kubectl-mcp-server 1.15.0__py3-none-any.whl → 1.17.0__py3-none-any.whl

tests/test_safety.py

@@ -0,0 +1,218 @@
+"""Tests for safety mode implementation."""
+
+import pytest
+from kubectl_mcp_tool.safety import (
+    SafetyMode,
+    get_safety_mode,
+    set_safety_mode,
+    is_operation_allowed,
+    check_safety_mode,
+    get_mode_info,
+    WRITE_OPERATIONS,
+    DESTRUCTIVE_OPERATIONS,
+)
+
+
+class TestSafetyMode:
+    """Test safety mode enum and state management."""
+
+    def setup_method(self):
+        """Reset safety mode to NORMAL before each test."""
+        set_safety_mode(SafetyMode.NORMAL)
+
+    def test_default_mode_is_normal(self):
+        """Test that default safety mode is NORMAL."""
+        assert get_safety_mode() == SafetyMode.NORMAL
+
+    def test_set_read_only_mode(self):
+        """Test setting read-only mode."""
+        set_safety_mode(SafetyMode.READ_ONLY)
+        assert get_safety_mode() == SafetyMode.READ_ONLY
+
+    def test_set_disable_destructive_mode(self):
+        """Test setting disable-destructive mode."""
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+        assert get_safety_mode() == SafetyMode.DISABLE_DESTRUCTIVE
+
+
+class TestOperationAllowed:
+    """Test is_operation_allowed function."""
+
+    def setup_method(self):
+        """Reset safety mode to NORMAL before each test."""
+        set_safety_mode(SafetyMode.NORMAL)
+
+    def test_all_operations_allowed_in_normal_mode(self):
+        """Test that all operations are allowed in NORMAL mode."""
+        for op in WRITE_OPERATIONS | DESTRUCTIVE_OPERATIONS:
+            allowed, reason = is_operation_allowed(op)
+            assert allowed is True
+            assert reason == ""
+
+    def test_read_operations_allowed_in_all_modes(self):
+        """Test that read operations are allowed in all modes."""
+        read_ops = ["get_pods", "list_namespaces", "describe_deployment", "get_logs"]
+
+        for mode in SafetyMode:
+            set_safety_mode(mode)
+            for op in read_ops:
+                allowed, reason = is_operation_allowed(op)
+                assert allowed is True
+
+    def test_write_operations_blocked_in_read_only_mode(self):
+        """Test that write operations are blocked in READ_ONLY mode."""
+        set_safety_mode(SafetyMode.READ_ONLY)
+
+        for op in WRITE_OPERATIONS:
+            allowed, reason = is_operation_allowed(op)
+            assert allowed is False
+            assert "read-only mode" in reason
+
+    def test_destructive_operations_blocked_in_read_only_mode(self):
+        """Test that destructive operations are blocked in READ_ONLY mode."""
+        set_safety_mode(SafetyMode.READ_ONLY)
+
+        for op in DESTRUCTIVE_OPERATIONS:
+            allowed, reason = is_operation_allowed(op)
+            assert allowed is False
+            assert "read-only mode" in reason
+
+    def test_write_operations_allowed_in_disable_destructive_mode(self):
+        """Test that non-destructive write operations are allowed in DISABLE_DESTRUCTIVE mode."""
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+
+        # Operations that are write but not destructive
+        non_destructive_writes = WRITE_OPERATIONS - DESTRUCTIVE_OPERATIONS
+        for op in non_destructive_writes:
+            allowed, reason = is_operation_allowed(op)
+            assert allowed is True
+
+    def test_destructive_operations_blocked_in_disable_destructive_mode(self):
+        """Test that destructive operations are blocked in DISABLE_DESTRUCTIVE mode."""
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+
+        for op in DESTRUCTIVE_OPERATIONS:
+            allowed, reason = is_operation_allowed(op)
+            assert allowed is False
+            assert "destructive operations are disabled" in reason
+
+
+class TestCheckSafetyModeDecorator:
+    """Test the check_safety_mode decorator."""
+
+    def setup_method(self):
+        """Reset safety mode to NORMAL before each test."""
+        set_safety_mode(SafetyMode.NORMAL)
+
+    def test_decorator_allows_in_normal_mode(self):
+        """Test that decorated function executes in NORMAL mode."""
+        @check_safety_mode
+        def delete_pod():
+            return {"success": True, "message": "Pod deleted"}
+
+        result = delete_pod()
+        assert result["success"] is True
