metadata_test.go 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442
  1. /*
  2. Copyright 2014 The Kubernetes Authors.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. */
  13. package gcp_credentials
  14. import (
  15. "encoding/base64"
  16. "encoding/json"
  17. "fmt"
  18. "io/ioutil"
  19. "net/http"
  20. "net/http/httptest"
  21. "net/url"
  22. "os"
  23. "reflect"
  24. "strings"
  25. "testing"
  26. utilnet "k8s.io/apimachinery/pkg/util/net"
  27. "k8s.io/kubernetes/pkg/credentialprovider"
  28. )
  29. func createProductNameFile() (string, error) {
  30. file, err := ioutil.TempFile("", "")
  31. if err != nil {
  32. return "", fmt.Errorf("failed to create temporary test file: %v", err)
  33. }
  34. return file.Name(), ioutil.WriteFile(file.Name(), []byte("Google"), 0600)
  35. }
  36. func TestDockerKeyringFromGoogleDockerConfigMetadata(t *testing.T) {
  37. registryUrl := "hello.kubernetes.io"
  38. email := "foo@bar.baz"
  39. username := "foo"
  40. password := "bar"
  41. auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", username, password)))
  42. sampleDockerConfig := fmt.Sprintf(`{
  43. "https://%s": {
  44. "email": %q,
  45. "auth": %q
  46. }
  47. }`, registryUrl, email, auth)
  48. var err error
  49. gceProductNameFile, err = createProductNameFile()
  50. if err != nil {
  51. t.Errorf("failed to create gce product name file: %v", err)
  52. }
  53. defer os.Remove(gceProductNameFile)
  54. const probeEndpoint = "/computeMetadata/v1/"
  55. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  56. // Only serve the one metadata key.
  57. if probeEndpoint == r.URL.Path {
  58. w.WriteHeader(http.StatusOK)
  59. } else if strings.HasSuffix(dockerConfigKey, r.URL.Path) {
  60. w.WriteHeader(http.StatusOK)
  61. w.Header().Set("Content-Type", "application/json")
  62. fmt.Fprintln(w, sampleDockerConfig)
  63. } else {
  64. http.Error(w, "", http.StatusNotFound)
  65. }
  66. }))
  67. defer server.Close()
  68. // Make a transport that reroutes all traffic to the example server
  69. transport := utilnet.SetTransportDefaults(&http.Transport{
  70. Proxy: func(req *http.Request) (*url.URL, error) {
  71. return url.Parse(server.URL + req.URL.Path)
  72. },
  73. })
  74. keyring := &credentialprovider.BasicDockerKeyring{}
  75. provider := &dockerConfigKeyProvider{
  76. metadataProvider{Client: &http.Client{Transport: transport}},
  77. }
  78. if !provider.Enabled() {
  79. t.Errorf("Provider is unexpectedly disabled")
  80. }
  81. keyring.Add(provider.Provide(""))
  82. creds, ok := keyring.Lookup(registryUrl)
  83. if !ok {
  84. t.Errorf("Didn't find expected URL: %s", registryUrl)
  85. return
  86. }
  87. if len(creds) > 1 {
  88. t.Errorf("Got more hits than expected: %s", creds)
  89. }
  90. val := creds[0]
  91. if username != val.Username {
  92. t.Errorf("Unexpected username value, want: %s, got: %s", username, val.Username)
  93. }
  94. if password != val.Password {
  95. t.Errorf("Unexpected password value, want: %s, got: %s", password, val.Password)
  96. }
  97. if email != val.Email {
  98. t.Errorf("Unexpected email value, want: %s, got: %s", email, val.Email)
  99. }
  100. }
  101. func TestDockerKeyringFromGoogleDockerConfigMetadataUrl(t *testing.T) {
  102. registryUrl := "hello.kubernetes.io"
  103. email := "foo@bar.baz"
  104. username := "foo"
  105. password := "bar"
  106. auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", username, password)))
  107. sampleDockerConfig := fmt.Sprintf(`{
  108. "https://%s": {
  109. "email": %q,
  110. "auth": %q
  111. }
  112. }`, registryUrl, email, auth)
  113. var err error
