func TestCertificateSubjectRestrictionPlugin(t *testing.T) {
	tests := map[string]struct {
		signerName string
		group      string
		error      string
	}{
		"should reject a request if signerName is kube-apiserver-client and group is system:masters": {
			signerName: certv1beta1.KubeAPIServerClientSignerName,
			group:      "system:masters",
			error:      `certificatesigningrequests.certificates.k8s.io "csr" is forbidden: use of kubernetes.io/kube-apiserver-client signer with system:masters group is not allowed`,
		},
		"should admit a request if signerName is NOT kube-apiserver-client and org is system:masters": {
			signerName: certv1beta1.LegacyUnknownSignerName,
			group:      "system:masters",
		},
		"should admit a request if signerName is kube-apiserver-client and group is NOT system:masters": {
			signerName: certv1beta1.KubeAPIServerClientSignerName,
			group:      "system:notmasters",
		},
	}
	for name, test := range tests {
		t.Run(name, func(t *testing.T) {
			// Run an apiserver with the default configuration options.
			s := kubeapiservertesting.StartTestServerOrDie(t, kubeapiservertesting.NewDefaultTestServerOptions(), []string{""}, framework.SharedEtcd())
			defer s.TearDownFn()
			client := clientset.NewForConfigOrDie(s.ClientConfig)

			// Attempt to create the CSR resource.
			csr := buildTestingCSR("csr", test.signerName, test.group)
			_, err := client.CertificatesV1beta1().CertificateSigningRequests().Create(context.TODO(), csr, metav1.CreateOptions{})
			if err != nil && test.error != err.Error() {
				t.Errorf("expected error %q but got: %v", test.error, err)
			}
			if err == nil && test.error != "" {
				t.Errorf("expected to get an error %q but got none", test.error)
			}
		})
	}
}
// Verifies that the CertificateSubjectRestriction admission controller works as expected.
Verifies that the CertificateSubjectRestriction admission controller works as expected.
// Verifies that the CertificateSubjectRestriction admission controller works as expected .
func TestCertificateSubjectRestrictionPlugin(t *testing.T) {
	tests := map[string]struct {
		signerName string
		group      string
		error      string
	}{
		"should reject a request if signerName is kube-apiserver-client and group is system:masters": {
			signerName: certv1beta1.KubeAPIServerClientSignerName,
			group:      "system:masters",
			error:      `certificatesigningrequests.certificates.k8s.io "csr" is forbidden: use of kubernetes.io/kube-apiserver-client signer with system:masters group is not allowed`,
		},
		"should admit a request if signerName is NOT kube-apiserver-client and org is system:masters": {
			signerName: certv1beta1.LegacyUnknownSignerName,
			group:      "system:masters",
		},
		"should admit a request if signerName is kube-apiserver-client and group is NOT system:masters": {
			signerName: certv1beta1.KubeAPIServerClientSignerName,
			group:      "system:notmasters",
		},
	}
	for name, test := range tests {
		t.Run(name, func(t *testing.T) {
			s := kubeapiservertesting.StartTestServerOrDie(t, kubeapiservertesting.NewDefaultTestServerOptions(), []string{""}, framework.SharedEtcd())
			defer s.TearDownFn()
			client := clientset.NewForConfigOrDie(s.ClientConfig)
			csr := buildTestingCSR("csr", test.signerName, test.group)
			_, err := client.CertificatesV1beta1().CertificateSigningRequests().Create(context.TODO(), csr, metav1.CreateOptions{})
			if err != nil && test.error != err.Error() {
				t.Errorf("expected error %q but got: %v", test.error, err)
			}
			if err == nil && test.error != "" {
				t.Errorf("expected to get an error %q but got none", test.error)
			}
		})
	}
}
func TestCertificateSubjectRestrictionPlugin ( t * testing . T ) { tests := map [ string ] struct { signerName string group string error string } { " " : { signerName : certv1beta1 . KubeAPIServerClientSignerName , group : " " , error : `certificatesigningrequests.certificates.k8s.io "csr" is forbidden: use of kubernetes.io/kube-apiserver-client signer with system:masters group is not allowed` , } , " " : { signerName : certv1beta1 . LegacyUnknownSignerName , group : " " , } , " " : { signerName : certv1beta1 . KubeAPIServerClientSignerName , group : " " , } , } for name , test := range tests { t . Run ( name , func ( t * testing . T ) { s := kubeapiservertesting . StartTestServerOrDie ( t , kubeapiservertesting . NewDefaultTestServerOptions ( ) , [ ] string { " " } , framework . SharedEtcd ( ) ) defer s . TearDownFn ( ) client := clientset . NewForConfigOrDie ( s . ClientConfig ) csr := buildTestingCSR ( " " , test . signerName , test . group ) _ , err := client . CertificatesV1beta1 ( ) . CertificateSigningRequests ( ) . Create ( context . TODO ( ) , csr , metav1 . CreateOptions { } ) if err != nil && test . error != err . Error ( ) { t . Errorf ( " " , test . error , err ) } if err == nil && test . error != " " { t . Errorf ( " " , test . error ) } } ) } }
Verifies that the CertificateSubjectRestriction admission controller works as expected.
Verifies that the CertificateSubjectRestriction admission controller works as expected .
// Run an apiserver with the default configuration options. // Attempt to create the CSR resource.