mirror of
https://github.com/Katakate/k7.git
synced 2026-09-21 17:43:20 +00:00
G
13fafe0997
Per-key node pins, k7d-fc pause/resume/exec, and HA-soak fixes. Playbook pins k7d 0.7.0. GitHub .deb, Launchpad PPA, and PyPI k7-sdk are 0.4.0.
106 lines
3.7 KiB
Python
106 lines
3.7 KiB
Python
"""Unit tests for ``k7 install --api-allow-cidr``.
|
|
|
|
Everything here is CLI-side: an invalid CIDR, or the flag combined with
|
|
``--cni flannel``, must fail *before* Ansible runs.
|
|
"""
|
|
|
|
from pathlib import Path
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from typer.testing import CliRunner
|
|
|
|
from k7.cli.k7 import app
|
|
from k7.core.models import OperationResult
|
|
|
|
runner = CliRunner()
|
|
|
|
|
|
def _install(args: list[str]):
|
|
if "--backend" not in args and "-b" not in args:
|
|
args = ["--backend", "kql", *args]
|
|
with patch("k7.cli.k7.K7Core") as core_cls:
|
|
install = MagicMock(return_value=OperationResult(success=True, message="ok"))
|
|
core_cls.return_value.install_node = install
|
|
result = runner.invoke(app, ["--core", "install", *args])
|
|
return result, install
|
|
|
|
|
|
def _extra_vars(install: MagicMock) -> dict:
|
|
return install.call_args.kwargs["extra_vars"]
|
|
|
|
|
|
def test_default_install_sends_an_empty_allowlist():
|
|
result, install = _install([])
|
|
assert result.exit_code == 0, result.output
|
|
assert _extra_vars(install)["k7_api_allow_cidrs"] == ""
|
|
|
|
|
|
def test_repeatable_flag_is_forwarded_comma_joined():
|
|
result, install = _install(["--api-allow-cidr", "203.0.113.4/32", "--api-allow-cidr", "198.51.100.0/24"])
|
|
assert result.exit_code == 0, result.output
|
|
assert _extra_vars(install)["k7_api_allow_cidrs"] == "203.0.113.4/32,198.51.100.0/24"
|
|
|
|
|
|
def test_bare_address_is_accepted_as_a_host_route():
|
|
result, install = _install(["--api-allow-cidr", "203.0.113.4"])
|
|
assert result.exit_code == 0, result.output
|
|
assert _extra_vars(install)["k7_api_allow_cidrs"] == "203.0.113.4"
|
|
|
|
|
|
def test_host_bits_set_are_accepted_strict_false():
|
|
result, install = _install(["--api-allow-cidr", "203.0.113.4/24"])
|
|
assert result.exit_code == 0, result.output
|
|
|
|
|
|
def test_invalid_cidr_fails_before_ansible():
|
|
result, install = _install(["--api-allow-cidr", "203.0.113.0/33"])
|
|
assert result.exit_code != 0
|
|
assert "is not a valid CIDR" in result.output
|
|
install.assert_not_called()
|
|
|
|
|
|
def test_garbage_cidr_fails_before_ansible():
|
|
result, install = _install(["--api-allow-cidr", "not-a-cidr"])
|
|
assert result.exit_code != 0
|
|
assert "is not a valid CIDR" in result.output
|
|
install.assert_not_called()
|
|
|
|
|
|
def test_flannel_is_rejected():
|
|
result, install = _install(["--cni", "flannel", "--api-allow-cidr", "203.0.113.4/32"])
|
|
assert result.exit_code != 0
|
|
assert "--api-allow-cidr requires the Cilium CNI" in result.output
|
|
install.assert_not_called()
|
|
|
|
|
|
def test_flannel_without_the_flag_still_installs():
|
|
result, install = _install(["--cni", "flannel"])
|
|
assert result.exit_code == 0, result.output
|
|
install.assert_called_once()
|
|
|
|
|
|
def test_allow_everything_warns_loudly():
|
|
result, install = _install(["--api-allow-cidr", "0.0.0.0/0"])
|
|
assert result.exit_code == 0, result.output
|
|
assert "allows every source address" in result.output
|
|
assert _extra_vars(install)["k7_api_allow_cidrs"] == "0.0.0.0/0"
|
|
|
|
|
|
def test_specific_cidr_does_not_warn():
|
|
result, _ = _install(["--api-allow-cidr", "203.0.113.4/32"])
|
|
assert result.exit_code == 0, result.output
|
|
assert "allows every source address" not in result.output
|
|
|
|
|
|
_PLAYBOOK = (Path(__file__).resolve().parents[2] / "src/k7/deploy/k7-install-node.yaml").read_text()
|
|
|
|
|
|
def test_playbook_policy_keeps_the_reserved_entities():
|
|
"""Dropping `host` from the rendered policy crash-loops the k7-api pod:
|
|
the kubelet liveness/readiness probes come from the node."""
|
|
assert '- fromEntities: ["host", "remote-node", "health", "kube-apiserver"]' in _PLAYBOOK
|
|
|
|
|
|
def test_playbook_only_switches_external_traffic_policy_with_an_allowlist():
|
|
assert "'Local' if k7_api_allow_cidrs_list | length > 0 else 'Cluster'" in _PLAYBOOK
|