Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate if role impersonation works in integration tests #748

Open
1 task
pmalek opened this issue Oct 17, 2024 · 0 comments
Open
1 task

Investigate if role impersonation works in integration tests #748

pmalek opened this issue Oct 17, 2024 · 0 comments

Comments

@pmalek
Copy link
Member

pmalek commented Oct 17, 2024

Problem statement

cfg.NewClientFunc = func(config *rest.Config, options client.Options) (client.Client, error) {
// always hijack and impersonate the system service account here so that the manager
// is testing the RBAC permissions we provide under config/rbac/. This helps alert us
// if we break our RBAC configs as the manager will emit permissions errors.
config.Impersonate.UserName = "system:serviceaccount:kong-system:controller-manager"
return client.New(config, options)
}
sets the role to impersonate in integration tests to test RBAC policy rules that is used for the manager.

Recently there's been several issues that slipped through the tests and surfaced in charts (e.g. Kong/charts#1146 and Kong/charts#1137 (comment))

This issue tracks to effort to verify why impersonation didn't work for these problems.

Acceptance criteria

  • As KGO developer I know that manager's policy rules are tested and I am sure that my changes are not going to accidentally cause RBAC errors for end users without causing tests failures.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant