nomostest

package
v1.23.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2025 License: Apache-2.0 Imports: 109 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// RegistryUsername is a contrived username used for authenticating to the in-cluster registry
	RegistryUsername = "user"
	// RegistryPassword is a contrived password used for authenticating to the in-cluster registry
	RegistryPassword = "password"
	// RegistryHTTPPort is an HTTP port surfaced on the in-cluster registry.
	RegistryHTTPPort = 5000
	// RegistryHTTPSPort is an HTTPS port surfaced on the in-cluster registry. The HTTPS
	// certificate is signed using a contrived CA.
	RegistryHTTPSPort = 5001
	// RegistryHTTPSAuthPort is an HTTPS port surfaced on the in-cluster registry with
	// basic authentication enabled. The HTTPS certificate is signed using a contrived CA.
	RegistryHTTPSAuthPort = 5002
	// TestRegistryServer is the name of the in-cluster registry Deployment and Service
	TestRegistryServer = "test-registry-server"
	// TestRegistryServerAuthenticated is the name of the in-cluster registry Service
	// which requires basic auth. This endpoint can be used as a sync URL when writing
	// tests to verify basic auth.
	TestRegistryServerAuthenticated = "test-registry-server-auth"
	// TestRegistryNamespace is the namespace used for the in-cluster registry
	TestRegistryNamespace = "test-registry-system"
)
View Source 
const (
	// ConfigSyncE2EFinalizer is a contrived finalizer to block deletion of
	// objects created by the e2e tests.
	ConfigSyncE2EFinalizer = "config-sync/e2e-test"
)
View Source 
const FieldManager = configsync.GroupName + "/nomostest"

FieldManager is the field manager to use when creating, updating, and patching kubernetes objects with kubectl and client-go. This is used to uniquely identify the nomostest client, to enable field pruning and merging. This must be different from the field manager used by config sync, in order to allow both clients to manage different fields on the same objects.

View Source 
const ImagePlaceholder = "SYNC_STATUS_WATCH_CONTROLLER_IMAGE"

ImagePlaceholder is the placeholder in the manifest that will be replaced with the actual image.

View Source 
const ManifestPath = "../../examples/post-sync/sync-watch-manifest.yaml"

ManifestPath is the path to the manifest file.

View Source 
const NomosE2E = "nomos-e2e"

NomosE2E is the subdirectory inside the filesystem's temporary directory in which we write test data.

View Source 
const OCISignatureVerificationNamespace = "oci-image-verification"

OCISignatureVerificationNamespace is the namespace where the OCI signature verification components are deployed.

View Source 
const OCISignatureVerificationServerName = "oci-signature-verification-server"

OCISignatureVerificationServerName is the name of the OCI signature verification server deployment and service.

View Source 
const StatusWatchName = "sync-status-watch"

StatusWatchName is the name of the sync status watch controller.

View Source 
const StatusWatchNamespace = "sync-status-watch"

StatusWatchNamespace is the namespace for the sync status watch controller.

View Source 
const TestImage = testing.TestInfraArtifactRepositoryAddress + "/sync-status-watch-controller:v1.0.0-7824c395"

TestImage is the image used for testing the sync status watch controller.

Variables

View Source 
var (

	// DefaultRootReconcilerName is the root-reconciler name of the default RootSync object: "root-sync".
	DefaultRootReconcilerName = core.RootReconcilerName(configsync.RootSyncName)
	// DefaultRootRepoNamespacedName is the NamespacedName of the default RootSync object.
	DefaultRootRepoNamespacedName = RootSyncNN(configsync.RootSyncName)
	// DefaultRootSyncID is the ID of the default RootSync object.
	DefaultRootSyncID = core.RootSyncID(configsync.RootSyncName)
)
View Source 
var CSNamespaces = []string{
	configmanagement.ControllerNamespace,
	configmanagement.MonitoringNamespace,
	configmanagement.RGControllerNamespace,
}

CSNamespaces is the namespaces of the Config Sync components.

Functions

func CheckImages 

func CheckImages() error

CheckImages ensures that all required images are installed on the local docker registry.

func Clean 

func Clean(nt *NT) error

Clean removes all objects of types registered in the Scheme, with the above caveats. It should be run before and after a test is run against any non-ephemeral cluster.

It is unnecessary to run this on Kind clusters that exist only for the duration of a single test.

func CleanSharedNTs 

func CleanSharedNTs()

CleanSharedNTs tears down the shared test environments.

func CosignPrivateKeyPath 

func CosignPrivateKeyPath(nt *NT) string

CosignPrivateKeyPath returns the private key for signing image

func CreateNamespaceSecrets 

func CreateNamespaceSecrets(nt *NT, ns string) error

CreateNamespaceSecrets creates secrets in a given namespace using local paths. It skips creating the Secret if the GitProvider is CSR or SSM because neither require a Secret.

func DefaultRepoSha1Fn 

func DefaultRepoSha1Fn(nt *NT, nn types.NamespacedName) (string, error)

DefaultRepoSha1Fn is the default function to retrieve the commit hash of the namespace repo.

func DefaultRootSha1Fn 

func DefaultRootSha1Fn(nt *NT, nn types.NamespacedName) (string, error)

DefaultRootSha1Fn is the default function to retrieve the commit hash of the root repo.

func DeleteObjectListItemsAndWait 

func DeleteObjectListItemsAndWait(nt *NT, objList client.ObjectList) error

DeleteObjectListItemsAndWait deletes all the list items in serial and waits for not found in parallel.

func DeleteObjectsAndWait 

func DeleteObjectsAndWait(nt *NT, objs ...client.Object) error

DeleteObjectsAndWait deletes zero or more objects in serial and waits for not found in parallel. NOTE: Deleting in parallel might be faster, but the log would be harder to debug.

func DeletePodByLabel 

func DeletePodByLabel(nt *NT, label, value string, waitForChildren bool) error

DeletePodByLabel deletes pods that have the label and waits until new pods come up.

func DeleteRemoteRepos 

func DeleteRemoteRepos(nt *NT)

DeleteRemoteRepos removes all remote repos on the Git provider.

func FailIfUnknown 

func FailIfUnknown(t testing.NTB, scheme *runtime.Scheme, o client.Object)

