52 lines
2.7 KiB
Python
52 lines
2.7 KiB
Python
"""校验渲染后的环境隔离与引用关系，无网络、集群写入或凭据访问。"""
|
|
from pathlib import Path
|
|
import re
|
|
import subprocess
|
|
import unittest
|
|
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1] / 'ayatori'
|
|
|
|
|
|
def render(environment):
|
|
return list(yaml.safe_load_all(subprocess.check_output(
|
|
['kubectl', 'kustomize', str(ROOT / environment)], text=True)))
|
|
|
|
|
|
class AyatoriManifestTests(unittest.TestCase):
|
|
def test_common_entry_cannot_register_instances_or_sync_credentials(self):
|
|
objects = render('.')
|
|
self.assertEqual([x['kind'] for x in objects], ['ConfigMap'])
|
|
self.assertEqual(objects[0]['metadata']['namespace'], 'ayatori-system')
|
|
|
|
def test_environment_isolation_scope_and_references(self):
|
|
for env, address, port in [('dev', '192.168.10.127', 5433), ('prod', '192.168.10.2', 5432)]:
|
|
with self.subTest(environment=env):
|
|
objects = render(env)
|
|
self.assertEqual(sorted(x['kind'] for x in objects),
|
|
['ConfigMap', 'ExternalSecret', 'PostgreSQLInstance'])
|
|
instance = next(x for x in objects if x['kind'] == 'PostgreSQLInstance')
|
|
secret = next(x for x in objects if x['kind'] == 'ExternalSecret')
|
|
self.assertNotIn('namespace', instance['metadata'])
|
|
self.assertEqual(instance['metadata']['name'], 'homelab-' + env)
|
|
self.assertEqual(instance['spec']['endpoint'], {
|
|
'host': 'pg-' + env + '.ad.ddupan.top', 'hostaddr': address,
|
|
'port': port, 'database': 'postgres', 'sslMode': 'verify-full'})
|
|
self.assertEqual(secret['metadata']['namespace'], 'ayatori-system')
|
|
self.assertEqual(instance['spec']['adminCredentialRef']['name'], secret['spec']['target']['name'])
|
|
self.assertEqual(secret['spec']['secretStoreRef'],
|
|
{'name': 'homelab-postgresql-' + env + '-admin', 'kind': 'SecretStore'})
|
|
self.assertEqual({x['remoteRef']['key'] for x in secret['spec']['data']},
|
|
{'infra/postgresql/ayatori/' + env})
|
|
self.assertEqual({x['secretKey'] for x in secret['spec']['data']}, {'username', 'password'})
|
|
self.assertEqual({x['remoteRef']['property'] for x in secret['spec']['data']}, {'username', 'password'})
|
|
policy = (ROOT / env / 'eso-policy.hcl').read_text()
|
|
self.assertEqual(re.findall(r'path\s+"([^"]+)"', policy),
|
|
['kv/data/infra/postgresql/ayatori/' + env])
|
|
self.assertEqual(re.findall(r'capabilities\s*=\s*\[([^]]+)\]', policy), ['"read"'])
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|