More Thorough Test Coverage of TargetHandler Rego

[open-policy-agent]

More Thorough Test Coverage of TargetHandler Rego

[maxsmythe]

Thanks for the info!

We do something with our e2e tests using kind.

I think this bug was actually addressed by this file:

gatekeeper/pkg/target/target_integration_test.go

Lines 125 to 270 in 569b1d3

	func TestConstraintEnforcement(t *testing.T) {
	tcs := []struct {
	name string
	obj *unstructured.Unstructured
	ns *corev1.Namespace
	constraint *unstructured.Unstructured
	allowed bool
	}{
	{
	name: "match deny all",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(),
	allowed: false,
	},
	{
	name: "match namespace",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setNamespaceName("my-ns")),
	allowed: false,
	},
	{
	name: "no match namespace",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setNamespaceName("not-my-ns")),
	allowed: true,
	},
	{
	name: "match excludedNamespaces",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setExcludedNamespaceName("my-ns")),
	allowed: true,
	},
	{
	name: "no match excludedNamespaces",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setExcludedNamespaceName("not-my-ns")),
	allowed: false,
	},
	{
	name: "match labelselector",
	obj: makeResource("some", "Thing", map[string]string{"a": "label"}),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setLabelSelector("a", "label")),
	allowed: false,
	},
	{
	name: "no match labelselector",
	obj: makeResource("some", "Thing", map[string]string{"a": "label"}),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setLabelSelector("different", "label")),
	allowed: true,
	},
	{
	name: "match nsselector",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns", map[string]string{"a": "label"}),
	constraint: makeConstraint(setNamespaceSelector("a", "label")),
	allowed: false,
	},
	{
	name: "no match nsselector",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns", map[string]string{"a": "label"}),
	constraint: makeConstraint(setNamespaceSelector("different", "label")),
	allowed: true,
	},
	{
	name: "match kinds",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setKinds([]string{"some"}, []string{"Thing"})),
	allowed: false,
	},
	{
	name: "no match kinds",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setKinds([]string{"different"}, []string{"Thing"})),
	allowed: true,
	},
	{
	name: "match everything",
	obj: makeResource("some", "Thing", map[string]string{"obj": "label"}),
	ns: makeNamespace("my-ns", map[string]string{"ns": "label"}),
	constraint: makeConstraint(
	setKinds([]string{"some"}, []string{"Thing"}),
	setNamespaceName("my-ns"),
	setLabelSelector("obj", "label"),
	setNamespaceSelector("ns", "label"),
	),
	allowed: false,
	},
	{
	name: "match everything but kind",
	obj: makeResource("some", "Thing", map[string]string{"obj": "label"}),
	ns: makeNamespace("my-ns", map[string]string{"ns": "label"}),
	constraint: makeConstraint(
	setKinds([]string{"different"}, []string{"Thing"}),
	setNamespaceName("my-ns"),
	setLabelSelector("obj", "label"),
	setNamespaceSelector("ns", "label"),
	),
	allowed: true,
	},
	{
	name: "match everything but namespace",
	obj: makeResource("some", "Thing", map[string]string{"obj": "label"}),
	ns: makeNamespace("my-ns", map[string]string{"ns": "label"}),
	constraint: makeConstraint(
	setKinds([]string{"some"}, []string{"Thing"}),
	setNamespaceName("different-ns"),
	setLabelSelector("obj", "label"),
	setNamespaceSelector("ns", "label"),
	),
	allowed: true,
	},
	{
	name: "match everything but labelselector",
	obj: makeResource("some", "Thing", map[string]string{"obj": "label"}),
	ns: makeNamespace("my-ns", map[string]string{"ns": "label"}),
	constraint: makeConstraint(
	setKinds([]string{"some"}, []string{"Thing"}),
	setNamespaceName("my-ns"),
	setLabelSelector("obj", "different-label"),
	setNamespaceSelector("ns", "label"),
	),
	allowed: true,
	},
	{
	name: "match everything but nsselector",
	obj: makeResource("some", "Thing", map[string]string{"obj": "label"}),
	ns: makeNamespace("my-ns", map[string]string{"ns": "label"}),
	constraint: makeConstraint(
	setKinds([]string{"some"}, []string{"Thing"}),
	setNamespaceName("my-ns"),
	setLabelSelector("obj", "label"),
	setNamespaceSelector("ns", "different-label"),
	),
	allowed: true,
	},
	}

Which allows us to run through match semantics as a unit test.

[nilekhc]

@maxsmythe in our company, I implemented a pipeline where I spin up k3s cluster, install gatekeeper, install template and constraints (from policy library like directory) and then test them by running actual create resource with the help of client-go. Let me know if this is the right approach and if so how can I implement here.
@ritazh