k8s.io/kubernetes@v1.29.3/pkg/kubelet/server/auth_test.go (about)

     1  /*
     2  Copyright 2016 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package server
    18  
    19  import (
    20  	"net/http"
    21  	"testing"
    22  
    23  	"github.com/stretchr/testify/assert"
    24  	"github.com/stretchr/testify/require"
    25  	"k8s.io/apiserver/pkg/authentication/user"
    26  	"k8s.io/apiserver/pkg/authorization/authorizer"
    27  )
    28  
    29  func TestIsSubPath(t *testing.T) {
    30  	testcases := map[string]struct {
    31  		subpath  string
    32  		path     string
    33  		expected bool
    34  	}{
    35  		"empty": {subpath: "", path: "", expected: true},
    36  
    37  		"match 1": {subpath: "foo", path: "foo", expected: true},
    38  		"match 2": {subpath: "/foo", path: "/foo", expected: true},
    39  		"match 3": {subpath: "/foo/", path: "/foo/", expected: true},
    40  		"match 4": {subpath: "/foo/bar", path: "/foo/bar", expected: true},
    41  
    42  		"subpath of root 1": {subpath: "/foo", path: "/", expected: true},
    43  		"subpath of root 2": {subpath: "/foo/", path: "/", expected: true},
    44  		"subpath of root 3": {subpath: "/foo/bar", path: "/", expected: true},
    45  
    46  		"subpath of path 1": {subpath: "/foo", path: "/foo", expected: true},
    47  		"subpath of path 2": {subpath: "/foo/", path: "/foo", expected: true},
    48  		"subpath of path 3": {subpath: "/foo/bar", path: "/foo", expected: true},
    49  
    50  		"mismatch 1": {subpath: "/foo", path: "/bar", expected: false},
    51  		"mismatch 2": {subpath: "/foo", path: "/foobar", expected: false},
    52  		"mismatch 3": {subpath: "/foobar", path: "/foo", expected: false},
    53  	}
    54  
    55  	for k, tc := range testcases {
    56  		result := isSubpath(tc.subpath, tc.path)
    57  		if result != tc.expected {
    58  			t.Errorf("%s: expected %v, got %v", k, tc.expected, result)
    59  		}
    60  	}
    61  }
    62  
    63  func TestGetRequestAttributes(t *testing.T) {
    64  	for _, test := range AuthzTestCases() {
    65  		t.Run(test.Method+":"+test.Path, func(t *testing.T) {
    66  			getter := NewNodeAuthorizerAttributesGetter(authzTestNodeName)
    67  
    68  			req, err := http.NewRequest(test.Method, "https://localhost:1234"+test.Path, nil)
    69  			require.NoError(t, err)
    70  			attrs := getter.GetRequestAttributes(AuthzTestUser(), req)
    71  
    72  			test.AssertAttributes(t, attrs)
    73  		})
    74  	}
    75  }
    76  
    77  const (
    78  	authzTestNodeName = "test"
    79  	authzTestUserName = "phibby"
    80  )
    81  
    82  type AuthzTestCase struct {
    83  	Method, Path string
    84  
    85  	ExpectedVerb, ExpectedSubresource string
    86  }
    87  
    88  func (a *AuthzTestCase) AssertAttributes(t *testing.T, attrs authorizer.Attributes) {
    89  	expectedAttributes := authorizer.AttributesRecord{
    90  		User:            AuthzTestUser(),
    91  		APIGroup:        "",
    92  		APIVersion:      "v1",
    93  		Verb:            a.ExpectedVerb,
    94  		Resource:        "nodes",
    95  		Name:            authzTestNodeName,
    96  		Subresource:     a.ExpectedSubresource,
    97  		ResourceRequest: true,
    98  		Path:            a.Path,
    99  	}
   100  
   101  	assert.Equal(t, expectedAttributes, attrs)
   102  }
   103  
   104  func AuthzTestUser() user.Info {
   105  	return &user.DefaultInfo{Name: authzTestUserName}
   106  }
   107  
   108  func AuthzTestCases() []AuthzTestCase {
   109  	// Path -> ExpectedSubresource
   110  	testPaths := map[string]string{
   111  		"/attach/{podNamespace}/{podID}/{containerName}":       "proxy",
   112  		"/attach/{podNamespace}/{podID}/{uid}/{containerName}": "proxy",
   113  		"/checkpoint/{podNamespace}/{podID}/{containerName}":   "proxy",
   114  		"/configz": "proxy",
   115  		"/containerLogs/{podNamespace}/{podID}/{containerName}": "proxy",
   116  		"/debug/flags/v":                                     "proxy",
   117  		"/debug/pprof/{subpath:*}":                           "proxy",
   118  		"/exec/{podNamespace}/{podID}/{containerName}":       "proxy",
   119  		"/exec/{podNamespace}/{podID}/{uid}/{containerName}": "proxy",
   120  		"/healthz":                            "proxy",
   121  		"/healthz/log":                        "proxy",
   122  		"/healthz/ping":                       "proxy",
   123  		"/healthz/syncloop":                   "proxy",
   124  		"/logs/":                              "log",
   125  		"/logs/{logpath:*}":                   "log",
   126  		"/metrics":                            "metrics",
   127  		"/metrics/cadvisor":                   "metrics",
   128  		"/metrics/probes":                     "metrics",
   129  		"/metrics/resource":                   "metrics",
   130  		"/pods/":                              "proxy",
   131  		"/portForward/{podNamespace}/{podID}": "proxy",
   132  		"/portForward/{podNamespace}/{podID}/{uid}":         "proxy",
   133  		"/run/{podNamespace}/{podID}/{containerName}":       "proxy",
   134  		"/run/{podNamespace}/{podID}/{uid}/{containerName}": "proxy",
   135  		"/runningpods/":  "proxy",
   136  		"/stats/":        "stats",
   137  		"/stats/summary": "stats",
   138  	}
   139  	testCases := []AuthzTestCase{}
   140  	for path, subresource := range testPaths {
   141  		testCases = append(testCases,
   142  			AuthzTestCase{"POST", path, "create", subresource},
   143  			AuthzTestCase{"GET", path, "get", subresource},
   144  			AuthzTestCase{"PUT", path, "update", subresource},
   145  			AuthzTestCase{"PATCH", path, "patch", subresource},
   146  			AuthzTestCase{"DELETE", path, "delete", subresource})
   147  	}
   148  	return testCases
   149  }