FailIfUnknown fails the test if the passed type is not declared in the passed Scheme.

func GetKnownHosts 

func GetKnownHosts(nt *NT) (string, error)

GetKnownHosts will generate and format the key to be used for known_hosts authentication with local git provider

func GitCommitFromSpec 

func GitCommitFromSpec(nt *NT, gitSpec *v1beta1.Git) (string, error)

GitCommitFromSpec returns the latest commit from a Git spec. Uses git ls-remote to avoid needing to clone the repo. Warning: may not work if authentication is required.

func InitGitRepos 

func InitGitRepos(nt *NT, repos ...types.NamespacedName)

InitGitRepos initializes the specified repositories in the test-git-server

func InitSharedEnvironments 

func InitSharedEnvironments() error

InitSharedEnvironments initializes shared test environments. It should be run at the beginning of the test suite if the --share-test-env flag is provided. It will produce a number of test environment equal to the go test parallelism.

func InstallConfigSync 

func InstallConfigSync(nt *NT) error

InstallConfigSync installs ConfigSync on the test cluster

func InstallRootSyncCRD 

func InstallRootSyncCRD(nt *NT) error

InstallRootSyncCRD installs the RootSync CRD on the test cluster

func InstallWebhook 

func InstallWebhook(nt *NT) error

InstallWebhook installs the Config Sync ValidatingWebhookConfiguration object.

func IsEstablished 

func IsEstablished(o client.Object) error

IsEstablished returns true if the given CRD is established on the cluster, which indicates if discovery knows about it yet. For more info see https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#create-a-customresourcedefinition

func IsReconcilerManagerConfigMap 

func IsReconcilerManagerConfigMap(obj client.Object) bool

IsReconcilerManagerConfigMap returns true if passed obj is the reconciler-manager ConfigMap reconciler-manager in config-management namespace.

func IsReconcilerTemplateConfigMap 

func IsReconcilerTemplateConfigMap(obj client.Object) bool

IsReconcilerTemplateConfigMap returns true if passed obj is the reconciler-manager ConfigMap reconciler-manager-cm in config-management namespace.

func MetricLabelsForRepoSync 

func MetricLabelsForRepoSync(nt *NT, syncNN types.NamespacedName) (prometheusmodel.LabelSet, error)

MetricLabelsForRepoSync returns a metric LabelSet that uniquely identifies metrics related to the specified RepoSync, since the latest generation.

func MetricLabelsForRootSync 

func MetricLabelsForRootSync(nt *NT, syncNN types.NamespacedName) (prometheusmodel.LabelSet, error)

MetricLabelsForRootSync returns a metric LabelSet that uniquely identifies metrics related to the specified RootSync, since the latest generation.

func NewPodReady 

func NewPodReady(nt *NT, labelName, currentLabel, childLabel string, oldCurrentPods, oldChildPods []corev1.Pod) error

NewPodReady checks if the new created pods are ready. It also checks if the new children pods that are managed by the pods are ready.

func NewTestWrapper 

func NewTestWrapper(t *testing.T, testFeature nomostesting.Feature, ntOptions ...ntopts.Opt) (nomostesting.NTB, *ntopts.New)

NewTestWrapper creates a test wrapper for use by the tests. This applies a common set of rules across tests, such as test features for selecting sets of tests or rules for skipping certain tests (e.g. StressTest). Usually tests should use nomostest.New but this is surfaced as a public method for test cases which do not need all the features of NT, such as access to a k8s cluster.

func NsReconcilerObjectKey 

func NsReconcilerObjectKey(namespace, syncName string) client.ObjectKey

NsReconcilerObjectKey returns an ObjectKey for interracting with the NsReconciler for the specified RepoSync.

func PrintFeatureDurations 

func PrintFeatureDurations()

PrintFeatureDurations prints the accumulative time duration testing each feature. This is intended to be called at the end of the test suite.

func PublicCertSecretName 

func PublicCertSecretName(sourceType Server) string

PublicCertSecretName is the name of the Secret which contains a CA cert used for HTTPS handshakes of the provided sync source

func RemoteNsRepoSha1Fn 

func RemoteNsRepoSha1Fn(nt *NT, nn types.NamespacedName) (string, error)

RemoteNsRepoSha1Fn returns the latest commit from a RepoSync Git spec.

func RemoteRootRepoSha1Fn 

func RemoteRootRepoSha1Fn(nt *NT, nn types.NamespacedName) (string, error)

RemoteRootRepoSha1Fn returns the latest commit from a RootSync Git spec.

func RepoSyncHasStatusSyncCommit 

func RepoSyncHasStatusSyncCommit(sha1 string) testpredicates.Predicate

RepoSyncHasStatusSyncCommit creates a Predicate that ensures that the .status.sync.commit field on the passed RepoSync matches sha1.

func RepoSyncHasStatusSyncPath 

func RepoSyncHasStatusSyncPath(syncPath string) testpredicates.Predicate

RepoSyncHasStatusSyncPath creates a Predicate that ensures that the .status.sync.gitStatus.dir field on the passed RepoSync matches the provided dir.

func RepoSyncNN 

func RepoSyncNN(ns, name string) types.NamespacedName

RepoSyncNN returns the NamespacedName of the RepoSync object.

func RepoSyncObjectV1Alpha1FromNonRootRepo 

func RepoSyncObjectV1Alpha1FromNonRootRepo(nt *NT, nn types.NamespacedName) *v1alpha1.RepoSync

RepoSyncObjectV1Alpha1FromNonRootRepo returns a v1alpha1 RepoSync object which uses a RepoSync repo from nt.SyncSources.

func RepoSyncObjectV1Beta1FromNonRootRepo 

func RepoSyncObjectV1Beta1FromNonRootRepo(nt *NT, nn types.NamespacedName) *v1beta1.RepoSync

RepoSyncObjectV1Beta1FromNonRootRepo returns a v1beta1 RepoSync object which uses a RepoSync repo from nt.SyncSources. Use nt.RepoSyncObjectGit is you want to change the source expectation.

func RepoSyncObjectV1Beta1FromOtherRootRepo 

func RepoSyncObjectV1Beta1FromOtherRootRepo(nt *NT, nn types.NamespacedName, repoName string) *v1beta1.RepoSync

