feat(test): support test pull secret

cmd/main.go

@@ -23,6 +23,7 @@ import (
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 
+	"github.com/RedHatInsights/runtimes-inventory-operator/internal/common"
 	"github.com/RedHatInsights/runtimes-inventory-operator/pkg/insights"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
@@ -111,8 +112,8 @@ func main() {
 				// in addition to any secret in the operator's namespace
 				&corev1.Secret{}: {
 					Namespaces: map[string]cache.Config{
-						"openshift-config": {
-							FieldSelector: fields.OneTermEqualSelector("metadata.name", "pull-secret"),
+						common.PullSecretNamespace: {
+							FieldSelector: fields.OneTermEqualSelector("metadata.name", common.PullSecretName),
 						},
 						operatorNamespace: {},
 					},

internal/common/constants.go

@@ -20,9 +20,12 @@ const (
 	ProxyServiceName         = ProxyDeploymentName
 	ProxyServicePort         = 8080
 	ProxySecretName          = "apicastconf"
+	PullSecretName           = "pull-secret"
+	PullSecretNamespace      = "openshift-config"
 	EnvInsightsBackendDomain = "INSIGHTS_BACKEND_DOMAIN"
 	EnvInsightsProxyDomain   = "INSIGHTS_PROXY_DOMAIN"
 	EnvInsightsEnabled       = "INSIGHTS_ENABLED"
+	EnvTestPullSecretName    = "INSIGHTS_TEST_PULL_SECRET_NAME"
 	// Environment variable to override the Insights proxy image
 	EnvInsightsProxyImageTag = "RELATED_IMAGE_INSIGHTS_PROXY"
 )

internal/controller/insights.go

@@ -120,7 +120,7 @@ func (r *InsightsReconciler) reconcileProxyService(ctx context.Context) error {
 func (r *InsightsReconciler) getTokenFromPullSecret(ctx context.Context) (*string, error) {
 	// Get the global pull secret
 	pullSecret := &corev1.Secret{}
-	err := r.Client.Get(ctx, types.NamespacedName{Namespace: "openshift-config", Name: "pull-secret"}, pullSecret)
+	err := r.Client.Get(ctx, types.NamespacedName{Namespace: r.pullSecretObj.Namespace, Name: r.pullSecretObj.Name}, pullSecret)
 	if err != nil {
 		return nil, err
 	}

internal/controller/insights_controller.go

@@ -38,6 +38,7 @@ type InsightsReconciler struct {
 	backendDomain string
 	proxyDomain   string
 	proxyImageTag string
+	pullSecretObj types.NamespacedName
 }
 
 // InsightsReconcilerConfig contains configuration to create an InsightsReconciler
@@ -61,12 +62,27 @@ func NewInsightsReconciler(config *InsightsReconcilerConfig) (*InsightsReconcile
 		return nil, errors.New("no proxy image tag provided for Insights")
 	}
 	proxyDomain := config.GetEnv(common.EnvInsightsProxyDomain)
+	// Check if a substitute pull secret for testing has been provided
+	testPullSecret := config.GetEnv(common.EnvTestPullSecretName)
+	var pullSecretObj types.NamespacedName
+	if len(testPullSecret) > 0 {
+		pullSecretObj = types.NamespacedName{
+			Name:      testPullSecret,
+			Namespace: config.Namespace,
+		}
+	} else {
+		pullSecretObj = types.NamespacedName{
+			Name:      common.PullSecretName,
+			Namespace: common.PullSecretNamespace,
+		}
+	}
 
 	return &InsightsReconciler{
 		InsightsReconcilerConfig: config,
 		backendDomain:            backendDomain,
 		proxyDomain:              proxyDomain,
 		proxyImageTag:            imageTag,
+		pullSecretObj:            pullSecretObj,
 	}, nil
 }
 
@@ -105,7 +121,7 @@ func (r *InsightsReconciler) SetupWithManager(mgr ctrl.Manager) error {
 }
 
 func (r *InsightsReconciler) isPullSecretOrProxyConfig(ctx context.Context, secret client.Object) []reconcile.Request {
-	if !(secret.GetNamespace() == "openshift-config" && secret.GetName() == "pull-secret") &&
+	if !(secret.GetNamespace() == r.pullSecretObj.Namespace && secret.GetName() == r.pullSecretObj.Name) &&
 		!(secret.GetNamespace() == r.Namespace && secret.GetName() == common.ProxySecretName) {
 		return nil
 	}

internal/controller/insights_controller_test.go

@@ -179,6 +179,34 @@ var _ = Describe("InsightsController", func() {
 					}, actual)
 					Expect(err).ToNot(HaveOccurred())
 
