Skip to content

Commit bb2d6cb

Browse files
mozesl-nokiamozesl-nokia
committed
move podmanager tls unit tests, add new ones
Signed-off-by: Mózes László Máté <laszlo.mozes@nokia.com> Assisted-by: Cursor:grok-4.5
1 parent 1130ec8 commit bb2d6cb

2 files changed

Lines changed: 227 additions & 105 deletions

File tree

‎func/internal/podmanager_tls_test.go‎

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,231 @@
1414

1515
package internal
1616

17+
import (
18+
"crypto/ecdsa"
19+
"crypto/elliptic"
20+
"crypto/rand"
21+
"crypto/tls"
22+
"crypto/x509"
23+
"crypto/x509/pkix"
24+
"encoding/pem"
25+
"math/big"
26+
"net"
27+
"os"
28+
"path/filepath"
29+
"testing"
30+
"time"
1731

32+
"github.com/stretchr/testify/assert"
33+
"github.com/stretchr/testify/require"
34+
)
35+
36+
func TestTlsCACertPath(t *testing.T) {
37+
tests := map[string]struct {
38+
files map[string][]byte
39+
wantFile string
40+
}{
41+
"prefers ca.crt over ca.pem": {
42+
files: map[string][]byte{
43+
"ca.crt": []byte("crt"),
44+
"ca.pem": []byte("pem"),
45+
},
46+
wantFile: "ca.crt",
47+
},
48+
"falls back to ca.pem": {
49+
files: map[string][]byte{
50+
"ca.pem": []byte("pem"),
51+
},
52+
wantFile: "ca.pem",
53+
},
54+
"falls back to cacert.pem": {
55+
files: map[string][]byte{
56+
"cacert.pem": []byte("cacert"),
57+
},
58+
wantFile: "cacert.pem",
59+
},
60+
"falls back to ca-bundle.crt": {
61+
files: map[string][]byte{
62+
"ca-bundle.crt": []byte("bundle"),
63+
},
64+
wantFile: "ca-bundle.crt",
65+
},
66+
"falls back to root.crt": {
67+
files: map[string][]byte{
68+
"root.crt": []byte("root"),
69+
},
70+
wantFile: "root.crt",
71+
},
72+
}
73+
74+
for name, tc := range tests {
75+
t.Run(name, func(t *testing.T) {
76+
dir := t.TempDir()
77+
for file, content := range tc.files {
78+
require.NoError(t, os.WriteFile(filepath.Join(dir, file), content, 0o600))
79+
}
80+
81+
path, err := tlsCACertPath(dir)
82+
require.NoError(t, err)
83+
assert.Equal(t, filepath.Join(dir, tc.wantFile), path)
84+
})
85+
}
86+
}
87+
88+
func TestTlsCACertPathMissingMount(t *testing.T) {
89+
_, err := tlsCACertPath(filepath.Join(t.TempDir(), "missing"))
90+
require.Error(t, err)
91+
assert.ErrorContains(t, err, "tls secret folder")
92+
}
93+
94+
func TestTlsCACertPathNoCandidates(t *testing.T) {
95+
_, err := tlsCACertPath(t.TempDir())
96+
require.Error(t, err)
97+
assert.ErrorContains(t, err, "no CA certificate found")
98+
assert.ErrorContains(t, err, "ca.crt")
99+
}
100+
101+
func TestLoadTLSConfig(t *testing.T) {
102+
tests := map[string]struct {
103+
writeCert func(t *testing.T) string
104+
wantErr string
105+
}{
106+
"valid PEM certificate": {
107+
writeCert: func(t *testing.T) string {
108+
t.Helper()
109+
path := filepath.Join(t.TempDir(), "ca.pem")
110+
require.NoError(t, os.WriteFile(path, generateSelfSignedCertPEM(t), 0o600))
111+
return path
112+
},
113+
},
114+
"invalid PEM data": {
115+
writeCert: func(t *testing.T) string {
116+
t.Helper()
117+
path := filepath.Join(t.TempDir(), "ca.pem")
118+
require.NoError(t, os.WriteFile(path, []byte("not a valid PEM certificate"), 0o600))
119+
return path
120+
},
121+
wantErr: "failed to append certificates",
122+
},
123+
"missing file": {
124+
writeCert: func(t *testing.T) string {
125+
t.Helper()
126+
return filepath.Join(t.TempDir(), "missing.pem")
127+
},
128+
wantErr: "no such file",
129+
},
130+
}
131+
132+
for name, tc := range tests {
133+
t.Run(name, func(t *testing.T) {
134+
caCertPath := tc.writeCert(t)
135+
136+
tlsConfig, err := loadTLSConfig(caCertPath)
137+
if tc.wantErr != "" {