  114. gceProductNameFile, err = createProductNameFile()
  115. if err != nil {
  116. t.Errorf("failed to create gce product name file: %v", err)
  117. }
  118. defer os.Remove(gceProductNameFile)
  119. const probeEndpoint = "/computeMetadata/v1/"
  120. const valueEndpoint = "/my/value"
  121. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  122. // Only serve the URL key and the value endpoint
  123. if probeEndpoint == r.URL.Path {
  124. w.WriteHeader(http.StatusOK)
  125. } else if valueEndpoint == r.URL.Path {
  126. w.WriteHeader(http.StatusOK)
  127. w.Header().Set("Content-Type", "application/json")
  128. fmt.Fprintln(w, sampleDockerConfig)
  129. } else if strings.HasSuffix(dockerConfigUrlKey, r.URL.Path) {
  130. w.WriteHeader(http.StatusOK)
  131. w.Header().Set("Content-Type", "application/text")
  132. fmt.Fprint(w, "http://foo.bar.com"+valueEndpoint)
  133. } else {
  134. http.Error(w, "", http.StatusNotFound)
  135. }
  136. }))
  137. defer server.Close()
  138. // Make a transport that reroutes all traffic to the example server
  139. transport := utilnet.SetTransportDefaults(&http.Transport{
  140. Proxy: func(req *http.Request) (*url.URL, error) {
  141. return url.Parse(server.URL + req.URL.Path)
  142. },
  143. })
  144. keyring := &credentialprovider.BasicDockerKeyring{}
  145. provider := &dockerConfigUrlKeyProvider{
  146. metadataProvider{Client: &http.Client{Transport: transport}},
  147. }
  148. if !provider.Enabled() {
  149. t.Errorf("Provider is unexpectedly disabled")
  150. }
  151. keyring.Add(provider.Provide(""))
  152. creds, ok := keyring.Lookup(registryUrl)
  153. if !ok {
  154. t.Errorf("Didn't find expected URL: %s", registryUrl)
  155. return
  156. }
  157. if len(creds) > 1 {
  158. t.Errorf("Got more hits than expected: %s", creds)
  159. }
  160. val := creds[0]
  161. if username != val.Username {
  162. t.Errorf("Unexpected username value, want: %s, got: %s", username, val.Username)
  163. }
  164. if password != val.Password {
  165. t.Errorf("Unexpected password value, want: %s, got: %s", password, val.Password)
  166. }
  167. if email != val.Email {
  168. t.Errorf("Unexpected email value, want: %s, got: %s", email, val.Email)
  169. }
  170. }
  171. func TestContainerRegistryBasics(t *testing.T) {
  172. registryUrl := "container.cloud.google.com"
  173. email := "1234@project.gserviceaccount.com"
  174. token := &tokenBlob{AccessToken: "ya26.lots-of-indiscernible-garbage"}
  175. const (
  176. serviceAccountsEndpoint = "/computeMetadata/v1/instance/service-accounts/"
  177. defaultEndpoint = "/computeMetadata/v1/instance/service-accounts/default/"
  178. scopeEndpoint = defaultEndpoint + "scopes"
  179. emailEndpoint = defaultEndpoint + "email"
  180. tokenEndpoint = defaultEndpoint + "token"
  181. )
  182. var err error
  183. gceProductNameFile, err = createProductNameFile()
  184. if err != nil {
  185. t.Errorf("failed to create gce product name file: %v", err)
  186. }
  187. defer os.Remove(gceProductNameFile)
  188. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  189. // Only serve the URL key and the value endpoint
  190. if scopeEndpoint == r.URL.Path {
  191. w.WriteHeader(http.StatusOK)
  192. w.Header().Set("Content-Type", "application/json")
  193. fmt.Fprintf(w, `["%s.read_write"]`, storageScopePrefix)
  194. } else if emailEndpoint == r.URL.Path {
  195. w.WriteHeader(http.StatusOK)
  196. fmt.Fprint(w, email)
  197. } else if tokenEndpoint == r.URL.Path {
  198. w.WriteHeader(http.StatusOK)
  199. w.Header().Set("Content-Type", "application/json")
  200. bytes, err := json.Marshal(token)
  201. if err != nil {
  202. t.Fatalf("unexpected error: %v", err)
