func TestCSRSignerNameSigningPlugin(t *testing.T) {
	tests := map[string]struct {
		allowedSignerName string
		signerName        string
		error             string
	}{
		"should admit when a user has permission for the exact signerName": {
			allowedSignerName: "example.com/something",
			signerName:        "example.com/something",
		},
		"should admit when a user has permission for the wildcard-suffixed signerName": {
			allowedSignerName: "example.com/*",
			signerName:        "example.com/something",
		},
		"should deny if a user does not have permission for the given signerName": {
			allowedSignerName: "example.com/not-something",
			signerName:        "example.com/something",
			error:             `certificatesigningrequests.certificates.k8s.io "csr" is forbidden: user not permitted to sign requests with signerName "example.com/something"`,
		},
	}
	for name, test := range tests {
		t.Run(name, func(t *testing.T) {
			// Run an apiserver with the default configuration options.
			s := kubeapiservertesting.StartTestServerOrDie(t, kubeapiservertesting.NewDefaultTestServerOptions(), []string{"--authorization-mode=RBAC"}, framework.SharedEtcd())
			defer s.TearDownFn()
			client := clientset.NewForConfigOrDie(s.ClientConfig)

			// Grant 'test-user' permission to sign CertificateSigningRequests with the specified signerName.
			const username = "test-user"
			grantUserPermissionToSignFor(t, client, username, test.allowedSignerName)
			// Create a CSR to attempt to sign.
			csr := createTestingCSR(t, client.CertificatesV1beta1().CertificateSigningRequests(), "csr", test.signerName, "")

			// Create a second client, impersonating the 'test-user' for us to test with.
			testuserConfig := restclient.CopyConfig(s.ClientConfig)
			testuserConfig.Impersonate = restclient.ImpersonationConfig{UserName: username}
			testuserClient := clientset.NewForConfigOrDie(testuserConfig)

			// Attempt to 'sign' the certificate.
			csr.Status.Certificate = []byte("dummy data")
			_, err := testuserClient.CertificatesV1beta1().CertificateSigningRequests().UpdateStatus(context.TODO(), csr, metav1.UpdateOptions{})
			if err != nil && test.error != err.Error() {
				t.Errorf("expected error %q but got: %v", test.error, err)
			}
			if err == nil && test.error != "" {
				t.Errorf("expected to get an error %q but got none", test.error)
			}
		})
	}
}
// Verifies that the CSR approval admission plugin correctly enforces that a
// user has permission to sign CSRs for the named signer
Verifies that the CSR approval admission plugin correctly enforces that a
user has permission to sign CSRs for the named signer
// Verifies that the CSR approval admission plugin correctly enforces that a // user has permission to sign CSRs for the named signer
func TestCSRSignerNameSigningPlugin(t *testing.T) {
	tests := map[string]struct {
		allowedSignerName string
		signerName        string
		error             string
	}{
		"should admit when a user has permission for the exact signerName": {
			allowedSignerName: "example.com/something",
			signerName:        "example.com/something",
		},
		"should admit when a user has permission for the wildcard-suffixed signerName": {
			allowedSignerName: "example.com/*",
			signerName:        "example.com/something",
		},
		"should deny if a user does not have permission for the given signerName": {
			allowedSignerName: "example.com/not-something",
			signerName:        "example.com/something",
			error:             `certificatesigningrequests.certificates.k8s.io "csr" is forbidden: user not permitted to sign requests with signerName "example.com/something"`,
		},
	}
	for name, test := range tests {
		t.Run(name, func(t *testing.T) {
			s := kubeapiservertesting.StartTestServerOrDie(t, kubeapiservertesting.NewDefaultTestServerOptions(), []string{"--authorization-mode=RBAC"}, framework.SharedEtcd())
			defer s.TearDownFn()
			client := clientset.NewForConfigOrDie(s.ClientConfig)
			const username = "test-user"
			grantUserPermissionToSignFor(t, client, username, test.allowedSignerName)
			csr := createTestingCSR(t, client.CertificatesV1beta1().CertificateSigningRequests(), "csr", test.signerName, "")
			testuserConfig := restclient.CopyConfig(s.ClientConfig)
			testuserConfig.Impersonate = restclient.ImpersonationConfig{UserName: username}
			testuserClient := clientset.NewForConfigOrDie(testuserConfig)
			csr.Status.Certificate = []byte("dummy data")
			_, err := testuserClient.CertificatesV1beta1().CertificateSigningRequests().UpdateStatus(context.TODO(), csr, metav1.UpdateOptions{})
			if err != nil && test.error != err.Error() {
				t.Errorf("expected error %q but got: %v", test.error, err)
			}
			if err == nil && test.error != "" {
				t.Errorf("expected to get an error %q but got none", test.error)
			}
		})
	}
}
func TestCSRSignerNameSigningPlugin ( t * testing . T ) { tests := map [ string ] struct { allowedSignerName string signerName string error string } { " " : { allowedSignerName : " " , signerName : " " , } , " " : { allowedSignerName : " " , signerName : " " , } , " " : { allowedSignerName : " " , signerName : " " , error : `certificatesigningrequests.certificates.k8s.io "csr" is forbidden: user not permitted to sign requests with signerName "example.com/something"` , } , } for name , test := range tests { t . Run ( name , func ( t * testing . T ) { s := kubeapiservertesting . StartTestServerOrDie ( t , kubeapiservertesting . NewDefaultTestServerOptions ( ) , [ ] string { " " } , framework . SharedEtcd ( ) ) defer s . TearDownFn ( ) client := clientset . NewForConfigOrDie ( s . ClientConfig ) const username = " " grantUserPermissionToSignFor ( t , client , username , test . allowedSignerName ) csr := createTestingCSR ( t , client . CertificatesV1beta1 ( ) . CertificateSigningRequests ( ) , " " , test . signerName , " " ) testuserConfig := restclient . CopyConfig ( s . ClientConfig ) testuserConfig . Impersonate = restclient . ImpersonationConfig { UserName : username } testuserClient := clientset . NewForConfigOrDie ( testuserConfig ) csr . Status . Certificate = [ ] byte ( " " ) _ , err := testuserClient . CertificatesV1beta1 ( ) . CertificateSigningRequests ( ) . UpdateStatus ( context . TODO ( ) , csr , metav1 . UpdateOptions { } ) if err != nil && test . error != err . Error ( ) { t . Errorf ( " " , test . error , err ) } if err == nil && test . error != " " { t . Errorf ( " " , test . error ) } } ) } }
Verifies that the CSR approval admission plugin correctly enforces that a
user has permission to sign CSRs for the named signer
Verifies that the CSR approval admission plugin correctly enforces that a user has permission to sign CSRs for the named signer
// Run an apiserver with the default configuration options. // Grant 'test-user' permission to sign CertificateSigningRequests with the specified signerName. // Create a CSR to attempt to sign. // Create a second client, impersonating the 'test-user' for us to test with. // Attempt to 'sign' the certificate.