138+
assert.ErrorContains(t, err, tc.wantErr)
139+
} else {
140+
require.NoError(t, err)
141+
require.NotNil(t, tlsConfig)
142+
assert.NotNil(t, tlsConfig.RootCAs)
143+
assert.Equal(t, uint16(tls.VersionTLS12), tlsConfig.MinVersion)
144+
}
145+
})
146+
}
147+
}
148+
149+
func TestMakeTlsTransport(t *testing.T) {
150+
tests := map[string]struct {
151+
setup func(t *testing.T) string
152+
errContains string
153+
}{
154+
"returns transport when ca.crt is valid": {
155+
setup: func(t *testing.T) string {
156+
t.Helper()
157+
dir := t.TempDir()
158+
require.NoError(t, os.WriteFile(filepath.Join(dir, "ca.crt"), generateSelfSignedCertPEM(t), 0o600))
159+
return dir
160+
},
161+
},
162+
"returns error when secret path is missing": {
163+
setup: func(t *testing.T) string {
164+
t.Helper()
165+
return filepath.Join(t.TempDir(), "missing")
166+
},
167+
errContains: "tls secret folder",
168+
},
169+
"returns error when no CA certificate found": {
170+
setup: func(t *testing.T) string {
171+
t.Helper()
172+
return t.TempDir()
173+
},
174+
errContains: "no CA certificate found",
175+
},
176+
"returns error when CA PEM is invalid": {
177+
setup: func(t *testing.T) string {
178+
t.Helper()
179+
dir := t.TempDir()
180+
require.NoError(t, os.WriteFile(filepath.Join(dir, "ca.crt"), []byte("not a cert"), 0o600))
181+
return dir
182+
},
183+
errContains: "failed to append certificates",
184+
},
185+
}
186+
187+
for name, tc := range tests {
188+
t.Run(name, func(t *testing.T) {
189+
transport, err := makeTlsTransport(tc.setup(t))
190+
if tc.errContains != "" {
191+
require.Error(t, err)
192+
assert.ErrorContains(t, err, tc.errContains)
193+
assert.Nil(t, transport)
194+
} else {
195+
require.NoError(t, err)
196+
assert.NotNil(t, transport)
197+
}
198+
})
199+
}
200+
}
201+
202+
func TestOtelTransport(t *testing.T) {
203+
tests := map[string]struct {
204+
tlsConfig *tls.Config
205+
}{
206+
"nil tls config wraps default transport": {
207+
tlsConfig: nil,
208+
},
209+
"applies provided tls config": {
210+
tlsConfig: &tls.Config{
211+
MinVersion: tls.VersionTLS12,
212+
RootCAs: x509.NewCertPool(),
213+
},
214+
},
215+
}
216+
217+
for name, tc := range tests {
218+
t.Run(name, func(t *testing.T) {
219+
transport := otelTransport(tc.tlsConfig)
220+
assert.NotNil(t, transport)
221+
})
222+
}
223+
}
224+
225+
func generateSelfSignedCertPEM(t *testing.T) []byte {
226+
t.Helper()
227+
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
228+
require.NoError(t, err)
229+
230+
template := x509.Certificate{
231+
SerialNumber: big.NewInt(1),
232+
Subject: pkix.Name{Organization: []string{"Test"}},
233+
NotBefore: time.Now(),
234+
NotAfter: time.Now().Add(time.Hour),
235+
KeyUsage: x509.KeyUsageCertSign,
236+
IsCA: true,
237+
IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
238+
}
239+
240+
certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
241+
require.NoError(t, err)
242+
243+
return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
244+
}

‎func/internal/podmanager_unit_test.go‎

Lines changed: 0 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,9 @@
1515
package internal
1616

1717
import (
18-
"crypto/ecdsa"
19-
"crypto/elliptic"
20-
"crypto/rand"
21-
"crypto/x509"
22-
"crypto/x509/pkix"
23-
"encoding/pem"
24-
"math/big"
25-
"net"
2618
"os"
2719
"path/filepath"
2820
"testing"
29-
"time"
3021

3122
"github.com/google/go-containerregistry/pkg/name"
3223
"github.com/stretchr/testify/assert"
@@ -377,80 +368,6 @@ func TestAppendImagePullSecret(t *testing.T) {
377368
})
378369
}
379370

