@@ -23,56 +23,60 @@ import (
23
23
)
24
24
25
25
var _ = Describe ("User defined service account" , func () {
26
+ var (
27
+ generatedNamespace corev1.Namespace
28
+ )
29
+
30
+ BeforeEach (func () {
31
+ generatedNamespace = SetupGeneratedTestNamespace (genName ("user-defined-sa-e2e-" ))
32
+ })
33
+
26
34
AfterEach (func () {
27
- TearDown ( testNamespace )
35
+ TeardownNamespace ( generatedNamespace . GetName () )
28
36
})
29
37
30
38
It ("with no permission" , func () {
31
39
32
40
kubeclient := newKubeClient ()
33
41
crclient := newCRClient ()
34
42
35
- namespace := genName ("scoped-ns-" )
36
- _ , cleanupNS := newNamespace (kubeclient , namespace )
37
- defer cleanupNS ()
38
-
39
43
// Create a service account, but add no permission to it.
40
44
saName := genName ("scoped-sa-" )
41
- _ , cleanupSA := newServiceAccount (kubeclient , namespace , saName )
45
+ _ , cleanupSA := newServiceAccount (kubeclient , generatedNamespace . GetName () , saName )
42
46
defer cleanupSA ()
43
47
44
48
// Add an OperatorGroup and specify the service account.
45
49
ogName := genName ("scoped-og-" )
46
- _ , cleanupOG := newOperatorGroupWithServiceAccount (crclient , namespace , ogName , saName )
50
+ _ , cleanupOG := newOperatorGroupWithServiceAccount (crclient , generatedNamespace . GetName () , ogName , saName )
47
51
defer cleanupOG ()
48
52
49
53
permissions := deploymentPermissions ()
50
- catsrc , subSpec , catsrcCleanup := newCatalogSource (GinkgoT (), kubeclient , crclient , "scoped" , namespace , permissions )
54
+ catsrc , subSpec , catsrcCleanup := newCatalogSource (GinkgoT (), kubeclient , crclient , "scoped" , generatedNamespace . GetName () , permissions )
51
55
defer catsrcCleanup ()
52
56
53
57
// Ensure that the catalog source is resolved before we create a subscription.
54
- _ , err := fetchCatalogSourceOnStatus (crclient , catsrc .GetName (), namespace , catalogSourceRegistryPodSynced )
58
+ _ , err := fetchCatalogSourceOnStatus (crclient , catsrc .GetName (), generatedNamespace . GetName () , catalogSourceRegistryPodSynced )
55
59
require .NoError (GinkgoT (), err )
56
60
57
61
subscriptionName := genName ("scoped-sub-" )
58
- cleanupSubscription := createSubscriptionForCatalog (crclient , namespace , subscriptionName , catsrc .GetName (), subSpec .Package , subSpec .Channel , subSpec .StartingCSV , subSpec .InstallPlanApproval )
62
+ cleanupSubscription := createSubscriptionForCatalog (crclient , generatedNamespace . GetName () , subscriptionName , catsrc .GetName (), subSpec .Package , subSpec .Channel , subSpec .StartingCSV , subSpec .InstallPlanApproval )
59
63
defer cleanupSubscription ()
60
64
61
65
// Wait until an install plan is created.
62
- subscription , err := fetchSubscription (crclient , namespace , subscriptionName , subscriptionHasInstallPlanChecker )
66
+ subscription , err := fetchSubscription (crclient , generatedNamespace . GetName () , subscriptionName , subscriptionHasInstallPlanChecker )
63
67
require .NoError (GinkgoT (), err )
64
68
require .NotNil (GinkgoT (), subscription )
65
69
66
70
// We expect the InstallPlan to be in status: Failed.
67
71
ipName := subscription .Status .Install .Name
68
72
ipPhaseCheckerFunc := buildInstallPlanPhaseCheckFunc (v1alpha1 .InstallPlanPhaseFailed )
69
- ipGot , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipName , namespace , ipPhaseCheckerFunc )
73
+ ipGot , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipName , generatedNamespace . GetName () , ipPhaseCheckerFunc )
70
74
require .NoError (GinkgoT (), err )
71
75
72
76
conditionGot := mustHaveCondition (GinkgoT (), ipGot , v1alpha1 .InstallPlanInstalled )
73
77
assert .Equal (GinkgoT (), corev1 .ConditionFalse , conditionGot .Status )
74
78
assert .Equal (GinkgoT (), v1alpha1 .InstallPlanReasonComponentFailed , conditionGot .Reason )
75
- assert .Contains (GinkgoT (), conditionGot .Message , fmt .Sprintf ("is forbidden: User \" system:serviceaccount:%s:%s\" cannot create resource" , namespace , saName ))
79
+ assert .Contains (GinkgoT (), conditionGot .Message , fmt .Sprintf ("is forbidden: User \" system:serviceaccount:%s:%s\" cannot create resource" , generatedNamespace . GetName () , saName ))
76
80
77
81
// Verify that all step resources are in Unknown state.
