Repository: doitintl/kube-no-trouble
Pull request #254 (2021-12-30 12:06:44)

Fix tests rules
This PR fixes non-working rules tests #252 and 2 other minor issues discovered once the tests started to work as expected:
- test: Fix review* fixture manifests to contain metadata
- fix: Resource name can be undefined in some cases


Patch:
diff --git a/fixtures/localsubjectaccessreview-v1beta1.yaml b/fixtures/localsubjectaccessreview-v1beta1.yaml
index b571daf..0fe4606 100644
--- a/fixtures/localsubjectaccessreview-v1beta1.yaml
+++ b/fixtures/localsubjectaccessreview-v1beta1.yaml
@@ -1,5 +1,6 @@
 apiVersion: authorization.k8s.io/v1beta1
 kind: LocalSubjectAccessReview
+metadata:
 spec:
   resourceAttributes:
     group: apps
diff --git a/fixtures/selfsubjectaccessreview-v1beta1.yaml b/fixtures/selfsubjectaccessreview-v1beta1.yaml
index 2889945..e490bb2 100644
--- a/fixtures/selfsubjectaccessreview-v1beta1.yaml
+++ b/fixtures/selfsubjectaccessreview-v1beta1.yaml
@@ -1,5 +1,6 @@
 apiVersion: authorization.k8s.io/v1beta1
 kind: SelfSubjectAccessReview
+metadata:
 spec:
   resourceAttributes:
     group: apps
diff --git a/fixtures/subjectaccessreview-v1beta1.yaml b/fixtures/subjectaccessreview-v1beta1.yaml
index ce0cbd5..d6672ea 100644
--- a/fixtures/subjectaccessreview-v1beta1.yaml
+++ b/fixtures/subjectaccessreview-v1beta1.yaml
@@ -1,5 +1,6 @@
 apiVersion: authorization.k8s.io/v1beta1
 kind: SubjectAccessReview
+metadata:
 spec:
   resourceAttributes:
     group: apps
diff --git a/fixtures/tokenreview-v1beta1.yaml b/fixtures/tokenreview-v1beta1.yaml
index 10fb3c9..453832b 100644
--- a/fixtures/tokenreview-v1beta1.yaml
+++ b/fixtures/tokenreview-v1beta1.yaml
@@ -1,5 +1,6 @@
 apiVersion: authentication.k8s.io/v1beta1
 kind: TokenReview
+metadata:
 spec:
   token: "014fbff9a07c..."
   audiences: ["https://myserver.example.com", "https://myserver.internal.example.com"]
diff --git a/pkg/rules/rego/deprecated-1-16.rego b/pkg/rules/rego/deprecated-1-16.rego
index 4cf5602..6927cbd 100644
--- a/pkg/rules/rego/deprecated-1-16.rego
+++ b/pkg/rules/rego/deprecated-1-16.rego
@@ -4,7 +4,7 @@ main[return] {
 	resource := input[_]
 	api := deprecated_resource(resource)
 	return := {
-		"Name": resource.metadata.name,
+		"Name": get_default(resource.metadata, "name", "<undefined>"),
 		# Namespace does not have to be defined in case of local manifests
 		"Namespace": get_default(resource.metadata, "namespace", "<undefined>"),
 		"Kind": resource.kind,
diff --git a/pkg/rules/rego/deprecated-1-22.rego b/pkg/rules/rego/deprecated-1-22.rego
index 7fe745b..09a786d 100644
--- a/pkg/rules/rego/deprecated-1-22.rego
+++ b/pkg/rules/rego/deprecated-1-22.rego
@@ -4,7 +4,7 @@ main[return] {
 	resource := input[_]
 	api := deprecated_resource(resource)
 	return := {
-		"Name": resource.metadata.name,
+		"Name": get_default(resource.metadata, "name", "<undefined>"),
 		# Namespace does not have to be defined in case of local manifests
 		"Namespace": get_default(resource.metadata, "namespace", "<undefined>"),
 		"Kind": resource.kind,
diff --git a/pkg/rules/rego/deprecated-1-25.rego b/pkg/rules/rego/deprecated-1-25.rego
index 88525c4..909902b 100644
--- a/pkg/rules/rego/deprecated-1-25.rego
+++ b/pkg/rules/rego/deprecated-1-25.rego
@@ -4,7 +4,7 @@ main[return] {
 	resource := input[_]
 	api := deprecated_resource(resource)
 	return := {
-		"Name": resource.metadata.name,
+		"Name": get_default(resource.metadata, "name", "<undefined>"),
 		# Namespace does not have to be defined in case of local manifests
 		"Namespace": get_default(resource.metadata, "namespace", "<undefined>"),
 		"Kind": resource.kind,


Test patch:
diff --git a/test/helper.go b/test/helper.go
index 1c93c69..5442db3 100644
--- a/test/helper.go
+++ b/test/helper.go
@@ -4,6 +4,10 @@ import (
 	"testing"
 
 	"github.com/doitintl/kube-no-trouble/pkg/collector"
+	"github.com/doitintl/kube-no-trouble/pkg/judge"
+	"github.com/doitintl/kube-no-trouble/pkg/rules"
+
+	"k8s.io/apimachinery/pkg/runtime/schema"
 )
 
 type resourceFixtureTestCase struct {
@@ -30,6 +34,25 @@ func testReourcesUsingFixtures(t *testing.T, testCases []resourceFixtureTestCase
 				t.Errorf("Expected to get %d, got %d", len(tc.expectedKinds), len(manifests))
 			}
 
+			loadedRules, err := rules.FetchRegoRules([]schema.GroupVersionKind{})
+			if err != nil {
+				t.Errorf("Failed to load rules")
+			}
+
+			judge, err := judge.NewRegoJudge(&judge.RegoOpts{}, loadedRules)
+			if err != nil {
+				t.Errorf("failed to create judge instance: %s", err)
+			}
+
+			results, err := judge.Eval(manifests)
+			if err != nil {
+				t.Errorf("failed to evaluate input: %s", err)
+			}
+
+			if len(results) != len(tc.expectedKinds) {
+				t.Errorf("expected %d findings, instead got: %d", len(tc.expectedKinds), len(results))
+			}
+
 			for i := range manifests {
 				if manifests[i]["kind"] != tc.expectedKinds[i] {
 					t.Errorf("Expected to get %s, instead got: %s", tc.expectedKinds[i], manifests[i]["kind"])