209 lines
10 KiB
C#
209 lines
10 KiB
C#
using FluentAssertions;
|
|
using Xunit;
|
|
using YamlDotNet.RepresentationModel;
|
|
|
|
namespace BluejayInfraLint.Tests;
|
|
|
|
[Trait("Category", "Unit")]
|
|
public sealed class Gx10AppleMdmNanohubTests
|
|
{
|
|
private static readonly string Root = FindRepoRoot();
|
|
private static readonly string AppRoot = Path.Combine(Root, "apps-gx10", "fc-apple-mdm");
|
|
private static readonly IReadOnlyList<YamlMappingNode> Documents = LoadDocuments();
|
|
|
|
[Fact]
|
|
public void Manifest_DeclaresLockedDownNanoHubRuntime()
|
|
{
|
|
Documents.Should().Contain(document => Is(document, "Namespace", "fc-apple-mdm"));
|
|
Documents.Should().Contain(document => Is(document, "ConfigMap", "fc-apple-mdm-root-ca"));
|
|
Documents.Should().Contain(document => Is(document, "Service", "fc-apple-mdm"));
|
|
Documents.Should().Contain(document => Is(document, "Service", "fc-apple-mdm-scep"));
|
|
Documents.Should().Contain(document => Is(document, "EndpointSlice", "fc-apple-mdm-scep-noc1"));
|
|
Documents.Should().Contain(document => Is(document, "NetworkPolicy", "fc-apple-mdm-netpol"));
|
|
Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "Secret");
|
|
Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "OnePasswordItem");
|
|
|
|
var pvc = Single("PersistentVolumeClaim", "fc-apple-mdm-data");
|
|
pvc.Scalar("spec", "storageClassName").Should().Be("local-path");
|
|
pvc.Scalar("spec", "resources", "requests", "storage").Should().Be("2Gi");
|
|
|
|
var deployment = Single("Deployment", "fc-apple-mdm");
|
|
deployment.Scalar("spec", "strategy", "type").Should().Be("Recreate");
|
|
deployment.Scalar("spec", "template", "metadata", "annotations", "fc.flowercore.io/probe-path").Should().Be("/version");
|
|
deployment.Scalar("spec", "template", "metadata", "annotations", "flowercore.io/root-ca-sha256")
|
|
.Should()
|
|
.Be("a9120c88fa3ec735d790aa4cfeb61ac2946730338969015bebaccc08fe10535e");
|
|
|
|
var maybePodSpec = deployment.Mapping("spec", "template", "spec");
|
|
maybePodSpec.Should().NotBeNull();
|
|
var podSpec = maybePodSpec!;
|
|
podSpec.Scalar("enableServiceLinks").Should().Be("false");
|
|
podSpec.Scalar("securityContext", "runAsUser").Should().Be("1654");
|
|
podSpec.Scalar("securityContext", "runAsNonRoot").Should().Be("true");
|
|
|
|
var container = podSpec.MappingSequence("containers").Should().ContainSingle().Subject;
|
|
container.Scalar("name").Should().Be("nanohub");
|
|
container.Scalar("image").Should().Be("localhost/fc-apple-mdm-nanohub:v0.2.0-20260617");
|
|
container.Scalar("imagePullPolicy").Should().Be("Never");
|
|
container.Scalar("securityContext", "readOnlyRootFilesystem").Should().Be("true");
|
|
container.Scalar("securityContext", "allowPrivilegeEscalation").Should().Be("false");
|
|
|
|
EnvValue(container, "NANOHUB_LISTEN").Should().Be(":9004");
|
|
EnvValue(container, "NANOHUB_STORAGE").Should().Be("file");
|
|
EnvValue(container, "NANOHUB_STORAGE_DSN").Should().Be("/var/lib/nanohub/db");
|
|
EnvValue(container, "NANOHUB_CHECKIN").Should().Be("true");
|
|
EnvValue(container, "NANOHUB_CA").Should().Be("/etc/nanohub/ca/root_ca.crt");
|
|