  203. }
  204. fmt.Fprintln(w, string(bytes))
  205. } else if serviceAccountsEndpoint == r.URL.Path {
  206. w.WriteHeader(http.StatusOK)
  207. fmt.Fprintln(w, "default/\ncustom")
  208. } else {
  209. http.Error(w, "", http.StatusNotFound)
  210. }
  211. }))
  212. defer server.Close()
  213. // Make a transport that reroutes all traffic to the example server
  214. transport := utilnet.SetTransportDefaults(&http.Transport{
  215. Proxy: func(req *http.Request) (*url.URL, error) {
  216. return url.Parse(server.URL + req.URL.Path)
  217. },
  218. })
  219. keyring := &credentialprovider.BasicDockerKeyring{}
  220. provider := &containerRegistryProvider{
  221. metadataProvider{Client: &http.Client{Transport: transport}},
  222. }
  223. if !provider.Enabled() {
  224. t.Errorf("Provider is unexpectedly disabled")
  225. }
  226. keyring.Add(provider.Provide(""))
  227. creds, ok := keyring.Lookup(registryUrl)
  228. if !ok {
  229. t.Errorf("Didn't find expected URL: %s", registryUrl)
  230. return
  231. }
  232. if len(creds) > 1 {
  233. t.Errorf("Got more hits than expected: %s", creds)
  234. }
  235. val := creds[0]
  236. if "_token" != val.Username {
  237. t.Errorf("Unexpected username value, want: %s, got: %s", "_token", val.Username)
  238. }
  239. if token.AccessToken != val.Password {
  240. t.Errorf("Unexpected password value, want: %s, got: %s", token.AccessToken, val.Password)
  241. }
  242. if email != val.Email {
  243. t.Errorf("Unexpected email value, want: %s, got: %s", email, val.Email)
  244. }
  245. }
  246. func TestContainerRegistryNoServiceAccount(t *testing.T) {
  247. const (
  248. serviceAccountsEndpoint = "/computeMetadata/v1/instance/service-accounts/"
  249. )
  250. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  251. // Only serve the URL key and the value endpoint
  252. if serviceAccountsEndpoint == r.URL.Path {
  253. w.WriteHeader(http.StatusOK)
  254. w.Header().Set("Content-Type", "application/json")
  255. bytes, err := json.Marshal([]string{})
  256. if err != nil {
  257. t.Fatalf("unexpected error: %v", err)
  258. }
  259. fmt.Fprintln(w, string(bytes))
  260. } else {
  261. http.Error(w, "", http.StatusNotFound)
  262. }
  263. }))
  264. defer server.Close()
  265. var err error
  266. gceProductNameFile, err = createProductNameFile()
  267. if err != nil {
  268. t.Errorf("failed to create gce product name file: %v", err)
  269. }
  270. defer os.Remove(gceProductNameFile)
  271. // Make a transport that reroutes all traffic to the example server
  272. transport := utilnet.SetTransportDefaults(&http.Transport{
  273. Proxy: func(req *http.Request) (*url.URL, error) {
  274. return url.Parse(server.URL + req.URL.Path)
  275. },
  276. })
  277. provider := &containerRegistryProvider{
  278. metadataProvider{Client: &http.Client{Transport: transport}},
  279. }
  280. if provider.Enabled() {
  281. t.Errorf("Provider is unexpectedly enabled")
  282. }
  283. }
  284. func TestContainerRegistryNoStorageScope(t *testing.T) {
  285. const (
  286. serviceAccountsEndpoint = "/computeMetadata/v1/instance/service-accounts/"
  287. defaultEndpoint = "/computeMetadata/v1/instance/service-accounts/default/"
  288. scopeEndpoint = defaultEndpoint + "scopes"
  289. )
  290. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  291. // Only serve the URL key and the value endpoint
  292. if scopeEndpoint == r.URL.Path {
  293. w.WriteHeader(http.StatusOK)
  294. w.Header().Set("Content-Type", "application/json")
  295. fmt.Fprint(w, `["https://www.googleapis.com/auth/compute.read_write"]`)
  296. } else if serviceAccountsEndpoint == r.URL.Path {
  297. w.WriteHeader(http.StatusOK)