+					Expect(actual.Labels).To(Equal(expected.Labels))
+					Expect(actual.Annotations).To(Equal(expected.Annotations))
+					Expect(metav1.IsControlledBy(actual, t.getProxyConfigMap())).To(BeTrue())
+					Expect(actual.Data).To(HaveLen(1))
+					Expect(actual.Data).To(HaveKey("config.json"))
+					Expect(actual.Data["config.json"]).To(MatchJSON(expected.StringData["config.json"]))
+				})
+			})
+			Context("with a test pull secret", func() {
+				BeforeEach(func() {
+					pullSecret := t.NewTestPullSecret()
+					t.EnvTestPullSecret = &pullSecret.Name
+					t.objs = append(t.objs, pullSecret)
+				})
+				JustBeforeEach(func() {
+					result, err := t.reconcile()
+					Expect(err).ToNot(HaveOccurred())
+					Expect(result).To(Equal(reconcile.Result{}))
+				})
+				It("should create the APICast config secret", func() {
+					expected := t.NewInsightsProxySecretWithTestPullSecret()
+					actual := &corev1.Secret{}
+					err := t.client.Get(context.Background(), types.NamespacedName{
+						Name:      expected.Name,
+						Namespace: expected.Namespace,
+					}, actual)
+					Expect(err).ToNot(HaveOccurred())
+
 					Expect(actual.Labels).To(Equal(expected.Labels))
 					Expect(actual.Annotations).To(Equal(expected.Annotations))
 					Expect(metav1.IsControlledBy(actual, t.getProxyConfigMap())).To(BeTrue())

internal/controller/insights_controller_unit_test.go

@@ -102,6 +102,19 @@ var _ = Describe("InsightsController", func() {
 				result := t.controller.isPullSecretOrProxyConfig(context.Background(), secret)
 				Expect(result).To(BeEmpty())
 			})
+			Context("with a test pull secret", func() {
+				BeforeEach(func() {
+					t.EnvTestPullSecret = &t.NewTestPullSecret().Name
+				})
+				It("should reconcile test pull secret", func() {
+					result := t.controller.isPullSecretOrProxyConfig(context.Background(), t.NewTestPullSecret())
+					Expect(result).To(ConsistOf(t.deploymentReconcileRequest()))
+				})
+				It("should not reconcile global pull secret", func() {
+					result := t.controller.isPullSecretOrProxyConfig(context.Background(), t.NewGlobalPullSecret())
+					Expect(result).To(BeEmpty())
+				})
+			})
 		})
 
 		Context("for deployments", func() {

internal/controller/test/resources.go

@@ -233,6 +233,73 @@ func (r *InsightsTestResources) NewInsightsProxySecretWithProxyDomain() *corev1.
 	}
 }
 
+func (r *InsightsTestResources) NewInsightsProxySecretWithTestPullSecret() *corev1.Secret {
+	return &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "apicastconf",
+			Namespace: r.Namespace,
+		},
+		StringData: map[string]string{
+			"config.json": fmt.Sprintf(`{
+				"services": [
+				  {
+					"id": "1",
+					"backend_version": "1",
+					"proxy": {
+					  "hosts": ["insights-proxy","insights-proxy.%s.svc.cluster.local"],
+					  "api_backend": "https://insights.example.com:443/",
+					  "backend": { "endpoint": "http://127.0.0.1:8081", "host": "backend" },
+					  "policy_chain": [
+						{
+						  "name": "default_credentials",
+						  "version": "builtin",
+						  "configuration": {
+							"auth_type": "user_key",
+							"user_key": "dummy_key"
+						  }
+						},
+						{
+						  "name": "headers",
+						  "version": "builtin",
+						  "configuration": {
+							"request": [
+							  {
+								"op": "set",
+								"header": "Authorization",
+								"value_type": "plain",
+								"value": "Bearer test"
+							  },
+							  {
+								"op": "set",
+								"header": "User-Agent",
+								"value_type": "plain",
+								"value": "%s cluster/abcde"
+							  }
+							]
+						  }
+						},
+						{
+						  "name": "apicast.policy.apicast"
+						}
+					  ],
+					  "proxy_rules": [
+						{
+						  "http_method": "POST",
+						  "pattern": "/",
+						  "metric_system_name": "hits",
+						  "delta": 1,
+						  "parameters": [],
+						  "querystring_parameters": {}
+						}
+					  ]
+					}
+				  }
+				]
+			  }`, r.Namespace, r.UserAgentPrefix),
+		},
+	}
+}
+
 func (r *InsightsTestResources) NewInsightsProxyDeployment() *appsv1.Deployment {
 	var resources *corev1.ResourceRequirements
 	if r.Resources != nil {
@@ -410,3 +477,16 @@ func (r *InsightsTestResources) NewClusterVersion() *configv1.ClusterVersion {
 		},
 	}
 }
+
+func (r *InsightsTestResources) NewTestPullSecret() *corev1.Secret {
+	config := `{"auths":{"example.com":{"auth":"world"},"cloud.openshift.com":{"auth":"test"}}}`
+	return &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-pull-secret",
+			Namespace: r.Namespace,
+		},
+		Data: map[string][]byte{
+			corev1.DockerConfigJsonKey: []byte(config),
+		},
+	}
+}

internal/controller/test/utils.go

@@ -24,6 +24,7 @@ type TestUtilsConfig struct {
 	EnvInsightsProxyImageTag *string
 	EnvInsightsBackendDomain *string
 	EnvInsightsProxyDomain   *string
+	EnvTestPullSecret        *string
 }
 
 type testOSUtils struct {
@@ -44,6 +45,9 @@ func NewTestOSUtils(config *TestUtilsConfig) *testOSUtils {
 	if config.EnvInsightsProxyDomain != nil {
 		envs["INSIGHTS_PROXY_DOMAIN"] = *config.EnvInsightsProxyDomain
 	}
+	if config.EnvTestPullSecret != nil {
+		envs["INSIGHTS_TEST_PULL_SECRET_NAME"] = *config.EnvTestPullSecret
+	}
 	return &testOSUtils{envs: envs}
 }