|
| 1 | +/* |
| 2 | +Copyright 2026 The Kubernetes Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package azuretasks |
| 18 | + |
| 19 | +import ( |
| 20 | + "testing" |
| 21 | + |
| 22 | + "github.com/Azure/azure-sdk-for-go/sdk/azcore/to" |
| 23 | + network "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork" |
| 24 | + "k8s.io/kops/upup/pkg/fi" |
| 25 | + "k8s.io/kops/upup/pkg/fi/cloudup/azure" |
| 26 | +) |
| 27 | + |
| 28 | +func newTestNetworkSecurityGroup(natGatewayPip *PublicIPAddress) *NetworkSecurityGroup { |
| 29 | + return &NetworkSecurityGroup{ |
| 30 | + Name: to.Ptr("nsg"), |
| 31 | + Lifecycle: fi.LifecycleSync, |
| 32 | + ResourceGroup: &ResourceGroup{ |
| 33 | + Name: to.Ptr("rg"), |
| 34 | + }, |
| 35 | + SecurityRules: []*NetworkSecurityRule{ |
| 36 | + { |
| 37 | + Name: to.Ptr("AllowSSH"), |
| 38 | + Priority: to.Ptr[int32](100), |
| 39 | + Access: network.SecurityRuleAccessAllow, |
| 40 | + Direction: network.SecurityRuleDirectionInbound, |
| 41 | + Protocol: network.SecurityRuleProtocolTCP, |
| 42 | + SourceAddressPrefix: to.Ptr("*"), |
| 43 | + SourcePortRange: to.Ptr("*"), |
| 44 | + DestinationAddressPrefix: to.Ptr("*"), |
| 45 | + DestinationPortRange: to.Ptr("22"), |
| 46 | + }, |
| 47 | + { |
| 48 | + Name: to.Ptr("AllowNodesToKubernetesAPI"), |
| 49 | + Priority: to.Ptr[int32](2000), |
| 50 | + Access: network.SecurityRuleAccessAllow, |
| 51 | + Direction: network.SecurityRuleDirectionInbound, |
| 52 | + Protocol: network.SecurityRuleProtocolTCP, |
| 53 | + SourcePublicIPAddress: natGatewayPip, |
| 54 | + SourcePortRange: to.Ptr("*"), |
| 55 | + DestinationAddressPrefix: to.Ptr("*"), |
| 56 | + DestinationPortRange: to.Ptr("443"), |
| 57 | + }, |
| 58 | + }, |
| 59 | + Tags: map[string]*string{ |
| 60 | + testTagKey: to.Ptr(testTagValue), |
| 61 | + }, |
| 62 | + } |
| 63 | +} |
| 64 | + |
| 65 | +func TestNetworkSecurityGroupRenderAzure(t *testing.T) { |
| 66 | + cloud := NewMockAzureCloud("eastus") |
| 67 | + apiTarget := azure.NewAzureAPITarget(cloud) |
| 68 | + nsg := &NetworkSecurityGroup{} |
| 69 | + expected := newTestNetworkSecurityGroup(&PublicIPAddress{ |
| 70 | + Name: to.Ptr("natgw"), |
| 71 | + IPAddress: to.Ptr("192.0.2.1"), |
| 72 | + }) |
| 73 | + if err := nsg.RenderAzure(apiTarget, nil, expected, nil); err != nil { |
| 74 | + t.Fatalf("unexpected error: %s", err) |
| 75 | + } |
| 76 | + |
| 77 | + actual := cloud.NetworkSecurityGroupsClient.NSGs[*expected.Name] |
| 78 | + if a, e := *actual.Name, *expected.Name; a != e { |
| 79 | + t.Errorf("unexpected Name: expected %s, but got %s", e, a) |
| 80 | + } |
| 81 | + if a, e := *actual.Properties.SecurityRules[0].Properties.SourceAddressPrefix, "*"; a != e { |
| 82 | + t.Errorf("unexpected SourceAddressPrefix: expected %s, but got %s", e, a) |
| 83 | + } |
| 84 | + if a, e := *actual.Properties.SecurityRules[1].Properties.SourceAddressPrefix, "192.0.2.1"; a != e { |
| 85 | + t.Errorf("unexpected SourceAddressPrefix: expected %s, but got %s", e, a) |
| 86 | + } |
| 87 | +} |
| 88 | + |
| 89 | +func TestNetworkSecurityGroupRenderAzureUnallocatedPublicIPAddress(t *testing.T) { |
| 90 | + cloud := NewMockAzureCloud("eastus") |
| 91 | + apiTarget := azure.NewAzureAPITarget(cloud) |
| 92 | + nsg := &NetworkSecurityGroup{} |
| 93 | + expected := newTestNetworkSecurityGroup(&PublicIPAddress{ |
| 94 | + Name: to.Ptr("natgw"), |
| 95 | + }) |
| 96 | + if err := nsg.RenderAzure(apiTarget, nil, expected, nil); err == nil { |
| 97 | + t.Fatalf("expected error rendering a rule whose public IP has no allocated address") |
| 98 | + } |
| 99 | +} |
| 100 | + |
| 101 | +func TestNetworkSecurityGroupFind(t *testing.T) { |
| 102 | + cloud := NewMockAzureCloud("eastus") |
| 103 | + ctx := &fi.CloudupContext{ |