RepoSyncObjectV1Beta1FromOtherRootRepo returns a v1beta1 RepoSync object which uses a RootSync repo from nt.SyncSources. Use nt.RepoSyncObjectGit is you want to change the source expectation.

func RepoSyncRoleBinding 

func RepoSyncRoleBinding(nn types.NamespacedName) *rbacv1.RoleBinding

RepoSyncRoleBinding returns rolebinding that grants service account permission to manage resources in the namespace.

func Reset 

func Reset(nt *NT) error

Reset performs multi-repo test reset: - Delete unmanaged RootSyncs & RepoSyncs (with deletion propagation) - Validate managed RepoSyncs & RootSyncs are deleted - Delete all test namespaces not containing config-sync itself - Clear Repository-to-RSync assignments

This should cleanly delete or reset all registered RSyncs. Any managed RSyncs must have deletion propagation enabled by the test that created them, otherwise their managed resources will not be deleted when the RSync is deleted. Any unregistered Repos must be reset by individual test Cleanup.

func ResetNamespaces 

func ResetNamespaces(nt *NT, nsList []corev1.Namespace) error

ResetNamespaces resets one or more Namespaces and all their namespaced objects. Use this for resetting Namespaces in tests that use delegated control.

func ResetReconcilerManagerConfigMap 

func ResetReconcilerManagerConfigMap(nt *NT) error

ResetReconcilerManagerConfigMap resets the reconciler manager config map to what is defined in the manifest

func ResetRepoSyncs 

func ResetRepoSyncs(nt *NT, rsList []v1beta1.RepoSync) error

ResetRepoSyncs cleans up one or more RepoSyncs and all their managed objects. Use this for cleaning up RepoSyncs in tests that use delegated control.

To ensure the reconcile finalizer has permission to delete managed resources, ClusterRole and RoleBindings will be created and then later deleted. This also cleans up any CRs, RBs, and CRBs left behind by delegated control.

func ResetRepository 

func ResetRepository(nt *NT, syncKind string, nn types.NamespacedName, sourceFormat configsync.SourceFormat) *gitproviders.ReadWriteRepository

ResetRepository creates or re-initializes a remote repository.

func ResetRootSyncs 

func ResetRootSyncs(nt *NT, rsList []v1beta1.RootSync) error

ResetRootSyncs cleans up one or more RootSyncs and all their managed objects. Use this for cleaning up RootSyncs in tests that use delegated control.

func RestConfig 

func RestConfig(t testing.NTB, opts *ntopts.New)

RestConfig sets up the config for creating a Client connection to a K8s cluster. If --test-cluster=kind, it creates a Kind cluster. If --test-cluster=kubeconfig, it uses the context specified in kubeconfig.

func RootReconcilerObjectKey 

func RootReconcilerObjectKey(syncName string) client.ObjectKey

RootReconcilerObjectKey returns an ObjectKey for interracting with the RootReconciler for the specified RootSync.

func RootSyncHasStatusSyncCommit 

func RootSyncHasStatusSyncCommit(sha1 string) testpredicates.Predicate

RootSyncHasStatusSyncCommit creates a Predicate that ensures that the .status.sync.commit field on the passed RootSync matches sha1.

func RootSyncHasStatusSyncPath 

func RootSyncHasStatusSyncPath(syncPath string) testpredicates.Predicate

RootSyncHasStatusSyncPath creates a Predicate that ensures that the .status.sync.gitStatus.dir field on the passed RootSync matches the provided dir.

func RootSyncNN 

func RootSyncNN(name string) types.NamespacedName

RootSyncNN returns the NamespacedName of the RootSync object.

func RootSyncObjectV1Alpha1FromRootRepo 

func RootSyncObjectV1Alpha1FromRootRepo(nt *NT, name string) *v1alpha1.RootSync

RootSyncObjectV1Alpha1FromRootRepo returns a v1alpha1 RootSync object which uses a RootSync repo from nt.SyncSources.

func RootSyncObjectV1Beta1FromOtherRootRepo 

func RootSyncObjectV1Beta1FromOtherRootRepo(nt *NT, syncName, repoName string) *v1beta1.RootSync

RootSyncObjectV1Beta1FromOtherRootRepo returns a v1beta1 RootSync object which uses a repo from a specific nt.RootRepo. Use nt.RootSyncObjectGit is you want to change the source expectation.

func RootSyncObjectV1Beta1FromRootRepo 

func RootSyncObjectV1Beta1FromRootRepo(nt *NT, name string) *v1beta1.RootSync

RootSyncObjectV1Beta1FromRootRepo returns a v1beta1 RootSync object which uses a RootSync repo from nt.SyncSources. Use nt.RootSyncObjectGit is you want to change the source expectation.

func SetDependencies 

func SetDependencies(obj client.Object, scheme *runtime.Scheme, dependencies ...client.Object) error

SetDependencies sets the specified objects as dependencies of the first object.

func SetExpectedGitCommit 

func SetExpectedGitCommit(nt *NT, syncID core.ID, expectedCommit string)

SetExpectedGitCommit updates the SyncSource for the specified RootSync or RepoSync with the provided Git commit, without changing the git reference of the source being pulled.

func SetExpectedOCIImageDigest 

func SetExpectedOCIImageDigest(nt *NT, syncID core.ID, expectedImageDigest string)

SetExpectedOCIImageDigest updates the SyncSource for the specified RootSync or RepoSync with the provided OCI image digest, without changing the ID of the image being pulled.

func SetExpectedSyncPath 

func SetExpectedSyncPath(nt *NT, syncID core.ID, syncPath string)

SetExpectedSyncPath updates the SyncSource for the specified RootSync or RepoSync with the provided Git dir, OCI dir. Updates both the Directory & ExpectedDirectory.

func SetExpectedSyncSource 

func SetExpectedSyncSource(nt *NT, syncID core.ID, source syncsource.SyncSource)

SetExpectedSyncSource creates, updates, or replaces the SyncSource for the specified RootSync or RepoSync.

func SetRSyncTestDefaults 

func SetRSyncTestDefaults(nt *NT, obj client.Object)

SetRSyncTestDefaults populates defaults for test RSyncs.

func SetRepoSyncDependencies 

func SetRepoSyncDependencies(nt *NT, rs client.Object) error

SetRepoSyncDependencies sets the depends-on annotation on the RepoSync for other objects managed by CentralControl (`setupCentralizedControl`).

