359 lines
12 KiB
Go
359 lines
12 KiB
Go
/*
|
|
Copyright 2017 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package aws
|
|
|
|
import (
|
|
"fmt"
|
|
"testing"
|
|
|
|
"github.com/aws/aws-sdk-go/aws"
|
|
"github.com/aws/aws-sdk-go/service/ec2"
|
|
"github.com/aws/aws-sdk-go/service/elb"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestElbProtocolsAreEqual(t *testing.T) {
|
|
grid := []struct {
|
|
L *string
|
|
R *string
|
|
Expected bool
|
|
}{
|
|
{
|
|
L: aws.String("http"),
|
|
R: aws.String("http"),
|
|
Expected: true,
|
|
},
|
|
{
|
|
L: aws.String("HTTP"),
|
|
R: aws.String("http"),
|
|
Expected: true,
|
|
},
|
|
{
|
|
L: aws.String("HTTP"),
|
|
R: aws.String("TCP"),
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: aws.String(""),
|
|
R: aws.String("TCP"),
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: aws.String(""),
|
|
R: aws.String(""),
|
|
Expected: true,
|
|
},
|
|
{
|
|
L: nil,
|
|
R: aws.String(""),
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: aws.String(""),
|
|
R: nil,
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: nil,
|
|
R: nil,
|
|
Expected: true,
|
|
},
|
|
}
|
|
for _, g := range grid {
|
|
actual := elbProtocolsAreEqual(g.L, g.R)
|
|
if actual != g.Expected {
|
|
t.Errorf("unexpected result from protocolsEquals(%v, %v)", g.L, g.R)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAWSARNEquals(t *testing.T) {
|
|
grid := []struct {
|
|
L *string
|
|
R *string
|
|
Expected bool
|
|
}{
|
|
{
|
|
L: aws.String("arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"),
|
|
R: aws.String("arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"),
|
|
Expected: true,
|
|
},
|
|
{
|
|
L: aws.String("ARN:AWS:ACM:US-EAST-1:123456789012:CERTIFICATE/12345678-1234-1234-1234-123456789012"),
|
|
R: aws.String("arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"),
|
|
Expected: true,
|
|
},
|
|
{
|
|
L: aws.String("arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"),
|
|
R: aws.String(""),
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: aws.String(""),
|
|
R: aws.String(""),
|
|
Expected: true,
|
|
},
|
|
{
|
|
L: nil,
|
|
R: aws.String(""),
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: aws.String(""),
|
|
R: nil,
|
|
Expected: false,
|
|
},
|
|
{
|
|
L: nil,
|
|
R: nil,
|
|
Expected: true,
|
|
},
|
|
}
|
|
for _, g := range grid {
|
|
actual := awsArnEquals(g.L, g.R)
|
|
if actual != g.Expected {
|
|
t.Errorf("unexpected result from awsArnEquals(%v, %v)", g.L, g.R)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestIsNLB(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
|
|
annotations map[string]string
|
|
want bool
|
|
}{
|
|
{
|
|
"NLB annotation provided",
|
|
map[string]string{"service.beta.kubernetes.io/aws-load-balancer-type": "nlb"},
|
|
true,
|
|
},
|
|
{
|
|
"NLB annotation has invalid value",
|
|
map[string]string{"service.beta.kubernetes.io/aws-load-balancer-type": "elb"},
|
|
false,
|
|
},
|
|
{
|
|
"NLB annotation absent",
|
|
map[string]string{},
|
|
false,
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Logf("Running test case %s", test.name)
|
|
got := isNLB(test.annotations)
|
|
|
|
if got != test.want {
|
|
t.Errorf("Incorrect value for isNLB() case %s. Got %t, expected %t.", test.name, got, test.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSecurityGroupFiltering(t *testing.T) {
|
|
grid := []struct {
|
|
in []*ec2.SecurityGroup
|
|
name string
|
|
expected int
|
|
description string
|
|
}{
|
|
{
|
|
in: []*ec2.SecurityGroup{
|
|
{
|
|
IpPermissions: []*ec2.IpPermission{
|
|
{
|
|
IpRanges: []*ec2.IpRange{
|
|
{
|
|
Description: aws.String("an unmanaged"),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
name: "unmanaged",
|
|
expected: 0,
|
|
description: "An environment without managed LBs should have %d, but found %d SecurityGroups",
|
|
},
|
|
{
|
|
in: []*ec2.SecurityGroup{
|
|
{
|
|
IpPermissions: []*ec2.IpPermission{
|
|
{
|
|
IpRanges: []*ec2.IpRange{
|
|
{
|
|
Description: aws.String("an unmanaged"),
|
|
},
|
|
{
|
|
Description: aws.String(fmt.Sprintf("%s=%s", NLBClientRuleDescription, "managedlb")),
|
|
},
|
|
{
|
|
Description: aws.String(fmt.Sprintf("%s=%s", NLBHealthCheckRuleDescription, "managedlb")),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
name: "managedlb",
|
|
expected: 1,
|
|
description: "Found %d, but should have %d Security Groups",
|
|
},
|
|
}
|
|
|
|
for _, g := range grid {
|
|
actual := len(filterForIPRangeDescription(g.in, g.name))
|
|
if actual != g.expected {
|
|
t.Errorf(g.description, actual, g.expected)
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
func TestSyncElbListeners(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
loadBalancerName string
|
|
listeners []*elb.Listener
|
|
listenerDescriptions []*elb.ListenerDescription
|
|
toCreate []*elb.Listener
|
|
toDelete []*int64
|
|
}{
|
|
{
|
|
name: "no edge cases",
|
|
loadBalancerName: "lb_one",
|
|
listeners: []*elb.Listener{
|
|
{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")},
|
|
{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP"), SSLCertificateId: aws.String("def-456")},
|
|
{InstancePort: aws.Int64(8443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(8443), Protocol: aws.String("TCP"), SSLCertificateId: aws.String("def-456")},
|
|
},
|
|
listenerDescriptions: []*elb.ListenerDescription{
|
|
{Listener: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")}},
|
|
{Listener: &elb.Listener{InstancePort: aws.Int64(8443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(8443), Protocol: aws.String("TCP"), SSLCertificateId: aws.String("def-456")}},
|
|
},
|
|
toDelete: []*int64{
|
|
aws.Int64(80),
|
|
},
|
|
toCreate: []*elb.Listener{
|
|
{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")},
|
|
{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP"), SSLCertificateId: aws.String("def-456")},
|
|
},
|
|
},
|
|
{
|
|
name: "no listeners to delete",
|
|
loadBalancerName: "lb_two",
|
|
listeners: []*elb.Listener{
|
|
{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")},
|
|
{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP"), SSLCertificateId: aws.String("def-456")},
|
|
},
|
|
listenerDescriptions: []*elb.ListenerDescription{
|
|
{Listener: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")}},
|
|
},
|
|
toCreate: []*elb.Listener{
|
|
{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP"), SSLCertificateId: aws.String("def-456")},
|
|
},
|
|
toDelete: []*int64{},
|
|
},
|
|
{
|
|
name: "no listeners to create",
|
|
loadBalancerName: "lb_three",
|
|
listeners: []*elb.Listener{
|
|
{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")},
|
|
},
|
|
listenerDescriptions: []*elb.ListenerDescription{
|
|
{Listener: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")}},
|
|
{Listener: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")}},
|
|
},
|
|
toDelete: []*int64{
|
|
aws.Int64(80),
|
|
},
|
|
toCreate: []*elb.Listener{},
|
|
},
|
|
{
|
|
name: "nil actual listener",
|
|
loadBalancerName: "lb_four",
|
|
listeners: []*elb.Listener{
|
|
{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP")},
|
|
},
|
|
listenerDescriptions: []*elb.ListenerDescription{
|
|
{Listener: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP"), SSLCertificateId: aws.String("abc-123")}},
|
|
{Listener: nil},
|
|
},
|
|
toDelete: []*int64{
|
|
aws.Int64(443),
|
|
},
|
|
toCreate: []*elb.Listener{
|
|
{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("HTTP")},
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
additions, removals := syncElbListeners(test.loadBalancerName, test.listeners, test.listenerDescriptions)
|
|
assert.Equal(t, additions, test.toCreate)
|
|
assert.Equal(t, removals, test.toDelete)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestElbListenersAreEqual(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
expected, actual *elb.Listener
|
|
equal bool
|
|
}{
|
|
{
|
|
name: "should be equal",
|
|
expected: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
actual: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
equal: true,
|
|
},
|
|
{
|
|
name: "instance port should be different",
|
|
expected: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
actual: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
equal: false,
|
|
},
|
|
{
|
|
name: "instance protocol should be different",
|
|
expected: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("HTTP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
actual: &elb.Listener{InstancePort: aws.Int64(80), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
equal: false,
|
|
},
|
|
{
|
|
name: "load balancer port should be different",
|
|
expected: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(443), Protocol: aws.String("TCP")},
|
|
actual: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
equal: false,
|
|
},
|
|
{
|
|
name: "protocol should be different",
|
|
expected: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("TCP")},
|
|
actual: &elb.Listener{InstancePort: aws.Int64(443), InstanceProtocol: aws.String("TCP"), LoadBalancerPort: aws.Int64(80), Protocol: aws.String("HTTP")},
|
|
equal: false,
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
assert.Equal(t, test.equal, elbListenersAreEqual(test.expected, test.actual))
|
|
})
|
|
}
|
|
}
|