180 lines
8.0 KiB
C#
180 lines
8.0 KiB
C#
using FluentAssertions;
|
|
using Xunit;
|
|
using YamlDotNet.RepresentationModel;
|
|
|
|
namespace BluejayInfraLint.Tests;
|
|
|
|
[Trait("Category", "Unit")]
|
|
public sealed class Gx10AppleMdmNanohubTests
|
|
{
|
|
private static readonly string Root = FindRepoRoot();
|
|
private static readonly string AppRoot = Path.Combine(Root, "apps-gx10", "fc-apple-mdm");
|
|
private static readonly IReadOnlyList<YamlMappingNode> Documents = LoadDocuments();
|
|
|
|
[Fact]
|
|
public void Manifest_DeclaresLockedDownNanoHubRuntime()
|
|
{
|
|
Documents.Should().Contain(document => Is(document, "Namespace", "fc-apple-mdm"));
|
|
Documents.Should().Contain(document => Is(document, "ConfigMap", "fc-apple-mdm-root-ca"));
|
|
Documents.Should().Contain(document => Is(document, "Service", "fc-apple-mdm"));
|
|
Documents.Should().Contain(document => Is(document, "NetworkPolicy", "fc-apple-mdm-netpol"));
|
|
Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "Secret");
|
|
Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "OnePasswordItem");
|
|
|
|
var pvc = Single("PersistentVolumeClaim", "fc-apple-mdm-data");
|
|
pvc.Scalar("spec", "storageClassName").Should().Be("local-path");
|
|
pvc.Scalar("spec", "resources", "requests", "storage").Should().Be("2Gi");
|
|
|
|
var deployment = Single("Deployment", "fc-apple-mdm");
|
|
deployment.Scalar("spec", "strategy", "type").Should().Be("Recreate");
|
|
deployment.Scalar("spec", "template", "metadata", "annotations", "fc.flowercore.io/probe-path").Should().Be("/version");
|
|
deployment.Scalar("spec", "template", "metadata", "annotations", "flowercore.io/root-ca-sha256")
|
|
.Should()
|
|
.Be("a9120c88fa3ec735d790aa4cfeb61ac2946730338969015bebaccc08fe10535e");
|
|
|
|
var maybePodSpec = deployment.Mapping("spec", "template", "spec");
|
|
maybePodSpec.Should().NotBeNull();
|
|
var podSpec = maybePodSpec!;
|
|
podSpec.Scalar("enableServiceLinks").Should().Be("false");
|
|
podSpec.Scalar("securityContext", "runAsUser").Should().Be("1654");
|
|
podSpec.Scalar("securityContext", "runAsNonRoot").Should().Be("true");
|
|
|
|
var container = podSpec.MappingSequence("containers").Should().ContainSingle().Subject;
|
|
container.Scalar("name").Should().Be("nanohub");
|
|
container.Scalar("image").Should().Be("localhost/fc-apple-mdm-nanohub:v0.2.0-20260617");
|
|
container.Scalar("imagePullPolicy").Should().Be("Never");
|
|
container.Scalar("securityContext", "readOnlyRootFilesystem").Should().Be("true");
|
|
container.Scalar("securityContext", "allowPrivilegeEscalation").Should().Be("false");
|
|
|
|
EnvValue(container, "NANOHUB_LISTEN").Should().Be(":9004");
|
|
EnvValue(container, "NANOHUB_STORAGE").Should().Be("file");
|
|
EnvValue(container, "NANOHUB_STORAGE_DSN").Should().Be("/var/lib/nanohub/db");
|
|
EnvValue(container, "NANOHUB_CHECKIN").Should().Be("true");
|
|
EnvValue(container, "NANOHUB_CA").Should().Be("/etc/nanohub/ca/root_ca.crt");
|
|
EnvSecretName(container, "NANOHUB_API_KEY").Should().Be("fc-apple-mdm-runtime");
|
|
EnvSecretKey(container, "NANOHUB_API_KEY").Should().Be("NANOHUB_API_KEY");
|
|
EnvSecretName(container, "NANOHUB_WEBHOOK_URL").Should().Be("fc-apple-mdm-runtime");
|
|
EnvSecretKey(container, "NANOHUB_WEBHOOK_URL").Should().Be("NANOHUB_WEBHOOK_URL");
|
|
EnvSecretOptional(container, "NANOHUB_WEBHOOK_URL").Should().Be("true");
|
|
|
|
VolumeMount(container, "data").Scalar("mountPath").Should().Be("/var/lib/nanohub");
|
|
VolumeMount(container, "root-ca").Scalar("mountPath").Should().Be("/etc/nanohub/ca");
|
|
VolumeMount(container, "root-ca").Scalar("readOnly").Should().Be("true");
|
|
ProbePath(container, "startupProbe").Should().Be("/version");
|
|
ProbePath(container, "readinessProbe").Should().Be("/version");
|
|
