feat: test account capabilities

Makefile

@@ -17,7 +17,8 @@ TESTS := \
 	07-biossettings-reboot \
 	08-bmcsettings \
 	09-persistent-boot-order \
-	10-bmcversion
+	10-bmcversion \
+	11-bmcuser
 
 .PHONY: help
 help: ## Show available targets
@@ -36,9 +37,10 @@ help: ## Show available targets
 	@echo "    test/05-indicator-led            (indicator LED)"
 	@echo "    test/06-biossettings-noreboot    (BIOSSettings, non-reboot setting)"
 	@echo "    test/07-biossettings-reboot      (BIOSSettings, reboot-required setting)"
-	@echo "    test/08-bmcsettings              (BMCSettings, Manager attribute; needs a Dell BMC)"
+	@echo "    test/08-bmcsettings              (BMCSettings, Manager attribute)"
 	@echo "    test/09-persistent-boot-order    (persistent boot order)"
 	@echo "    test/10-bmcversion               (BMCVersion, version read without upgrade)"
+	@echo "    test/11-bmcuser                  (BMCUser, BMC account create/rotate/delete)"
 	@echo ""
 
 .PHONY: require-values

coverage.md

@@ -31,6 +31,7 @@ These rows/capabilities include the following placeholders in their `test` field
 | `tests/08-bmcsettings`           | `BMC Registration`, `Discovery`, `bmc-settings.attr-get`, `bmc-settings.attr-pending`, `bmc-settings.set-immediate`, `bmc-settings.attr-check` |
 | `tests/09-persistent-boot-order` | `BMC Registration`, `Discovery`, `boot.order-get`, `boot.order-set`, `power.on`, `power.off-graceful`                                          |
 | `tests/10-bmcversion`            | `BMC Registration`, `Discovery`, `bmc.version`                                                                                                 |
+| `tests/11-bmcuser`               | `BMC Registration`, `account.service`, `account.list`, `account.create-update`, `account.delete`                                               |
 | `tests/12-force-power-off`       | `BMC Registration`, `Discovery`, `power.off-graceful`, `power.off-force`, `power.wait-state`                                                   |
 
 ## Coverage by capability
@@ -67,10 +68,10 @@ These rows/capabilities include the following placeholders in their `test` field
 | `manager.get`                | `BMC Registration`                                                            |   yes    |
 | `manager.discover`           | uncovered                                                                     |    -     |
 | `manager.reset`              | `tests/04-bmc-reset`                                                          |    no    |
-| `account.create-update`      | uncovered                                                                     |    -     |
-| `account.delete`             | uncovered                                                                     |    -     |
-| `account.list`               | uncovered                                                                     |    -     |
-| `account.service`            | uncovered                                                                     |    -     |
+| `account.create-update`      | `tests/11-bmcuser`                                                |   yes    |
+| `account.delete`             | `tests/11-bmcuser`                                                |   yes    |
+| `account.list`               | `tests/11-bmcuser`                                                |   yes    |
+| `account.service`            | `tests/11-bmcuser`                                                |   yes    |
 | `indicator.set-led`          | `tests/05-indicator-led`                                                      |   yes    |
 | `events.subscribe`           | uncovered                                                                     |    -     |
 | `events.unsubscribe`         | uncovered                                                                     |    -     |

tests/11-bmcuser/bmcuser.yaml

@@ -0,0 +1,11 @@
+apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+kind: BMCUser
+metadata:
+  name: (join('-', ['compatibility', $namespace, 'user']))
+  labels:
+    metal-operator-test-framework/namespace: ($namespace)
+spec:
+  userName: ($userName)
+  roleID: ($roleID)
+  bmcRef:
+    name: (join('-', ['compatibility', $namespace]))

tests/11-bmcuser/chainsaw-test.yaml

@@ -0,0 +1,126 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: 11-bmcuser
+spec:
+  concurrent: false
+  bindings:
+    - name: userName
+      value: foobar
+    - name: roleID
+      value: ReadOnly
+  steps:
+    - name: register-bmc
+      try:
+        - apply:
+            file: ../shared/bmcsecret.yaml
+        - apply:
+            file: ../shared/bmc.yaml
+      cleanup:
+        - sleep:
+            duration: 10s
+        - delete:
+            timeout: 2m
+            ref:
+              apiVersion: metal.ironcore.dev/v1alpha1
+              kind: Server
+              labels:
+                metal-operator-test-framework/namespace: ($namespace)
+    - name: assert-bmc-enabled
+      try:
+        - assert:
+            resource:
+              apiVersion: metal.ironcore.dev/v1alpha1
+              kind: BMC
+              metadata:
+                name: (join('-', ['compatibility', $namespace]))
+              status:
+                state: Enabled
+    - name: create-user
+      try:
+        - apply:
+            file: bmcuser.yaml
+        - assert:
+            resource:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              metadata:
+                name: (join('-', ['compatibility', $namespace, 'user']))
+              spec:
+                (bmcSecretRef.name != null): true
+              status:
+                (id != null): true
+    - name: assert-effective-secret
+      try:
+        - assert:
+            resource:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              metadata:
+                name: (join('-', ['compatibility', $namespace, 'user']))
+              (status.effectiveBMCSecretRef.name == spec.bmcSecretRef.name): true
+    - name: assert-generated-secret
+      bindings:
+        - name: secretName
+          value: (x_k8s_get($client, 'baseboard.metal.ironcore.dev/v1alpha1', 'BMCUser', '', join('-', ['compatibility', $namespace, 'user'])).spec.bmcSecretRef.name)
+      try:
+        - assert:
+            resource:
+              apiVersion: metal.ironcore.dev/v1alpha1
+              kind: BMCSecret
+              metadata:
+                name: ($secretName)
+                ownerReferences:
+                  - kind: BMCUser
+                    name: (join('-', ['compatibility', $namespace, 'user']))
+    - name: rotate-credentials
+      bindings:
+        - name: user
+          value: (x_k8s_get($client, 'baseboard.metal.ironcore.dev/v1alpha1', 'BMCUser', '', join('-', ['compatibility', $namespace, 'user'])))
+        - name: previousSecret
+          value: ($user.spec.bmcSecretRef.name)
+        - name: accountID
+          value: ($user.status.id)
+      try:
+        - patch:
+            resource:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              metadata:
+                name: (join('-', ['compatibility', $namespace, 'user']))
+                annotations:
+                  metal.ironcore.dev/operation: rotate-credentials
+        - assert:
+            resource:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              metadata:
+                name: (join('-', ['compatibility', $namespace, 'user']))
+                (annotations."metal.ironcore.dev/operation" || 'absent'): 'absent'
+              spec:
+                (bmcSecretRef.name != $previousSecret): true
+              status:
+                id: ($accountID)
+        - assert:
+            resource:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              metadata:
+                name: (join('-', ['compatibility', $namespace, 'user']))
+              (status.effectiveBMCSecretRef.name == spec.bmcSecretRef.name): true
+              status:
+                id: ($accountID)
+    - name: delete-user
+      try:
+        - delete:
+            timeout: 2m
+            ref:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              name: (join('-', ['compatibility', $namespace, 'user']))
+        - error:
+            resource:
+              apiVersion: baseboard.metal.ironcore.dev/v1alpha1
+              kind: BMCUser
+              metadata:
+                name: (join('-', ['compatibility', $namespace, 'user']))