1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
// Copyright 2019 The Kubernetes Authors.
// SPDX-License-Identifier: Apache-2.0
package krusty_test
import (
"testing"
kusttest_test "sigs.k8s.io/kustomize/api/testutils/kusttest"
)
// Reproduce issue #3732
func TestValidatingWebhookCombinedNamespaces(t *testing.T) {
th := kusttest_test.MakeHarness(t)
th.WriteK("base", `
resources:
- service.yaml
- validatingwebhook.yaml
`)
th.WriteF("base/service.yaml", `
apiVersion: v1
kind: Service
metadata:
name: admission
namespace: base-namespace
spec:
type: ClusterIP
ports:
- name: https-webhook
port: 443
targetPort: webhook
`)
th.WriteF("base/validatingwebhook.yaml", `
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: validatingwebhook
webhooks:
- name: validate
matchPolicy: Equivalent
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1beta1
operations:
- CREATE
- UPDATE
resources:
- ingresses
failurePolicy: Fail
sideEffects: None
admissionReviewVersions:
- v1
- v1beta1
clientConfig:
service:
namespace: base-namespace
name: admission
path: /networking/v1beta1/ingresses
`)
th.WriteK("overlay", `
namespace: merge-namespace
resources:
- ../base
patchesStrategicMerge:
- validatingwebhookdelete.yaml
`)
th.WriteF("overlay/validatingwebhookdelete.yaml", `
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: validatingwebhook
$patch: delete
`)
th.WriteK("combined", `
resources:
- ../base
- ../overlay
`)
m := th.Run("combined", th.MakeDefaultOptions())
th.AssertActualEqualsExpected(m, `
apiVersion: v1
kind: Service
metadata:
name: admission
namespace: base-namespace
spec:
ports:
- name: https-webhook
port: 443
targetPort: webhook
type: ClusterIP
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: validatingwebhook
webhooks:
- admissionReviewVersions:
- v1
- v1beta1
clientConfig:
service:
name: admission
namespace: merge-namespace
path: /networking/v1beta1/ingresses
failurePolicy: Fail
matchPolicy: Equivalent
name: validate
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1beta1
operations:
- CREATE
- UPDATE
resources:
- ingresses
sideEffects: None
---
apiVersion: v1
kind: Service
metadata:
name: admission
namespace: merge-namespace
spec:
ports:
- name: https-webhook
port: 443
targetPort: webhook
type: ClusterIP
`)
}
|
