feat: add Azure plugin (#131)

* feat: add Azure plugin Signed-off-by: Tyler Gillson <tyler.gillson@gmail.com> * test: add coverage Signed-off-by: Tyler Gillson <tyler.gillson@gmail.com> --------- Signed-off-by: Tyler Gillson <tyler.gillson@gmail.com>
validator-labs · Nov 22, 2023 · 25073e3 · 25073e3
1 parent e393d98
commit 25073e3
Show file tree

Hide file tree

Showing 3 changed files with 144 additions and 2 deletions.
diff --git a/chart/validator/templates/plugin-secret-azure.yaml b/chart/validator/templates/plugin-secret-azure.yaml
@@ -0,0 +1,10 @@
+{{- if .Values.pluginSecrets.azure }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ required ".Values.pluginSecrets.azure.secretName is required!" .Values.pluginSecrets.azure.secretName }}
+stringData:
+  {{- range $key, $val := .Values.pluginSecrets.azure.env }}
+  {{ $key }}: {{ $val | quote }}
+  {{- end }}
+{{- end }}
diff --git a/chart/validator/values.yaml b/chart/validator/values.yaml
@@ -133,13 +133,89 @@ plugins:
       type: ClusterIP
     auth:
       # Option 1: Leave secret undefined for implicit auth (node instance role, IMDSv2, etc.)
-      # Option 2: Create a secret via pluginSecrets (see below). Note: secretName and pluginSecrets.aws.secretName match.
+      # Option 2: Create a secret via pluginSecrets (see below). Note: secretName and pluginSecrets.aws.secretName must match.
       # Option 3: Specify the name of a preexisting secret in your target cluster and leave pluginSecrets.aws undefined.
       #
       secret: {}  # Delete these curly braces if you're specifying secretName!
         # secretName: aws-creds
       # Override the service account used by AWS validator (optional, could be used for IMDSv2 on EKS)
-      # WARNING: the chosen service account must have the same RBAC privileges as seen in manager-rbac.yaml
+      # WARNING: the chosen service account must include all RBAC privileges found in the AWS plugin template:
+      #          https://github.com/spectrocloud-labs/validator-plugin-aws/blob/main/chart/validator-plugin-aws/templates/manager-rbac.yaml
+      serviceAccountName: ""
+- chart:
+    name: validator-plugin-azure
+    repository: "https://spectrocloud-labs.github.io/validator-plugin-azure"
+    version: "v0.0.1"
+  values: |-
+    controllerManager:
+      kubeRbacProxy:
+        args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --v=0
+        containerSecurityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        image:
+          repository: gcr.io/kubebuilder/kube-rbac-proxy
+          tag: v0.15.0
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 5m
+            memory: 64Mi
+      manager:
+        args:
+        - --health-probe-bind-address=:8081
+        - --leader-elect
+        containerSecurityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+        image:
+          repository: quay.io/spectrocloud-labs/validator-plugin-azure
+          tag: v0.0.1
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 10m
+            memory: 64Mi
+        # Optionally specify a volumeMount to mount a volume containing a private key
+        # to leverage Azure Service principal with certificate authentication.
+        volumeMounts: []
+      replicas: 1
+      serviceAccount:
+        annotations: {}
+      # Optionally specify a volume containing a private key to leverage Azure Service
+      # principal with certificate authentication.
+      volumes: []
+    kubernetesClusterDomain: cluster.local
+    metricsService:
+      ports:
+      - name: https
+        port: 8443
+        protocol: TCP
+        targetPort: https
+      type: ClusterIP
+    auth:
+      # Option 1: Leave secret undefined for WorkloadIdentityCredential authentication.
+      # Option 2: Create a secret via pluginSecrets (see below). Note: secretName and pluginSecrets.azure.secretName must match.
+      # Option 3: Specify the name of a preexisting secret in your target cluster and leave pluginSecrets.azure undefined.
+      #
+      secret: {}  # Delete these curly braces if you're specifying secretName!
+        # secretName: azure-creds
+
+      # Override the service account used by Azure validator (optional, could be used for WorkloadIdentityCredentials on AKS)
+      # WARNING: the chosen service account must include all RBAC privileges found in the Azure plugin template:
+      #          https://github.com/spectrocloud-labs/validator-plugin-aws/blob/main/chart/validator-plugin-azure/templates/manager-rbac.yaml
       serviceAccountName: ""
 - chart:
     name: validator-plugin-vsphere
@@ -275,6 +351,26 @@ pluginSecrets:
     # secretAccessKey: ""
     # sessionToken: ""
 
