path: root/spec/lib/gitlab/kubernetes/kube_client_spec.rb

# frozen_string_literal: true

require 'spec_helper'

RSpec.describe Gitlab::Kubernetes::KubeClient do
  include StubRequests
  include KubernetesHelpers

  let(:api_url) { 'https://kubernetes.example.com/prefix' }
  let(:kubeclient_options) { { auth_options: { bearer_token: 'xyz' } } }

  let(:client) { described_class.new(api_url, **kubeclient_options) }

  before do
    stub_kubeclient_discover(api_url)
  end

  def method_call(client, method_name)
    case method_name
    when /\A(get_|delete_)/
      client.public_send(method_name)
    when /\A(create_|update_|patch_)/
      client.public_send(method_name, {})
    else
      raise "Unknown method name #{method_name}"
    end
  end

  shared_examples 'a Kubeclient' do
    it 'is a Kubeclient::Client' do
      is_expected.to be_an_instance_of Kubeclient::Client
    end

    it 'has the kubeclient options' do
      expect(subject.auth_options).to eq({ bearer_token: 'xyz' })
    end
  end

  shared_examples 'redirection not allowed' do |method_name|
    context 'api_url is redirected' do
      before do
        redirect_url = 'https://not-under-our-control.example.com/api/v1/pods'

        stub_request(:get, %r{\A#{api_url}/})
          .to_return(status: 302, headers: { location: redirect_url })

        stub_request(:get, redirect_url)
          .to_return(status: 200, body: '{}')
      end

      it 'does not follow redirects' do
        expect { method_call(client, method_name) }.to raise_error(Kubeclient::HttpError)
      end
    end
  end

  shared_examples 'dns rebinding not allowed' do |method_name|
    it 'does not allow DNS rebinding' do
      stub_dns(api_url, ip_address: '8.8.8.8')
      client

      stub_dns(api_url, ip_address: '192.168.2.120')
      expect { method_call(client, method_name) }.to raise_error(ArgumentError, /is blocked/)
    end
  end

  describe '.graceful_request' do
    context 'successful' do
      before do
        allow(client).to receive(:foo).and_return(true)
      end

      it 'returns connected status and foo response' do
        result = described_class.graceful_request(1) { client.foo }

        expect(result).to eq({ status: :connected, response: true })
      end
    end

    context 'errored' do
      using RSpec::Parameterized::TableSyntax

      where(:error, :connection_status, :error_status) do
        SocketError                                      | :unreachable            | :connection_error
        OpenSSL::X509::CertificateError                  | :authentication_failure | :authentication_error
        StandardError                                    | :unknown_failure        | :unknown_error
        Kubeclient::HttpError.new(408, "timed out", nil) | :unreachable            | :http_error
        Kubeclient::HttpError.new(408, "timeout", nil)   | :unreachable            | :http_error
        Kubeclient::HttpError.new(408, "", nil)          | :authentication_failure | :http_error
      end

      with_them do
        before do
          allow(client).to receive(:foo).and_raise(error)
        end

        it 'returns error status' do
          result = described_class.graceful_request(1) { client.foo }

          expect(result).to eq({ status: connection_status, connection_error: error_status })
        end
      end
    end
  end

  describe '#initialize' do
    shared_examples 'local address' do
      it 'blocks local addresses' do
        expect { client }.to raise_error(Gitlab::UrlBlocker::BlockedUrlError)
      end

      context 'when local requests are allowed' do
        before do
          stub_application_setting(allow_local_requests_from_web_hooks_and_services: true)
        end

        it 'allows local addresses' do
          expect { client }.not_to raise_error
        end
      end
    end

    context 'localhost address' do
      let(:api_url) { 'http://localhost:22' }

      it_behaves_like 'local address'
    end

    context 'private network address' do
      let(:api_url) { 'http://192.168.1.2:3003' }

      it_behaves_like 'local address'
    end

    it 'falls back to default options, but allows overriding' do
      client = described_class.new(api_url)
      defaults = Gitlab::Kubernetes::KubeClient::DEFAULT_KUBECLIENT_OPTIONS
      expect(client.kubeclient_options[:timeouts]).to eq(defaults[:timeouts])

      client = Gitlab::Kubernetes::KubeClient.new(api_url, timeouts: { read: 7 })
      expect(client.kubeclient_options[:timeouts][:read]).to eq(7)
      expect(client.kubeclient_options[:timeouts][:open]).to eq(defaults[:timeouts][:open])
    end
  end

  describe '#core_client' do
    subject { client.core_client }

    it_behaves_like 'a Kubeclient'

    it 'has the core API endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/api\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1')
    end
  end

  describe '#rbac_client' do
    subject { client.rbac_client }

    it_behaves_like 'a Kubeclient'

    it 'has the RBAC API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/rbac.authorization.k8s.io\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1')
    end
  end

