66 "testing"
77
88 "github.com/google/go-cmp/cmp"
9- "github.com/kubewarden/audit-scanner/internal/constants"
109 policiesv1 "github.com/kubewarden/kubewarden-controller/pkg/apis/policies/v1"
1110 admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
1211 appsv1 "k8s.io/api/apps/v1"
@@ -120,6 +119,22 @@ var policyPodsNamespaces = policiesv1.ClusterAdmissionPolicy{
120119 }},
121120}
122121
122+ // used to test incorrect resources, when using *
123+ var policyAsteriskRules = policiesv1.ClusterAdmissionPolicy {
124+ Spec : policiesv1.ClusterAdmissionPolicySpec {PolicySpec : policiesv1.PolicySpec {
125+ Rules : []admissionregistrationv1.RuleWithOperations {
126+ {
127+ Operations : nil ,
128+ Rule : admissionregistrationv1.Rule {
129+ APIGroups : []string {"*" },
130+ APIVersions : []string {"v1" },
131+ Resources : []string {"pods" },
132+ },
133+ },
134+ },
135+ }},
136+ }
137+
123138func TestGetResourcesForPolicies (t * testing.T ) {
124139 pod1 := v1.Pod {
125140 ObjectMeta : metav1.ObjectMeta {
@@ -247,6 +262,7 @@ func TestGetResourcesForPolicies(t *testing.T) {
247262 {"policy with label filter" , []policiesv1.Policy {& policy4 }, expectedP4 , "kubewarden" },
248263 {"we skip incorrect GVKs" , []policiesv1.Policy {& policyIncorrectRules }, expectedPIncorrectRules , "default" },
249264 {"we skip clusterwide resources" , []policiesv1.Policy {& policyPodsNamespaces }, expectedPPodsNamespaces , "default" }, // namespaces get filtered
265+ {"we skip asterisk rules, they get expanded by clientgo" , []policiesv1.Policy {& policyAsteriskRules }, []AuditableResources {}, "default" },
250266 }
251267
252268 for _ , test := range tests {
@@ -537,6 +553,46 @@ func TestGetClusterWideResourcesForPolicies(t *testing.T) {
537553 PolicyStatus : policiesv1 .PolicyStatusActive ,
538554 },
539555 }
556+ policyWithAsteriskRules := policiesv1.ClusterAdmissionPolicy {
557+ ObjectMeta : metav1.ObjectMeta {
558+ Name : "cap" ,
559+ // It's necessary to define ResourceVersion and Generation
560+ // because the fake client can set values for these fields.
561+ // See more at docs:
562+ // ObjectMeta's `Generation` and `ResourceVersion` don't
563+ // behave properly, Patch or Update operations that rely
564+ // on these fields will fail, or give false positives.
565+ // https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/client/fake
566+ ResourceVersion : "123" ,
567+ Generation : 1 ,
568+ },
569+ Spec : policiesv1.ClusterAdmissionPolicySpec {
570+ PolicySpec : policiesv1.PolicySpec {
571+ BackgroundAudit : true ,
572+ Rules : []admissionregistrationv1.RuleWithOperations {
573+ {
574+ Operations : []admissionregistrationv1.OperationType {admissionregistrationv1 .Create },
575+ Rule : admissionregistrationv1.Rule {
576+ APIGroups : []string {"*" },
577+ APIVersions : []string {"v1" },
578+ Resources : []string {"pods" , "namespaces" },
579+ },
580+ },
581+ {
582+ Operations : []admissionregistrationv1.OperationType {admissionregistrationv1 .Create },
583+ Rule : admissionregistrationv1.Rule {
584+ APIGroups : []string {"" },
585+ APIVersions : []string {"v1" },
586+ Resources : []string {"pods" , "namespaces" },
587+ },
588+ },
589+ },
590+ },
591+ },
592+ Status : policiesv1.PolicyStatus {
593+ PolicyStatus : policiesv1 .PolicyStatusActive ,
594+ },
595+ }
540596
541597 customScheme := scheme .Scheme
542598 customScheme .AddKnownTypes (policiesv1 .GroupVersion , & policiesv1.ClusterAdmissionPolicy {}, & policiesv1.AdmissionPolicy {}, & policiesv1.ClusterAdmissionPolicyList {}, & policiesv1.AdmissionPolicyList {})
@@ -605,6 +661,10 @@ func TestGetClusterWideResourcesForPolicies(t *testing.T) {
605661 Policies : []policiesv1.Policy {& policyWithLabelFilter },
606662 Resources : []unstructured.Unstructured {{Object : unstructuredNamespace2 }},
607663 }}},
664+ {"Filter cluster wide resource with policies with asterisk rules" , []policiesv1.Policy {& policyWithAsteriskRules }, []AuditableResources {{
665+ Policies : []policiesv1.Policy {& policyWithAsteriskRules },
666+ Resources : []unstructured.Unstructured {{Object : unstructuredNamespace }, {Object : unstructuredNamespace2 }},
667+ }}},
608668 }
609669
610670 for _ , test := range tests {
@@ -706,7 +766,12 @@ func TestIsNamespacedResource(t *testing.T) {
706766 Version : "v1" ,
707767 Resource : "foos" ,
708768 },
709- false , constants .ErrResourceNotFound ,
769+ false ,
770+ apimachineryerrors .NewNotFound (
771+ schema.GroupResource {
772+ Group : "" ,
773+ Resource : "foos" ,
774+ }, "foos" ),
710775 },
711776 }
712777
@@ -721,7 +786,7 @@ func TestIsNamespacedResource(t *testing.T) {
721786 fetcher := Fetcher {dynamicClient , "" , "" , fakeClientSet }
722787
723788 isNamespaced , err := fetcher .isNamespacedResource (ttest .gvr )
724- if (err != nil && ttest .expectedErr != nil && ! errors . Is ( err , ttest .expectedErr )) || (err != nil && ttest .expectedErr == nil ) {
789+ if (err != nil && ttest .expectedErr != nil && err . Error () != ttest .expectedErr . Error ( )) || (err != nil && ttest .expectedErr == nil ) {
725790 t .Errorf ("unexpected error: " + err .Error ())
726791 }
727792 if isNamespaced != ttest .expectedIsNamespaced {
0 commit comments