From cbae34a2b1325712242f5cb7b119a5ce68ff4e6b Mon Sep 17 00:00:00 2001 From: Nont Date: Tue, 26 Aug 2025 18:32:05 -0500 Subject: [PATCH 1/6] Address comments from previous PR Signed-off-by: Nont --- .../validatingadmissionpolicy.go | 2 - test/e2e/managed_resource_vap_test.go | 84 ++++++++++++++++--- test/e2e/setup_test.go | 2 +- 3 files changed, 75 insertions(+), 13 deletions(-) diff --git a/pkg/webhook/managedresource/validatingadmissionpolicy.go b/pkg/webhook/managedresource/validatingadmissionpolicy.go index e86b09ae8..73b4a9b16 100644 --- a/pkg/webhook/managedresource/validatingadmissionpolicy.go +++ b/pkg/webhook/managedresource/validatingadmissionpolicy.go @@ -50,7 +50,6 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, }, - ResourceNames: []string{"default"}, }, { RuleWithOperations: admv1.RuleWithOperations{ @@ -61,7 +60,6 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, }, - ResourceNames: []string{"default"}, }, }, }, diff --git a/test/e2e/managed_resource_vap_test.go b/test/e2e/managed_resource_vap_test.go index d538d2576..6f86c30e2 100644 --- a/test/e2e/managed_resource_vap_test.go +++ b/test/e2e/managed_resource_vap_test.go @@ -25,11 +25,12 @@ import ( . "github.com/onsi/gomega" admissionregistrationv1 "k8s.io/api/admissionregistration/v1" corev1 "k8s.io/api/core/v1" + networkingv1 "k8s.io/api/networking/v1" k8sErrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" - testutils "go.goms.io/fleet/test/e2e/v1alpha1/utils" + placementv1beta1 "go.goms.io/fleet/apis/placement/v1beta1" ) const ( @@ -39,14 +40,16 @@ const ( vapBindingName = "aks-fleet-managed-by-arm" ) +var managedByLabelMap = map[string]string{ + managedByLabel: managedByLabelValue, +} + // Helper functions for creating managed resources func createManagedNamespace(name string) *corev1.Namespace { return &corev1.Namespace{ ObjectMeta: metav1.ObjectMeta{ - Name: name, - Labels: map[string]string{ - managedByLabel: managedByLabelValue, - }, + Name: name, + Labels: managedByLabelMap, }, } } @@ -72,7 +75,7 @@ func expectDeniedByVAP(err error) { } var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("managedresource"), Ordered, func() { - BeforeAll(func() { + It("The VAP and its binding should exist", func() { var vap admissionregistrationv1.ValidatingAdmissionPolicy Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vap)).Should(Succeed(), "ValidatingAdmissionPolicy should be installed") @@ -93,7 +96,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag } ns.Annotations = map[string]string{"test": "annotation"} return notMasterUser.Update(ctx, &ns) - }, testutils.PollTimeout, testutils.PollInterval).Should(Succeed()) + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) By("expecting successful DELETE operation on unmanaged namespace") Expect(notMasterUser.Delete(ctx, unmanagedNS)).To(Succeed()) @@ -123,7 +126,6 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag if err != nil { Expect(k8sErrors.IsNotFound(err)).To(BeTrue()) } - Expect(sysMastersClient.Create(ctx, managedNS)).To(Succeed()) var ns corev1.Namespace err = sysMastersClient.Get(ctx, types.NamespacedName{Name: managedNS.Name}, &ns) @@ -151,7 +153,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag return updateErr } return nil - }, testutils.PollTimeout, testutils.PollInterval).Should(Succeed()) + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) expectDeniedByVAP(updateErr) }) @@ -170,7 +172,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag return updateErr } return nil - }, testutils.PollTimeout, testutils.PollInterval).Should(Succeed()) + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) }) AfterAll(func() { @@ -180,4 +182,66 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag } }) }) + + Context("For other resources in scope", func() { + It("should deny creating managed resource quotas", func() { + Eventually(func() error { + rq := corev1.ResourceQuota{ + ObjectMeta: metav1.ObjectMeta{ + Name: "managedrq", + Namespace: "default", + Labels: managedByLabelMap, + }, + } + err := notMasterUser.Create(ctx, &rq) + if k8sErrors.IsConflict(err) { + return err + } + expectDeniedByVAP(err) + return nil + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }) + It("should deny creating managed network policy", func() { + Eventually(func() error { + np := networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "managednp", + Namespace: "default", + Labels: managedByLabelMap, + }, + } + err := notMasterUser.Create(ctx, &np) + if k8sErrors.IsConflict(err) { + return err + } + expectDeniedByVAP(err) + return nil + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }) + It("should deny creating managed CRP", func() { + Eventually(func() error { + crp := placementv1beta1.ClusterResourcePlacement{ + ObjectMeta: metav1.ObjectMeta{ + Name: "managedcrp", + Labels: managedByLabelMap, + }, + Spec: placementv1beta1.PlacementSpec{ + ResourceSelectors: []placementv1beta1.ClusterResourceSelector{ + { + Group: "", + Version: "v1", + Kind: "Namespace", + }, + }, + }, + } + err := notMasterUser.Create(ctx, &crp) + if k8sErrors.IsConflict(err) { + return err + } + expectDeniedByVAP(err) + return nil + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }) + }) }) diff --git a/test/e2e/setup_test.go b/test/e2e/setup_test.go index 2aa14c39e..4b2c8a302 100644 --- a/test/e2e/setup_test.go +++ b/test/e2e/setup_test.go @@ -336,7 +336,7 @@ func beforeSuiteForAllProcesses() { notMasterUser = hubCluster.ImpersonateKubeClient Expect(notMasterUser).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster") sysMastersClient = hubCluster.SystemMastersClient - Expect(notMasterUser).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster") + Expect(sysMastersClient).NotTo(BeNil(), "Failed to initialize impersonate client for accessing Kubernetes cluster") var pricingProvider1 trackers.PricingProvider if isAzurePropertyProviderEnabled { From 82d4309feca0428a329c8fb6cdf9254d6ae46f8b Mon Sep 17 00:00:00 2001 From: Nont Date: Wed, 27 Aug 2025 12:01:12 -0500 Subject: [PATCH 2/6] Limit the enforcement blast radius Signed-off-by: Nont --- pkg/webhook/managedresource/validatingadmissionpolicy.go | 2 ++ test/e2e/managed_resource_vap_test.go | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/pkg/webhook/managedresource/validatingadmissionpolicy.go b/pkg/webhook/managedresource/validatingadmissionpolicy.go index 73b4a9b16..e86b09ae8 100644 --- a/pkg/webhook/managedresource/validatingadmissionpolicy.go +++ b/pkg/webhook/managedresource/validatingadmissionpolicy.go @@ -50,6 +50,7 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, }, + ResourceNames: []string{"default"}, }, { RuleWithOperations: admv1.RuleWithOperations{ @@ -60,6 +61,7 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, }, + ResourceNames: []string{"default"}, }, }, }, diff --git a/test/e2e/managed_resource_vap_test.go b/test/e2e/managed_resource_vap_test.go index 6f86c30e2..2ac9fe723 100644 --- a/test/e2e/managed_resource_vap_test.go +++ b/test/e2e/managed_resource_vap_test.go @@ -188,7 +188,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag Eventually(func() error { rq := corev1.ResourceQuota{ ObjectMeta: metav1.ObjectMeta{ - Name: "managedrq", + Name: "default", Namespace: "default", Labels: managedByLabelMap, }, @@ -205,7 +205,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag Eventually(func() error { np := networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ - Name: "managednp", + Name: "default", Namespace: "default", Labels: managedByLabelMap, }, From 4f7a0a767a8edf01ba4060e1a527888f9eeba9b7 Mon Sep 17 00:00:00 2001 From: Nont Date: Wed, 10 Sep 2025 13:51:01 -0500 Subject: [PATCH 3/6] Add tests for other resource types Signed-off-by: Nont --- test/e2e/managed_resource_vap_test.go | 168 ++++++++++++++++---------- 1 file changed, 101 insertions(+), 67 deletions(-) diff --git a/test/e2e/managed_resource_vap_test.go b/test/e2e/managed_resource_vap_test.go index 2ac9fe723..d21f78990 100644 --- a/test/e2e/managed_resource_vap_test.go +++ b/test/e2e/managed_resource_vap_test.go @@ -45,19 +45,53 @@ var managedByLabelMap = map[string]string{ } // Helper functions for creating managed resources -func createManagedNamespace(name string) *corev1.Namespace { +func createUnmanagedNamespace(name string) *corev1.Namespace { return &corev1.Namespace{ ObjectMeta: metav1.ObjectMeta{ - Name: name, - Labels: managedByLabelMap, + Name: name, }, } } +func createManagedNamespace(name string) *corev1.Namespace { + ns := createUnmanagedNamespace(name) + ns.Labels = managedByLabelMap + return ns +} -func createUnmanagedNamespace(name string) *corev1.Namespace { - return &corev1.Namespace{ +func createManagedResourceQuota(ns, name string) *corev1.ResourceQuota { + return &corev1.ResourceQuota{ ObjectMeta: metav1.ObjectMeta{ - Name: name, + Name: name, + Namespace: ns, + Labels: managedByLabelMap, + }, + } +} + +func createManagedNetworkPolicy(ns, name string) *networkingv1.NetworkPolicy { + return &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: ns, + Labels: managedByLabelMap, + }, + } +} + +func createManagedCRP(name string) *placementv1beta1.ClusterResourcePlacement { + return &placementv1beta1.ClusterResourcePlacement{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Labels: managedByLabelMap, + }, + Spec: placementv1beta1.PlacementSpec{ + ResourceSelectors: []placementv1beta1.ResourceSelectorTerm{ + { + Group: "", + Version: "v1", + Kind: "Namespace", + }, + }, }, } } @@ -175,6 +209,67 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) }) + Context("For other resources in scope", func() { + + It("should deny creating managed resource quotas", func() { + rq := createManagedResourceQuota("default", "default") + err := notMasterUser.Create(ctx, rq) + expectDeniedByVAP(err) + }) + + It("should deny creating managed network policy", func() { + np := createManagedNetworkPolicy("default", "default") + err := notMasterUser.Create(ctx, np) + expectDeniedByVAP(err) + }) + + It("should deny creating managed CRP", func() { + crp := createManagedCRP("test-crp") + err := notMasterUser.Create(ctx, crp) + expectDeniedByVAP(err) + }) + + It("general expected behavior of other resources", func() { + rq := createManagedResourceQuota("default", "default") + np := createManagedNetworkPolicy("default", "default") + crp := createManagedCRP("test-crp") + err := sysMastersClient.Create(ctx, rq) + Expect(err).To(BeNil(), "system:masters user should create managed ResourceQuota") + err = sysMastersClient.Create(ctx, np) + Expect(err).To(BeNil(), "system:masters user should create managed NetworkPolicy") + err = sysMastersClient.Create(ctx, crp) + Expect(err).To(BeNil(), "system:masters user should create managed CRP") + + var updateErr error + Eventually(func() error { + var urq corev1.ResourceQuota + if err := sysMastersClient.Get(ctx, types.NamespacedName{Name: "default", Namespace: "default"}, &urq); err != nil { + return err + } + urq.Annotations = map[string]string{"test": "annotation"} + By("expecting denial of UPDATE operation on managed namespace") + updateErr = notMasterUser.Update(ctx, &urq) + if