v13 registry mirroring and proxying testing #1422
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| // Copyright Mondoo, Inc. 2026 | ||
| // SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| package k8s | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| appsv1 "k8s.io/api/apps/v1" | ||
| batchv1 "k8s.io/api/batch/v1" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| ) | ||
|
|
||
| func TestUpdateCronJobFields_ImagePullSecrets(t *testing.T) { | ||
| desired := &batchv1.CronJob{ | ||
| Spec: batchv1.CronJobSpec{ | ||
| Schedule: "*/5 * * * *", | ||
| JobTemplate: batchv1.JobTemplateSpec{ | ||
| Spec: batchv1.JobSpec{ | ||
| Template: corev1.PodTemplateSpec{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Name: "test", Image: "test:latest"}}, | ||
| ImagePullSecrets: []corev1.LocalObjectReference{ | ||
| {Name: "my-secret"}, | ||
| {Name: "another-secret"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| obj := &batchv1.CronJob{} | ||
| UpdateCronJobFields(obj, desired) | ||
|
|
||
| assert.Equal(t, desired.Spec.Schedule, obj.Spec.Schedule) | ||
| assert.Equal(t, desired.Spec.JobTemplate.Spec.Template.Spec.Containers, obj.Spec.JobTemplate.Spec.Template.Spec.Containers) | ||
| assert.Equal(t, desired.Spec.JobTemplate.Spec.Template.Spec.ImagePullSecrets, obj.Spec.JobTemplate.Spec.Template.Spec.ImagePullSecrets) | ||
| } | ||
|
|
||
| func TestUpdateCronJobFields_PreservesUnmanagedFields(t *testing.T) { | ||
| obj := &batchv1.CronJob{ | ||
| Spec: batchv1.CronJobSpec{ | ||
| JobTemplate: batchv1.JobTemplateSpec{ | ||
| Spec: batchv1.JobSpec{ | ||
| Template: corev1.PodTemplateSpec{ | ||
| Spec: corev1.PodSpec{ | ||
| DNSPolicy: corev1.DNSClusterFirst, | ||
| SchedulerName: "custom-scheduler", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| desired := &batchv1.CronJob{ | ||
| ObjectMeta: metav1.ObjectMeta{Labels: map[string]string{"app": "test"}}, | ||
| Spec: batchv1.CronJobSpec{ | ||
| Schedule: "*/10 * * * *", | ||
| JobTemplate: batchv1.JobTemplateSpec{ | ||
| Spec: batchv1.JobSpec{ | ||
| Template: corev1.PodTemplateSpec{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Name: "test"}}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| UpdateCronJobFields(obj, desired) | ||
|
|
||
| // Managed fields are updated | ||
| assert.Equal(t, "*/10 * * * *", obj.Spec.Schedule) | ||
| // Unmanaged fields are preserved | ||
| assert.Equal(t, corev1.DNSClusterFirst, obj.Spec.JobTemplate.Spec.Template.Spec.DNSPolicy) | ||
| assert.Equal(t, "custom-scheduler", obj.Spec.JobTemplate.Spec.Template.Spec.SchedulerName) | ||
| } | ||
|
|
||
| func TestUpdateDeploymentFields_ImagePullSecrets(t *testing.T) { | ||
| desired := &appsv1.Deployment{ | ||
| Spec: appsv1.DeploymentSpec{ | ||
| Template: corev1.PodTemplateSpec{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Name: "test", Image: "test:latest"}}, | ||
| ImagePullSecrets: []corev1.LocalObjectReference{ | ||
| {Name: "my-secret"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| obj := &appsv1.Deployment{} | ||
| UpdateDeploymentFields(obj, desired) | ||
|
|
||
| assert.Equal(t, desired.Spec.Template.Spec.ImagePullSecrets, obj.Spec.Template.Spec.ImagePullSecrets) | ||
| assert.Equal(t, desired.Spec.Template.Spec.Containers, obj.Spec.Template.Spec.Containers) | ||
| } | ||
|
|
||
| func TestUpdateDaemonSetFields_ImagePullSecrets(t *testing.T) { | ||
| desired := &appsv1.DaemonSet{ | ||
| Spec: appsv1.DaemonSetSpec{ | ||
| Template: corev1.PodTemplateSpec{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Name: "test", Image: "test:latest"}}, | ||
| ImagePullSecrets: []corev1.LocalObjectReference{ | ||
| {Name: "my-secret"}, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| obj := &appsv1.DaemonSet{} | ||
