@@ -13,7 +13,7 @@ import (
1313 "github.com/gruntwork-io/terratest/modules/logger"
1414 "github.com/gruntwork-io/terratest/modules/random"
1515 "github.com/gruntwork-io/terratest/modules/terraform"
16- "github.com/gruntwork-io/terratest/modules/test-structure"
16+ test_structure "github.com/gruntwork-io/terratest/modules/test-structure"
1717 "github.com/stretchr/testify/assert"
1818 "github.com/stretchr/testify/require"
1919 authv1 "k8s.io/api/authorization/v1"
@@ -25,6 +25,53 @@ type TemplateArgs struct {
2525 ServiceAccountName string
2626}
2727
28+ func TestK8SNamespaceWithServiceAccountNoCreate (t * testing.T ) {
29+ t .Parallel ()
30+
31+ // Uncomment any of the following to skip that section during the test
32+ // os.Setenv("SKIP_foo", "true") // This stage doesn't exist, but is useful in ensuring the test directory isn't copied
33+ // os.Setenv("SKIP_create_test_copy_of_examples", "true")
34+ // os.Setenv("SKIP_create_terratest_options", "true")
35+ // os.Setenv("SKIP_terraform_apply", "true")
36+ // os.Setenv("SKIP_validate", "true")
37+ // os.Setenv("SKIP_cleanup", "true")
38+
39+ // Create a directory path that won't conflict
40+ workingDir := filepath .Join ("." , "stages" , t .Name ())
41+
42+ test_structure .RunTestStage (t , "create_test_copy_of_examples" , func () {
43+ testFolder := test_structure .CopyTerraformFolderToTemp (t , ".." , "examples" )
44+ logger .Logf (t , "path to test folder %s\n " , testFolder )
45+ k8sNamespaceTerraformModulePath := filepath .Join (testFolder , "k8s-namespace-with-service-account" )
46+ test_structure .SaveString (t , workingDir , "k8sNamespaceTerraformModulePath" , k8sNamespaceTerraformModulePath )
47+ })
48+
49+ test_structure .RunTestStage (t , "create_terratest_options" , func () {
50+ k8sNamespaceTerraformModulePath := test_structure .LoadString (t , workingDir , "k8sNamespaceTerraformModulePath" )
51+ uniqueID := random .UniqueId ()
52+ k8sNamespaceTerratestOptions := createExampleK8SNamespaceTerraformOptions (
53+ t , uniqueID , k8sNamespaceTerraformModulePath )
54+ k8sNamespaceTerratestOptions .Vars ["create_resources" ] = 0
55+ test_structure .SaveString (t , workingDir , "uniqueID" , uniqueID )
56+ test_structure .SaveTerraformOptions (t , workingDir , k8sNamespaceTerratestOptions )
57+ })
58+
59+ defer test_structure .RunTestStage (t , "cleanup" , func () {
60+ k8sNamespaceTerratestOptions := test_structure .LoadTerraformOptions (t , workingDir )
61+ terraform .Destroy (t , k8sNamespaceTerratestOptions )
62+ })
63+
64+ test_structure .RunTestStage (t , "terraform_apply" , func () {
65+ k8sNamespaceTerratestOptions := test_structure .LoadTerraformOptions (t , workingDir )
66+ counts := terraform .GetResourceCount (t , terraform .InitAndPlan (t , k8sNamespaceTerratestOptions ))
67+ assert .Equal (t , 0 , counts .Change )
68+ assert .Equal (t , 0 , counts .Destroy )
69+ // IMPORTANT NOTE: we don't expect any resources to create, but because of how the dependencies system works, we
70+ // expect to see 4 resources created: the 4 null_resources that act as a dependency getter.
71+ assert .Equal (t , 4 , counts .Add )
72+ })
73+ }
74+
2875func TestK8SNamespaceWithServiceAccount (t * testing.T ) {
2976 t .Parallel ()
3077
@@ -88,15 +135,15 @@ func TestK8SNamespaceWithServiceAccount(t *testing.T) {
88135// validateNamespace verifies that the namespace was created and is active.
89136func validateNamespace (t * testing.T , k8sNamespaceTerratestOptions * terraform.Options ) {
90137 namespace := terraform .Output (t , k8sNamespaceTerratestOptions , "name" )
91- kubectlOptions := k8s .NewKubectlOptions ("" , "" )
138+ kubectlOptions := k8s .NewKubectlOptions ("" , "" , "default" )
92139 k8sNamespace := k8s .GetNamespace (t , kubectlOptions , namespace )
93140 assert .Equal (t , k8sNamespace .Name , namespace )
94141 assert .Equal (t , k8sNamespace .Status .Phase , corev1 .NamespaceActive )
95142}
96143
97144// validateRbacAccessAll verifies that the access all RBAC role has read and write privileges to the namespace
98145func validateRbacAccessAll (t * testing.T , k8sNamespaceTerratestOptions * terraform.Options ) {
99- kubectlOptions := k8s .NewKubectlOptions ("" , "" )
146+ kubectlOptions := k8s .NewKubectlOptions ("" , "" , "default" )
100147 namespace := terraform .Output (t , k8sNamespaceTerratestOptions , "name" )
101148 serviceAccountName := terraform .Output (t , k8sNamespaceTerratestOptions , "service_account_access_all" )
102149 templateArgs := TemplateArgs {
@@ -128,7 +175,7 @@ func validateRbacAccessAll(t *testing.T, k8sNamespaceTerratestOptions *terraform
128175
129176// validateRbacAccessReadOnly verifies that the access read only RBAC role has read only privileges to the namespace
130177func validateRbacAccessReadOnly (t * testing.T , k8sNamespaceTerratestOptions * terraform.Options ) {
131- kubectlOptions := k8s .NewKubectlOptions ("" , "" )
178+ kubectlOptions := k8s .NewKubectlOptions ("" , "" , "default" )
132179 namespace := terraform .Output (t , k8sNamespaceTerratestOptions , "name" )
133180 serviceAccountName := terraform .Output (t , k8sNamespaceTerratestOptions , "service_account_access_read_only" )
134181 templateArgs := TemplateArgs {
@@ -181,8 +228,7 @@ func checkAccessForServiceAccount(
181228 // Wait for up to 5 minutes for pod to start (60 tries, 5 seconds inbetween each trial)
182229 // We explicitly set the namespace to default here, because the Kubernetes API requires an explicit namespace when
183230 // looking up pods by name.
184- namespacedKubectlOptions := k8s .NewKubectlOptions ("" , "" )
185- namespacedKubectlOptions .Namespace = namespace
231+ namespacedKubectlOptions := k8s .NewKubectlOptions ("" , "" , namespace )
186232 k8s .WaitUntilPodAvailable (t , namespacedKubectlOptions , curlPodName , 60 , 5 * time .Second )
187233
188234 // Run the check function while the curl pod is up
0 commit comments