RootSync dependencies aren't managed by another RootSync, and DelegatedControl doesn't apply with ConfigSync, so depends-on won't have any effect in those scenerios.

Takes an Object because it supports both v1alpha1 and v1beta1 RepoSyncs.

func SetRootSyncGitBranch 

func SetRootSyncGitBranch(nt *NT, syncName, branch string)

SetRootSyncGitBranch updates the root-sync object with the provided git branch

func SetRootSyncGitDir 

func SetRootSyncGitDir(nt *NT, syncName, syncPath string)

SetRootSyncGitDir updates the root-sync object with the provided git dir.

func SetRootSyncGitRevision 

func SetRootSyncGitRevision(nt *NT, syncName, revision string)

SetRootSyncGitRevision updates the root-sync object with the provided git branch

func SetupFakeSSHCreds 

func SetupFakeSSHCreds(nt *NT, rsKind string, rsRef types.NamespacedName, auth configsync.AuthType, secretName string) error

SetupFakeSSHCreds sets up the RSync Secret when needed. The Secret may or may not exist depending on the test settings.

  • If the Git provider is local, bitbucket, or gitlab, the test scaffolding uses 'ssh' as the auth type. The Secret should already exist in this case.
  • If the Git provider is CSR, it uses 'gcpserviceaccount' as the auth type. The Secret won't be created. Hence, this function creates a fake one to bypass the validation in the reconciler-manager.

func SetupOCISignatureVerification 

func SetupOCISignatureVerification(nt *NT) error

SetupOCISignatureVerification sets up the OCI signature verification environment, including the namespace, service account, OCI signature verification server, and validating webhook configuration.

func SetupSyncStatusWatchController 

func SetupSyncStatusWatchController(nt *NT) error

SetupSyncStatusWatchController sets up the sync status watch controller in the cluster. It creates the necessary namespace and deploys the controller.

func StopWebhook 

func StopWebhook(nt *NT)

StopWebhook removes the Config Sync ValidatingWebhookConfiguration object.

func StructuredNSPath 

func StructuredNSPath(namespace, resourceName string) string

StructuredNSPath returns structured path with namespace and resourcename in repo.

func TailReconcilerLogs 

func TailReconcilerLogs(ctx context.Context, nt *NT, reconcilerNN types.NamespacedName)

TailReconcilerLogs starts tailing a reconciler's logs. The logs are stored in memory until either the context is cancelled or the kubectl command exits (usually because the container exited). This allows capturing logs even if the reconciler is deleted before the test ends. The logs will only be printed if the test has failed when the command exits. Run in an goroutine to capture logs in the background while deleting RSyncs.

func TeardownOCISignatureVerification 

func TeardownOCISignatureVerification(nt *NT) error

TeardownOCISignatureVerification removes the OCI signature verification environment, including the validating webhook configuration, server deployment, service, namespace, and related resources.

func TeardownSyncStatusWatchController 

func TeardownSyncStatusWatchController(nt *NT) error

TeardownSyncStatusWatchController tears down the sync status watch controller from the cluster. It removes the namespace and associated resources.

func TestClusterName 

func TestClusterName(t testing.NTB) string

TestClusterName returns the name of the test cluster.

func TestDir 

func TestDir(t nomostesting.NTB) string

TestDir creates a unique temporary directory for the E2E test.

Returned directory is absolute and OS-specific.

func UninstallRootSyncCRD 

func UninstallRootSyncCRD(nt *NT) error

UninstallRootSyncCRD uninstalls the RootSync CRD on the test cluster

func UpdateExpectedSyncSource 

func UpdateExpectedSyncSource[T syncsource.SyncSource](nt *NT, syncID core.ID, mutateFn func(T))

UpdateExpectedSyncSource executes the provided function on an existing SyncSource in the SyncSources, allowing updating multiple fields.

func ValidateMetrics 

func ValidateMetrics(nt *NT, predicates ...MetricsPredicate) error

ValidateMetrics connects to prometheus and retries the predicates in order until successful (with timeout).

func ValidateMultiRepoDeployments 

func ValidateMultiRepoDeployments(nt *NT) error

ValidateMultiRepoDeployments waits for all Config Sync components to become available. RootSync root-sync will be re-created, if not found.

func ValidatePodByLabel 

func ValidatePodByLabel(nt *NT, label, value string, predicates ...testpredicates.Predicate) error

ValidatePodByLabel validates that all Pods matching the provided label pass the provided list of predicates.

func ValidateStandardMetrics 

func ValidateStandardMetrics(nt *NT) error

ValidateStandardMetrics validates the set of standard metrics for the reconciler-manager and all registered nt.SyncSources.

func ValidateStandardMetricsForRepoSync 

func ValidateStandardMetricsForRepoSync(nt *NT, summary testmetrics.Summary) error

ValidateStandardMetricsForRepoSync validates the set of standard metrics for the specified RootSync.

func ValidateStandardMetricsForRootSync 

func ValidateStandardMetricsForRootSync(nt *NT, summary testmetrics.Summary) error

ValidateStandardMetricsForRootSync validates the set of standard metrics for the specified RootSync.

func ValidateStandardMetricsForSync 

func ValidateStandardMetricsForSync(nt *NT, syncKind testmetrics.SyncKind, syncLabels prometheusmodel.LabelSet, commitHash string, summary testmetrics.Summary) error

ValidateStandardMetricsForSync validates the set of standard metrics for the specified sync.

func VersionFromManifest 

func VersionFromManifest(t testing.NTB) string

VersionFromManifest parses the image tag from the local manifest

func Wait 

func Wait(t testing.NTB, opName string, timeout time.Duration, condition func() error, opts ...WaitOption) error

Wait provides a logged wait for condition to return nil with options for timeout. It fails the test on errors. Generally it's preferred to use WatchObject when possible. This function can be used for preconditions which are hard/impossible to express with WatchObject/WatchPredicate.

func WaitForCRDs 

func WaitForCRDs(nt *NT, crds []string) error

WaitForCRDs waits until the specified CRDs are established on the cluster.

func WaitForConfigSyncReady 

func WaitForConfigSyncReady(nt *NT) error

WaitForConfigSyncReady validates if the config sync deployments are ready.

func WaitForNamespace 

func WaitForNamespace(nt *NT, timeout time.Duration, namespace string) error

WaitForNamespace waits for a namespace to exist and be ready to use

func WaitForNamespaces 

func WaitForNamespaces(nt *NT, timeout time.Duration, namespaces ...string) error

WaitForNamespaces waits for namespaces to exist and be ready to use

func WaitForWebhookReadiness 

func WaitForWebhookReadiness(nt *NT)

WaitForWebhookReadiness waits up to 3 minutes for the wehbook becomes ready. If the webhook still is not ready after 3 minutes, the test would fail.

