adestis-mf commented on code in PR #14690:
URL: https://github.com/apache/cloudstack/pull/14690#discussion_r4550982915
##########
plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java:
##########
@@ -914,4 +923,30 @@ public void
testValidateNodeAffinityGroupsAffinityNoExistingWorkers() {
Mockito.verify(kubernetesClusterAffinityGroupMapDao).listAffinityGroupIdsByClusterIdAndNodeType(1L,
WORKER.name());
}
+ @Test
+ public void testProjectKubernetesAccountRoleAllowsTheProviderApis() {
+ Role role = Mockito.mock(Role.class);
+ Mockito.when(roleService.createRole(Mockito.anyString(),
Mockito.any(RoleType.class), Mockito.anyString(),
Mockito.anyBoolean())).thenReturn(role);
+
+ kubernetesClusterManager.createProjectKubernetesAccountRole();
+
+ ArgumentCaptor<Rule> rules = ArgumentCaptor.forClass(Rule.class);
+ ArgumentCaptor<RolePermissionEntity.Permission> permissions =
ArgumentCaptor.forClass(RolePermissionEntity.Permission.class);
+ Mockito.verify(roleService,
Mockito.atLeastOnce()).createRolePermission(Mockito.eq(role), rules.capture(),
permissions.capture(), Mockito.anyString());
+ List<String> ruleStrings = new ArrayList<>();
+ for (Rule rule : rules.getAllValues()) {
+ ruleStrings.add(rule.getRuleString());
+ }
+
+ for (String api : Arrays.asList("listCapabilities", "listVPCs",
"listNetworkACLLists", "updateNetworkACLItem",
+ "listLBStickinessPolicies", "createLBStickinessPolicy",
"deleteLBStickinessPolicy")) {
+ int index = ruleStrings.indexOf(api);
+ Assert.assertTrue(api + " is not in the role: " + ruleStrings,
index >= 0);
+ Assert.assertEquals(api, RolePermissionEntity.Permission.ALLOW,
permissions.getAllValues().get(index));
+ }
+ int last = ruleStrings.size() - 1;
+ Assert.assertEquals("*", ruleStrings.get(last));
+ Assert.assertEquals(RolePermissionEntity.Permission.DENY,
permissions.getAllValues().get(last));
Review Comment:
Both captors are filled by the same `verify`, so their lists are paired call
by call and the indices can't diverge. Each API in the list gets exactly one
ALLOW and `*` comes last with DENY, so a duplicate would be an ALLOW as well.
I'd keep the test as it is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