EnvSecretName(container, "NANOHUB_API_KEY").Should().Be("fc-apple-mdm-runtime");
|
|
EnvSecretKey(container, "NANOHUB_API_KEY").Should().Be("NANOHUB_API_KEY");
|
|
EnvSecretName(container, "NANOHUB_WEBHOOK_URL").Should().Be("fc-apple-mdm-runtime");
|
|
EnvSecretKey(container, "NANOHUB_WEBHOOK_URL").Should().Be("NANOHUB_WEBHOOK_URL");
|
|
EnvSecretOptional(container, "NANOHUB_WEBHOOK_URL").Should().Be("true");
|
|
|
|
VolumeMount(container, "data").Scalar("mountPath").Should().Be("/var/lib/nanohub");
|
|
VolumeMount(container, "root-ca").Scalar("mountPath").Should().Be("/etc/nanohub/ca");
|
|
VolumeMount(container, "root-ca").Scalar("readOnly").Should().Be("true");
|
|
ProbePath(container, "startupProbe").Should().Be("/version");
|
|
ProbePath(container, "readinessProbe").Should().Be("/version");
|
|
container.Scalar("livenessProbe", "tcpSocket", "port").Should().Be("9004");
|
|
}
|
|
|
|
[Fact]
|
|
public void Manifest_ExposesOnlyMdmCheckinVersionAndScepPaths()
|
|
{
|
|
var certificate = Single("Certificate", "fc-apple-mdm-tls");
|
|
certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
|
|
certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
|
|
certificate.ScalarSequence("spec", "dnsNames").Should().ContainSingle("mdm.iamworkin.lan");
|
|
|
|
var scepService = Single("Service", "fc-apple-mdm-scep");
|
|
scepService.Scalar("spec", "type").Should().Be("ClusterIP");
|
|
var scepServicePort = scepService.MappingSequence("spec", "ports").Should().ContainSingle().Subject;
|
|
scepServicePort.Scalar("name").Should().Be("http");
|
|
scepServicePort.Scalar("port").Should().Be("80");
|
|
scepServicePort.Scalar("targetPort").Should().Be("9080");
|
|
|
|
var scepEndpointSlice = Single("EndpointSlice", "fc-apple-mdm-scep-noc1");
|
|
scepEndpointSlice.Scalar("addressType").Should().Be("IPv4");
|
|
scepEndpointSlice.Scalar("metadata", "labels", "kubernetes.io/service-name").Should().Be("fc-apple-mdm-scep");
|
|
var scepEndpoint = scepEndpointSlice.MappingSequence("endpoints").Should().ContainSingle().Subject;
|
|
scepEndpoint.ScalarSequence("addresses").Should().ContainSingle("10.0.56.10");
|
|
var scepEndpointPort = scepEndpointSlice.MappingSequence("ports").Should().ContainSingle().Subject;
|
|
scepEndpointPort.Scalar("name").Should().Be("http");
|
|
scepEndpointPort.Scalar("port").Should().Be("9080");
|
|
|
|
var ingress = Single("IngressRoute", "fc-apple-mdm");
|
|
var routes = ingress.MappingSequence("spec", "routes");
|
|
routes.Should().HaveCount(2);
|
|
var scepRoute = routes.Single(route => route.Scalar("match")?.Contains("PathPrefix(`/scep`)") == true);
|
|
var nanohubRoute = routes.Single(route => route.Scalar("match")?.Contains("PathPrefix(`/mdm`)") == true);
|
|
var match = nanohubRoute.Scalar("match");
|
|
|
|
match.Should().Contain("Host(`mdm.iamworkin.lan`)");
|
|
match.Should().Contain("PathPrefix(`/mdm`)");
|
|
match.Should().Contain("PathPrefix(`/checkin`)");
|
|
match.Should().Contain("PathPrefix(`/version`)");
|
|
match.Should().NotContain("/api/v1");
|
|
match.Should().NotContain("PathPrefix(`/api`)");
|
|
|
|
scepRoute.Scalar("match").Should().Contain("Host(`mdm.iamworkin.lan`)");
|
|
scepRoute.Scalar("match").Should().Contain("PathPrefix(`/scep`)");