78
82
for _ , step := range ipGot .Status .Plan {
@@ -85,43 +89,39 @@ var _ = Describe("User defined service account", func() {
85
89
kubeclient := newKubeClient ()
86
90
crclient := newCRClient ()
87
91
88
- namespace := genName ("scoped-ns-" )
89
- _ , cleanupNS := newNamespace (kubeclient , namespace )
90
- defer cleanupNS ()
91
-
92
92
// Create a service account, add enough permission to it so that operator install is successful.
93
93
saName := genName ("scoped-sa" )
94
- _ , cleanupSA := newServiceAccount (kubeclient , namespace , saName )
94
+ _ , cleanupSA := newServiceAccount (kubeclient , generatedNamespace . GetName () , saName )
95
95
defer cleanupSA ()
96
- cleanupPerm := grantPermission (GinkgoT (), kubeclient , namespace , saName )
96
+ cleanupPerm := grantPermission (GinkgoT (), kubeclient , generatedNamespace . GetName () , saName )
97
97
defer cleanupPerm ()
98
98
99
99
// Add an OperatorGroup and specify the service account.
100
100
ogName := genName ("scoped-og-" )
101
- _ , cleanupOG := newOperatorGroupWithServiceAccount (crclient , namespace , ogName , saName )
101
+ _ , cleanupOG := newOperatorGroupWithServiceAccount (crclient , generatedNamespace . GetName () , ogName , saName )
102
102
defer cleanupOG ()
103
103
104
104
permissions := deploymentPermissions ()
105
- catsrc , subSpec , catsrcCleanup := newCatalogSource (GinkgoT (), kubeclient , crclient , "scoped" , namespace , permissions )
105
+ catsrc , subSpec , catsrcCleanup := newCatalogSource (GinkgoT (), kubeclient , crclient , "scoped" , generatedNamespace . GetName () , permissions )
106
106
defer catsrcCleanup ()
107
107
108
108
// Ensure that the catalog source is resolved before we create a subscription.
109
- _ , err := fetchCatalogSourceOnStatus (crclient , catsrc .GetName (), namespace , catalogSourceRegistryPodSynced )
109
+ _ , err := fetchCatalogSourceOnStatus (crclient , catsrc .GetName (), generatedNamespace . GetName () , catalogSourceRegistryPodSynced )
110
110
require .NoError (GinkgoT (), err )
111
111
112
112
subscriptionName := genName ("scoped-sub-" )
113
- cleanupSubscription := createSubscriptionForCatalog (crclient , namespace , subscriptionName , catsrc .GetName (), subSpec .Package , subSpec .Channel , subSpec .StartingCSV , subSpec .InstallPlanApproval )
113
+ cleanupSubscription := createSubscriptionForCatalog (crclient , generatedNamespace . GetName () , subscriptionName , catsrc .GetName (), subSpec .Package , subSpec .Channel , subSpec .StartingCSV , subSpec .InstallPlanApproval )
114
114
defer cleanupSubscription ()
115
115
116
116
// Wait until an install plan is created.
117
- subscription , err := fetchSubscription (crclient , namespace , subscriptionName , subscriptionHasInstallPlanChecker )
117
+ subscription , err := fetchSubscription (crclient , generatedNamespace . GetName () , subscriptionName , subscriptionHasInstallPlanChecker )
118
118
require .NoError (GinkgoT (), err )
119
119
require .NotNil (GinkgoT (), subscription )
120
120
121
121
// We expect the InstallPlan to be in status: Complete.
122
122
ipName := subscription .Status .Install .Name
123
123
ipPhaseCheckerFunc := buildInstallPlanPhaseCheckFunc (v1alpha1 .InstallPlanPhaseComplete )
124
- ipGot , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipName , namespace , ipPhaseCheckerFunc )
124
+ ipGot , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipName , generatedNamespace . GetName () , ipPhaseCheckerFunc )
125
125
require .NoError (GinkgoT (), err )
126
126
127
127
conditionGot := mustHaveCondition (GinkgoT (), ipGot , v1alpha1 .InstallPlanInstalled )
@@ -141,50 +141,46 @@ var _ = Describe("User defined service account", func() {
141
141
kubeclient := newKubeClient ()
142
142
crclient := newCRClient ()
143
143
144
- namespace := genName ("scoped-ns-" )
145
- _ , cleanupNS := newNamespace (kubeclient , namespace )
146
- defer cleanupNS ()
147
-
148
144
// Create a service account, but add no permission to it.