Types

type Cluster 

type Cluster interface {
	// Exists whether the cluster exists
	Exists() (bool, error)
	// Create the k8s cluster
	Create() error
	// Delete the k8s cluster
	Delete() error
	// Connect to the k8s cluster (generate kubeconfig)
	Connect() error
	// Hash returns the cluster hash.
	Hash() (string, error)
}

Cluster is an interface for a target k8s cluster used by the e2e tests

type GKECluster 

type GKECluster struct {
	Name                  string        `json:"name"`
	Location              string        `json:"location"`
	CurrentMasterVersion  string        `json:"currentMasterVersion"`
	CurrentNodeVersion    string        `json:"currentNodeVersion"`
	InitialClusterVersion string        `json:"initialClusterVersion"`
	NodePools             []GKENodePool `json:"nodePools"`
}

GKECluster represents a partial json response from `gcloud container clusters describe --format json`.

type GKENodePool 

type GKENodePool struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

GKENodePool represents a partial json response of the `nodePools` from `gcloud container clusters describe --format json`.

type MetricsPredicate 

type MetricsPredicate func(context.Context, prometheusv1.API) error

MetricsPredicate errors if the metrics do not match expectations.

func ReconcilerErrorMetrics 

func ReconcilerErrorMetrics(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash string, summary testmetrics.ErrorSummary) MetricsPredicate

ReconcilerErrorMetrics returns a MetricsPredicate that validates the following metrics: - ResourceFightsView - ResourceConflictsView - InternalErrorsView - ReconcilerErrorsView

func ReconcilerManagerMetrics 

func ReconcilerManagerMetrics(nt *NT) MetricsPredicate

ReconcilerManagerMetrics returns a MetricsPredicate that validates the ReconcileDurationView metric.

func ReconcilerOperationsMetrics 

func ReconcilerOperationsMetrics(nt *NT, syncLabels prometheusmodel.LabelSet, ops ...testmetrics.ObjectOperation) MetricsPredicate

ReconcilerOperationsMetrics returns a MetricsPredicate that validates the APICallDurationView, ApplyOperationsView, and RemediateDurationView metrics.

func ReconcilerParserDuration 

func ReconcilerParserDuration(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash, source, status string) MetricsPredicate

ReconcilerParserDuration returns a MetricsPredicate that validates the ParserDurationView metric for the specified reconciler, commit, source, and status.

func ReconcilerParserMetrics 

func ReconcilerParserMetrics(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash string) MetricsPredicate

ReconcilerParserMetrics returns a MetricsPredicate that validates the ParserDurationView metric for all parser sources (read, parse, update).

func ReconcilerPipelineError 

func ReconcilerPipelineError(nt *NT, syncLabels prometheusmodel.LabelSet, component string, value int) MetricsPredicate

ReconcilerPipelineError returns a MetricsPredicate that validates the PipelineErrorView metric for the specified reconciler and component.

func ReconcilerPipelineMetrics 

func ReconcilerPipelineMetrics(nt *NT, syncLabels prometheusmodel.LabelSet, summary testmetrics.ErrorSummary) MetricsPredicate

ReconcilerPipelineMetrics returns a MetricsPredicate that validates the PipelineErrorView metrics for source, rendering, and sync components.

func ReconcilerSourceMetrics 

func ReconcilerSourceMetrics(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash string, numResources int) MetricsPredicate

ReconcilerSourceMetrics returns a MetricsPredicate that validates the DeclaredResourcesView metric.

func ReconcilerSyncError 

func ReconcilerSyncError(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash string) MetricsPredicate

ReconcilerSyncError returns a MetricsPredicate that validates that the latest commit sync errored for the specified reconciler and commit.

func ReconcilerSyncMetrics 

func ReconcilerSyncMetrics(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash string) MetricsPredicate

ReconcilerSyncMetrics returns a MetricsPredicate that validates the LastApplyTimestampView, ApplyDurationView, and LastSyncTimestampView metrics.

func ReconcilerSyncSuccess 

func ReconcilerSyncSuccess(nt *NT, syncLabels prometheusmodel.LabelSet, commitHash string) MetricsPredicate

ReconcilerSyncSuccess returns a MetricsPredicate that validates that the latest commit synced successfully for the specified reconciler and commit.

type NT 

type NT struct {
	Context context.Context

	// T is the test environment for the test.
	// Used to exit tests early when setup fails, and for logging.
	T testing.NTB

	// Logger wraps testing.NTB and provides a simple logging interface for
	// test utilities to use without needing access to the whole testing.NTB.
	// Use if you want Debug and Log, but don't need to Error, Fatal, or Fail.
	Logger *testlogger.TestLogger

	// Shell is a test wrapper used to run shell commands.
	Shell *testshell.TestShell

	// ClusterName is the unique name of the test run.
	ClusterName string

	// TmpDir is the temporary directory the test will write to.
	// By default, automatically deleted when the test finishes.
	TmpDir string

	// Config specifies how to create a new connection to the cluster.
	Config *rest.Config

	// KubeClient is a test wrapper used to make Kubernetes calls.
	KubeClient *testkubeclient.KubeClient

	// Watcher is a test helper used to make Watch calls
	Watcher *testwatcher.Watcher

	// WatchClient is the underlying client used to talk to the Kubernetes
	// cluster, when performing watches.
	//
	// Most tests shouldn't need to talk directly to this, unless simulating
	// direct interactions with the API Server.
	WatchClient client.WithWatch