380-
func TestTlsCACertPath(t *testing.T) {
381-
t.Run("prefers ca.crt over ca.pem", func(t *testing.T) {
382-
dir := t.TempDir()
383-
require.NoError(t, os.WriteFile(filepath.Join(dir, "ca.crt"), []byte("crt"), 0o600))
384-
require.NoError(t, os.WriteFile(filepath.Join(dir, "ca.pem"), []byte("pem"), 0o600))
385-
386-
path, err := tlsCACertPath(dir)
387-
require.NoError(t, err)
388-
assert.Equal(t, filepath.Join(dir, "ca.crt"), path)
389-
})
390-
391-
t.Run("falls back to ca.pem", func(t *testing.T) {
392-
dir := t.TempDir()
393-
require.NoError(t, os.WriteFile(filepath.Join(dir, "ca.pem"), []byte("pem"), 0o600))
394-
395-
path, err := tlsCACertPath(dir)
396-
require.NoError(t, err)
397-
assert.Equal(t, filepath.Join(dir, "ca.pem"), path)
398-
})
399-
400-
t.Run("returns error when mount path is missing", func(t *testing.T) {
401-
_, err := tlsCACertPath(filepath.Join(t.TempDir(), "missing"))
402-
require.Error(t, err)
403-
assert.ErrorContains(t, err, "tls secret folder")
404-
})
405-
406-
t.Run("returns error when no candidate files exist", func(t *testing.T) {
407-
dir := t.TempDir()
408-
_, err := tlsCACertPath(dir)
409-
require.Error(t, err)
410-
assert.ErrorContains(t, err, "no CA certificate found")
411-
assert.ErrorContains(t, err, "ca.crt")
412-
})
413-
}
414-
415-
func TestLoadTLSConfig(t *testing.T) {
416-
t.Run("valid PEM certificate", func(t *testing.T) {
417-
// Generate a self-signed certificate for testing
418-
certPEM := generateSelfSignedCertPEM(t)
419-
420-
tmpFile, err := os.CreateTemp("", "ca-cert-*.pem")
421-
require.NoError(t, err)
422-
defer os.Remove(tmpFile.Name())
423-
424-
_, err = tmpFile.Write(certPEM)
425-
require.NoError(t, err)
426-
require.NoError(t, tmpFile.Close())
427-
428-
tlsConfig, err := loadTLSConfig(tmpFile.Name())
429-
require.NoError(t, err)
430-
assert.NotNil(t, tlsConfig)
431-
assert.NotNil(t, tlsConfig.RootCAs)
432-
})
433-
434-
t.Run("invalid PEM data", func(t *testing.T) {
435-
tmpFile, err := os.CreateTemp("", "ca-cert-invalid-*.pem")
436-
require.NoError(t, err)
437-
defer os.Remove(tmpFile.Name())
438-
439-
_, err = tmpFile.WriteString("not a valid PEM certificate")
440-
require.NoError(t, err)
441-
require.NoError(t, tmpFile.Close())
442-
443-
_, err = loadTLSConfig(tmpFile.Name())
444-
assert.Error(t, err)
445-
assert.Contains(t, err.Error(), "failed to append certificates")
446-
})
447-
448-
t.Run("missing file", func(t *testing.T) {
449-
_, err := loadTLSConfig("/nonexistent/ca.pem")
450-
assert.Error(t, err)
451-
})
452-
}
453-
454371
func TestFindPodsForService(t *testing.T) {
455372
t.Run("returns matching pods", func(t *testing.T) {
456373
svc := &corev1.Service{
@@ -646,28 +563,6 @@ func TestGetCustomAuth(t *testing.T) {
646563
})
647564
}
648565

649-
// generateSelfSignedCertPEM generates a self-signed certificate PEM for testing.
650-
func generateSelfSignedCertPEM(t *testing.T) []byte {
651-
t.Helper()
652-
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
653-
require.NoError(t, err)
654-
655-
template := x509.Certificate{
656-
SerialNumber: big.NewInt(1),
657-
Subject: pkix.Name{Organization: []string{"Test"}},
658-
NotBefore: time.Now(),
659-
NotAfter: time.Now().Add(time.Hour),
660-
KeyUsage: x509.KeyUsageCertSign,
661-
IsCA: true,
662-
IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
663-
}
664-
665-
certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
666-
require.NoError(t, err)
667-
668-
return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
669-
}
670-
671566
// parseTestReference is a helper to parse an image reference for testing.
672567
func parseTestReference(image string) (name.Reference, error) {
673568
return name.ParseReference(image)

0 commit comments

Comments
 (0)