  298. fmt.Fprintln(w, "default/\ncustom")
  299. } else {
  300. http.Error(w, "", http.StatusNotFound)
  301. }
  302. }))
  303. defer server.Close()
  304. var err error
  305. gceProductNameFile, err = createProductNameFile()
  306. if err != nil {
  307. t.Errorf("failed to create gce product name file: %v", err)
  308. }
  309. defer os.Remove(gceProductNameFile)
  310. // Make a transport that reroutes all traffic to the example server
  311. transport := utilnet.SetTransportDefaults(&http.Transport{
  312. Proxy: func(req *http.Request) (*url.URL, error) {
  313. return url.Parse(server.URL + req.URL.Path)
  314. },
  315. })
  316. provider := &containerRegistryProvider{
  317. metadataProvider{Client: &http.Client{Transport: transport}},
  318. }
  319. if provider.Enabled() {
  320. t.Errorf("Provider is unexpectedly enabled")
  321. }
  322. }
  323. func TestComputePlatformScopeSubstitutesStorageScope(t *testing.T) {
  324. const (
  325. serviceAccountsEndpoint = "/computeMetadata/v1/instance/service-accounts/"
  326. defaultEndpoint = "/computeMetadata/v1/instance/service-accounts/default/"
  327. scopeEndpoint = defaultEndpoint + "scopes"
  328. )
  329. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  330. // Only serve the URL key and the value endpoint
  331. if scopeEndpoint == r.URL.Path {
  332. w.WriteHeader(http.StatusOK)
  333. w.Header().Set("Content-Type", "application/json")
  334. fmt.Fprint(w, `["https://www.googleapis.com/auth/compute.read_write","https://www.googleapis.com/auth/cloud-platform.read-only"]`)
  335. } else if serviceAccountsEndpoint == r.URL.Path {
  336. w.WriteHeader(http.StatusOK)
  337. w.Header().Set("Content-Type", "application/json")
  338. fmt.Fprintln(w, "default/\ncustom")
  339. } else {
  340. http.Error(w, "", http.StatusNotFound)
  341. }
  342. }))
  343. defer server.Close()
  344. var err error
  345. gceProductNameFile, err = createProductNameFile()
  346. if err != nil {
  347. t.Errorf("failed to create gce product name file: %v", err)
  348. }
  349. defer os.Remove(gceProductNameFile)
  350. // Make a transport that reroutes all traffic to the example server
  351. transport := utilnet.SetTransportDefaults(&http.Transport{
  352. Proxy: func(req *http.Request) (*url.URL, error) {
  353. return url.Parse(server.URL + req.URL.Path)
  354. },
  355. })
  356. provider := &containerRegistryProvider{
  357. metadataProvider{Client: &http.Client{Transport: transport}},
  358. }
  359. if !provider.Enabled() {
  360. t.Errorf("Provider is unexpectedly disabled")
  361. }
  362. }
  363. func TestAllProvidersNoMetadata(t *testing.T) {
  364. server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  365. http.Error(w, "", http.StatusNotFound)
  366. }))
  367. defer server.Close()
  368. // Make a transport that reroutes all traffic to the example server
  369. transport := utilnet.SetTransportDefaults(&http.Transport{
  370. Proxy: func(req *http.Request) (*url.URL, error) {
  371. return url.Parse(server.URL + req.URL.Path)
  372. },
  373. })
  374. providers := []credentialprovider.DockerConfigProvider{
  375. &dockerConfigKeyProvider{
  376. metadataProvider{Client: &http.Client{Transport: transport}},
  377. },
  378. &dockerConfigUrlKeyProvider{
  379. metadataProvider{Client: &http.Client{Transport: transport}},
  380. },
  381. &containerRegistryProvider{
  382. metadataProvider{Client: &http.Client{Transport: transport}},
  383. },
  384. }
  385. for _, provider := range providers {
  386. if provider.Enabled() {
  387. t.Errorf("Provider %s is unexpectedly enabled", reflect.TypeOf(provider).String())
  388. }
  389. }
  390. }