csr_ssa_test.go

package apiserver

import (
	"context"
	"testing"

	"github.com/google/go-cmp/cmp"
	"github.com/google/go-cmp/cmp/cmpopts"
	certificatesv1 "k8s.io/api/certificates/v1"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	certificatesv1applyconfigurations "k8s.io/client-go/applyconfigurations/certificates/v1"
)

func TestSSAOnCSRStatus(t *testing.T) {
	client, closeFn := setup(t)
	defer closeFn()

	csr, err := client.CertificatesV1().CertificateSigningRequests().Create(context.TODO(), &certificatesv1.CertificateSigningRequest{
		ObjectMeta: metav1.ObjectMeta{
			Name: "test-csr",
		},
		Spec: certificatesv1.CertificateSigningRequestSpec{
			SignerName: "example.com/signer",
			Usages:     []certificatesv1.KeyUsage{certificatesv1.UsageAny},
			Request: []byte(`-----BEGIN CERTIFICATE REQUEST-----
MIIByjCCATMCAQAwgYkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKEwpHb29nbGUgSW5jMR8w
HQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MRcwFQYDVQQDEw53d3cuZ29v
Z2xlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApZtYJCHJ4VpVXHfV
IlstQTlO4qC03hjX+ZkPyvdYd1Q4+qbAeTwXmCUKYHThVRd5aXSqlPzyIBwieMZr
WFlRQddZ1IzXAlVRDWwAo60KecqeAXnnUK+5fXoTI/UgWshre8tJ+x/TMHaQKR/J
cIWPhqaQhsJuzZbvAdGA80BLxdMCAwEAAaAAMA0GCSqGSIb3DQEBBQUAA4GBAIhl
4PvFq+e7ipARgI5ZM+GZx6mpCz44DTo0JkwfRDf+BtrsaC0q68eTf2XhYOsq4fkH
Q0uA0aVog3f5iJxCa3Hp5gxbJQ6zV6kJ0TEsuaaOhEko9sdpCoPOnRBm2i/XRD2D
6iNh8f8z0ShGsFqjDgFHyF3o+lUyj+UC6H1QW7bn
-----END CERTIFICATE REQUEST-----`),
		},
	}, metav1.CreateOptions{})
	if err != nil {
		t.Fatalf("failed to create CSR: %v", err)
	}

	if _, err := client.CertificatesV1().CertificateSigningRequests().ApplyStatus(context.TODO(), certificatesv1applyconfigurations.CertificateSigningRequest(csr.Name).WithStatus(
		certificatesv1applyconfigurations.CertificateSigningRequestStatus().WithConditions(
			certificatesv1applyconfigurations.CertificateSigningRequestCondition().
				WithType(certificatesv1.CertificateFailed).
				WithStatus(corev1.ConditionTrue).
				WithReason("SignerValidationFailure").
				WithMessage("fake").
				WithLastUpdateTime(metav1.Now()),
		),
	), metav1.ApplyOptions{FieldManager: "apply-test"}); err != nil {
		t.Fatalf("failed to apply CSR status: %v", err)
	}

	csr, err = client.CertificatesV1().CertificateSigningRequests().Get(context.TODO(), csr.Name, metav1.GetOptions{})
	if err != nil {
		t.Fatalf("failed to get CSR status: %v", err)
	}

	if diff := cmp.Diff(csr.Status.Conditions, []certificatesv1.CertificateSigningRequestCondition{{
		Type:    certificatesv1.CertificateFailed,
		Status:  corev1.ConditionTrue,
		Reason:  "SignerValidationFailure",
		Message: "fake",
	}}, cmpopts.IgnoreFields(certificatesv1.CertificateSigningRequestCondition{}, "LastUpdateTime", "LastTransitionTime")); diff != "" {
		t.Fatalf("got incorrect CSR status conditions: %v", diff)
	}
}