| 104 | + T: fi.CloudupSubContext{ |
| 105 | + Cloud: cloud, |
| 106 | + }, |
| 107 | + } |
| 108 | + |
| 109 | + natGatewayPip := &PublicIPAddress{ |
| 110 | + Name: to.Ptr("natgw"), |
| 111 | + IPAddress: to.Ptr("192.0.2.1"), |
| 112 | + } |
| 113 | + nsg := newTestNetworkSecurityGroup(natGatewayPip) |
| 114 | + nsg.SecurityRules = append(nsg.SecurityRules, &NetworkSecurityRule{ |
| 115 | + Name: to.Ptr("AllowNodesToKopsController"), |
| 116 | + Priority: to.Ptr[int32](2001), |
| 117 | + Access: network.SecurityRuleAccessAllow, |
| 118 | + Direction: network.SecurityRuleDirectionInbound, |
| 119 | + Protocol: network.SecurityRuleProtocolTCP, |
| 120 | + SourcePublicIPAddress: natGatewayPip, |
| 121 | + SourcePortRange: to.Ptr("*"), |
| 122 | + DestinationAddressPrefix: to.Ptr("*"), |
| 123 | + DestinationPortRange: to.Ptr("3988"), |
| 124 | + }) |
| 125 | + // Find will return nothing if there is no network security group created. |
| 126 | + actual, err := nsg.Find(ctx) |
| 127 | + if err != nil { |
| 128 | + t.Fatalf("unexpected error: %s", err) |
| 129 | + } |
| 130 | + if actual != nil { |
| 131 | + t.Errorf("unexpected networkSecurityGroup found: %+v", actual) |
| 132 | + } |
| 133 | + |
| 134 | + cloud.NetworkSecurityGroupsClient.NSGs[*nsg.Name] = &network.SecurityGroup{ |
| 135 | + Name: nsg.Name, |
| 136 | + ID: to.Ptr("id"), |
| 137 | + Properties: &network.SecurityGroupPropertiesFormat{ |
| 138 | + SecurityRules: []*network.SecurityRule{ |
| 139 | + { |
| 140 | + Name: to.Ptr("AllowNodesToKubernetesAPI"), |
| 141 | + Properties: &network.SecurityRulePropertiesFormat{ |
| 142 | + Priority: to.Ptr[int32](2000), |
| 143 | + Access: to.Ptr(network.SecurityRuleAccessAllow), |
| 144 | + Direction: to.Ptr(network.SecurityRuleDirectionInbound), |
| 145 | + Protocol: to.Ptr(network.SecurityRuleProtocolTCP), |
| 146 | + SourceAddressPrefix: to.Ptr("192.0.2.1"), |
| 147 | + SourcePortRange: to.Ptr("*"), |
| 148 | + DestinationAddressPrefix: to.Ptr("*"), |
| 149 | + DestinationPortRange: to.Ptr("443"), |
| 150 | + }, |
| 151 | + }, |
| 152 | + { |
| 153 | + Name: to.Ptr("AllowNodesToKopsController"), |
| 154 | + Properties: &network.SecurityRulePropertiesFormat{ |
| 155 | + Priority: to.Ptr[int32](2001), |
| 156 | + Access: to.Ptr(network.SecurityRuleAccessAllow), |
| 157 | + Direction: to.Ptr(network.SecurityRuleDirectionInbound), |
| 158 | + Protocol: to.Ptr(network.SecurityRuleProtocolTCP), |
| 159 | + SourceAddressPrefix: to.Ptr("*"), |
| 160 | + SourcePortRange: to.Ptr("*"), |
| 161 | + DestinationAddressPrefix: to.Ptr("*"), |
| 162 | + DestinationPortRange: to.Ptr("3988"), |
| 163 | + }, |
| 164 | + }, |
| 165 | + }, |
| 166 | + }, |
| 167 | + } |
| 168 | + // Find again. |
| 169 | + actual, err = nsg.Find(ctx) |
| 170 | + if err != nil { |
| 171 | + t.Fatalf("unexpected error: %s", err) |
| 172 | + } |
| 173 | + if a, e := *actual.Name, *nsg.Name; a != e { |
| 174 | + t.Errorf("unexpected networkSecurityGroup name: expected %s, but got %s", e, a) |
| 175 | + } |
| 176 | + // A source matching the referenced public IP maps back to the task reference. |
| 177 | + if a := actual.SecurityRules[0]; a.SourcePublicIPAddress != natGatewayPip || a.SourceAddressPrefix != nil { |
| 178 | + t.Errorf("expected rule source mapped to the referenced public IP, but got %+v", a) |
| 179 | + } |
| 180 | + // A non-matching source stays literal, so pre-existing wildcard rules show up as a change. |
| 181 | + if a := actual.SecurityRules[1]; a.SourcePublicIPAddress != nil || fi.ValueOf(a.SourceAddressPrefix) != "*" { |
| 182 | + t.Errorf("expected rule source to stay literal, but got %+v", a) |
| 183 | + } |
| 184 | +} |
![kubernetes-prow[bot]](https://avatars.githubusercontent.com/in/992787?v=4&size=40){kind=avatar}
0 commit comments