+        assert result["message"] == "Pod deleted"
+
+    def test_decorator_blocks_write_in_read_only_mode(self):
+        """Test that decorated function is blocked in READ_ONLY mode."""
+        set_safety_mode(SafetyMode.READ_ONLY)
+
+        @check_safety_mode
+        def run_pod():
+            return {"success": True, "message": "Pod created"}
+
+        result = run_pod()
+        assert result["success"] is False
+        assert "blocked" in result["error"]
+        assert result["blocked_by"] == "read_only"
+        assert result["operation"] == "run_pod"
+
+    def test_decorator_blocks_destructive_in_disable_destructive_mode(self):
+        """Test that destructive operations are blocked."""
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+
+        @check_safety_mode
+        def delete_deployment():
+            return {"success": True, "message": "Deployment deleted"}
+
+        result = delete_deployment()
+        assert result["success"] is False
+        assert "blocked" in result["error"]
+        assert result["blocked_by"] == "disable_destructive"
+
+    def test_decorator_allows_non_destructive_write_in_disable_destructive_mode(self):
+        """Test that non-destructive writes are allowed in DISABLE_DESTRUCTIVE mode."""
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+
+        @check_safety_mode
+        def scale_deployment():
+            return {"success": True, "message": "Deployment scaled"}
+
+        result = scale_deployment()
+        assert result["success"] is True
+
+
+class TestGetModeInfo:
+    """Test get_mode_info function."""
+
+    def setup_method(self):
+        """Reset safety mode to NORMAL before each test."""
+        set_safety_mode(SafetyMode.NORMAL)
+
+    def test_normal_mode_info(self):
+        """Test mode info in NORMAL mode."""
+        info = get_mode_info()
+        assert info["mode"] == "normal"
+        assert "All operations allowed" in info["description"]
+        assert info["blocked_operations"] == []
+
+    def test_read_only_mode_info(self):
+        """Test mode info in READ_ONLY mode."""
+        set_safety_mode(SafetyMode.READ_ONLY)
+        info = get_mode_info()
+        assert info["mode"] == "read_only"
+        assert "read" in info["description"].lower()
+        assert len(info["blocked_operations"]) > 0
+        assert "delete_pod" in info["blocked_operations"]
+        assert "run_pod" in info["blocked_operations"]
+
+    def test_disable_destructive_mode_info(self):
+        """Test mode info in DISABLE_DESTRUCTIVE mode."""
+        set_safety_mode(SafetyMode.DISABLE_DESTRUCTIVE)
+        info = get_mode_info()
+        assert info["mode"] == "disable_destructive"
+        assert "delete" in info["description"].lower()
+        assert len(info["blocked_operations"]) > 0
+        assert "delete_pod" in info["blocked_operations"]
+        # Non-destructive writes should not be blocked
+        assert "scale_deployment" not in info["blocked_operations"]
+
+
+class TestOperationCategories:
+    """Test that operations are categorized correctly."""
+
+    def test_all_destructive_ops_are_write_ops(self):
+        """Test that all destructive operations are also write operations."""
+        for op in DESTRUCTIVE_OPERATIONS:
+            assert op in WRITE_OPERATIONS, f"{op} is destructive but not in WRITE_OPERATIONS"
+
+    def test_expected_write_operations_exist(self):
+        """Test that expected write operations are defined."""
+        expected = [
+            "run_pod", "delete_pod",
+            "scale_deployment", "restart_deployment",
+            "install_helm_chart", "uninstall_helm_chart",
+            "apply_manifest", "delete_resource",
+        ]
+        for op in expected:
+            assert op in WRITE_OPERATIONS, f"Expected {op} in WRITE_OPERATIONS"
+
+    def test_expected_destructive_operations_exist(self):
+        """Test that expected destructive operations are defined."""
+        expected = [
+            "delete_pod", "delete_deployment", "delete_namespace",
+            "delete_resource", "uninstall_helm_chart",
+        ]
+        for op in expected:
+            assert op in DESTRUCTIVE_OPERATIONS, f"Expected {op} in DESTRUCTIVE_OPERATIONS"

tests/test_tools.py

@@ -1,8 +1,8 @@
 """
 Unit tests for all MCP tools in kubectl-mcp-server.
 
