util.go 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101
  1. /*
  2. Copyright 2017 The Kubernetes Authors.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. */
  13. package kubeconfig
  14. import (
  15. "crypto/x509"
  16. "encoding/pem"
  17. "testing"
  18. clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
  19. certstestutil "k8s.io/kubernetes/cmd/kubeadm/app/util/certs"
  20. )
  21. // AssertKubeConfigCurrentCluster is a utility function for kubeadm testing that asserts if the CurrentCluster in
  22. // the given KubeConfig object contains refers to a specific cluster
  23. func AssertKubeConfigCurrentCluster(t *testing.T, config *clientcmdapi.Config, expectedAPIServerAddress string, expectedAPIServerCaCert *x509.Certificate) {
  24. currentContext := config.Contexts[config.CurrentContext]
  25. currentCluster := config.Clusters[currentContext.Cluster]
  26. // Assert expectedAPIServerAddress
  27. if currentCluster.Server != expectedAPIServerAddress {
  28. t.Errorf("kubeconfig.currentCluster.Server is [%s], expected [%s]", currentCluster.Server, expectedAPIServerAddress)
  29. }
  30. // Assert the APIServerCaCert
  31. if len(currentCluster.CertificateAuthorityData) == 0 {
  32. t.Error("kubeconfig.currentCluster.CertificateAuthorityData is empty, expected not empty")
  33. return
  34. }
  35. block, _ := pem.Decode(currentCluster.CertificateAuthorityData)
  36. currentAPIServerCaCert, err := x509.ParseCertificate(block.Bytes)
  37. if err != nil {
  38. t.Errorf("kubeconfig.currentCluster.CertificateAuthorityData is not a valid CA: %v", err)
  39. return
  40. }
  41. if !currentAPIServerCaCert.Equal(expectedAPIServerCaCert) {
  42. t.Errorf("kubeconfig.currentCluster.CertificateAuthorityData not correspond to the expected CA cert")
  43. }
  44. }
  45. // AssertKubeConfigCurrentAuthInfoWithClientCert is a utility function for kubeadm testing that asserts if the CurrentAuthInfo in
  46. // the given KubeConfig object contains a clientCert that refers to a specific client name, is signed by the expected CA, includes the expected organizations
  47. func AssertKubeConfigCurrentAuthInfoWithClientCert(t *testing.T, config *clientcmdapi.Config, signinCa *x509.Certificate, expectedClientName string, expectedOrganizations ...string) {
  48. currentContext := config.Contexts[config.CurrentContext]
  49. currentAuthInfo := config.AuthInfos[currentContext.AuthInfo]
  50. // assert clientCert
  51. if len(currentAuthInfo.ClientCertificateData) == 0 {
  52. t.Error("kubeconfig.currentAuthInfo.ClientCertificateData is empty, expected not empty")
  53. return
  54. }
  55. block, _ := pem.Decode(config.AuthInfos[currentContext.AuthInfo].ClientCertificateData)
  56. currentClientCert, err := x509.ParseCertificate(block.Bytes)
  57. if err != nil {
  58. t.Errorf("kubeconfig.currentAuthInfo.ClientCertificateData is not a valid CA: %v", err)
  59. return
  60. }
  61. // Asserts the clientCert is signed by the signinCa
  62. certstestutil.AssertCertificateIsSignedByCa(t, currentClientCert, signinCa)
  63. // Asserts the clientCert has ClientAuth ExtKeyUsage
  64. certstestutil.AssertCertificateHasClientAuthUsage(t, currentClientCert)
  65. // Asserts the clientCert has expected expectedUserName as CommonName
  66. certstestutil.AssertCertificateHasCommonName(t, currentClientCert, expectedClientName)
  67. // Asserts the clientCert has expected Organizations
  68. certstestutil.AssertCertificateHasOrganizations(t, currentClientCert, expectedOrganizations...)
  69. }
  70. // AssertKubeConfigCurrentAuthInfoWithToken is a utility function for kubeadm testing that asserts if the CurrentAuthInfo in
  71. // the given KubeConfig object refers to expected token
  72. func AssertKubeConfigCurrentAuthInfoWithToken(t *testing.T, config *clientcmdapi.Config, expectedClientName, expectedToken string) {
  73. currentContext := config.Contexts[config.CurrentContext]
  74. currentAuthInfo := config.AuthInfos[currentContext.AuthInfo]
  75. // assert token
  76. if currentAuthInfo.Token != expectedToken {
  77. t.Errorf("kubeconfig.currentAuthInfo.Token [%s], expected [%s]", currentAuthInfo.Token, expectedToken)
  78. return
  79. }
  80. }