K8s/IAM: Move identity.grafana.app to iam.grafana.app (#92929)

2024-09-05 09:43:54 +03:00
parent aae788ae46
commit 9338e40dc3
85 changed files with 142 additions and 143 deletions
@@ -0,0 +1,149 @@
+package identity
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/tests/apis"
+	"github.com/grafana/grafana/pkg/tests/testinfra"
+	"github.com/grafana/grafana/pkg/tests/testsuite"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var gvrTeams = schema.GroupVersionResource{
+	Group:    "iam.grafana.app",
+	Version:  "v0alpha1",
+	Resource: "teams",
+}
+
+var gvrUsers = schema.GroupVersionResource{
+	Group:    "iam.grafana.app",
+	Version:  "v0alpha1",
+	Resource: "users",
+}
+
+func TestMain(m *testing.M) {
+	testsuite.Run(m)
+}
+
+func TestIntegrationRequiresDevMode(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
+		AppModeProduction: true, // should fail
+		DisableAnonymous:  true,
+		EnableFeatureToggles: []string{
+			featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs, // Required to start the example service
+		},
+	})
+
+	_, err := helper.NewDiscoveryClient().ServerResourcesForGroupVersion("iam.grafana.app/v0alpha1")
+	require.Error(t, err)
+}
+
+func TestIntegrationIdentity(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+	helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
+		AppModeProduction: false, // required for experimental APIs
+		DisableAnonymous:  true,
+		EnableFeatureToggles: []string{
+			featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs, // Required to start the example service
+		},
+	})
+	_, err := helper.NewDiscoveryClient().ServerResourcesForGroupVersion("iam.grafana.app/v0alpha1")
+	require.NoError(t, err)
+
+	t.Run("read only views", func(t *testing.T) {
+		ctx := context.Background()
+		teamClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.Admin,
+			GVR:  gvrTeams,
+		})
+		rsp, err := teamClient.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+		found := teamClient.SanitizeJSONList(rsp, "name")
+		require.JSONEq(t, `{
+      "items": [
+        {
+          "apiVersion": "iam.grafana.app/v0alpha1",
+          "kind": "Team",
+          "metadata": {
+            "annotations": {
+              "grafana.app/originName": "SQL",
+              "grafana.app/originPath": "${originPath}"
+            },
+            "creationTimestamp": "${creationTimestamp}",
+            "name": "${name}",
+            "namespace": "default",
+            "resourceVersion": "${resourceVersion}"
+          },
+          "spec": {
+            "email": "staff@Org1",
+            "title": "staff"
+          }
+        }
+      ]
+    }`, found)
+
+		// Org1 users
+		userClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.Admin,
+			GVR:  gvrUsers,
+		})
+		rsp, err = userClient.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+
+		// Get just the specs (avoids values that change with each deployment)
+		found = teamClient.SpecJSON(rsp)
+		// fmt.Printf("%s", found) // NOTE the first value does not have an email or login
+		require.JSONEq(t, `[
+			{},
+			{
+				"email": "admin-1",
+				"login": "admin-1"
+			},
+			{
+				"email": "editor-1",
+				"login": "editor-1"
+			},
+			{
+				"email": "viewer-1",
+				"login": "viewer-1"
+			}
+		]`, found)
+
+		// OrgB users
+		userClient = helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,                                        // super admin
+			Namespace: helper.Namespacer(helper.OrgB.Admin.Identity.GetOrgID()), // list values for orgB with super admin user
+			GVR:       gvrUsers,
+		})
+		rsp, err = userClient.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+
+		// Get just the specs (avoids values that change with each deployment)
+		found = teamClient.SpecJSON(rsp)
+		fmt.Printf("%s", found) // NOTE the first value does not have an email or login
+		require.JSONEq(t, `[
+			{
+				"email": "admin-3",
+				"login": "admin-3"
+			},
+			{
+				"email": "editor-3",
+				"login": "editor-3"
+			},
+			{
+				"email": "viewer-3",
+				"login": "viewer-3"
+			}
+		]`, found)
+	})
+}