container.Scalar("livenessProbe", "tcpSocket", "port").Should().Be("9004");
|
|
}
|
|
|
|
[Fact]
|
|
public void Manifest_ExposesOnlyMdmCheckinAndVersionPaths()
|
|
{
|
|
var certificate = Single("Certificate", "fc-apple-mdm-tls");
|
|
certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
|
|
certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
|
|
certificate.ScalarSequence("spec", "dnsNames").Should().ContainSingle("mdm.iamworkin.lan");
|
|
|
|
var ingress = Single("IngressRoute", "fc-apple-mdm");
|
|
var route = ingress.MappingSequence("spec", "routes").Should().ContainSingle().Subject;
|
|
var match = route.Scalar("match");
|
|
|
|
match.Should().Contain("Host(`mdm.iamworkin.lan`)");
|
|
match.Should().Contain("PathPrefix(`/mdm`)");
|
|
match.Should().Contain("PathPrefix(`/checkin`)");
|
|
match.Should().Contain("PathPrefix(`/version`)");
|
|
match.Should().NotContain("/api/v1");
|
|
match.Should().NotContain("PathPrefix(`/api`)");
|
|
}
|
|
|
|
[Fact]
|
|
public void Readme_DocumentsSecretImportAndSupportBoundary()
|
|
{
|
|
var readme = File.ReadAllText(Path.Combine(AppRoot, "README.md"));
|
|
|
|
readme.Should().Contain("FlowerCore Apple MDM Runtime");
|
|
readme.Should().Contain("Secret/fc-apple-mdm-runtime");
|
|
readme.Should().Contain("imagePullPolicy: Never");
|
|
readme.Should().Contain("10.0.57.202");
|
|
readme.Should().Contain("does not create an APNs MDM push certificate");
|
|
readme.Should().Contain("managed Wi-Fi payload");
|
|
}
|
|
|
|
private static YamlMappingNode Single(string kind, string name)
|
|
{
|
|
return Documents.Single(document => Is(document, kind, name));
|
|
}
|
|
|
|
private static bool Is(YamlMappingNode document, string kind, string name)
|
|
{
|
|
return document.Scalar("kind") == kind
|
|
&& document.Scalar("metadata", "name") == name;
|
|
}
|
|
|
|
private static string? EnvValue(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("value");
|
|
}
|
|
|
|
private static string? EnvSecretName(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "name");
|
|
}
|
|
|
|
private static string? EnvSecretKey(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "key");
|
|
}
|
|
|
|
private static string? EnvSecretOptional(YamlMappingNode container, string name)
|
|
{
|
|
return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "optional");
|
|
}
|
|
|
|
private static string? ProbePath(YamlMappingNode container, string probeKey)
|
|
{
|
|
return container.Scalar(probeKey, "httpGet", "path");
|
|
}
|
|
|
|
private static YamlMappingNode VolumeMount(YamlMappingNode container, string name)
|
|
{
|
|
return container.MappingSequence("volumeMounts")
|
|
.Single(mount => mount.Scalar("name") == name);
|
|
}
|
|
|
|
private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
|
|
{
|
|
return container.MappingSequence("env")
|
|
.SingleOrDefault(env => env.Scalar("name") == name);
|
|
}
|
|
|
|
private static IReadOnlyList<YamlMappingNode> LoadDocuments()
|
|
{
|
|
var stream = new YamlStream();
|
|
using var reader = File.OpenText(Path.Combine(AppRoot, "fc-apple-mdm.yaml"));
|
|
stream.Load(reader);
|
|
|
|
return stream.Documents
|
|
.Select(document => document.RootNode)
|
|
.OfType<YamlMappingNode>()
|
|
.Where(mapping => !string.IsNullOrWhiteSpace(mapping.Scalar("kind")))
|
|
.ToList();
|
|
}
|
|
|
|
private static string FindRepoRoot()
|
|
{
|
|
var current = new DirectoryInfo(AppContext.BaseDirectory);
|
|
while (current is not null)
|
|
{
|
|
if (Directory.Exists(Path.Combine(current.FullName, "apps-gx10"))
|
|
&& Directory.Exists(Path.Combine(current.FullName, "tests"))
|
|
&& File.Exists(Path.Combine(current.FullName, "README.md")))
|
|
{
|
|
return current.FullName;
|
|
}
|
|
|
|
current = current.Parent;
|
|
}
|
|
|
|
throw new DirectoryNotFoundException("Could not find bluejay-infra root.");
|
|
}
|
|
}
|