-This module contains comprehensive tests for all 125 Kubernetes tools
-provided by the MCP server (131 total with UI tools).
+This module contains comprehensive tests for all Kubernetes tools
+provided by the MCP server (224 total with ecosystem tools).
 """
 
 import pytest
@@ -12,7 +12,7 @@ from unittest.mock import patch, MagicMock
 from datetime import datetime
 
 
-# Complete list of all 131 tools that must be registered (125 core + 6 UI)
+# Complete list of all 224 tools that must be registered (125 core + 6 UI + 93 ecosystem)
 EXPECTED_TOOLS = [
     # Pods (pods.py)
     "get_pods", "get_logs", "get_pod_events", "check_pod_health", "exec_in_pod",
@@ -65,15 +65,55 @@ EXPECTED_TOOLS = [
     # UI tools (ui.py) - 6 tools for MCP-UI interactive dashboards
     "show_pod_logs_ui", "show_pods_dashboard_ui", "show_resource_yaml_ui",
     "show_cluster_overview_ui", "show_events_timeline_ui", "render_k8s_dashboard_screenshot",
+    # GitOps tools (gitops.py) - 7 tools for Flux and ArgoCD
+    "gitops_apps_list_tool", "gitops_app_get_tool", "gitops_app_sync_tool", "gitops_app_status_tool",
+    "gitops_sources_list_tool", "gitops_source_get_tool", "gitops_detect_engine_tool",
+    # Cert-Manager tools (certs.py) - 9 tools
+    "certs_list_tool", "certs_get_tool", "certs_issuers_list_tool", "certs_issuer_get_tool",
+    "certs_renew_tool", "certs_status_explain_tool", "certs_challenges_list_tool",
+    "certs_requests_list_tool", "certs_detect_tool",
+    # Policy tools (policy.py) - 6 tools for Kyverno and Gatekeeper
+    "policy_list_tool", "policy_get_tool", "policy_violations_list_tool", "policy_explain_denial_tool",
+    "policy_audit_tool", "policy_detect_tool",
+    # Backup tools (backup.py) - 11 tools for Velero
+    "backup_list_tool", "backup_get_tool", "backup_create_tool", "backup_delete_tool",
+    "restore_list_tool", "restore_create_tool", "restore_get_tool", "backup_locations_list_tool",
+    "backup_schedules_list_tool", "backup_schedule_create_tool", "backup_detect_tool",
+    # KEDA tools (keda.py) - 7 tools for autoscaling
+    "keda_scaledobjects_list_tool", "keda_scaledobject_get_tool", "keda_scaledjobs_list_tool",
+    "keda_triggerauths_list_tool", "keda_triggerauth_get_tool", "keda_hpa_list_tool", "keda_detect_tool",
+    # Cilium tools (cilium.py) - 8 tools for network observability
+    "cilium_policies_list_tool", "cilium_policy_get_tool", "cilium_endpoints_list_tool",
+    "cilium_identities_list_tool", "cilium_nodes_list_tool", "cilium_status_tool",
+    "hubble_flows_query_tool", "cilium_detect_tool",
+    # Rollouts tools (rollouts.py) - 11 tools for progressive delivery
+    "rollouts_list_tool", "rollout_get_tool", "rollout_status_tool", "rollout_promote_tool",
+    "rollout_abort_tool", "rollout_retry_tool", "rollout_restart_tool", "analysis_runs_list_tool",
+    "flagger_canaries_list_tool", "flagger_canary_get_tool", "rollouts_detect_tool",
+    # Cluster API tools (capi.py) - 11 tools for cluster lifecycle
+    "capi_clusters_list_tool", "capi_cluster_get_tool", "capi_machines_list_tool",
+    "capi_machine_get_tool", "capi_machinedeployments_list_tool", "capi_machinedeployment_scale_tool",
+    "capi_machinesets_list_tool", "capi_machinehealthchecks_list_tool", "capi_clusterclasses_list_tool",
+    "capi_cluster_kubeconfig_tool", "capi_detect_tool",
+    # KubeVirt tools (kubevirt.py) - 13 tools for VM management
+    "kubevirt_vms_list_tool", "kubevirt_vm_get_tool", "kubevirt_vmis_list_tool",
+    "kubevirt_vm_start_tool", "kubevirt_vm_stop_tool", "kubevirt_vm_restart_tool",
+    "kubevirt_vm_pause_tool", "kubevirt_vm_unpause_tool", "kubevirt_vm_migrate_tool",
+    "kubevirt_datasources_list_tool", "kubevirt_instancetypes_list_tool",
+    "kubevirt_datavolumes_list_tool", "kubevirt_detect_tool",
+    # Istio/Kiali tools (kiali.py) - 10 tools for service mesh
+    "istio_virtualservices_list_tool", "istio_virtualservice_get_tool", "istio_destinationrules_list_tool",
+    "istio_gateways_list_tool", "istio_peerauthentications_list_tool", "istio_authorizationpolicies_list_tool",
+    "istio_proxy_status_tool", "istio_analyze_tool", "istio_sidecar_status_tool", "istio_detect_tool",
 ]
 
