github.com/oam-dev/kubevela@v1.9.11/pkg/auth/round_trippers_test.go (about)

     1  /*
     2  
     3   Copyright 2021 The KubeVela Authors.
     4  
     5   Licensed under the Apache License, Version 2.0 (the "License");
     6   you may not use this file except in compliance with the License.
     7   You may obtain a copy of the License at
     8  
     9       http://www.apache.org/licenses/LICENSE-2.0
    10  
    11   Unless required by applicable law or agreed to in writing, software
    12   distributed under the License is distributed on an "AS IS" BASIS,
    13   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    14   See the License for the specific language governing permissions and
    15   limitations under the License.
    16  
    17  */
    18  
    19  package auth
    20  
    21  import (
    22  	"context"
    23  	"net/http"
    24  	"testing"
    25  
    26  	"github.com/stretchr/testify/require"
    27  	authv1 "k8s.io/api/authentication/v1"
    28  	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    29  	utilfeature "k8s.io/apiserver/pkg/util/feature"
    30  	"k8s.io/client-go/transport"
    31  	featuregatetesting "k8s.io/component-base/featuregate/testing"
    32  
    33  	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
    34  	"github.com/oam-dev/kubevela/pkg/features"
    35  	"github.com/oam-dev/kubevela/pkg/oam"
    36  )
    37  
    38  type testRoundTripper struct {
    39  	Request  *http.Request
    40  	Response *http.Response
    41  	Err      error
    42  }
    43  
    44  func (rt *testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
    45  	rt.Request = req
    46  	return rt.Response, rt.Err
    47  }
    48  
    49  func TestImpersonatingRoundTripper(t *testing.T) {
    50  	defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.AuthenticateApplication, true)()
    51  	AuthenticationWithUser = true
    52  	defer func() {
    53  		AuthenticationWithUser = false
    54  	}()
    55  	testSets := map[string]struct {
    56  		ctxFn         func(context.Context) context.Context
    57  		expectedUser  string
    58  		expectedGroup []string
    59  	}{
    60  		"with service account": {
    61  			ctxFn: func(ctx context.Context) context.Context {
    62  				app := &v1beta1.Application{}
    63  				app.SetNamespace("vela-system")
    64  				v1.SetMetaDataAnnotation(&app.ObjectMeta, oam.AnnotationApplicationServiceAccountName, "default")
    65  				return ContextWithUserInfo(ctx, app)
    66  			},
    67  			expectedUser:  "system:serviceaccount:vela-system:default",
    68  			expectedGroup: nil,
    69  		},
    70  		"without service account and app": {
    71  			ctxFn: func(ctx context.Context) context.Context {
    72  				return ContextWithUserInfo(ctx, nil)
    73  			},
    74  			expectedUser:  "",
    75  			expectedGroup: nil,
    76  		},
    77  		"without service account": {
    78  			ctxFn: func(ctx context.Context) context.Context {
    79  				return ContextWithUserInfo(ctx, &v1beta1.Application{})
    80  			},
    81  			expectedUser:  AuthenticationDefaultUser,
    82  			expectedGroup: nil,
    83  		},
    84  		"with user and groups": {
    85  			ctxFn: func(ctx context.Context) context.Context {
    86  				app := &v1beta1.Application{}
    87  				SetUserInfoInAnnotation(&app.ObjectMeta, authv1.UserInfo{
    88  					Username: "username",
    89  					Groups:   []string{"kubevela:group1", "kubevela:group2"},
    90  				})
    91  				return ContextWithUserInfo(ctx, app)
    92  			},
    93  			expectedUser:  "username",
    94  			expectedGroup: []string{"kubevela:group1", "kubevela:group2"},
    95  		},
    96  	}
    97  	for name, ts := range testSets {
    98  		t.Run(name, func(t *testing.T) {
    99  			ctx := ts.ctxFn(context.TODO())
   100  			req, _ := http.NewRequest(http.MethodGet, "/", nil)
   101  			req = req.WithContext(ctx)
   102  			rt := &testRoundTripper{}
   103  			_, err := NewImpersonatingRoundTripper(rt).RoundTrip(req)
   104  			require.NoError(t, err)
   105  			if ts.expectedUser == "" {
   106  				_, ok := rt.Request.Header[transport.ImpersonateUserHeader]
   107  				require.False(t, ok)
   108  				return
   109  			}
   110  			require.Equal(t, ts.expectedUser, rt.Request.Header.Get(transport.ImpersonateUserHeader))
   111  			require.Equal(t, ts.expectedGroup, rt.Request.Header.Values(transport.ImpersonateGroupHeader))
   112  		})
   113  	}
   114  }