diff --git a/Makefile b/Makefile index 9118f59..72d32e7 100644 --- a/Makefile +++ b/Makefile @@ -17,7 +17,8 @@ TESTS := \ 07-biossettings-reboot \ 08-bmcsettings \ 09-persistent-boot-order \ - 10-bmcversion + 10-bmcversion \ + 11-bmcuser .PHONY: help help: ## Show available targets @@ -36,9 +37,10 @@ help: ## Show available targets @echo " test/05-indicator-led (indicator LED)" @echo " test/06-biossettings-noreboot (BIOSSettings, non-reboot setting)" @echo " test/07-biossettings-reboot (BIOSSettings, reboot-required setting)" - @echo " test/08-bmcsettings (BMCSettings, Manager attribute; needs a Dell BMC)" + @echo " test/08-bmcsettings (BMCSettings, Manager attribute)" @echo " test/09-persistent-boot-order (persistent boot order)" @echo " test/10-bmcversion (BMCVersion, version read without upgrade)" + @echo " test/11-bmcuser (BMCUser, BMC account create/rotate/delete)" @echo "" .PHONY: require-values diff --git a/coverage.md b/coverage.md index 2f2e143..e6d53c5 100644 --- a/coverage.md +++ b/coverage.md @@ -31,6 +31,7 @@ These rows/capabilities include the following placeholders in their `test` field | `tests/08-bmcsettings` | `BMC Registration`, `Discovery`, `bmc-settings.attr-get`, `bmc-settings.attr-pending`, `bmc-settings.set-immediate`, `bmc-settings.attr-check` | | `tests/09-persistent-boot-order` | `BMC Registration`, `Discovery`, `boot.order-get`, `boot.order-set`, `power.on`, `power.off-graceful` | | `tests/10-bmcversion` | `BMC Registration`, `Discovery`, `bmc.version` | +| `tests/11-bmcuser` | `BMC Registration`, `account.service`, `account.list`, `account.create-update`, `account.delete` | | `tests/12-force-power-off` | `BMC Registration`, `Discovery`, `power.off-graceful`, `power.off-force`, `power.wait-state` | ## Coverage by capability @@ -67,10 +68,10 @@ These rows/capabilities include the following placeholders in their `test` field | `manager.get` | `BMC Registration` | yes | | `manager.discover` | uncovered | - | | `manager.reset` | `tests/04-bmc-reset` | no | -| `account.create-update` | uncovered | - | -| `account.delete` | uncovered | - | -| `account.list` | uncovered | - | -| `account.service` | uncovered | - | +| `account.create-update` | `tests/11-bmcuser` | yes | +| `account.delete` | `tests/11-bmcuser` | yes | +| `account.list` | `tests/11-bmcuser` | yes | +| `account.service` | `tests/11-bmcuser` | yes | | `indicator.set-led` | `tests/05-indicator-led` | yes | | `events.subscribe` | uncovered | - | | `events.unsubscribe` | uncovered | - | diff --git a/tests/11-bmcuser/bmcuser.yaml b/tests/11-bmcuser/bmcuser.yaml new file mode 100644 index 0000000..39f01f0 --- /dev/null +++ b/tests/11-bmcuser/bmcuser.yaml @@ -0,0 +1,11 @@ +apiVersion: baseboard.metal.ironcore.dev/v1alpha1 +kind: BMCUser +metadata: + name: (join('-', ['compatibility', $namespace, 'user'])) + labels: + metal-operator-test-framework/namespace: ($namespace) +spec: + userName: ($userName) + roleID: ($roleID) + bmcRef: + name: (join('-', ['compatibility', $namespace])) diff --git a/tests/11-bmcuser/chainsaw-test.yaml b/tests/11-bmcuser/chainsaw-test.yaml new file mode 100644 index 0000000..bd9f597 --- /dev/null +++ b/tests/11-bmcuser/chainsaw-test.yaml @@ -0,0 +1,126 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: 11-bmcuser +spec: + concurrent: false + bindings: + - name: userName + value: foobar + - name: roleID + value: ReadOnly + steps: + - name: register-bmc + try: + - apply: + file: ../shared/bmcsecret.yaml + - apply: + file: ../shared/bmc.yaml + cleanup: + - sleep: + duration: 10s + - delete: + timeout: 2m + ref: + apiVersion: metal.ironcore.dev/v1alpha1 + kind: Server + labels: + metal-operator-test-framework/namespace: ($namespace) + - name: assert-bmc-enabled + try: + - assert: + resource: + apiVersion: metal.ironcore.dev/v1alpha1 + kind: BMC + metadata: + name: (join('-', ['compatibility', $namespace])) + status: + state: Enabled + - name: create-user + try: + - apply: + file: bmcuser.yaml + - assert: + resource: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + metadata: + name: (join('-', ['compatibility', $namespace, 'user'])) + spec: + (bmcSecretRef.name != null): true + status: + (id != null): true + - name: assert-effective-secret + try: + - assert: + resource: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + metadata: + name: (join('-', ['compatibility', $namespace, 'user'])) + (status.effectiveBMCSecretRef.name == spec.bmcSecretRef.name): true + - name: assert-generated-secret + bindings: + - name: secretName + value: (x_k8s_get($client, 'baseboard.metal.ironcore.dev/v1alpha1', 'BMCUser', '', join('-', ['compatibility', $namespace, 'user'])).spec.bmcSecretRef.name) + try: + - assert: + resource: + apiVersion: metal.ironcore.dev/v1alpha1 + kind: BMCSecret + metadata: + name: ($secretName) + ownerReferences: + - kind: BMCUser + name: (join('-', ['compatibility', $namespace, 'user'])) + - name: rotate-credentials + bindings: + - name: user + value: (x_k8s_get($client, 'baseboard.metal.ironcore.dev/v1alpha1', 'BMCUser', '', join('-', ['compatibility', $namespace, 'user']))) + - name: previousSecret + value: ($user.spec.bmcSecretRef.name) + - name: accountID + value: ($user.status.id) + try: + - patch: + resource: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + metadata: + name: (join('-', ['compatibility', $namespace, 'user'])) + annotations: + metal.ironcore.dev/operation: rotate-credentials + - assert: + resource: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + metadata: + name: (join('-', ['compatibility', $namespace, 'user'])) + (annotations."metal.ironcore.dev/operation" || 'absent'): 'absent' + spec: + (bmcSecretRef.name != $previousSecret): true + status: + id: ($accountID) + - assert: + resource: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + metadata: + name: (join('-', ['compatibility', $namespace, 'user'])) + (status.effectiveBMCSecretRef.name == spec.bmcSecretRef.name): true + status: + id: ($accountID) + - name: delete-user + try: + - delete: + timeout: 2m + ref: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + name: (join('-', ['compatibility', $namespace, 'user'])) + - error: + resource: + apiVersion: baseboard.metal.ironcore.dev/v1alpha1 + kind: BMCUser + metadata: + name: (join('-', ['compatibility', $namespace, 'user']))