 
 class TestAllToolsRegistered:
-    """Comprehensive tests to verify all 131 tools are registered (125 core + 6 UI)."""
+    """Comprehensive tests to verify all 224 tools are registered (125 core + 6 UI + 93 ecosystem)."""
 
     @pytest.mark.unit
-    def test_all_127_tools_registered(self):
-        """Verify all 131 expected tools are registered (excluding optional browser tools)."""
+    def test_all_164_tools_registered(self):
+        """Verify all 224 expected tools are registered (excluding optional browser tools)."""
         import os
         from kubectl_mcp_tool.mcp_server import MCPServer
 
@@ -94,8 +134,8 @@ class TestAllToolsRegistered:
             tools = asyncio.run(get_tools())
             tool_names = {t.name for t in tools}
 
-            # Verify count (131 tools = 125 core + 6 UI, browser tools disabled)
-            assert len(tools) == 131, f"Expected 131 tools, got {len(tools)}"
+            # Verify count (224 tools = 125 core + 6 UI + 93 ecosystem, browser tools disabled)
+            assert len(tools) == 224, f"Expected 224 tools, got {len(tools)}"
 
             # Check for missing tools
             missing_tools = set(EXPECTED_TOOLS) - tool_names
@@ -120,6 +160,16 @@ class TestAllToolsRegistered:
             register_operations_tools,
             register_diagnostics_tools,
             register_cost_tools,
+            register_gitops_tools,
+            register_certs_tools,
+            register_policy_tools,
+            register_backup_tools,
+            register_keda_tools,
+            register_cilium_tools,
+            register_rollouts_tools,
+            register_capi_tools,
+            register_kubevirt_tools,
+            register_istio_tools,
         )
         # All imports should succeed
         assert callable(register_helm_tools)
@@ -133,6 +183,18 @@ class TestAllToolsRegistered:
         assert callable(register_operations_tools)
         assert callable(register_diagnostics_tools)
         assert callable(register_cost_tools)
+        # Ecosystem tools
+        assert callable(register_gitops_tools)
+        assert callable(register_certs_tools)
+        assert callable(register_policy_tools)
+        assert callable(register_backup_tools)
+        # Advanced ecosystem tools
+        assert callable(register_keda_tools)
+        assert callable(register_cilium_tools)
+        assert callable(register_rollouts_tools)
+        assert callable(register_capi_tools)
+        assert callable(register_kubevirt_tools)
+        assert callable(register_istio_tools)
 