|
|
var scepRouteService = scepRoute.MappingSequence("services").Should().ContainSingle().Subject;
|
|
scepRouteService.Scalar("name").Should().Be("fc-apple-mdm-scep");
|
|
scepRouteService.Scalar("port").Should().Be("80");
|
|
}
|
|
|
|
[Fact]
|
|
public void Readme_DocumentsSecretImportAndSupportBoundary()
|
|
{
|
|
var readme = File.ReadAllText(Path.Combine(AppRoot, "README.md"));
|
|
|
|
readme.Should().Contain("FlowerCore Apple MDM Runtime");
|
|
readme.Should().Contain("Secret/fc-apple-mdm-runtime");
|
|
readme.Should().Contain("imagePullPolicy: Never");
|
|
readme.Should().Contain("10.0.57.202");
|
|
readme.Should().Contain("https://mdm.iamworkin.lan/scep/apple-mdm-scep");
|
|
readme.Should().Contain("Smallstep SCEP requires an RSA intermediate");
|
|
readme.Should().Contain("does not create an APNs MDM push certificate");
|
|
readme.Should().Contain("managed Wi-Fi payload");
|
|
}
|
|
|
|
private static YamlMappingNode Single(string kind, string name)
|
|
{
|
|
return Documents.Single(document => Is(document, kind, name));
|
|
}
|
|
|
|
private static bool Is(YamlMappingNode document, string kind, string name)
|
|
{
|
|
return document.Scalar("kind") == kind
|
|
&& document.Scalar("metadata", "name") == name;
|
|
}
|
|
|
|
private static string? EnvValue(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("value");
|
|
}
|
|
|
|
private static string? EnvSecretName(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "name");
|
|
}
|
|
|
|
private static string? EnvSecretKey(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "key");
|
|
}
|
|
|
|
private static string? EnvSecretOptional(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "optional");
|
|
}
|
|
|
|
private static string? ProbePath(YamlMappingNode container, string probeKey)
|
|
{
|
|
return container.Scalar(probeKey, "httpGet", "path");
|
|
}
|
|
|
|
private static YamlMappingNode VolumeMount(YamlMappingNode container, string name)
|
|
{
|
|
return container.MappingSequence("volumeMounts")
|
|
.Single(mount => mount.Scalar("name") == name);
|
|
}
|
|
|
|
private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
|
|
{
|
|
return container.MappingSequence("env")
|
|
.SingleOrDefault(env => env.Scalar("name") == name);
|
|
}
|
|
|
|
private static IReadOnlyList<YamlMappingNode> LoadDocuments()
|
|
{
|
|
var stream = new YamlStream();
|
|
using var reader = File.OpenText(Path.Combine(AppRoot, "fc-apple-mdm.yaml"));
|
|
stream.Load(reader);
|
|
|
|
return stream.Documents
|
|
.Select(document => document.RootNode)
|
|
.OfType<YamlMappingNode>()
|
|
.Where(mapping => !string.IsNullOrWhiteSpace(mapping.Scalar("kind")))
|
|
.ToList();
|
|
}
|
|
|
|
private static string FindRepoRoot()
|
|
{
|
|
var current = new DirectoryInfo(AppContext.BaseDirectory);
|
|
while (current is not null)
|
|
{
|
|
if (Directory.Exists(Path.Combine(current.FullName, "apps-gx10"))
|
|
&& Directory.Exists(Path.Combine(current.FullName, "tests"))
|
|
&& File.Exists(Path.Combine(current.FullName, "README.md")))
|
|
{
|
|
return current.FullName;
|
|
}
|
|
|
|
current = current.Parent;
|
|
}
|
|
|
|
throw new DirectoryNotFoundException("Could not find bluejay-infra root.");
|
|
}
|
|
}
|