Additional audit tests
package integration
import (
+ "io/ioutil"
+ "os"
"testing"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ "k8s.io/apiserver/pkg/apis/audit"
kclientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
+ configapi "github.com/openshift/origin/pkg/cmd/server/apis/config"
testutil "github.com/openshift/origin/test/util"
testserver "github.com/openshift/origin/test/util/server"
)
-func setupAuditTest(t *testing.T) (kclientset.Interface, func()) {
+func setupAudit(t *testing.T, auditConfig configapi.AuditConfig) (kclientset.Interface, func()) {
masterConfig, err := testserver.DefaultMasterOptions()
if err != nil {
t.Fatalf("error creating config: %v", err)
}
- masterConfig.AuditConfig.Enabled = true
+ masterConfig.AuditConfig = auditConfig
kubeConfigFile, err := testserver.StartConfiguredMasterAPI(masterConfig)
if err != nil {
t.Fatalf("error starting server: %v", err)
@@ -30,7 +34,7 @@ func setupAuditTest(t *testing.T) (kclientset.Interface, func()) {
}
func TestBasicFunctionalityWithAudit(t *testing.T) {
- kubeClient, fn := setupAuditTest(t)
+ kubeClient, fn := setupAudit(t, configapi.AuditConfig{Enabled: true})
defer fn()
if _, err := kubeClient.Core().Pods(metav1.NamespaceDefault).Watch(metav1.ListOptions{}); err != nil {
@@ -39,3 +43,62 @@ func TestBasicFunctionalityWithAudit(t *testing.T) {
// TODO: test oc debug, exec, rsh, port-forward
}
+
+func TestAuditConfigEmbeded(t *testing.T) {
+ auditConfig := configapi.AuditConfig{
+ Enabled: true,
+ PolicyConfiguration: &audit.Policy{
+ Rules: []audit.PolicyRule{
+ {Level: audit.LevelMetadata},
+ },
+ },
+ }
+ kubeClient, fn := setupAudit(t, auditConfig)
+ defer fn()
+
+ if _, err := kubeClient.Core().Pods(metav1.NamespaceDefault).Watch(metav1.ListOptions{}); err != nil {
+ t.Errorf("Unexpected error watching pods: %v", err)
+ }
+}
+
+func TestAuditConfigV1Alpha1File(t *testing.T) {
+ testAuditConfigFile(t, []byte(`
+apiVersion: audit.k8s.io/v1alpha1
+kind: Policy
+rules:
+- level: Metadata
+`))
+}
+
+func TestAuditConfigV1Beta1File(t *testing.T) {
+ testAuditConfigFile(t, []byte(`
+apiVersion: audit.k8s.io/v1beta1
+kind: Policy
+rules:
+- level: Metadata
+`))
+}
+
+func testAuditConfigFile(t *testing.T, policy []byte) {
+ tmp, err := ioutil.TempFile("", "audit-policy")
+ if err != nil {
+ t.Fatalf("Cannot create a temporary file: %v", err)
+ }
+ defer os.Remove(tmp.Name())
+ if _, err := tmp.Write(policy); err != nil {
+ t.Fatalf("Cannot write to a temporary file: %v", err)
+ }
+ if err := tmp.Close(); err != nil {
+ t.Fatalf("Cannot close a temporary file: %v", err)
+ }
+ auditConfig := configapi.AuditConfig{
+ Enabled: true,
+ PolicyFile: tmp.Name(),
+ }
+ kubeClient, fn := setupAudit(t, auditConfig)
+ defer fn()
+
+ if _, err := kubeClient.Core().Pods(metav1.NamespaceDefault).Watch(metav1.ListOptions{}); err != nil {
+ t.Errorf("Unexpected error watching pods: %v", err)
+ }
+}
