k8s.io/client-go@v0.31.1/plugin/pkg/client/auth/exec/exec_cache_test.go (about)

     1  /*
     2  Copyright 2022 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package exec_test // separate package to prevent circular import
    18  
    19  import (
    20  	"context"
    21  	"testing"
    22  	"time"
    23  
    24  	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    25  	utilnet "k8s.io/apimachinery/pkg/util/net"
    26  	clientset "k8s.io/client-go/kubernetes"
    27  	"k8s.io/client-go/rest"
    28  	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
    29  )
    30  
    31  // TestExecTLSCache asserts the semantics of the TLS cache when exec auth is used.
    32  //
    33  // In particular, when:
    34  //   - multiple identical rest configs exist as distinct objects, and
    35  //   - these rest configs use exec auth, and
    36  //   - these rest configs are used to create distinct clientsets, then
    37  //
    38  // the underlying TLS config is shared between those clientsets.
    39  func TestExecTLSCache(t *testing.T) {
    40  	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
    41  	t.Cleanup(cancel)
    42  
    43  	config1 := &rest.Config{
    44  		Host: "https://localhost",
    45  		ExecProvider: &clientcmdapi.ExecConfig{
    46  			Command:         "./testdata/test-plugin.sh",
    47  			APIVersion:      "client.authentication.k8s.io/v1",
    48  			InteractiveMode: clientcmdapi.IfAvailableExecInteractiveMode,
    49  		},
    50  	}
    51  	client1 := clientset.NewForConfigOrDie(config1)
    52  
    53  	config2 := &rest.Config{
    54  		Host: "https://localhost",
    55  		ExecProvider: &clientcmdapi.ExecConfig{
    56  			Command:         "./testdata/test-plugin.sh",
    57  			APIVersion:      "client.authentication.k8s.io/v1",
    58  			InteractiveMode: clientcmdapi.IfAvailableExecInteractiveMode,
    59  		},
    60  	}
    61  	client2 := clientset.NewForConfigOrDie(config2)
    62  
    63  	config3 := &rest.Config{
    64  		Host: "https://localhost",
    65  		ExecProvider: &clientcmdapi.ExecConfig{
    66  			Command:         "./testdata/test-plugin.sh",
    67  			Args:            []string{"make this exec auth different"},
    68  			APIVersion:      "client.authentication.k8s.io/v1",
    69  			InteractiveMode: clientcmdapi.IfAvailableExecInteractiveMode,
    70  		},
    71  	}
    72  	client3 := clientset.NewForConfigOrDie(config3)
    73  
    74  	_, _ = client1.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
    75  	_, _ = client2.CoreV1().Namespaces().List(ctx, metav1.ListOptions{})
    76  	_, _ = client3.CoreV1().PersistentVolumes().List(ctx, metav1.ListOptions{})
    77  
    78  	rt1 := client1.RESTClient().(*rest.RESTClient).Client.Transport
    79  	rt2 := client2.RESTClient().(*rest.RESTClient).Client.Transport
    80  	rt3 := client3.RESTClient().(*rest.RESTClient).Client.Transport
    81  
    82  	tlsConfig1, err := utilnet.TLSClientConfig(rt1)
    83  	if err != nil {
    84  		t.Fatal(err)
    85  	}
    86  	tlsConfig2, err := utilnet.TLSClientConfig(rt2)
    87  	if err != nil {
    88  		t.Fatal(err)
    89  	}
    90  	tlsConfig3, err := utilnet.TLSClientConfig(rt3)
    91  	if err != nil {
    92  		t.Fatal(err)
    93  	}
    94  
    95  	if tlsConfig1 == nil || tlsConfig2 == nil || tlsConfig3 == nil {
    96  		t.Fatal("expected non-nil TLS configs")
    97  	}
    98  
    99  	if tlsConfig1 != tlsConfig2 {
   100  		t.Fatal("expected the same TLS config for matching exec config via rest config")
   101  	}
   102  
   103  	if tlsConfig1 == tlsConfig3 {
   104  		t.Fatal("expected different TLS config for non-matching exec config via rest config")
   105  	}
   106  }