From 3e534f8025cf6ae5d6cf838454406de1bc298bcc Mon Sep 17 00:00:00 2001 From: Stavros kois Date: Wed, 1 Feb 2023 19:02:13 +0200 Subject: [PATCH] update some tests --- .../tests/configmap/name_test.yaml | 6 +- .../tests/controller/names_test.yaml | 52 ++++++++++++++++- .../tests/imagePullSecret/name_test.yaml | 6 +- .../common-test/tests/secret/name_test.yaml | 6 +- .../tests/serviceAccount/metadata_test.yaml | 54 ++++++++++++++++++ .../tests/serviceAccount/name_test.yaml | 45 +++++++++++++++ .../tests/serviceAccount/validation_test.yaml | 56 ++++++++++++++++++ library/common/1.0.0/docs/serviceAccounts.md | 4 +- .../1.0.0/templates/lib/controller/_pod.tpl | 2 +- .../lib/serviceAccount/_validation.tpl | 57 +++++++++++++++++++ .../templates/spawner/_serviceAccount.tpl | 9 ++- library/common/1.0.0/values.yaml | 4 ++ 12 files changed, 286 insertions(+), 15 deletions(-) create mode 100644 library/common-test/tests/serviceAccount/metadata_test.yaml create mode 100644 library/common-test/tests/serviceAccount/name_test.yaml create mode 100644 library/common-test/tests/serviceAccount/validation_test.yaml create mode 100644 library/common/1.0.0/templates/lib/serviceAccount/_validation.tpl diff --git a/library/common-test/tests/configmap/name_test.yaml b/library/common-test/tests/configmap/name_test.yaml index 70c3dd7053..06b2cb010c 100644 --- a/library/common-test/tests/configmap/name_test.yaml +++ b/library/common-test/tests/configmap/name_test.yaml @@ -24,13 +24,13 @@ tests: equal: path: metadata.name value: release-name-common-test-my-configmap1 - - documentIndex: &configmapDoc2 1 + - documentIndex: &otherConfigmapDoc 1 isKind: of: ConfigMap - - documentIndex: *configmapDoc2 + - documentIndex: *otherConfigmapDoc isAPIVersion: of: v1 - - documentIndex: *configmapDoc2 + - documentIndex: *otherConfigmapDoc equal: path: metadata.name value: release-name-common-test-my-configmap2 diff --git a/library/common-test/tests/controller/names_test.yaml b/library/common-test/tests/controller/names_test.yaml index faf8781777..33f4175fa4 100644 --- a/library/common-test/tests/controller/names_test.yaml +++ b/library/common-test/tests/controller/names_test.yaml @@ -10,11 +10,27 @@ tests: primary: true type: Deployment podSpec: {} - other-controller-name: + daemonset-controller-name: enabled: true primary: false type: DaemonSet podSpec: {} + stateful-controller-name: + enabled: true + primary: false + type: StatefulSet + podSpec: {} + cronjob-controller-name: + enabled: true + primary: false + type: CronJob + schedule: "*/1 * * * *" + podSpec: {} + job-controller-name: + enabled: true + primary: false + type: Job + podSpec: {} asserts: - documentIndex: &deploymentDoc 0 isKind: @@ -26,7 +42,17 @@ tests: equal: path: metadata.name value: release-name-common-test - - documentIndex: &daemonSetDoc 1 + - documentIndex: &cronJobDoc 1 + isKind: + of: CronJob + - documentIndex: *cronJobDoc + isAPIVersion: + of: batch/v1 + - documentIndex: *cronJobDoc + equal: + path: metadata.name + value: release-name-common-test-cronjob-controller-name + - documentIndex: &daemonSetDoc 2 isKind: of: DaemonSet - documentIndex: *daemonSetDoc @@ -35,4 +61,24 @@ tests: - documentIndex: *daemonSetDoc equal: path: metadata.name - value: release-name-common-test-other-controller-name + value: release-name-common-test-daemonset-controller-name + - documentIndex: &jobDoc 3 + isKind: + of: Job + - documentIndex: *jobDoc + isAPIVersion: + of: batch/v1 + - documentIndex: *jobDoc + equal: + path: metadata.name + value: release-name-common-test-job-controller-name + - documentIndex: &statefulSetDoc 4 + isKind: + of: StatefulSet + - documentIndex: *statefulSetDoc + isAPIVersion: + of: apps/v1 + - documentIndex: *statefulSetDoc + equal: + path: metadata.name + value: release-name-common-test-stateful-controller-name diff --git a/library/common-test/tests/imagePullSecret/name_test.yaml b/library/common-test/tests/imagePullSecret/name_test.yaml index 8e390563d5..51430e70e3 100644 --- a/library/common-test/tests/imagePullSecret/name_test.yaml +++ b/library/common-test/tests/imagePullSecret/name_test.yaml @@ -30,13 +30,13 @@ tests: equal: path: metadata.name value: release-name-common-test-my-pull-secret1 - - documentIndex: &secretDoc2 1 + - documentIndex: &otherSecretDoc 1 isKind: of: Secret - - documentIndex: *secretDoc2 + - documentIndex: *otherSecretDoc isAPIVersion: of: v1 - - documentIndex: *secretDoc2 + - documentIndex: *otherSecretDoc equal: path: metadata.name value: release-name-common-test-my-pull-secret2 diff --git a/library/common-test/tests/secret/name_test.yaml b/library/common-test/tests/secret/name_test.yaml index a8bde274c2..6ac4bf50f8 100644 --- a/library/common-test/tests/secret/name_test.yaml +++ b/library/common-test/tests/secret/name_test.yaml @@ -24,13 +24,13 @@ tests: equal: path: metadata.name value: release-name-common-test-my-secret1 - - documentIndex: &secretDoc2 1 + - documentIndex: &otherSecretDoc 1 isKind: of: Secret - - documentIndex: *secretDoc2 + - documentIndex: *otherSecretDoc isAPIVersion: of: v1 - - documentIndex: *secretDoc2 + - documentIndex: *otherSecretDoc equal: path: metadata.name value: release-name-common-test-my-secret2 diff --git a/library/common-test/tests/serviceAccount/metadata_test.yaml b/library/common-test/tests/serviceAccount/metadata_test.yaml new file mode 100644 index 0000000000..b9ae9fd2d6 --- /dev/null +++ b/library/common-test/tests/serviceAccount/metadata_test.yaml @@ -0,0 +1,54 @@ +suite: service account metadata test +templates: + - common.yaml +chart: + appVersion: &appVer v9.9.9 +tests: + - it: should pass with service account created with labels and annotations + set: + label1: label1 + label2: global_label2 + annotation1: annotation1 + annotation2: global_annotation2 + global: + labels: + g_label1: global_label1 + g_label2: "{{ .Values.label2 }}" + annotations: + g_annotation1: global_annotation1 + g_annotation2: "{{ .Values.annotation2 }}" + serviceAccounts: + my-sa1: + enabled: true + labels: + label1: "{{ .Values.label1 }}" + label2: label2 + annotations: + annotation1: "{{ .Values.annotation1 }}" + annotation2: annotation2 + asserts: + - documentIndex: &serviceAccountDoc 0 + isKind: + of: ServiceAccount + - documentIndex: *serviceAccountDoc + equal: + path: metadata.annotations + value: + annotation1: annotation1 + annotation2: annotation2 + g_annotation1: global_annotation1 + g_annotation2: global_annotation2 + - documentIndex: *serviceAccountDoc + equal: + path: metadata.labels + value: + app: common-test-1.0.0 + release: release-name + helm-revision: 0 + helm.sh/chart: common-test-1.0.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/version: *appVer + g_label1: global_label1 + g_label2: global_label2 + label1: label1 + label2: label2 diff --git a/library/common-test/tests/serviceAccount/name_test.yaml b/library/common-test/tests/serviceAccount/name_test.yaml new file mode 100644 index 0000000000..15d3911560 --- /dev/null +++ b/library/common-test/tests/serviceAccount/name_test.yaml @@ -0,0 +1,45 @@ +suite: service account name test +templates: + - common.yaml +tests: + - it: should generate correct name + set: + serviceAccounts: + my-sa1: + enabled: true + my-sa2: + enabled: true + main: + enabled: true + primary: true + asserts: + - documentIndex: &primaryServiceAccount 0 + isKind: + of: ServiceAccount + - documentIndex: *primaryServiceAccount + isAPIVersion: + of: v1 + - documentIndex: *primaryServiceAccount + equal: + path: metadata.name + value: release-name-common-test + - documentIndex: &serviceAccount 1 + isKind: + of: ServiceAccount + - documentIndex: *serviceAccount + isAPIVersion: + of: v1 + - documentIndex: *serviceAccount + equal: + path: metadata.name + value: release-name-common-test-my-sa1 + - documentIndex: &otherServiceAccount 2 + isKind: + of: ServiceAccount + - documentIndex: *otherServiceAccount + isAPIVersion: + of: v1 + - documentIndex: *otherServiceAccount + equal: + path: metadata.name + value: release-name-common-test-my-sa2 diff --git a/library/common-test/tests/serviceAccount/validation_test.yaml b/library/common-test/tests/serviceAccount/validation_test.yaml new file mode 