feat(manager): Add forbiddenAnnotations,forbiddenLabels to serviceOpt…

…ions
projectcapsule · Nov 15, 2023 · 8b4f7ad · 8b4f7ad
1 parent 5e13ac9
commit 8b4f7ad
Show file tree

Hide file tree

Showing 10 changed files with 500 additions and 198 deletions.
diff --git a/config/crd/bases/capsule.clastix.io_tenants.yaml b/config/crd/bases/capsule.clastix.io_tenants.yaml
@@ -1873,6 +1873,28 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot
+                      set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set
+                      for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the
@@ -3107,6 +3129,28 @@ spec:
                     required:
                     - allowed
                     type: object
+                  forbiddenAnnotations:
+                    description: Define the annotations that a Tenant Owner cannot
+                      set for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
+                  forbiddenLabels:
+                    description: Define the labels that a Tenant Owner cannot set
+                      for their Service resources.
+                    properties:
+                      denied:
+                        items:
+                          type: string
+                        type: array
+                      deniedRegex:
+                        type: string
+                    type: object
                 type: object
               storageClasses:
                 description: Specifies the allowed StorageClasses assigned to the

diff --git a/e2e/service_forbidden_metadata_test.go b/e2e/service_forbidden_metadata_test.go
@@ -0,0 +1,161 @@
+//go:build e2e
+
+// Copyright 2020-2023 Project Capsule Authors.
+// SPDX-License-Identifier: Apache-2.0
+
+package e2e
+
+import (
+    "context"
+    "time"
+
+    . "github.com/onsi/ginkgo/v2"
+    . "github.com/onsi/gomega"
+    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+    "k8s.io/apimachinery/pkg/types"
+
+    capsulev1beta2 "github.com/projectcapsule/capsule/api/v1beta2"
+    "github.com/projectcapsule/capsule/pkg/api"
+)
+
+var _ = Describe("creating a Service with user-specified labels and annotations", func() {
+    tnt := &capsulev1beta2.Tenant{
+        ObjectMeta: metav1.ObjectMeta{
+            Name: "tenant-user-metadata-forbidden",
+        },
+        Spec: capsulev1beta2.TenantSpec{
+            ServiceOptions: &api.ServiceOptions{
+                ForbiddenLabels: api.ForbiddenListSpec{
+                    Exact: []string{"foo", "bar"},
+                    Regex: "^gatsby-.*$",
+                },
+                ForbiddenAnnotations: api.ForbiddenListSpec{
+                    Exact: []string{"foo", "bar"},
+                    Regex: "^gatsby-.*$",
+                },
+            },
+            Owners: capsulev1beta2.OwnerListSpec{
+                {
+                    Name: "gatsby",
+                    Kind: "User",
+                },
+            },
+        },
+    }
+
+    JustBeforeEach(func() {
+        EventuallyCreation(func() error {
+            tnt.ResourceVersion = ""
+            return k8sClient.Create(context.TODO(), tnt)
+        }).Should(Succeed())
+    })
+    JustAfterEach(func() {
+        Expect(k8sClient.Delete(context.TODO(), tnt)).Should(Succeed())
+    })
+
+    It("should allow", func() {
+        By("specifying non-forbidden labels", func() {
+            svc := NewService("")
+            svc.SetLabels(map[string]string{"bim": "baz"})
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+        })
+        By("specifying non-forbidden annotations", func() {
+            svc := NewService("")
+            svc.SetAnnotations(map[string]string{"bim": "baz"})
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+        })
+    })
+
+    It("should fail when creating a Service", func() {
+        By("specifying forbidden labels using exact match", func() {
+            svc := NewService("")
+            svc.SetLabels(map[string]string{"foo": "bar"})
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+        })
+        By("specifying forbidden labels using regex match", func() {
+            svc := NewService("")
+            svc.SetLabels(map[string]string{"gatsby-foo": "bar"})
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+        })
+        By("specifying forbidden annotations using exact match", func() {
+            svc := NewService("")
+            svc.SetAnnotations(map[string]string{"foo": "bar"})
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+        })
+        By("specifying forbidden annotations using regex match", func() {
+            svc := NewService("")
+            svc.SetAnnotations(map[string]string{"gatsby-foo": "bar"})
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).ShouldNot(Succeed())
+        })
+    })
+
+    It("should fail when updating a Service", func() {
+        cs := ownerClient(tnt.Spec.Owners[0])
+
+        By("specifying forbidden labels using exact match", func() {
+            svc := NewService("forbidden-labels-exact-match")
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+            Consistently(func() error {
+                if err := k8sClient.Get(context.Background(), types.NamespacedName{Name: svc.GetName()}, svc); err != nil {
+                    return nil
+                }
+
+                svc.SetLabels(map[string]string{"foo": "bar"})
+
+                _, err := cs.CoreV1().Services().Update(context.Background(), svc, metav1.UpdateOptions{})
+
+                return err
+            }, 10*time.Second, time.Second).ShouldNot(Succeed())
+        })
+        By("specifying forbidden labels using regex match", func() {
+            svc := NewService("forbidden-labels-regex-match")
+
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+            Consistently(func() error {
+                if err := k8sClient.Get(context.Background(), types.NamespacedName{Name: svc.GetName()}, svc); err != nil {
+                    return nil
+                }
+
+                svc.SetLabels(map[string]string{"gatsby-foo": "bar"})
+
+                _, err := cs.CoreV1().Services().Update(context.Background(), svc, metav1.UpdateOptions{})
+
+                return err
+            }, 3*time.Second, time.Second).ShouldNot(Succeed())
+        })
+        By("specifying forbidden annotations using exact match", func() {
+            svc := NewService("forbidden-annotations-exact-match")
+
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+            rbacPatch(svc.GetName())
+            Consistently(func() error {
+                if err := k8sClient.Get(context.Background(), types.NamespacedName{Name: svc.GetName()}, svc); err != nil {
+                    return nil
+                }
+
+                svc.SetAnnotations(map[string]string{"foo": "bar"})
+
+                _, err := cs.CoreV1().Services().Update(context.Background(), svc, metav1.UpdateOptions{})
+
+                return err
+            }, 10*time.Second, time.Second).ShouldNot(Succeed())
+        })
+        By("specifying forbidden annotations using regex match", func() {
+            svc := NewService("forbidden-annotations-regex-match")
+
+            ServiceCreation(svc, tnt.Spec.Owners[0], defaultTimeoutInterval).Should(Succeed())
+            rbacPatch(svc.GetName())
+            Consistently(func() error {
+                if err := k8sClient.Get(context.Background(), types.NamespacedName{Name: svc.GetName()}, svc); err != nil {
+                    return nil
+                }
+
+                svc.SetAnnotations(map[string]string{"gatsby-foo": "bar"})
+
+                _, err := cs.CoreV1().Services().Update(context.Background(), svc, metav1.UpdateOptions{})
+
+                return err
+            }, 10*time.Second, time.Second).ShouldNot(Succeed())
+        })
+    })
+})