@@ -10,7 +10,6 @@ import (
1010 paperclipv1alpha1 "github.com/paperclipinc/paperclip-operator/api/v1alpha1"
1111)
1212
13- //nolint:unparam // test helper kept flexible for future test cases
1413func newTestInstance (name string ) * paperclipv1alpha1.Instance {
1514 return & paperclipv1alpha1.Instance {
1615 ObjectMeta : metav1.ObjectMeta {
@@ -277,6 +276,39 @@ func TestBuildNetworkPolicy(t *testing.T) {
277276 }
278277}
279278
279+ func TestBuildNetworkPolicyCloudSandboxK8sAPIEgress (t * testing.T ) {
280+ instance := newTestInstance ("my-paperclip" )
281+ instance .Spec .Adapters .CloudSandbox = & paperclipv1alpha1.CloudSandboxSpec {
282+ Enabled : true ,
283+ }
284+ np := BuildNetworkPolicy (instance )
285+
286+ found := false
287+ for _ , rule := range np .Spec .Egress {
288+ for _ , port := range rule .Ports {
289+ if port .Port != nil && port .Port .IntValue () == 6443 {
290+ found = true
291+ }
292+ }
293+ }
294+ if ! found {
295+ t .Error ("expected egress rule for K8s API port 6443 when cloud sandbox enabled" )
296+ }
297+ }
298+
299+ func TestBuildNetworkPolicyNoK8sAPIEgressWithoutSandbox (t * testing.T ) {
300+ instance := newTestInstance ("my-paperclip" )
301+ np := BuildNetworkPolicy (instance )
302+
303+ for _ , rule := range np .Spec .Egress {
304+ for _ , port := range rule .Ports {
305+ if port .Port != nil && port .Port .IntValue () == 6443 {
306+ t .Error ("should not have K8s API egress rule when cloud sandbox is not enabled" )
307+ }
308+ }
309+ }
310+ }
311+
280312func TestBuildIngress (t * testing.T ) {
281313 instance := newTestInstance ("my-paperclip" )
282314 instance .Spec .Networking .Ingress = & paperclipv1alpha1.IngressSpec {
@@ -666,6 +698,68 @@ func TestBuildStatefulSetNoCloudSandbox(t *testing.T) {
666698 }
667699}
668700
701+ func TestBuildStatefulSetCloudSandboxSchedulingEnvVars (t * testing.T ) {
702+ instance := newTestInstance ("my-paperclip" )
703+ instance .Spec .Adapters .CloudSandbox = & paperclipv1alpha1.CloudSandboxSpec {
704+ Enabled : true ,
705+ }
706+ instance .Spec .Availability .NodeSelector = map [string ]string {
707+ "cloud.google.com/gke-nodepool" : "sandbox" ,
708+ }
709+ instance .Spec .Availability .Tolerations = []corev1.Toleration {
710+ {
711+ Key : "sandbox" ,
712+ Operator : corev1 .TolerationOpEqual ,
713+ Value : "true" ,
714+ Effect : corev1 .TaintEffectNoSchedule ,
715+ },
716+ }
717+
718+ sts := BuildStatefulSet (instance , nil )
719+ container := sts .Spec .Template .Spec .Containers [0 ]
720+
721+ envMap := make (map [string ]string )
722+ for _ , env := range container .Env {
723+ if env .Value != "" {
724+ envMap [env .Name ] = env .Value
725+ }
726+ }
727+
728+ // Verify nodeSelector env var
729+ nsVal , ok := envMap ["PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR" ]
730+ if ! ok {
731+ t .Fatal ("expected PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR to be set" )
732+ }
733+ if nsVal != `{"cloud.google.com/gke-nodepool":"sandbox"}` {
734+ t .Errorf ("unexpected nodeSelector JSON: %s" , nsVal )
735+ }
736+
737+ // Verify tolerations env var
738+ tolVal , ok := envMap ["PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS" ]
739+ if ! ok {
740+ t .Fatal ("expected PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS to be set" )
741+ }
742+ if tolVal != `[{"key":"sandbox","operator":"Equal","value":"true","effect":"NoSchedule"}]` {
743+ t .Errorf ("unexpected tolerations JSON: %s" , tolVal )
744+ }
745+
746+ // Verify these are NOT set when availability scheduling is empty
747+ instance2 := newTestInstance ("my-paperclip-2" )
748+ instance2 .Spec .Adapters .CloudSandbox = & paperclipv1alpha1.CloudSandboxSpec {
749+ Enabled : true ,
750+ }
751+ sts2 := BuildStatefulSet (instance2 , nil )
752+ container2 := sts2 .Spec .Template .Spec .Containers [0 ]
753+ for _ , env := range container2 .Env {
754+ if env .Name == "PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR" {
755+ t .Error ("unexpected PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR when nodeSelector is empty" )
756+ }
757+ if env .Name == "PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS" {
758+ t .Error ("unexpected PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS when tolerations is empty" )
759+ }
760+ }
761+ }
762+
669763func TestBuildSandboxRole (t * testing.T ) {
670764 instance := newTestInstance ("my-paperclip" )
671765 role := BuildSandboxRole (instance , "test-ns" )
0 commit comments