stop tests from starting informers for no reason
@@ -138,11 +138,12 @@ var (
}
)
-var _ = g.Describe("The default cluster RBAC policy", func() {
+var _ = g.Describe("[Feature:OpenShiftAuthorization] The default cluster RBAC policy", func() {
defer g.GinkgoRecover()
oc := exutil.NewCLI("default-rbac-policy", exutil.KubeConfigPath())
+ g.It("should have correct RBAC rules", func() {
kubeInformers := informers.NewSharedInformerFactory(oc.AdminKubeClient(), 20*time.Minute)
ruleResolver := exutil.NewRuleResolver(kubeInformers.Rbac().V1()) // signal what informers we want to use early
@@ -167,19 +168,21 @@ var _ = g.Describe("The default cluster RBAC policy", func() {
exutil.FatalErr(err)
}
- g.It("should only allow the system:authenticated group to access certain policy rules", func() {
+ g.By("should only allow the system:authenticated group to access certain policy rules", func() {
testAllGroupRules(ruleResolver, kuser.AllAuthenticated, allAuthenticatedRules, namespaces.Items)
})
- g.It("should only allow the system:unauthenticated group to access certain policy rules", func() {
+ g.By("should only allow the system:unauthenticated group to access certain policy rules", func() {
testAllGroupRules(ruleResolver, kuser.AllUnauthenticated, allUnauthenticatedRules, namespaces.Items)
})
- g.It("should only allow the system:authenticated:oauth group to access certain policy rules", func() {
+ g.By("should only allow the system:authenticated:oauth group to access certain policy rules", func() {
testAllGroupRules(ruleResolver, "system:authenticated:oauth", []rbacv1.PolicyRule{
rbacv1helpers.NewRule("create").Groups(projectGroup, legacyProjectGroup).Resources("projectrequests").RuleOrDie(),
}, namespaces.Items)
})
+
+ })
})
func testAllGroupRules(ruleResolver validation.AuthorizationRuleResolver, group string, expectedClusterRules []rbacv1.PolicyRule, namespaces []corev1.Namespace) {