     @pytest.mark.unit
     def test_all_tools_have_descriptions(self):

kubectl_mcp_server-1.15.0.dist-info/RECORD

@@ -1,49 +0,0 @@
-kubectl_mcp_server-1.15.0.dist-info/licenses/LICENSE,sha256=nH9Z0W0WNH2oQ4cPrBAU8ldDcHfeI6NUbkSGiazYWgQ,1070
-kubectl_mcp_tool/__init__.py,sha256=umb22NMExrmcVr1J_Dgbg9NZEKk4kk46vx4uEQPgpko,580
-kubectl_mcp_tool/__main__.py,sha256=CE6cTD6PA71Ap0i5_gE17Pb9FcedOJmtGRNzZ5-TFSc,1490
-kubectl_mcp_tool/diagnostics.py,sha256=uwolSoHadRkB-J8PAsabbexfj6sTNCIIRRrABBRXoTU,11776
-kubectl_mcp_tool/k8s_config.py,sha256=E4OqsiMhY5m3N1jgB0JUdzwgKj_kB8S4WbaVirnwvTs,15173
-kubectl_mcp_tool/mcp_server.py,sha256=T1ZQWw9c69VDM11ECxavTc6NYWcjy4q1FpkqW23fiwc,21309
-kubectl_mcp_tool/auth/__init__.py,sha256=ot8ivZZkDtV8Rg0y1UYruwobKCPyxX1svqh35wWxKvY,347
-kubectl_mcp_tool/auth/config.py,sha256=wi3wuJNMyDqMeluDHL0MaJyedIFv5CFVxiUaEVaTvzk,2267
-kubectl_mcp_tool/auth/scopes.py,sha256=KPmuGO0SrTkjzlElWFOV29ie9apTdMklOCkiA-965lI,6147
-kubectl_mcp_tool/auth/verifier.py,sha256=ChZM-UsZJgZc3LjSfw8VfSydkKqKBZ1s8es71LlB_A0,2431
-kubectl_mcp_tool/cli/__init__.py,sha256=NDd1-7_Ira9vx0uNVOUqhkK7S53IOTu0WUBWOKCtap8,1348
-kubectl_mcp_tool/cli/__main__.py,sha256=OxhHqW8YsTd565acTDlZknljPAw6FN9JW7pNtgWIcFE,196
-kubectl_mcp_tool/cli/cli.py,sha256=qy2mQ0uDrQ9qzv5LP_w9sJ2y_yt3Qzx5m2pzh1i-u4o,19694
-kubectl_mcp_tool/cli/errors.py,sha256=nCvopWH9bt8wGRt6RTDoXo7IsKwsdwzRMvJ5OM2a1Eg,9018
-kubectl_mcp_tool/cli/output.py,sha256=N1AUoRDiBe3lA27l96ZSdIA7pa4GqXLOP3PBdyoLHsQ,10060
-kubectl_mcp_tool/prompts/__init__.py,sha256=BacBNfoVxow6aci8Zzcfam3m1oM7yYzM0IRT1L3uCOQ,77
-kubectl_mcp_tool/prompts/prompts.py,sha256=ZfmTCio8NqOYYxF8VVo9f6VWGCS34J8tvmBfhNblr58,22942
-kubectl_mcp_tool/resources/__init__.py,sha256=ERkn0ErlaGi9-dybv4wrAaT8WretvNp6K002h7Agjno,83
-kubectl_mcp_tool/resources/resources.py,sha256=kvK4OM3Ox5cFvWDqJBTXOfBgnRYdoqdvvjsdCg0PJfY,12713
-kubectl_mcp_tool/tools/__init__.py,sha256=tlm6TtwzHbGqQhIAQNAByLjgpDiim3eqdP89Y3JZfiA,1057
-kubectl_mcp_tool/tools/browser.py,sha256=OvXUHzEuciRQInnwLLC16iObOOdniu09b9RT81y7sdc,25338
-kubectl_mcp_tool/tools/cluster.py,sha256=Xyb18x7d1Eg3l0XZ2JMmCOb0c0IbtVCpk2RH2rKgKDY,20944
-kubectl_mcp_tool/tools/core.py,sha256=67Cx1z4DqV0Qd26yXkF1eBXbUIlBB3Qj2W8rOInvb54,17801
