Add tests for VM webhook

test/migration/setup/setup_migration_test.go

@@ -9,6 +9,7 @@ import (
 
 func TestSetupMigration(t *testing.T) {
 	// given
+	t.Setenv("skip-mutating-webhook-check-on-setup", "true")
 	awaitilities := WaitForDeployments(t)
 
 	runner := migration.SetupMigrationRunner{

testsupport/wait/member.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"os"
 	"reflect"
 	"strings"
 	"testing"
@@ -2149,7 +2150,7 @@ func (a *MemberAwaitility) WaitForMemberWebhooks(t *testing.T, image string) {
 	a.waitForService(t)
 	a.waitForWebhookDeployment(t, image)
 	ca := a.verifySecret(t)
-	a.verifyUserPodWebhookConfig(t, ca)
+	a.verifyMutatingWebhookConfig(t, ca)
 	a.verifyValidatingWebhookConfig(t, ca)
 }
 
@@ -2236,35 +2237,83 @@ func (a *MemberAwaitility) verifySecret(t *testing.T) []byte {
 	return ca
 }
 
-func (a *MemberAwaitility) verifyUserPodWebhookConfig(t *testing.T, ca []byte) {
-	t.Logf("checking MutatingWebhookConfiguration '%s'", "sandbox-users-pods")
+func (a *MemberAwaitility) verifyMutatingWebhookConfig(t *testing.T, ca []byte) {
+	if val := os.Getenv("skip-mutating-webhook-check-on-setup"); val == "true" {
+		// skipped temporarily only for setup migration test but applies for after migration test
+		return
+	}
+
+	t.Logf("checking MutatingWebhookConfiguration")
 	actualMutWbhConf := &admv1.MutatingWebhookConfiguration{}
 	a.waitForResource(t, "", "member-operator-webhook", actualMutWbhConf)
 	assert.Equal(t, bothWebhookLabels, actualMutWbhConf.Labels)
-	require.Len(t, actualMutWbhConf.Webhooks, 1)
-
-	webhook := actualMutWbhConf.Webhooks[0]
-	assert.Equal(t, "users.pods.webhook.sandbox", webhook.Name)
-	assert.Equal(t, []string{"v1"}, webhook.AdmissionReviewVersions)
-	assert.Equal(t, admv1.SideEffectClassNone, *webhook.SideEffects)
-	assert.Equal(t, int32(5), *webhook.TimeoutSeconds)
-	assert.Equal(t, admv1.NeverReinvocationPolicy, *webhook.ReinvocationPolicy)
-	assert.Equal(t, admv1.Ignore, *webhook.FailurePolicy)
-	assert.Equal(t, admv1.Equivalent, *webhook.MatchPolicy)
-	assert.Equal(t, codereadyToolchainProviderLabel, webhook.NamespaceSelector.MatchLabels)
-	assert.Equal(t, ca, webhook.ClientConfig.CABundle)
-	assert.Equal(t, "member-operator-webhook", webhook.ClientConfig.Service.Name)
-	assert.Equal(t, a.Namespace, webhook.ClientConfig.Service.Namespace)
-	assert.Equal(t, "/mutate-users-pods", *webhook.ClientConfig.Service.Path)
-	assert.Equal(t, int32(443), *webhook.ClientConfig.Service.Port)
-	require.Len(t, webhook.Rules, 1)
-
-	rule := webhook.Rules[0]
-	//assert.Equal(t, []admv1.OperationType{admv1.Create}, rule.Operations)
-	assert.Equal(t, []string{""}, rule.APIGroups)
-	assert.Equal(t, []string{"v1"}, rule.APIVersions)
-	assert.Equal(t, []string{"pods"}, rule.Resources)
-	assert.Equal(t, admv1.NamespacedScope, *rule.Scope)
+	require.Len(t, actualMutWbhConf.Webhooks, 2)
+
+	type Rule struct {
+		Operations  []admv1.OperationType
+		APIGroups   []string
+		APIVersions []string
+		Resources   []string
+	}
+
+	tests := map[string]struct {