	// IsGKEAutopilot indicates if the test cluster is a GKE Autopilot cluster.
	IsGKEAutopilot bool

	// ClusterVersion is the parsed version of the target test cluster
	ClusterVersion *clusterversion.ClusterVersion

	// ClusterSupportsBursting indicates if the cluster supports bursting.
	ClusterSupportsBursting bool

	// ClusterHash is a 64 character long unique identifier formed in hex used to identify a GKE cluster.
	ClusterHash string

	// DefaultWaitTimeout is the default timeout for tests to wait for sync completion.
	DefaultWaitTimeout time.Duration

	// DefaultReconcileTimeout is the default timeout for the applier to wait
	// for object reconciliation.
	DefaultReconcileTimeout *time.Duration

	// SyncSources tracks the RootSyncs & RepoSyncs used by the current test.
	// Each one is mapped to a SyncSource or nil, if no source is configured.
	// The list of IDs is used for iterating over test RSyncs.
	// The ID group and kind must always be either RootSync of RepoSync.
	SyncSources syncsource.Set

	// MetricsExpectations tracks the objects expected to be declared in the
	// source and the operations expected to be performed on them by the set of
	// RootSyncs and RepoSyncs managed by this test.
	MetricsExpectations *testmetrics.SyncSetExpectations

	// ReconcilerPollingPeriod defines how often the reconciler should poll the
	// filesystem for updates to the source or rendered configs.
	ReconcilerPollingPeriod time.Duration

	// HydrationPollingPeriod defines how often the hydration-controller should
	// poll the filesystem for rendering the DRY configs.
	HydrationPollingPeriod time.Duration

	// OCISignatureVerificationCertPath is the path to certs used for communicating with OCI signature verification Webhook Server.
	OCISignatureVerificationCertPath string

	// Scheme is the Scheme for the test suite that maps from structs to GVKs.
	Scheme *runtime.Scheme

	// GitProvider is the provider that hosts the Git repositories.
	GitProvider gitproviders.GitProvider

	// OCIProvider is the provider that hosts the OCI repositories.
	OCIProvider registryproviders.OCIRegistryProvider

	// HelmProvider is the provider that hosts the helm packages.
	HelmProvider registryproviders.HelmRegistryProvider

	// HelmClient provides helm and crane clients to connect to
	// the environment-specific Helm repository.
	HelmClient *testshell.HelmClient

	// OCIClient provides a crane client to connect to the
	// environment-specific OCI repository.
	OCIClient *testshell.OCIClient

	// RemoteRepositories maintains a map between the repo local name and the remote repository.
	// It includes both root repo and namespace repos and can be shared among test cases.
	// It is used to reuse existing repositories instead of creating new ones.
	RemoteRepositories map[types.NamespacedName]*gitproviders.ReadWriteRepository

	// WebhookDisabled indicates whether the ValidatingWebhookConfiguration is deleted.
	WebhookDisabled *bool

	// Control indicates how the test case was setup.
	Control ntopts.RepoControl
	// contains filtered or unexported fields
}

NT represents the test environment for a single Nomos end-to-end test case.

func FreshTestEnv 

func FreshTestEnv(t nomostesting.NTB, opts *ntopts.New) *NT

FreshTestEnv establishes a connection to a test cluster based on the passed

options.

Marks the test as parallel. For now we have no tests which *can't* be made parallel; if we need that in the future we can make a version of this function that doesn't do this. As below keeps us from forgetting to mark tests as parallel, and unnecessarily waiting.

The following are guaranteed to be available when this function returns: 1) A connection to the Kubernetes cluster. 2) A functioning git server hosted on the cluster. 3) A fresh ACM installation.

func New 

func New(t *testing.T, testFeature nomostesting.Feature, ntOptions ...ntopts.Opt) *NT

New establishes a connection to a test cluster and prepares it for testing.

func SharedNT 

func SharedNT(t testing.NTB) *NT

SharedNT returns the shared test environment.

func SharedTestEnv 

func SharedTestEnv(t nomostesting.NTB, opts *ntopts.New) *NT

SharedTestEnv connects to a shared test cluster.

func (*NT) ApplyGatekeeperCRD 

func (nt *NT) ApplyGatekeeperCRD(file, crd string) error

ApplyGatekeeperCRD applies the specified gatekeeper testdata file and waits for the specified CRD to be established, then resets the client RESTMapper.

func (*NT) BuildAndPushHelmPackage 

func (nt *NT) BuildAndPushHelmPackage(rsRef types.NamespacedName, options ...registryproviders.HelmOption) (*registryproviders.HelmPackage, error)

BuildAndPushHelmPackage uses the current file system state of the provided Repository to build a helm package and push it to the current HelmProvider. The resulting HelmPackage object can be used to set the spec.oci.image field on the RSync.

func (*NT) BuildAndPushOCIImage 

func (nt *NT) BuildAndPushOCIImage(rsRef types.NamespacedName, options ...registryproviders.ImageOption) (*registryproviders.OCIImage, error)

BuildAndPushOCIImage uses the current file system state of the provided Repository to build an OCI image and push it to the current OCIProvider. The resulting OCIImage object can be used to set the spec.oci.image field on the RSync.

func (*NT) GetPodLogs 

func (nt *NT) GetPodLogs(namespace, deployment, container string, previousPodLog bool, startTime *time.Time) ([]string, error)

GetPodLogs retrieves the logs from the specified deployment's pod. It can fetch logs from the current or previous pod instance based on the previousPodLog flag. If startTime is provided, it will filter logs to only include entries since that time.

func (*NT) ListReconcilerClusterRoleBindings 

func (nt *NT) ListReconcilerClusterRoleBindings(syncKind string, rsRef types.NamespacedName) ([]rbacv1.ClusterRoleBinding, error)

ListReconcilerClusterRoleBindings is a convenience method for listing all ClusterRoleBindings associated with a reconciler.

func (*NT) ListReconcilerRoleBindings 

func (nt *NT) ListReconcilerRoleBindings(syncKind string, rsRef types.NamespacedName) ([]rbacv1.RoleBinding, error)

ListReconcilerRoleBindings is a convenience method for listing all RoleBindings associated with a reconciler.

func (*NT) LogDeploymentPodResources 

func (nt *NT) LogDeploymentPodResources(namespace, deployment string)

LogDeploymentPodResources logs the resources of the deployment's pod's containers

func (*NT) Must 

func (nt *NT) Must(args ...interface{})

Must not error.