100644 index 0000000000..6fe17b2298 --- /dev/null +++ b/library/common-test/tests/serviceAccount/validation_test.yaml @@ -0,0 +1,56 @@ +suite: service account validation test +templates: + - common.yaml +tests: + - it: should fail with name longer than 63 characters + set: + serviceAccounts: + my-service-account-super-long-name-that-is-longer-than-63-characters: + enabled: true + asserts: + - failedTemplate: + errorMessage: Name [release-name-common-test-my-service-account-super-long-name-that-is-longer-than-63-characters] is not valid. Must start and end with an alphanumeric character. It can contain '-'. And must be at most 63 characters. + + - it: should fail with name starting with underscore + set: + serviceAccounts: + _my-sa: + enabled: true + data: + foo: bar + asserts: + - failedTemplate: + errorMessage: Name [release-name-common-test-_my-sa] is not valid. Must start and end with an alphanumeric character. It can contain '-'. And must be at most 63 characters. + + - it: should fail with labels not a dict + set: + serviceAccounts: + my-sa: + enabled: true + labels: "not a dict" + asserts: + - failedTemplate: + errorMessage: Service Account - Expected to be a dictionary, but got [string] + + - it: should fail with annotations not a dict + set: + serviceAccounts: + my-sa: + enabled: true + annotations: "not a dict" + asserts: + - failedTemplate: + errorMessage: Service Account - Expected to be a dictionary, but got [string] + + - it: should fail with more than 1 primary service accounts + set: + serviceAccounts: + my-sa: + enabled: true + primary: true + my-sa2: + enabled: true + primary: true + asserts: + - failedTemplate: + errorMessage: Service Account - Only one service account can be primary diff --git a/library/common/1.0.0/docs/serviceAccounts.md b/library/common/1.0.0/docs/serviceAccounts.md index 88d3d1a658..1ba11ccf76 100644 --- a/library/common/1.0.0/docs/serviceAccounts.md +++ b/library/common/1.0.0/docs/serviceAccounts.md @@ -5,6 +5,7 @@ | serviceAccounts | `dict` | ❌ | ❌ | `{}` | Define the serviceAccounts as dicts | | serviceAccounts.[sa-name] | `dict` | ✅ | ❌ | `{}` | Holds secret definition | | serviceAccounts.[sa-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the secret | +| serviceAccounts.[sa-name].primary | `boolean` | ❌ | ❌ | `false` | Sets the service account as primary | | serviceAccounts.[sa-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for secret | | serviceAccounts.[sa-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for secret | | serviceAccounts.[sa-name].targetSelectAll | `boolean` | ❌ | ❌ | | Whether to assign the serviceAccount to all pods or not | @@ -24,7 +25,8 @@ Appears in: Naming scheme: -- `$FullName-$ServiceAccountName` (release-name-chart-name-ServiceAccountName) +- Primary: `$FullName` (release-name-chart-name) +- Non-Primary: `$FullName-$ServiceAccountName` (release-name-chart-name-ServiceAccountName) --- diff --git a/library/common/1.0.0/templates/lib/controller/_pod.tpl b/library/common/1.0.0/templates/lib/controller/_pod.tpl index a9556c9d86..df7ad67c26 100644 --- a/library/common/1.0.0/templates/lib/controller/_pod.tpl +++ b/library/common/1.0.0/templates/lib/controller/_pod.tpl @@ -9,6 +9,7 @@ objectData: The object data to be used to render the Pod. {{- $objectData := .objectData -}} serviceAccountName: {{ include "ix.v1.common.lib.pod.serviceAccountName" (dict "rootCtx" $rootCtx "objectData" $objectData) }} automountServiceAccountToken: {{ include "ix.v1.common.lib.pod.automountServiceAccountToken" (dict "rootCtx" $rootCtx "objectData" $objectData) }} +runtimeClassName: {{ include "ix.v1.common.lib.pod.runtimeClassName" (dict "rootCtx" $rootCtx "objectData" $objectData) }} {{- with (include "ix.v1.common.lib.pod.imagePullSecrets" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }} imagePullSecrets: {{- . | nindent 2 }} @@ -41,7 +42,6 @@ terminationGracePeriodSeconds: {{ . }} tolerations: {{- . | nindent 2 }} {{- end }} -#TODO:runtimeClassName: #TODO:securityContext: #TODO:containers: #TODO:initContainers: diff --git