Repository: k3s-io/k3s
File: pkg/clientaccess/token_test.go (Go)

Code before:
func TestTrustedCA(t *testing.T) {
	assert := assert.New(t)
	server := newTLSServer(t, defaultUsername, defaultPassword)
	defer server.Close()

	testInfo := &Info{
		CACerts:  getServerCA(server),
		BaseURL:  server.URL,
		Username: defaultUsername,
		Password: defaultPassword,
		caHash:   hashCA(getServerCA(server)),
	}

	testCases := []struct {
		token    string
		expected string
	}{
		{defaultPassword, ""},
		{testInfo.String(), testInfo.Username},
	}

	// Point OS CA bundle at this test's CA cert to simulate a trusted CA cert.
	// Note that this only works if the OS CA bundle has not yet been loaded in this process,
	// as it is cached for the duration of the process lifetime.
	// Ref: https://github.com/golang/go/issues/41888
	path := t.TempDir() + "/ca.crt"
	writeServerCA(server, path)
	os.Setenv("SSL_CERT_FILE", path)

	for _, testCase := range testCases {
		info, err := ParseAndValidateToken(server.URL, testCase.token)
		if assert.NoError(err, testCase) {
			assert.Nil(info.CACerts, testCase)
			assert.Equal(testCase.expected, info.Username, testCase.token)
		}

		info, err = ParseAndValidateTokenForUser(server.URL, testCase.token, "agent")
		if assert.NoError(err, testCase) {
			assert.Nil(info.CACerts, testCase)
			assert.Equal("agent", info.Username, testCase)
		}
	}

	// Confirm that the cert is actually trusted by the OS CA bundle by making a request
	// with empty cert pool
	testInfo.CACerts = nil
	res, err := Get("/v1-k3s/server-bootstrap", testInfo)
	assert.NoError(err)
	assert.NotEmpty(res)

	os.Unsetenv("SSL_CERT_FILE")

Review comment (suggestion):
The `t.TempDir()` is available at go >= 1.15 https://golang.org/doc/go1.15#testing
To use `iotuil.TempDir` is more suitable https://golang.org/pkg/io/ioutil/#TempDir

Code after:
func TestTrustedCA(t *testing.T) {
	assert := assert.New(t)
	server := newTLSServer(t, defaultUsername, defaultPassword, false)
	defer server.Close()

	testInfo := &Info{
		CACerts:  getServerCA(server),
		BaseURL:  server.URL,
		Username: defaultUsername,
		Password: defaultPassword,
		caHash:   hashCA(getServerCA(server)),
	}

	testCases := []struct {
		token    string
		expected string
	}{
		{defaultPassword, ""},
		{testInfo.String(), testInfo.Username},
	}

	// Point OS CA bundle at this test's CA cert to simulate a trusted CA cert.
	// Note that this only works if the OS CA bundle has not yet been loaded in this process,
	// as it is cached for the duration of the process lifetime.
	// Ref: https://github.com/golang/go/issues/41888
	path := t.TempDir() + "/ca.crt"
	writeServerCA(server, path)
	os.Setenv("SSL_CERT_FILE", path)

	for _, testCase := range testCases {
		info, err := ParseAndValidateToken(server.URL, testCase.token)
		if assert.NoError(err, testCase) {
			assert.Nil(info.CACerts, testCase)
			assert.Equal(testCase.expected, info.Username, testCase.token)
		}

		info, err = ParseAndValidateTokenForUser(server.URL, testCase.token, "agent")
		if assert.NoError(err, testCase) {
			assert.Nil(info.CACerts, testCase)
			assert.Equal("agent", info.Username, testCase)
		}
	}

	// Confirm that the cert is actually trusted by the OS CA bundle by making a request
	// with empty cert pool
	testInfo.CACerts = nil
	res, err := Get("/v1-k3s/server-bootstrap", testInfo)
	assert.NoError(err)
	assert.NotEmpty(res)
}