149
145
saName := genName ("scoped-sa-" )
150
- _ , cleanupSA := newServiceAccount (kubeclient , namespace , saName )
146
+ _ , cleanupSA := newServiceAccount (kubeclient , generatedNamespace . GetName () , saName )
151
147
defer cleanupSA ()
152
148
153
149
// Add an OperatorGroup and specify the service account.
154
150
ogName := genName ("scoped-og-" )
155
- _ , cleanupOG := newOperatorGroupWithServiceAccount (crclient , namespace , ogName , saName )
151
+ _ , cleanupOG := newOperatorGroupWithServiceAccount (crclient , generatedNamespace . GetName () , ogName , saName )
156
152
defer cleanupOG ()
157
153
158
154
permissions := deploymentPermissions ()
159
- catsrc , subSpec , catsrcCleanup := newCatalogSource (GinkgoT (), kubeclient , crclient , "scoped" , namespace , permissions )
155
+ catsrc , subSpec , catsrcCleanup := newCatalogSource (GinkgoT (), kubeclient , crclient , "scoped" , generatedNamespace . GetName () , permissions )
160
156
defer catsrcCleanup ()
161
157
162
158
// Ensure that the catalog source is resolved before we create a subscription.
163
- _ , err := fetchCatalogSourceOnStatus (crclient , catsrc .GetName (), namespace , catalogSourceRegistryPodSynced )
159
+ _ , err := fetchCatalogSourceOnStatus (crclient , catsrc .GetName (), generatedNamespace . GetName () , catalogSourceRegistryPodSynced )
164
160
require .NoError (GinkgoT (), err )
165
161
166
162
subscriptionName := genName ("scoped-sub-" )
167
- cleanupSubscription := createSubscriptionForCatalog (crclient , namespace , subscriptionName , catsrc .GetName (), subSpec .Package , subSpec .Channel , subSpec .StartingCSV , subSpec .InstallPlanApproval )
163
+ cleanupSubscription := createSubscriptionForCatalog (crclient , generatedNamespace . GetName () , subscriptionName , catsrc .GetName (), subSpec .Package , subSpec .Channel , subSpec .StartingCSV , subSpec .InstallPlanApproval )
168
164
defer cleanupSubscription ()
169
165
170
166
// Wait until an install plan is created.
171
- subscription , err := fetchSubscription (crclient , namespace , subscriptionName , subscriptionHasInstallPlanChecker )
167
+ subscription , err := fetchSubscription (crclient , generatedNamespace . GetName () , subscriptionName , subscriptionHasInstallPlanChecker )
172
168
require .NoError (GinkgoT (), err )
173
169
require .NotNil (GinkgoT (), subscription )
174
170
175
171
// We expect the InstallPlan to be in status: Failed.
176
172
ipNameOld := subscription .Status .InstallPlanRef .Name
177
173
ipPhaseCheckerFunc := buildInstallPlanPhaseCheckFunc (v1alpha1 .InstallPlanPhaseFailed )
178
- ipGotOld , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipNameOld , namespace , ipPhaseCheckerFunc )
174
+ ipGotOld , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipNameOld , generatedNamespace . GetName () , ipPhaseCheckerFunc )
179
175
require .NoError (GinkgoT (), err )
180
176
require .Equal (GinkgoT (), v1alpha1 .InstallPlanPhaseFailed , ipGotOld .Status .Phase )
181
177
182
178
// Grant permission now and this should trigger an retry of InstallPlan.
183
- cleanupPerm := grantPermission (GinkgoT (), kubeclient , namespace , saName )
179
+ cleanupPerm := grantPermission (GinkgoT (), kubeclient , generatedNamespace . GetName () , saName )
184
180
defer cleanupPerm ()
185
181
186
182
ipPhaseCheckerFunc = buildInstallPlanPhaseCheckFunc (v1alpha1 .InstallPlanPhaseComplete )
187
- ipGotNew , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipNameOld , namespace , ipPhaseCheckerFunc )
183
+ ipGotNew , err := fetchInstallPlanWithNamespace (GinkgoT (), crclient , ipNameOld , generatedNamespace . GetName () , ipPhaseCheckerFunc )
188
184
require .NoError (GinkgoT (), err )
189
185
require .Equal (GinkgoT (), v1alpha1 .InstallPlanPhaseComplete , ipGotNew .Status .Phase )
190
186
})
0 commit comments