a/library/common/1.0.0/templates/lib/serviceAccount/_validation.tpl b/library/common/1.0.0/templates/lib/serviceAccount/_validation.tpl new file mode 100644 index 0000000000..5d67016e03 --- /dev/null +++ b/library/common/1.0.0/templates/lib/serviceAccount/_validation.tpl @@ -0,0 +1,57 @@ +{{/* Service Account Validation */}} +{{/* Call this template: +{{ include "ix.v1.common.lib.serviceAccount.validation" (dict "objectData" $objectData) -}} +objectData: + labels: The labels of the serviceAccount. + annotations: The annotations of the serviceAccount. + data: The data of the serviceAccount. +*/}} + +{{- define "ix.v1.common.lib.serviceAccount.validation" -}} + {{- $objectData := .objectData -}} + + {{- if and $objectData.labels (not (kindIs "map" $objectData.labels)) -}} + {{- fail (printf "Service Account - Expected to be a dictionary, but got [%v]" (kindOf $objectData.labels)) -}} + {{- end -}} + + {{- if and $objectData.annotations (not (kindIs "map" $objectData.annotations)) -}} + {{- fail (printf "Service Account - Expected to be a dictionary, but got [%v]" (kindOf $objectData.annotations)) -}} + {{- end -}} + +{{- end -}} + +{{/* Service Account Primary Validation */}} +{{/* Call this template: +{{ include "ix.v1.common.lib.serviceAccount.primaryValidation" (dict "objectData" $objectData) -}} +objectData: + labels: The labels of the serviceAccount. + annotations: The annotations of the serviceAccount. + data: The data of the serviceAccount. +*/}} + +{{- define "ix.v1.common.lib.serviceAccount.primaryValidation" -}} + + {{/* Initialize values */}} + {{- $hasPrimary := false -}} + + {{- range $name, $serviceAccount := .Values.serviceAccounts -}} + + {{/* If service account is enabled */}} + {{- if $serviceAccount.enabled -}} + + {{/* And service account is primary */}} + {{- if and (hasKey $serviceAccount "primary") ($serviceAccount.primary) -}} + + {{/* Fail if there is already a primary service account */}} + {{- if $hasPrimary -}} + {{- fail "Service Account - Only one service account can be primary" -}} + {{- end -}} + + {{- $hasPrimary = true -}} + + {{- end -}} + + {{- end -}} + {{- end -}} + +{{- end -}} diff --git a/library/common/1.0.0/templates/spawner/_serviceAccount.tpl b/library/common/1.0.0/templates/spawner/_serviceAccount.tpl index 2a2f90f902..a44f883b05 100644 --- a/library/common/1.0.0/templates/spawner/_serviceAccount.tpl +++ b/library/common/1.0.0/templates/spawner/_serviceAccount.tpl @@ -5,6 +5,9 @@ {{- define "ix.v1.common.spawner.serviceAccounts" -}} + {{/* Primary validation for enabled service accounts. */}} + {{- include "ix.v1.common.lib.serviceAccount.primaryValidation" $ -}} + {{- range $name, $serviceAccount := .Values.serviceAccounts -}} {{- if $serviceAccount.enabled -}} @@ -12,10 +15,14 @@ {{/* Create a copy of the configmap */}} {{- $objectData := (mustDeepCopy $serviceAccount) -}} - {{- $objectName := (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $) $name) -}} + {{- $objectName := include "ix.v1.common.lib.chart.names.fullname" $ -}} + {{- if not $objectData.primary -}} + {{- $objectName = (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $) $name) -}} + {{- end -}} {{/* Perform validations */}} {{- include "ix.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}} + {{- include "ix.v1.common.lib.serviceAccount.validation" (dict "objectData" $objectData) -}} {{/* Set the name of the service account */}} {{- $_ := set $objectData "name" $objectName -}} diff --git a/library/common/1.0.0/values.yaml b/library/common/1.0.0/values.yaml index 274a15fe01..d4cc6cc591 100644 --- a/library/common/1.0.0/values.yaml +++ b/library/common/1.0.0/values.yaml @@ -6,6 +6,9 @@ global: annotations: {} # -- Scale Storage Class scaleZFSStorageClass: '{{ printf "ix-storage-class-%v" .Release.Name }}' + ixChartContext: + addNvidiaRuntimeClass: true + nvidiaRuntimeClassName: asdf # TODO: fallbackDefaults: @@ -121,6 +124,7 @@ podOptions: tolerations: [] schedulerName: "" priorityClassName: "" + runtimeClassName: "" automountServiceAccountToken: false terminationGracePeriodSeconds: 120 # TODO: Add affinity