Function TestExcludedNamespaces

pkg/webhook/policy_test.go:422–522

(t *testing.T)

}

func TestExcludedNamespaces(t *testing.T) {
	cfg := &v1alpha1.Config{
		Spec: v1alpha1.ConfigSpec{
			Match: []v1alpha1.MatchEntry{
				{
					ExcludedNamespaces: []wildcard.Wildcard{"kube-*"},
					Processes:          []string{"*"},
				},
			},
			Validation: v1alpha1.Validation{
				Traces: []v1alpha1.Trace{},
			},
		},
	}
	ctx := context.Background()
	opa, err := makeOpaClient()
	if err != nil {
		t.Fatalf("Could not initialize OPA: %s", err)
	}
	if _, err := opa.AddTemplate(ctx, validRegoTemplate()); err != nil {
		t.Fatalf("could not add template: %s", err)
	}
	if _, err := opa.AddConstraint(ctx, validRegoTemplateConstraint()); err != nil {
		t.Fatalf("could not add constraint: %s", err)
	}
	pe := process.New()
	pe.Add(cfg.Spec.Match)
	expSystem := expansion.NewSystem(mutation.NewSystem(mutation.SystemOpts{}))
	handler := validationHandler{
		opa:             opa,
		expansionSystem: expSystem,
		webhookHandler: webhookHandler{
			injectedConfig:  cfg,
			client:          &nsGetter{},
			reader:          &nsGetter{},
			processExcluder: pe,
		},
		log: log,
	}
	tc := []struct {
		Name            string
		Namespace       string
		Operation       admissionv1.Operation
		Raw             []byte
		OldRaw          []byte
		AllowedExpected bool
	}{
		{
			Name:            "ExcludedNamespace invalid create",
			Namespace:       "notkube-test",
			Operation:       admissionv1.Create,
			Raw:             []byte(`{"apiVersion": "v1", "kind": "Pod", "metadata": {"name": "acbd","namespace": ""}}`),
			AllowedExpected: false,
		},
		{
			Name:            "ExcludedNamespace valid create",
			Namespace:       "kube-test",
			Operation:       admissionv1.Create,