k8sErrors.IsConflict(updateErr) { + return updateErr + } + return nil + }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + expectDeniedByVAP(updateErr) + + err = notMasterUser.Delete(ctx, np) + expectDeniedByVAP(err) + err = notMasterUser.Delete(ctx, crp) + expectDeniedByVAP(err) + + err = sysMastersClient.Delete(ctx, rq) + Expect(err).To(BeNil(), "system:masters user should create managed ResourceQuota") + err = sysMastersClient.Delete(ctx, np) + Expect(err).To(BeNil(), "system:masters user should create managed NetworkPolicy") + err = sysMastersClient.Delete(ctx, crp) + Expect(err).To(BeNil(), "system:masters user should create managed CRP") + }) + }) + AfterAll(func() { err := sysMastersClient.Delete(ctx, managedNS) if err != nil { @@ -183,65 +278,4 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag }) }) - Context("For other resources in scope", func() { - It("should deny creating managed resource quotas", func() { - Eventually(func() error { - rq := corev1.ResourceQuota{ - ObjectMeta: metav1.ObjectMeta{ - Name: "default", - Namespace: "default", - Labels: managedByLabelMap, - }, - } - err := notMasterUser.Create(ctx, &rq) - if k8sErrors.IsConflict(err) { - return err - } - expectDeniedByVAP(err) - return nil - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) - }) - It("should deny creating managed network policy", func() { - Eventually(func() error { - np := networkingv1.NetworkPolicy{ - ObjectMeta: metav1.ObjectMeta{ - Name: "default", - Namespace: "default", - Labels: managedByLabelMap, - }, - } - err := notMasterUser.Create(ctx, &np) - if k8sErrors.IsConflict(err) { - return err - } - expectDeniedByVAP(err) - return nil - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) - }) - It("should deny creating managed CRP", func() { - Eventually(func() error { - crp := placementv1beta1.ClusterResourcePlacement{ - ObjectMeta: metav1.ObjectMeta{ - Name: "managedcrp", - Labels: managedByLabelMap, - }, - Spec: placementv1beta1.PlacementSpec{ - ResourceSelectors: []placementv1beta1.ClusterResourceSelector{ - { - Group: "", - Version: "v1", - Kind: "Namespace", - }, - }, - }, - } - err := notMasterUser.Create(ctx, &crp) - if k8sErrors.IsConflict(err) { - return err - } - expectDeniedByVAP(err) - return nil - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) - }) - }) }) From a54993b6604e66421604e8d01edcae0f19538545 Mon Sep 17 00:00:00 2001 From: Nont Date: Thu, 11 Sep 2025 15:51:26 -0500 Subject: [PATCH 4/6] Fix comments Signed-off-by: Nont --- .../managedresource/validatingadmissionpolicy.go | 8 ++++---- .../managedresource/validatingadmissionpolicy_test.go | 2 +- test/e2e/managed_resource_vap_test.go | 11 +++++------ 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/pkg/webhook/managedresource/validatingadmissionpolicy.go b/pkg/webhook/managedresource/validatingadmissionpolicy.go index e86b09ae8..fdf7ad631 100644 --- a/pkg/webhook/managedresource/validatingadmissionpolicy.go +++ b/pkg/webhook/managedresource/validatingadmissionpolicy.go @@ -36,7 +36,7 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { Rule: admv1.Rule{ APIGroups: []string{""}, Resources: []string{"namespaces"}, - APIVersions: []string{"*"}, + APIVersions: []string{"v1"}, }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, }, @@ -46,7 +46,7 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { Rule: admv1.Rule{ APIGroups: []string{""}, Resources: []string{"resourcequotas"}, - APIVersions: []string{"*"}, + APIVersions: []string{"v1"}, }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, }, @@ -80,7 +80,7 @@ func GetValidatingAdmissionPolicy(isHub bool) *admv1.ValidatingAdmissionPolicy { RuleWithOperations: admv1.RuleWithOperations{ Rule: admv1.Rule{ APIGroups: []string{"placement.kubernetes-fleet.io"}, - Resources: []string{"clusterresourceplacements"}, + Resources: []string{"*"}, APIVersions: []string{"*"}, }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, @@ -101,7 +101,7 @@ func GetValidatingAdmissionPolicyBinding() *admv1.ValidatingAdmissionPolicyBindi Name: resourceName, }, Spec: admv1.ValidatingAdmissionPolicyBindingSpec{ - PolicyName: "aks-fleet-managed-by-arm", + PolicyName: resourceName, ValidationActions: []admv1.ValidationAction{ admv1.Deny, }, diff --git a/pkg/webhook/managedresource/validatingadmissionpolicy_test.go b/pkg/webhook/managedresource/validatingadmissionpolicy_test.go index 403734ca2..d894cea3f 100644 --- a/pkg/webhook/managedresource/validatingadmissionpolicy_test.go +++ b/pkg/webhook/managedresource/validatingadmissionpolicy_test.go @@ -41,7 +41,7 @@ func TestGetValidatingAdmissionPolicy(t *testing.T) { RuleWithOperations: admv1.RuleWithOperations{ Rule: admv1.Rule{ APIGroups: []string{"placement.kubernetes-fleet.io"}, - Resources: []string{"clusterresourceplacements"}, + Resources: []string{"*"}, APIVersions: []string{"*"}, }, Operations: []admv1.OperationType{admv1.Create, admv1.Update, admv1.Delete}, diff --git a/test/e2e/managed_resource_vap_test.go b/test/e2e/managed_resource_vap_test.go index d21f78990..18722c040 100644 --- a/test/e2e/managed_resource_vap_test.go +++ b/test/e2e/managed_resource_vap_test.go @@ -37,7 +37,6 @@ const ( managedByLabel = "fleet.azure.com/managed-by" managedByLabelValue = "arm" vapName = "aks-fleet-managed-by-arm" - vapBindingName = "aks-fleet-managed-by-arm" ) var managedByLabelMap = map[string]string{ @@ -114,7 +113,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vap)).Should(Succeed(), "ValidatingAdmissionPolicy should be installed") var vapBinding admissionregistrationv1.ValidatingAdmissionPolicyBinding - Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapBindingName}, &vapBinding)).Should(Succeed(), "ValidatingAdmissionPolicyBinding should be installed") + Expect(sysMastersClient.Get(ctx, types.NamespacedName{Name: vapName}, &vapBinding)).Should(Succeed(), "ValidatingAdmissionPolicyBinding should be installed") }) It("should allow operations on unmanaged namespace for non-system:masters user", func() { @@ -130,7 +129,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag } ns.Annotations = map[string]string{"test": "annotation"} return notMasterUser.Update(ctx, &ns) - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }, eventuallyDuration, eventuallyInterval).Should(Succeed()) By("expecting successful DELETE operation on unmanaged namespace") Expect(notMasterUser.Delete(ctx, unmanagedNS)).To(Succeed()) @@ -187,7 +186,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag return updateErr } return nil - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }, eventuallyDuration, eventuallyInterval).Should(Succeed()) expectDeniedByVAP(updateErr) }) @@ -206,7 +205,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag return updateErr } return nil - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }, eventuallyDuration, eventuallyInterval).Should(Succeed()) }) Context("For other resources in scope", func() { @@ -253,7 +252,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag return updateErr } return nil - }, eventuallyDuration, workloadEventuallyDuration).Should(Succeed()) + }, eventuallyDuration, eventuallyInterval).Should(Succeed()) expectDeniedByVAP(updateErr) err = notMasterUser.Delete(ctx, np) From 358ae6587999c53f55792e8c3b8e07658481f018 Mon Sep 17 00:00:00 2001 From: Nont Date: Fri, 12 Sep 2025 16:26:56 -0500 Subject: [PATCH 5/6] Fix using the wrong client for test Signed-off-by: Nont --- test/e2e/managed_resource_vap_test.go | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/test/e2e/managed_resource_vap_test.go b/test/e2e/managed_resource_vap_test.go index 18722c040..5a89deb4c 100644 --- a/test/e2e/managed_resource_vap_test.go +++ b/test/e2e/managed_resource_vap_test.go @@ -200,7 +200,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag } ns.Annotations = map[string]string{"test": "annotation"} By("expecting denial of UPDATE operation on managed namespace") - updateErr = notMasterUser.Update(ctx, &ns) + updateErr = sysMastersClient.Update(ctx, &ns) if k8sErrors.IsConflict(updateErr) { return updateErr } @@ -209,7 +209,6 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag }) Context("For other resources in scope", func() { - It("should deny creating managed resource quotas", func() { rq := createManagedResourceQuota("default", "default") err := notMasterUser.Create(ctx, rq) @@ -276,5 +275,4 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag } }) }) - }) From b0310b7c9c0c9fe4805d2bf9f02f6b61c9f2f555 Mon Sep 17 00:00:00 2001 From: Nont Date: Mon, 15 Sep 2025 16:07:22 -0500 Subject: [PATCH 6/6] Add an e2e test for another placement resource Signed-off-by: Nont --- test/e2e/managed_resource_vap_test.go | 31 +++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/test/e2e/managed_resource_vap_test.go b/test/e2e/managed_resource_vap_test.go index 5a89deb4c..5bbd641c3 100644 --- a/test/e2e/managed_resource_vap_test.go +++ b/test/e2e/managed_resource_vap_test.go @@ -95,6 +95,25 @@ func createManagedCRP(name string) *placementv1beta1.ClusterResourcePlacement { } } +func createManagedResourcePlacement(name string) *placementv1beta1.ResourcePlacement { + return &placementv1beta1.ResourcePlacement{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: "default", + Labels: managedByLabelMap, + }, + Spec: placementv1beta1.PlacementSpec{ + ResourceSelectors: []placementv1beta1.ResourceSelectorTerm{ + { + Group: "", + Version: "v1", + Kind: "Pod", + }, + }, + }, + } +} + func expectDeniedByVAP(err error) { var statusErr *k8sErrors.StatusError Expect(errors.As(err, &statusErr)).To(BeTrue(), fmt.Sprintf("Expected StatusError, got error %s of type %s", err, reflect.TypeOf(err))) @@ -238,6 +257,10 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag err = sysMastersClient.Create(ctx, crp) Expect(err).To(BeNil(), "system:masters user should create managed CRP") + work := createManagedResourcePlacement("test-work") + err = notMasterUser.Create(ctx, work) + expectDeniedByVAP(err) + var updateErr error Eventually(func() error { var urq corev1.ResourceQuota @@ -245,7 +268,7 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag return err } urq.Annotations = map[string]string{"test": "annotation"} - By("expecting denial of UPDATE operation on managed namespace") + By("expecting denial of UPDATE operation on managed resource quota") updateErr = notMasterUser.Update(ctx, &urq) if k8sErrors.IsConflict(updateErr) { return updateErr @@ -260,11 +283,11 @@ var _ = Describe("ValidatingAdmissionPolicy for Managed Resources", Label("manag expectDeniedByVAP(err) err = sysMastersClient.Delete(ctx, rq) - Expect(err).To(BeNil(), "system:masters user should create managed ResourceQuota") + Expect(err).To(BeNil(), "system:masters user should delete managed ResourceQuota") err = sysMastersClient.Delete(ctx, np) - Expect(err).To(BeNil(), "system:masters user should create managed NetworkPolicy") + Expect(err).To(BeNil(), "system:masters user should delete managed NetworkPolicy") err = sysMastersClient.Delete(ctx, crp) - Expect(err).To(BeNil(), "system:masters user should create managed CRP") + Expect(err).To(BeNil(), "system:masters user should delete managed CRP") }) })