CertificateProvisioner implements ConfigurationProvisioner<KubernetesEnvironment> { @Override public void provision(KubernetesEnvironment k8sEnv, RuntimeIdentity identity) throws InfrastructureException { if (!isConfigured()) { return; } String selfSignedCertSecretName = identity.getWorkspaceId() + CHE_SELF_SIGNED_CERT_SECRET_SUFFIX; k8sEnv .getSecrets() .put( selfSignedCertSecretName, new SecretBuilder() .withNewMetadata() .withName(selfSignedCertSecretName) .endMetadata() .withStringData(ImmutableMap.of(CA_CERT_FILE, certificate)) .build()); for (PodData pod : k8sEnv.getPodsData().values()) { if (pod.getRole() == PodRole.DEPLOYMENT) { if (pod.getSpec() .getVolumes() .stream() .noneMatch(v -> v.getName().equals(CHE_SELF_SIGNED_CERT_VOLUME))) { pod.getSpec().getVolumes().add(buildCertSecretVolume(selfSignedCertSecretName)); } } for (Container container : pod.getSpec().getInitContainers()) { provisionCertVolumeMountIfNeeded(container); } for (Container container : pod.getSpec().getContainers()) { provisionCertVolumeMountIfNeeded(container); } } } CertificateProvisioner(); @VisibleForTesting  CertificateProvisioner(String certificate); boolean isConfigured(); String getCertPath(); @Override void provision(KubernetesEnvironment k8sEnv, RuntimeIdentity identity); static final String CHE_SELF_SIGNED_CERT_SECRET_SUFFIX; static final String CHE_SELF_SIGNED_CERT_VOLUME; static final String CERT_MOUNT_PATH; static final String CA_CERT_FILE; }
@Test public void shouldAddSecretWithCertificateIntoEnvironment() throws Exception { provisioner.provision(k8sEnv, runtimeId); Map<String, Secret> secrets = k8sEnv.getSecrets(); assertEquals(secrets.size(), 1); Secret certSecret = secrets.get(EXPECTED_CERT_NAME); assertNotNull(certSecret); assertEquals(certSecret.getMetadata().getName(), EXPECTED_CERT_NAME); assertEquals(certSecret.getStringData().get(CA_CERT_FILE), CERT_CONTENT); }
@Test public void shouldAddVolumeAndVolumeMountsToPodsAndContainersInEnvironment() throws Exception { k8sEnv.addPod(createPod("pod")); k8sEnv.addPod(createPod("pod2")); provisioner.provision(k8sEnv, runtimeId); for (Pod pod : k8sEnv.getPodsCopy().values()) { verifyVolumeIsPresent(pod); for (Container container : pod.getSpec().getInitContainers()) { verifyVolumeMountIsPresent(container); } for (Container container : pod.getSpec().getContainers()) { verifyVolumeMountIsPresent(container); } } }
@Test public void shouldNotAddVolumeAndVolumeMountsToPodsAndContainersInEnvironmentIfCertIsNotConfigured() throws Exception { provisioner = new CertificateProvisioner(""); k8sEnv.addPod(createPod("pod")); k8sEnv.addPod(createPod("pod2")); provisioner.provision(k8sEnv, runtimeId); for (Pod pod : k8sEnv.getPodsCopy().values()) { assertTrue(pod.getSpec().getVolumes().isEmpty()); for (Container container : pod.getSpec().getContainers()) { assertTrue(container.getVolumeMounts().isEmpty()); } } }
@Test public void shouldNotAddVolumeButAddMountToInjectablePod() throws Exception { provisioner = new CertificateProvisioner(CERT_CONTENT); k8sEnv.addPod(createPod("pod")); k8sEnv.addInjectablePod("r", "i", createPod("injected")); provisioner.provision(k8sEnv, runtimeId); Pod pod = k8sEnv.getPodsCopy().get("pod"); Pod injected = k8sEnv.getInjectablePodsCopy().getOrDefault("r", emptyMap()).get("i"); assertNotNull(pod); assertNotNull(injected); verifyVolumeIsPresent(pod); pod.getSpec().getContainers().forEach(this::verifyVolumeMountIsPresent); assertTrue(injected.getSpec().getVolumes().isEmpty()); injected.getSpec().getContainers().forEach(this::verifyVolumeMountIsPresent); }