This is a test helper that immediately fails the test if any of the arguments are a non-nil error. All nil and non-error argument are ignored. Usage Example: nt.Must(DoSomething())

Note: Because nil objects lose their type when passed through an interface{}, There's no way to validate that an error type was actually passed. Consider using require.NoError instead, when the only return value is an error.

func (*NT) MustDeleteGatekeeperTestData 

func (nt *NT) MustDeleteGatekeeperTestData(file, name string)

MustDeleteGatekeeperTestData deletes the specified gatekeeper testdata file, then resets the client RESTMapper.

func (*NT) MustKubectl 

func (nt *NT) MustKubectl(args ...string) []byte

MustKubectl fails the test immediately if the kubectl command fails. On success, returns STDOUT.

func (*NT) MustMergePatch 

func (nt *NT) MustMergePatch(obj client.Object, patch string, opts ...client.PatchOption)

MustMergePatch is like MergePatch but will call t.Fatal if the patch fails.

func (*NT) NumRepoSyncNamespaces 

func (nt *NT) NumRepoSyncNamespaces() int

NumRepoSyncNamespaces returns the number of unique namespaces managed by RepoSyncs.

func (*NT) PodLogs 

func (nt *NT) PodLogs(namespace, deployment, container string, previousPodLog bool)

PodLogs prints the logs from the specified deployment. If there is an error getting the logs for the specified deployment, prints the error.

func (*NT) RenewClient 

func (nt *NT) RenewClient()

RenewClient gets a new Client for talking to the cluster.

Call this manually from within a test if you expect a controller to create a CRD dynamically, or if the test applies a CRD directly to the API Server.

func (*NT) RepoSyncClusterRole 

func (nt *NT) RepoSyncClusterRole() *rbacv1.ClusterRole

RepoSyncClusterRole returns the NS reconciler ClusterRole

func (*NT) RepoSyncObjectGit 

func (nt *NT) RepoSyncObjectGit(nn types.NamespacedName, repo gitproviders.Repository, branch, revision, syncPath string, sourceFormat configsync.SourceFormat) *v1beta1.RepoSync

RepoSyncObjectGit creates a new RepoSync object with a Git source, using the default test config plus the specified inputs. Creates, updates, or replaces the SyncSource expectation for this RepoSync.

func (*NT) RepoSyncObjectGitSyncSource 

func (nt *NT) RepoSyncObjectGitSyncSource(nn types.NamespacedName, source *syncsource.GitSyncSource) *v1beta1.RepoSync

RepoSyncObjectGitSyncSource creates a new RepoSync object with a Git source, using the default test config plus the specified inputs.

func (*NT) RepoSyncObjectHelm 

func (nt *NT) RepoSyncObjectHelm(nn types.NamespacedName, chartID registryproviders.HelmChartID) *v1beta1.RepoSync

RepoSyncObjectHelm returns a RepoSync object that syncs the provided HelmPackage. Creates, updates, or replaces the SyncSource expectation for this RepoSync.

func (*NT) RepoSyncObjectHelmSyncSource 

func (nt *NT) RepoSyncObjectHelmSyncSource(nn types.NamespacedName, source *syncsource.HelmSyncSource) *v1beta1.RepoSync

RepoSyncObjectHelmSyncSource returns a RepoSync object that syncs the provided Helm chart.

func (*NT) RepoSyncObjectOCI 

func (nt *NT) RepoSyncObjectOCI(nn types.NamespacedName, imageID registryproviders.OCIImageID, syncPath, expectedImageDigest string) *v1beta1.RepoSync

RepoSyncObjectOCI returns a RepoSync object that syncs the provided OCIImage. ImageID is used for pulling. ImageDigest is used for validating the result. Creates, updates, or replaces the SyncSource expectation for this RepoSync.

func (*NT) RepoSyncObjectOCISyncSource 

func (nt *NT) RepoSyncObjectOCISyncSource(nn types.NamespacedName, source *syncsource.OCISyncSource) *v1beta1.RepoSync

RepoSyncObjectOCISyncSource returns a RepoSync object that syncs the provided OCI image.

func (*NT) RootSyncObjectGit 

func (nt *NT) RootSyncObjectGit(name string, repo gitproviders.Repository, branch, revision, syncPath string, sourceFormat configsync.SourceFormat) *v1beta1.RootSync

RootSyncObjectGit creates a new RootSync object with a Git source, using the default test config plus the specified inputs. Creates, updates, or replaces the SyncSource expectation for this RootSync.

func (*NT) RootSyncObjectGitSyncSource 

func (nt *NT) RootSyncObjectGitSyncSource(name string, source *syncsource.GitSyncSource) *v1beta1.RootSync

RootSyncObjectGitSyncSource creates a new RootSync object with a Git source, using the default test config plus the specified inputs.

func (*NT) RootSyncObjectHelm 

func (nt *NT) RootSyncObjectHelm(name string, chartID registryproviders.HelmChartID) *v1beta1.RootSync

RootSyncObjectHelm returns a RootSync object that syncs the provided Helm chart. Creates, updates, or replaces the SyncSource expectation for this RootSync.

func (*NT) RootSyncObjectHelmSyncSource 

func (nt *NT) RootSyncObjectHelmSyncSource(name string, source *syncsource.HelmSyncSource) *v1beta1.RootSync

RootSyncObjectHelmSyncSource returns a RootSync object that syncs the provided Helm chart.

func (*NT) RootSyncObjectOCI 

func (nt *NT) RootSyncObjectOCI(name string, imageID registryproviders.OCIImageID, syncPath, expectedImageDigest string) *v1beta1.RootSync

RootSyncObjectOCI returns a RootSync object that syncs the provided OCI image. ImageID is used for pulling. ImageDigest is used for validating the result. Creates, updates, or replaces the SyncSource expectation for this RootSync.

func (*NT) RootSyncObjectOCISyncSource 

func (nt *NT) RootSyncObjectOCISyncSource(name string, source *syncsource.OCISyncSource) *v1beta1.RootSync

RootSyncObjectOCISyncSource returns a RootSync object that syncs the provided OCI image.

func (*NT) SyncSourceGitReadWriteRepository 

func (nt *NT) SyncSourceGitReadWriteRepository(id core.ID) *gitproviders.ReadWriteRepository

SyncSourceGitReadWriteRepository returns the git ReadWriteRepository for the specified RSync, if it exists in NT.SyncSources.

func (*NT) Validate 

func (nt *NT) Validate(name, namespace string, o client.Object, predicates ...testpredicates.Predicate) error

Validate returns an error if the indicated object does not exist.

