def test_get_roles(self):
rbac = RBAC('default', None)
rbac._get_cluster_role_bindings = MagicMock(
return_value=self.TEST_ROLE_BINDINGS)
rbac._get_namespace_role_bindings = MagicMock(
return_value=self.TEST_ROLE_BINDINGS)
self.assertEqual(rbac.get_roles(self.TEST_USER),
{'octarine-role:[email protected]'})
def test_get_permissions(self):
rbac = RBAC('default', None)
rbac._get_namespace_roles = MagicMock(return_value=self.TEST_ROLES)
rbac._get_cluster_roles = MagicMock(return_value={'items': []})
rbac._get_namespace_role_bindings = MagicMock(
return_value=self.TEST_ROLE_BINDINGS)
rbac._get_cluster_role_bindings = MagicMock(return_value={'items': []})
self.assertEqual(json.dumps(rbac.get_permissions(self.TEST_USER)),
json.dumps(self.TEST_PERMISSIONS))
def test_get_unused_privilege_role(self):
verbs = ["get", "list", "watch", "create", "update", "patch", "delete"]
empty_verb_to_resource = {k: set() for k in verbs}
rbac = RBAC('default', None)
rbac._get_namespace_roles = MagicMock(return_value=self.TEST_ROLES)
rbac._get_cluster_roles = MagicMock(return_value={'items': []})
rbac._get_namespace_role_bindings = MagicMock(
return_value=self.TEST_ROLE_BINDINGS)
rbac._get_cluster_role_bindings = MagicMock(return_value={'items': []})
self.assertEqual(
rbac.get_unused_permissions(self.TEST_USER, self.AUDIT_LOG_PATH),
empty_verb_to_resource)
def test_parse_all_users_from_role_bindings(self):
users = RBAC._parse_all_users_from_role_bindings(
self.TEST_ROLE_BINDINGS)
self.assertEqual(users, {self.TEST_USER})
def test_parse_permissions(self):
permissions = RBAC._parse_permissions([self.TEST_ROLE],
self.TEST_ROLES)
self.assertEqual(json.dumps(permissions),
json.dumps(self.TEST_PERMISSIONS))
def test_parse_roles(self):
roles = RBAC._parse_roles('*****@*****.**',
self.TEST_ROLE_BINDINGS)
self.assertEqual(roles, [self.TEST_ROLE])
def test_get_least_privilege_role(self):
role, rolebinding = RBAC.get_least_privilege_role(
self.TEST_USER, self.AUDIT_LOG_PATH)
self.assertTrue(
TestKubeRBAC._compare_roles(role, self.TEST_LEAST_PRIVILEGE_ROLE))
def test_get_audited_permissions(self):
audited_permissions = RBAC.get_audited_permissions(
self.TEST_USER, self.AUDIT_LOG_PATH)
self.assertEqual(audited_permissions, TEST_AUDITED_PERMISSIONS)
def test_get_users(self):
rbac = RBAC('default', None)
rbac._get_namespace_role_bindings = MagicMock(
return_value=self.TEST_ROLE_BINDINGS)
rbac._get_cluster_role_bindings = MagicMock(return_value={'items': []})
self.assertEqual(rbac.get_users(), {self.TEST_USER})