api/config/v1/tests/apiservers.config.openshift.io/TLSAdherence.yaml at c8b8ebcaa8a6aa582cd07552f95c827a0da95ef4 · openshift/api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
apiVersion: apiextensions.k8s.io/v1
name: "APIServer"
crdName: apiservers.config.openshift.io
featureGates:
- TLSAdherence
tests:
  onCreate:
    - name: Should be able to create with tlsAdherence set to LegacyExternalAPIServerComponentsOnly
      initial: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: LegacyExternalAPIServerComponentsOnly
      expected: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          audit:
            profile: Default
          tlsAdherence: LegacyExternalAPIServerComponentsOnly
    - name: Should be able to create with tlsAdherence set to StrictAllComponents
      initial: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: StrictAllComponents
      expected: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          audit:
            profile: Default
          tlsAdherence: StrictAllComponents
    - name: Should reject invalid tlsAdherence value
      initial: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: InvalidValue
      expectedError: 'spec.tlsAdherence: Unsupported value: "InvalidValue": supported values: "LegacyExternalAPIServerComponentsOnly", "StrictAllComponents"'
  onUpdate:
    - name: Should be able to update tlsAdherence from LegacyExternalAPIServerComponentsOnly to StrictAllComponents
      initial: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: LegacyExternalAPIServerComponentsOnly
      updated: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: StrictAllComponents
      expected: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          audit:
            profile: Default
          tlsAdherence: StrictAllComponents
    - name: Should be able to update tlsAdherence from StrictAllComponents to LegacyExternalAPIServerComponentsOnly
      initial: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: StrictAllComponents
      updated: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: LegacyExternalAPIServerComponentsOnly
      expected: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          audit:
            profile: Default
          tlsAdherence: LegacyExternalAPIServerComponentsOnly
    - name: Should not allow removing tlsAdherence once set
      initial: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec:
          tlsAdherence: StrictAllComponents
      updated: |
        apiVersion: config.openshift.io/v1
        kind: APIServer
        spec: {}
      expectedError: "tlsAdherence may not be removed once set"