+  # If installing the Azure plugin, the below config is required unless one of the following applies:
+  # - The target cluster already contains a secret with the correct format and you've specified its name above.
+  #   If specifying your own secret, refer to chart/validator/templates/plugin-secret-azure.yaml for
+  #   an example of the expected format and ensure that it exists in the same namespace as the Helm release.
+  # - You're deploying to a K8s cluster in AKS and relying on WorkloadIdentityCredentials, plus you've specified auth.serviceAccountName
+  #
+  azure: {}  # Don't forget to delete these curly braces if you're specifying credentials here!
+    # secretName: azure-creds  # ensure this matches the Azure plugin values above
+    #
+    # Any valid combination of Azure credential environment variables, per the options defined in:
+    # https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#readme-environment-variables.
+    # env:
+    #   AZURE_CLIENT_ID: ""
+    #   AZURE_TENANT_ID: ""
+    #   AZURE_CLIENT_SECRET: ""
+    #   AZURE_CLIENT_CERTIFICATE_PATH: ""
+    #   AZURE_CLIENT_CERTIFICATE_PASSWORD: ""
+    #   AZURE_USERNAME: ""
+    #   AZURE_PASSWORD: ""
+
   # If installing the vSphere plugin, the below config is required unless the following applies:
   # - The target cluster already contains a secret with the correct format and you've specified its name above.
   #   If specifying your own secret, refer to chart/validator/templates/plugin-secret-vsphere.yaml for

diff --git a/internal/controller/validationresult_controller_test.go b/internal/controller/validationresult_controller_test.go
@@ -2,8 +2,11 @@ package controller
 
 import (
 	"context"
+	"errors"
 	"os"
 	"path/filepath"
+	"reflect"
+	"testing"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -13,6 +16,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	"github.com/spectrocloud-labs/validator/api/v1alpha1"
+	"github.com/spectrocloud-labs/validator/internal/test"
 	"github.com/spectrocloud-labs/validator/pkg/constants"
 	//+kubebuilder:scaffold:imports
 )
@@ -121,3 +125,35 @@ var _ = Describe("ValidationResult controller", Ordered, func() {
 		}, timeout, interval).Should(BeTrue(), "failed to update ValidationResult Status")
 	})
 })
+
+func TestUpdateStatus(t *testing.T) {
+	cs := []struct {
+		name       string
+		reconciler ValidationResultReconciler
+		vr         *v1alpha1.ValidationResult
+		expected   error
+	}{
+		{
+			name: "Fail (update_status)",
+			reconciler: ValidationResultReconciler{
+				Client: test.ClientMock{
+					SubResourceMock: test.SubResourceMock{
+						UpdateErrors: []error{errors.New("update failed")},
+					},
+				},
+			},
+			vr: &v1alpha1.ValidationResult{
+				Status: v1alpha1.ValidationResultStatus{},
+			},
+			expected: errors.New("update failed"),
+		},
+	}
+	for _, c := range cs {
+		t.Log(c.name)
+		vr = c.vr
+		err := c.reconciler.updateStatus(context.Background())
+		if err != nil && !reflect.DeepEqual(c.expected.Error(), err.Error()) {
+			t.Errorf("expected (%v), got (%v)", c.expected, err)
+		}
+	}
+}