k8s.io/apiserver@v0.31.1/pkg/authorization/metrics/metrics_test.go (about)

     1  /*
     2  Copyright 2024 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package metrics
    18  
    19  import (
    20  	"context"
    21  	"strings"
    22  	"testing"
    23  
    24  	"k8s.io/apiserver/pkg/authorization/authorizer"
    25  	"k8s.io/component-base/metrics/legacyregistry"
    26  	"k8s.io/component-base/metrics/testutil"
    27  )
    28  
    29  func TestRecordAuthorizationDecisionsTotal(t *testing.T) {
    30  	prefix := `
    31      # HELP apiserver_authorization_decisions_total [ALPHA] Total number of terminal decisions made by an authorizer split by authorizer type, name, and decision.
    32      # TYPE apiserver_authorization_decisions_total counter`
    33  	metrics := []string{
    34  		namespace + "_" + subsystem + "_decisions_total",
    35  	}
    36  
    37  	authorizationDecisionsTotal.Reset()
    38  	RegisterMetrics()
    39  
    40  	dummyAuthorizer := &dummyAuthorizer{}
    41  	a := InstrumentedAuthorizer("mytype", "myname", dummyAuthorizer)
    42  
    43  	// allow
    44  	{
    45  		dummyAuthorizer.decision = authorizer.DecisionAllow
    46  		_, _, _ = a.Authorize(context.Background(), nil)
    47  		expectedValue := prefix + `
    48  			apiserver_authorization_decisions_total{decision="allowed",name="myname",type="mytype"} 1
    49  		`
    50  		if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil {
    51  			t.Fatal(err)
    52  		}
    53  		authorizationDecisionsTotal.Reset()
    54  	}
    55  
    56  	// deny
    57  	{
    58  		dummyAuthorizer.decision = authorizer.DecisionDeny
    59  		_, _, _ = a.Authorize(context.Background(), nil)
    60  		_, _, _ = a.Authorize(context.Background(), nil)
    61  		expectedValue := prefix + `
    62  			apiserver_authorization_decisions_total{decision="denied",name="myname",type="mytype"} 2
    63  		`
    64  		if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil {
    65  			t.Fatal(err)
    66  		}
    67  		authorizationDecisionsTotal.Reset()
    68  	}
    69  
    70  	// no-opinion emits no metric
    71  	{
    72  		dummyAuthorizer.decision = authorizer.DecisionNoOpinion
    73  		_, _, _ = a.Authorize(context.Background(), nil)
    74  		_, _, _ = a.Authorize(context.Background(), nil)
    75  		expectedValue := prefix + `
    76  		`
    77  		if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil {
    78  			t.Fatal(err)
    79  		}
    80  		authorizationDecisionsTotal.Reset()
    81  	}
    82  
    83  	// unknown decision emits a metric
    84  	{
    85  		dummyAuthorizer.decision = authorizer.DecisionDeny + 10
    86  		_, _, _ = a.Authorize(context.Background(), nil)
    87  		expectedValue := prefix + `
    88  			apiserver_authorization_decisions_total{decision="unknown",name="myname",type="mytype"} 1
    89  		`
    90  		if err := testutil.GatherAndCompare(legacyregistry.DefaultGatherer, strings.NewReader(expectedValue), metrics...); err != nil {
    91  			t.Fatal(err)
    92  		}
    93  		authorizationDecisionsTotal.Reset()
    94  	}
    95  
    96  }
    97  
    98  type dummyAuthorizer struct {
    99  	decision authorizer.Decision
   100  	err      error
   101  }
   102  
   103  func (d *dummyAuthorizer) Authorize(ctx context.Context, attrs authorizer.Attributes) (authorizer.Decision, string, error) {
   104  	return d.decision, "", d.err
   105  }