Validates the object against each of the passed Predicates, returning error if any Predicate fails.

func (*NT) ValidateNotFound 

func (nt *NT) ValidateNotFound(name, namespace string, o client.Object) error

ValidateNotFound returns an error if the indicated object exists.

`o` must either be: 1) a struct pointer to the type of the object to search for, or 2) an unstructured.Unstructured with the type information filled in.

func (*NT) ValidateNotFoundOrNoMatch 

func (nt *NT) ValidateNotFoundOrNoMatch(name, namespace string, o client.Object) error

ValidateNotFoundOrNoMatch returns an error if the indicated object is neither NotFound nor NoMatchFound (GVK not found).

Use this instead of ValidateNotFound when deleting a CRD or APIService at the same time as a custom resource, to avoid the race between possible errors.

func (*NT) ValidateSyncObject 

func (nt *NT) ValidateSyncObject(gvk schema.GroupVersionKind, name, namespace string,
	predicates ...testpredicates.Predicate) error

ValidateSyncObject validates the specified object satisfies the specified constraints.

gvk specifies the GroupVersionKind of the object to retrieve and validate.

name and namespace identify the specific object to check.

predicates are functions that return an error if the object is invalid.

func (*NT) WatchForAllSyncs 

func (nt *NT) WatchForAllSyncs(options ...WatchForAllSyncsOptions) error

WatchForAllSyncs calls WatchForSync on all Syncs in nt.SyncSources.

If you want to validate specific fields of a Sync object, use nt.Watcher.WatchObject() instead.

func (*NT) WatchForSync 

func (nt *NT) WatchForSync(
	gvk schema.GroupVersionKind,
	name, namespace string,
	source syncsource.SyncSource,
	options ...WatchForSyncOption,
) error

WatchForSync watches the specified sync object until it's synced.

  • gvk (required) is the sync object GroupVersionKind
  • name (required) is the sync object name
  • namespace (required) is the sync object namespace
  • source (required) is the expectations for this RSync.
  • opts (optional) allows configuring the watcher (e.g. timeout)

type Server 

type Server string

Server represents a test server type, such as registry-server, git-server, or oci-image-verification-server. The first two represent sync sources, but they don't necessarily map 1:1 to Config Sync sources. For example, registry-server handles both OCI and Helm sources. 

const (
	// RootAuthSecretName is the name of the Auth secret required by the
	// RootSync reconciler to authenticate with the git-server.
	RootAuthSecretName = controllers.GitCredentialVolume

	// NamespaceAuthSecretName is the name of the Auth secret required by the
	// RepoSync reconciler to authenticate with the git-server.
	NamespaceAuthSecretName = "ssh-key"

	// GitSyncSource is the name of the git-server sync source. Used by the git
	// source type.
	GitSyncSource Server = "git-server"

	// RegistrySyncSource is the name of the registry-server sync source. Used
	// by both the oci and helm source types.
	RegistrySyncSource Server = "registry-server"

	// ImageVerificationServer is the name of the test OCI image verification server.
	// Used for verifying OCI image signatures.
	ImageVerificationServer Server = "image-verification"
)

type Sha1Func 

type Sha1Func func(nt *NT, nn types.NamespacedName) (string, error)

Sha1Func is the function type that retrieves the commit sha1.

type WaitOption 

type WaitOption func(wait *waitSpec)

WaitOption is an optional parameter for Wait

func WaitTimeout 

func WaitTimeout(timeout time.Duration) WaitOption

WaitTimeout provides the timeout option to Wait.

type WatchForAllSyncsOptions 

type WatchForAllSyncsOptions func(*watchForAllSyncsOptions)

WatchForAllSyncsOptions is an optional parameter for WaitForRepoSyncs.

func RepoSyncOnly 

func RepoSyncOnly() WatchForAllSyncsOptions

RepoSyncOnly specifies that only the NonRootRepos should be synced.

func RootSyncOnly 

func RootSyncOnly() WatchForAllSyncsOptions

RootSyncOnly specifies that only the RootRepos should be synced.

func SkipAllResourceGroupChecks 

func SkipAllResourceGroupChecks() WatchForAllSyncsOptions

SkipAllResourceGroupChecks is an optional parameter which specifies to skip ResourceGroup checks for all RSyncs after they finish syncing.

func SkipNonRootRepos 

func SkipNonRootRepos(skipNonRootRepos ...types.NamespacedName) WatchForAllSyncsOptions

SkipNonRootRepos specifies RepoSyncs which do not need to be synced.

func SkipReadyCheck 

func SkipReadyCheck() WatchForAllSyncsOptions

SkipReadyCheck specifies not to wait for all Config Sync components to be ready.

func SkipRootRepos 

func SkipRootRepos(skipRootRepos ...string) WatchForAllSyncsOptions

SkipRootRepos specifies RootSyncs which do not need to be synced.

func WithTimeout 

func WithTimeout(timeout time.Duration) WatchForAllSyncsOptions

WithTimeout provides the timeout to WaitForRepoSyncs.

type WatchForSyncOption 

type WatchForSyncOption func(*watchForSyncOptions)

WatchForSyncOption is an optional parameter for WatchForSync.

func SkipResourceGroupCheck 

func SkipResourceGroupCheck() WatchForSyncOption

SkipResourceGroupCheck is an optional parameter to skip the ResourceGroup watch after the RSync finishes syncing.

func WithWatchOptions 

func WithWatchOptions(watchOpts ...testwatcher.WatchOption) WatchForSyncOption

WithWatchOptions is an optional parameter to specify WatchOptions used for both the RSync watch and ResourceGroup watch.

Source Files

View all Source files

Directories

Path Synopsis
util

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.