattr(config, 'browser')
+
+    def test_config_reload_callbacks(self):
+        """Test config reload callback registration."""
+        from kubectl_mcp_tool.config import (
+            register_reload_callback,
+            unregister_reload_callback,
+        )
+
+        callback_called = []
+
+        def test_callback(config):
+            callback_called.append(config)
+
+        register_reload_callback(test_callback)
+
+        # Unregister to clean up
+        unregister_reload_callback(test_callback)
+
+        # Verify unregister worked
+        assert len(callback_called) == 0  # Not called since we unregistered
+
+
+class TestMCPServerSafety:
+    """Test safety mode integration in MCP server."""
+
+    def test_safety_mode_info(self):
+        """Test safety mode info retrieval."""
+        from kubectl_mcp_tool.safety import (
+            SafetyMode,
+            set_safety_mode,
+            get_mode_info,
+        )
+
+        set_safety_mode(SafetyMode.NORMAL)
+        info = get_mode_info()
+        assert info["mode"] == "normal"
+        assert "description" in info
+        assert info["blocked_operations"] == []
+
+        set_safety_mode(SafetyMode.READ_ONLY)
+        info = get_mode_info()
+        assert info["mode"] == "read_only"
+        assert len(info["blocked_operations"]) > 0
+
+    def test_operation_allowed_check(self):
+        """Test operation allowed check."""
+        from kubectl_mcp_tool.safety import (
+            SafetyMode,
+            set_safety_mode,
+            is_operation_allowed,
+        )
+
+        set_safety_mode(SafetyMode.NORMAL)
+        allowed, reason = is_operation_allowed("delete_pod")
+        assert allowed is True
+        assert reason == ""
+
+        set_safety_mode(SafetyMode.READ_ONLY)
+        allowed, reason = is_operation_allowed("delete_pod")
+        assert allowed is False
+        assert "blocked" in reason.lower()
+
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+        allowed, reason = is_operation_allowed("delete_pod")
+        assert allowed is False
+        assert "blocked" in reason.lower()
+
+        # Non-destructive write should be allowed
+        allowed, reason = is_operation_allowed("create_deployment")
+        assert allowed is True