  describe '#extensions_client' do
    subject { client.extensions_client }

    it_behaves_like 'a Kubeclient'

    it 'has the extensions API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/extensions\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1beta1')
    end
  end

  describe '#istio_client' do
    subject { client.istio_client }

    it_behaves_like 'a Kubeclient'

    it 'has the Istio API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/networking.istio.io\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1alpha3')
    end
  end

  describe '#knative_client' do
    subject { client.knative_client }

    it_behaves_like 'a Kubeclient'

    it 'has the extensions API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/serving.knative.dev\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1alpha1')
    end
  end

  describe '#networking_client' do
    subject { client.networking_client }

    it_behaves_like 'a Kubeclient'

    it 'has the networking API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/networking.k8s.io\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1')
    end
  end

  describe '#cilium_networking_client' do
    subject { client.cilium_networking_client }

    it_behaves_like 'a Kubeclient'

    it 'has the cilium API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/cilium.io\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v2')
    end
  end

  describe '#metrics_client' do
    subject { client.metrics_client }

    it_behaves_like 'a Kubeclient'

    it 'has the metrics API group endpoint' do
      expect(subject.api_endpoint.to_s).to match(%r{\/apis\/metrics.k8s.io\Z})
    end

    it 'has the api_version' do
      expect(subject.instance_variable_get(:@api_version)).to eq('v1beta1')
    end
  end

  describe 'core API' do
    let(:core_client) { client.core_client }

    [
      :get_nodes,
      :get_pods,
      :get_secrets,
      :get_config_map,
      :get_pod,
      :get_namespace,
      :get_secret,
      :get_service,
      :get_service_account,
      :delete_namespace,
      :delete_pod,
      :delete_service_account,
      :create_config_map,
      :create_namespace,
      :create_pod,
      :create_secret,
      :create_service_account,
      :update_config_map,
      :update_secret,
      :update_service_account
    ].each do |method|
      describe "##{method}" do
        include_examples 'redirection not allowed', method
        include_examples 'dns rebinding not allowed', method

        it 'delegates to the core client' do
          expect(client).to delegate_method(method).to(:core_client)
        end

        it 'responds to the method' do
          expect(client).to respond_to method
        end
      end
    end
  end

  describe 'rbac API group' do
    let(:rbac_client) { client.rbac_client }

    [
      :create_role,
      :get_role,
      :update_role,
      :delete_role_binding,
      :update_role_binding,
      :update_cluster_role_binding
    ].each do |method|
      describe "##{method}" do
        include_examples 'redirection not allowed', method
        include_examples 'dns rebinding not allowed', method

        it 'delegates to the rbac client' do
          expect(client).to delegate_method(method).to(:rbac_client)
        end

        it 'responds to the method' do
          expect(client).to respond_to method
        end
      end
    end
  end

  describe '#get_deployments' do
    let(:extensions_client) { client.extensions_client }
    let(:apps_client) { client.apps_client }

    include_examples 'redirection not allowed', 'get_deployments'
    include_examples 'dns rebinding not allowed', 'get_deployments'

    it 'delegates to the extensions client' do
      expect(extensions_client).to receive(:get_deployments)

      client.get_deployments
    end

    context 'extensions does not have deployments for Kubernetes 1.16+ clusters' do
      before do
        WebMock
          .stub_request(:get, api_url + '/apis/extensions/v1beta1')
          .to_return(kube_response(kube_1_16_extensions_v1beta1_discovery_body))
      end

      it 'delegates to the apps client' do
        expect(apps_client).to receive(:get_deployments)

        client.get_deployments
      end
    end
  end

  describe '#get_ingresses' do
    let(:extensions_client) { client.extensions_client }
    let(:networking_client) { client.networking_client }

    include_examples 'redirection not allowed', 'get_ingresses'
    include_examples 'dns rebinding not allowed', 'get_ingresses'

    it 'delegates to the extensions client' do
      expect(extensions_client).to receive(:get_ingresses)

      client.get_ingresses
    end

    context 'extensions does not have deployments for Kubernetes 1.22+ clusters' do
      before do
        WebMock
          .stub_request(:get, api_url + '/apis/extensions/v1beta1')
          .to_return(kube_response(kube_1_22_extensions_v1beta1_discovery_body))
      end

      it 'delegates to the apps client' do
        expect(networking_client).to receive(:get_ingresses)

        client.get_ingresses
      end
    end
  end

  describe '#patch_ingress' do
    let(:extensions_client) { client.extensions_client }
    let(:networking_client) { client.networking_client }

    include_examples 'redirection not allowed', 'patch_ingress'
    include_examples 'dns rebinding not allowed', 'patch_ingress'

    it 'delegates to the extensions client' do
      expect(extensions_client).to receive(:patch_ingress)

      client.patch_ingress
    end

    context 'extensions does not have ingress for Kubernetes 1.22+ clusters' do
      before do
        WebMock
          .stub_request(:get, api_url + '/apis/extensions/v1beta1')
          .to_return(kube_response(kube_1_22_extensions_v1beta1_discovery_body))
      end