| UpdateDaemonSetFields(obj, desired) | ||
|
|
||
| assert.Equal(t, desired.Spec.Template.Spec.ImagePullSecrets, obj.Spec.Template.Spec.ImagePullSecrets) | ||
| assert.Equal(t, desired.Spec.Template.Spec.Containers, obj.Spec.Template.Spec.Containers) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| #!/usr/bin/env bash | ||
| # Copyright Mondoo, Inc. 2026 | ||
| # SPDX-License-Identifier: BUSL-1.1 | ||
|
|
||
| # Test: Registry Mirroring, imagePullSecrets & Proxy | ||
| # Builds operator, deploys with AR-based mirror registry and optional proxy, | ||
| # verifies image references, pull secrets, and proxy configuration. | ||
| # | ||
| # Prerequisites: | ||
| # - Terraform infrastructure provisioned with enable_mirror_test=true | ||
| # - crane CLI installed (go install github.com/google/go-containerregistry/cmd/crane@latest) | ||
| # - gcloud authenticated, docker, helm, kubectl available | ||
| # - For proxy testing: also set enable_proxy_test=true in terraform | ||
| # | ||
| # Usage: | ||
| # ./run-registry-mirroring.sh | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| E2E_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
| source "${E2E_ROOT}/scripts/common.sh" | ||
|
|
||
| info "==========================================" | ||
| info " Test: Registry Mirroring & Proxy" | ||
| info "==========================================" | ||
|
|
||
| # Step 1: Load Terraform outputs (includes mirror and proxy outputs) | ||
| load_tf_outputs | ||
|
|
||
| # Validate that mirror test infra is provisioned | ||
| if [[ "${ENABLE_MIRROR_TEST}" != "true" ]]; then | ||
| die "This test requires enable_mirror_test=true in Terraform. Run: terraform apply -var='enable_mirror_test=true'" | ||
| fi | ||
|
|
||
| # Step 2: Build and push operator image | ||
| info "--- Step: Build and Push ---" | ||
| source "${E2E_ROOT}/scripts/build-and-push.sh" | ||
|
|
||
| # Step 3: Create imagePullSecret for mirror AR repo | ||
| info "--- Step: Setup Mirror Registry Credentials ---" | ||
| source "${E2E_ROOT}/scripts/setup-mirror-registry.sh" | ||
|
|
||
| # Step 4: Populate mirror AR repo with cnspec image | ||
| info "--- Step: Populate Mirror Registry ---" | ||
| source "${E2E_ROOT}/scripts/populate-mirror-registry.sh" | ||
|
|
||
| # Step 5: Deploy test workload | ||
| info "--- Step: Deploy Test Workload ---" | ||
| source "${E2E_ROOT}/scripts/deploy-test-workload.sh" | ||
|
|
||
| # Step 6: Set proxy env vars from Terraform if enabled | ||
| if [[ "${ENABLE_PROXY_TEST}" == "true" ]]; then | ||
| info "Proxy testing enabled — Squid proxy at ${SQUID_PROXY_IP}" | ||
| else | ||
| info "Proxy testing disabled — skipping proxy configuration" | ||
| fi | ||
|
|
||
| # Step 7: Deploy operator with mirroring/proxy configuration | ||
| info "--- Step: Deploy Operator with Mirroring ---" | ||
| source "${E2E_ROOT}/scripts/deploy-operator-mirroring.sh" | ||
|
|
||
| # Step 8: Apply MondooAuditConfig | ||
| info "--- Step: Apply Mondoo Config ---" | ||
| source "${E2E_ROOT}/scripts/apply-mondoo-config.sh" | ||
|
|
||
| # Step 9: Wait for operator to reconcile | ||
| info "Waiting 90s for operator to reconcile with mirrored images..." | ||
| sleep 90 | ||
|
|
||
| # Step 10: Standard verification | ||
| info "--- Step: Standard Verify ---" | ||
| source "${E2E_ROOT}/scripts/verify.sh" | ||
|
|
||
| # Step 11: Mirroring-specific verification | ||
| info "--- Step: Verify Mirroring & Proxy ---" | ||
| source "${E2E_ROOT}/scripts/verify-mirroring.sh" | ||
|
|
||
| info "" | ||
| info "==========================================" | ||
| info " Test: Registry Mirroring & Proxy - COMPLETE" | ||
| info "==========================================" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.