+		Index         int
+		Name          string
+		Path          string
+		FailurePolicy admv1.FailurePolicyType
+		Rule          Rule
+	}{
+		"users pods webhook": {
+			Index:         0,
+			Name:          "users.pods.webhook.sandbox",
+			Path:          "/mutate-users-pods",
+			FailurePolicy: admv1.Ignore,
+			Rule: Rule{
+				Operations:  []admv1.OperationType{"CREATE"},
+				APIGroups:   []string{""},
+				APIVersions: []string{"v1"},
+				Resources:   []string{"pods"},
+			},
+		},
+		"virtual machine webhook": {
+			Index:         1,
+			Name:          "users.virtualmachines.webhook.sandbox",
+			Path:          "/mutate-virtual-machines",
+			FailurePolicy: admv1.Fail,
+			Rule: Rule{
+				Operations:  []admv1.OperationType{"CREATE"},
+				APIGroups:   []string{"kubevirt.io"},
+				APIVersions: []string{"v1"},
+				Resources:   []string{"virtualmachines"},
+			},
+		},
+	}
+	for k, tc := range tests {
+		t.Run(k, func(t *testing.T) {
+			webhook := actualMutWbhConf.Webhooks[tc.Index]
+			assert.Equal(t, tc.Name, webhook.Name)
+			assert.Equal(t, []string{"v1"}, webhook.AdmissionReviewVersions)
+			assert.Equal(t, admv1.SideEffectClassNone, *webhook.SideEffects)
+			assert.Equal(t, int32(5), *webhook.TimeoutSeconds)
+			assert.Equal(t, admv1.NeverReinvocationPolicy, *webhook.ReinvocationPolicy)
+			assert.Equal(t, tc.FailurePolicy, *webhook.FailurePolicy)
+			assert.Equal(t, admv1.Equivalent, *webhook.MatchPolicy)
+			assert.Equal(t, codereadyToolchainProviderLabel, webhook.NamespaceSelector.MatchLabels)
+			assert.Equal(t, ca, webhook.ClientConfig.CABundle)
+			assert.Equal(t, "member-operator-webhook", webhook.ClientConfig.Service.Name)
+			assert.Equal(t, a.Namespace, webhook.ClientConfig.Service.Namespace)
+			assert.Equal(t, tc.Path, *webhook.ClientConfig.Service.Path)
+			assert.Equal(t, int32(443), *webhook.ClientConfig.Service.Port)
+			require.Len(t, webhook.Rules, 1)
+
+			rule := webhook.Rules[0]
+			assert.Equal(t, tc.Rule.Operations, rule.Operations)
+			assert.Equal(t, tc.Rule.APIGroups, rule.APIGroups)
+			assert.Equal(t, tc.Rule.APIVersions, rule.APIVersions)
+			assert.Equal(t, tc.Rule.Resources, rule.Resources)
+			assert.Equal(t, admv1.NamespacedScope, *rule.Scope)
+		})
+	}
 }
 
 func (a *MemberAwaitility) verifyValidatingWebhookConfig(t *testing.T, ca []byte) {
@@ -2301,7 +2350,7 @@ func (a *MemberAwaitility) verifyValidatingWebhookConfig(t *testing.T, ca []byte
 	assert.Equal(t, []string{"v1"}, checlusterWebhook.AdmissionReviewVersions)
 	assert.Equal(t, admv1.SideEffectClassNone, *checlusterWebhook.SideEffects)
 	assert.Equal(t, int32(5), *checlusterWebhook.TimeoutSeconds)
-	assert.Equal(t, admv1.Ignore, *checlusterWebhook.FailurePolicy)
+	assert.Equal(t, admv1.Fail, *checlusterWebhook.FailurePolicy)
 	assert.Equal(t, admv1.Equivalent, *checlusterWebhook.MatchPolicy)
 	assert.Equal(t, codereadyToolchainProviderLabel, checlusterWebhook.NamespaceSelector.MatchLabels)
 	assert.Equal(t, ca, checlusterWebhook.ClientConfig.CABundle)