      it 'delegates to the apps client' do
        expect(networking_client).to receive(:patch_ingress)

        client.patch_ingress
      end
    end
  end

  describe 'istio API group' do
    let(:istio_client) { client.istio_client }

    [
      :create_gateway,
      :get_gateway,
      :update_gateway
    ].each do |method|
      describe "##{method}" do
        include_examples 'redirection not allowed', method
        include_examples 'dns rebinding not allowed', method

        it 'delegates to the istio client' do
          expect(client).to delegate_method(method).to(:istio_client)
        end

        it 'responds to the method' do
          expect(client).to respond_to method
        end
      end
    end
  end

  describe 'networking API group' do
    let(:networking_client) { client.networking_client }

    [
      :create_network_policy,
      :get_network_policies,
      :get_network_policy,
      :update_network_policy,
      :delete_network_policy
    ].each do |method|
      describe "##{method}" do
        include_examples 'redirection not allowed', method
        include_examples 'dns rebinding not allowed', method

        it 'delegates to the networking client' do
          expect(client).to delegate_method(method).to(:networking_client)
        end

        it 'responds to the method' do
          expect(client).to respond_to method
        end
      end
    end
  end

  describe 'cilium API group' do
    let(:cilium_networking_client) { client.cilium_networking_client }

    [
      :create_cilium_network_policy,
      :get_cilium_network_policies,
      :get_cilium_network_policy,
      :update_cilium_network_policy,
      :delete_cilium_network_policy
    ].each do |method|
      describe "##{method}" do
        include_examples 'redirection not allowed', method
        include_examples 'dns rebinding not allowed', method

        it 'delegates to the cilium client' do
          expect(client).to delegate_method(method).to(:cilium_networking_client)
        end

        it 'responds to the method' do
          expect(client).to respond_to method
        end
      end
    end
  end

  describe 'non-entity methods' do
    it 'does not proxy for non-entity methods' do
      expect(client).not_to respond_to :proxy_url
    end

    it 'throws an error' do
      expect { client.proxy_url }.to raise_error(NoMethodError)
    end
  end

  describe '#get_pod_log' do
    let(:core_client) { client.core_client }

    it 'is delegated to the core client' do
      expect(client).to delegate_method(:get_pod_log).to(:core_client)
    end
  end

  describe '#watch_pod_log' do
    let(:core_client) { client.core_client }

    it 'is delegated to the core client' do
      expect(client).to delegate_method(:watch_pod_log).to(:core_client)
    end
  end

  shared_examples 'create_or_update method using put' do
    let(:update_method) { "update_#{resource_type}" }

    it 'calls the update method' do
      expect(client).to receive(update_method).with(resource)

      subject
    end
  end

  shared_examples 'create_or_update method' do
    let(:get_method) { "get_#{resource_type}" }
    let(:update_method) { "update_#{resource_type}" }
    let(:create_method) { "create_#{resource_type}" }

    context 'resource exists' do
      before do
        expect(client).to receive(get_method).and_return(resource)
      end

      it 'calls the update method' do
        expect(client).to receive(update_method).with(resource)

        subject
      end
    end

    context 'resource does not exist' do
      before do
        expect(client).to receive(get_method).and_raise(Kubeclient::ResourceNotFoundError.new(404, 'Not found', nil))
      end

      it 'calls the create method' do
        expect(client).to receive(create_method).with(resource)

        subject
      end
    end
  end

  describe '#create_or_update_cluster_role_binding' do
    let(:resource_type) { 'cluster_role_binding' }

    let(:resource) do
      ::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
    end

    subject { client.create_or_update_cluster_role_binding(resource) }

    it_behaves_like 'create_or_update method using put'
  end

  describe '#create_or_update_role_binding' do
    let(:resource_type) { 'role_binding' }

    let(:resource) do
      ::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
    end

    subject { client.create_or_update_role_binding(resource) }

    it_behaves_like 'create_or_update method using put'
  end

  describe '#create_or_update_service_account' do
    let(:resource_type) { 'service_account' }

    let(:resource) do
      ::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
    end

    subject { client.create_or_update_service_account(resource) }

    it_behaves_like 'create_or_update method'
  end

  describe '#create_or_update_secret' do
    let(:resource_type) { 'secret' }

    let(:resource) do
      ::Kubeclient::Resource.new(metadata: { name: 'name', namespace: 'namespace' })
    end

    subject { client.create_or_update_secret(resource) }

    it_behaves_like 'create_or_update method'
  end

  describe 'methods that do not exist on any client' do
    it 'throws an error' do
      expect { client.non_existent_method }.to raise_error(NoMethodError)
    end

    it 'returns false for respond_to' do
      expect(client.respond_to?(:non_existent_method)).to be_falsey
    end
  end
end