prole/tests/etc/test_init_kerberos_k3s_real_kdc.sh

#!/usr/bin/env bash
# Regression test for etc/init_kerberos.sh in k3s mode with real KDC endpoint.

set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
KNOE_HOME=$(cd "$SCRIPT_DIR/../.." && pwd)
SOURCE_ETC_DIR="$KNOE_HOME/etc"

TMP_DIR=$(mktemp -d)
trap 'rm -rf "$TMP_DIR"' EXIT

WORK_DIR="$TMP_DIR/work"
BIN_DIR="$TMP_DIR/bin"
mkdir -p "$WORK_DIR/etc" "$WORK_DIR/conf" "$BIN_DIR"

cp "$SOURCE_ETC_DIR/init_kerberos.sh" "$WORK_DIR/etc/init_kerberos.sh"
cp "$SOURCE_ETC_DIR/knoe_cfg.sh" "$WORK_DIR/etc/knoe_cfg.sh"
chmod +x "$WORK_DIR/etc/init_kerberos.sh"

cat <<EOF > "$WORK_DIR/etc/init_kerberos_test.sh"
#!/usr/bin/env bash
exit 0
EOF
chmod +x "$WORK_DIR/etc/init_kerberos_test.sh"

cat <<EOF > "$WORK_DIR/env.sh"
#!/usr/bin/env bash
export KNOE_HOME="$WORK_DIR"
export KNOE_CONF="$WORK_DIR/conf"
EOF

cat <<EOF > "$WORK_DIR/conf/knoe.cfg"
[globals]
knoe.home = $WORK_DIR
knoe.mode = k3s
EOF

export KUBECTL_LOG="$TMP_DIR/kubectl.log"
export KUBECTL_PAYLOAD_LOG="$TMP_DIR/kubectl-payload.log"

cat <<'EOF' > "$BIN_DIR/kubectl"
#!/usr/bin/env bash
set -euo pipefail

args=("$@")
printf '%s\n' "${args[*]}" >> "${KUBECTL_LOG}"

sub=""
sub_idx=-1
i=0
while [[ $i -lt ${#args[@]} ]]; do
  case "${args[$i]}" in
    -n|--namespace|--context|--kubeconfig)
      i=$((i + 2))
      ;;
    --namespace=*|--context=*|--kubeconfig=*)
      i=$((i + 1))
      ;;
    -*)
      i=$((i + 1))
      ;;
    *)
      sub="${args[$i]}"
      sub_idx=$i
      break
      ;;
  esac
done

case "$sub" in
  get)
    resource="${args[$((sub_idx + 1))]:-}"
    if [[ "$resource" == "namespace" ]]; then
      exit 1
    fi
    if [[ "$resource" == "pods" ]]; then
      printf ''
      exit 0
    fi
    exit 0
    ;;
  create)
    resource="${args[$((sub_idx + 1))]:-}"
    if [[ "$resource" == "namespace" ]]; then
      exit 0
    fi
    if [[ "$resource" == "configmap" ]]; then
      cat <<YAML
apiVersion: v1
kind: ConfigMap
metadata:
  name: knoe-krb5-conf
YAML
      exit 0
    fi
    exit 0
    ;;
  apply)
    payload="$(cat || true)"
    printf '%s\n' "$payload" >> "${KUBECTL_PAYLOAD_LOG}"

    case " ${args[*]} " in
      *" --validate=false "*)
        ;;
      *)
        echo "error: error validating \"STDIN\": error validating data: failed to download openapi: the server has asked for the client to provide credentials" >&2
        exit 1
        ;;
    esac

    if [[ "$payload" == *"name: knoe-kdc-egress"* ]]; then
      if [[ "$payload" != *"cidr: 10.0.0.3/32"* ]]; then
        echo "missing expected kdc cidr in NetworkPolicy payload" >&2
        exit 1
      fi
      if [[ "$payload" == *"cidr: 0.0.0.0/0"* ]]; then
        echo "unexpected broad egress cidr in NetworkPolicy payload" >&2
        exit 1
      fi
    fi

    exit 0
    ;;
  wait|exec|delete|rollout|patch|config)
    exit 0
    ;;
  *)
    exit 0
    ;;
esac
EOF
chmod +x "$BIN_DIR/kubectl"

cat <<'EOF' > "$BIN_DIR/curl"
#!/usr/bin/env bash
exit 0
EOF
chmod +x "$BIN_DIR/curl"

cat <<'EOF' > "$BIN_DIR/jq"
#!/usr/bin/env bash
exit 0
EOF
chmod +x "$BIN_DIR/jq"

export PATH="$BIN_DIR:$PATH"

export KNOE_HOME="$WORK_DIR"
export KNOE_CONF="$WORK_DIR/conf"
export NAMESPACE="knoe-db-a0001"
export SERVICE_NAMESPACE="default"
export KNOE_MODE="k3s"
export KRB5_REALM="PROLE.ORG"
export KRB5_KDC="10.0.0.3"
export KRB5_ADMIN="10.0.0.3"
export KRB5_PASSWORD="test-password"

if "$WORK_DIR/etc/init_kerberos.sh" test >"$TMP_DIR/stdout" 2>"$TMP_DIR/stderr"; then
  :
else
  echo "FAILURE: init_kerberos.sh test exited non-zero"
  cat "$TMP_DIR/stderr"
  exit 1
fi

if ! grep -q "Using KDC endpoint for test: 10.0.0.3" "$TMP_DIR/stdout"; then
  echo "FAILURE: expected real KDC endpoint log line not found"
  cat "$TMP_DIR/stdout"
  exit 1
fi

if ! grep -q "apply --validate=false" "$KUBECTL_LOG"; then
  echo "FAILURE: expected kubectl apply --validate=false invocation not found"
  cat "$KUBECTL_LOG"
  exit 1
fi

if ! grep -q "apply --validate=false -n knoe-db-a0001 -f -" "$KUBECTL_LOG"; then
  echo "FAILURE: expected KDC policy apply in resolved namespace not found"
  cat "$KUBECTL_LOG"
  exit 1
fi

if grep -q "apply --validate=false -n default -f -" "$KUBECTL_LOG"; then
  echo "FAILURE: unexpected KDC policy apply against default namespace"
  cat "$KUBECTL_LOG"
  exit 1
fi

echo "SUCCESS"