-kubectl_mcp_tool/tools/cost.py,sha256=fcFlIv-bsMdKESw-l-T6ECsUplDukNHaqM76JCYVHvQ,29629
-kubectl_mcp_tool/tools/deployments.py,sha256=e138KV30DQhLCnvXntrofx1XdLH0dC0_mlODbzkluKk,18329
-kubectl_mcp_tool/tools/diagnostics.py,sha256=LGpW-cx2ui40IIq4pZPT2O8nVzKCpOEVnnQ1OGUSVt0,7864
-kubectl_mcp_tool/tools/helm.py,sha256=v_d1aH79VCKJmFi-kXG1LwzZRw6OFToyVC7D9tEp99A,61658
-kubectl_mcp_tool/tools/networking.py,sha256=5I-2SHp2kK9OyGJJ9KUU0hetlYoREIfin1J6CJA6HVQ,14309
-kubectl_mcp_tool/tools/operations.py,sha256=c7j1quXwRDoB9pMkmnLZ5Mk4QoCAuEzWVXJl_hmg2tc,24862
-kubectl_mcp_tool/tools/pods.py,sha256=PsjqbudCUEgZdJmBBeHX3qg-mObn9mlVOCpJOU8XBd8,27271
-kubectl_mcp_tool/tools/security.py,sha256=d7WLj-JZwr-0opzkRNWyPdMykvBjdsDCBSZHovDIPLo,13971
-kubectl_mcp_tool/tools/storage.py,sha256=ILI3X5GYXASCETqg3A7X33B7PjwD5UsxL-iDG7yTi_8,5676
-kubectl_mcp_tool/tools/ui.py,sha256=HHi0KM2JTvZFpQjo5V6XkJf02hxFoasec7uyNY5wuuo,39702
-kubectl_mcp_tool/utils/__init__.py,sha256=CHBCpaXwt994DlqyRFkkRky2TK8OmmDl0Gyc28369gI,348
-kubectl_mcp_tool/utils/helpers.py,sha256=W--wiVSKKqmjpxxdLT0J6rmhOQcp1OFk9jLrtQUVpGw,2444
-tests/__init__.py,sha256=qZPXYXv3whkkWhi61Ngzj09GHnIFlVSZrajE0XRk55o,290
-tests/conftest.py,sha256=6054YlpuGleV3Wg8BnVj4lnKWhGk-Eqc9JYTXxOmsXs,10782
-tests/test_auth.py,sha256=PoESfWiN92wSGUdVwLL3Z1AP6C1zUsVmgTI7Q8ZdlxM,11074
-tests/test_browser.py,sha256=45DLXhdz9HcEWHHcS04xe-a7o6KaVH525wXxLXq-dCA,20621
-tests/test_cli.py,sha256=G-f9uByWooe-yUOH0ahBdoft4uz8TC0R0OzDs1Lom-4,10014
-tests/test_prompts.py,sha256=3TcJUvSNxhTqfySW6DCrW9MwiMDumciLQRjjbucwqlA,17803
-tests/test_resources.py,sha256=Z0Ex8WdRz-B3VZa1s0eAaDDGbhy7dRdqy1uFVOe2Qbo,12689
-tests/test_server.py,sha256=lLvgbqutnivSgQMNrki0O48whBQt0UXjdwT047nf0nw,14415
-tests/test_tools.py,sha256=JL_Q1KDQe7uMR66QnLn9aa-zydSyx1GkKgq4wlMOXiU,30654
-kubectl_mcp_server-1.15.0.dist-info/METADATA,sha256=CFKlU2lYLirN-ddE8qUZLGhp7VvUe7i7N1e2zjR0pGk,35139
-kubectl_mcp_server-1.15.0.dist-info/WHEEL,sha256=qELbo2s1Yzl39ZmrAibXA2jjPLUYfnVhUNTlyF1rq0Y,92
-kubectl_mcp_server-1.15.0.dist-info/entry_points.txt,sha256=zeOxQGaNC4r58deEmqsLCU5hfMjF0VqFUt9P5wWsKEM,109
-kubectl_mcp_server-1.15.0.dist-info/top_level.txt,sha256=o5IpfOGG-lqU8rVWJeK9aYC0r4f6qEX09QiBhZlYbkQ,23
-kubectl_mcp_server-1.15.0.dist-info/RECORD,,