converge.yml

- name: Tests
  hosts: localhost
  connection: local
  collections:
  - kubernetes.core
  vars:
    custom_resource: "{{ lookup('template', cr_file_path) | from_yaml }}"
  tasks:
  - import_tasks: ../common/tasks.yml
  - import_tasks: ../asserts/pod_asserts.yml
  - import_tasks: ../common/wait_for_kiali_cr_changes.yml

  - name: The initial Kiali ConfigMap
    debug:
      msg: "{{ kiali_configmap }}"

  - name: Get Kiali OAuthClient if on OpenShift
    vars:
      instance_name: "{{ kiali.instance_name | default('kiali') }}"
    k8s_info:
      api_version: oauth.openshift.io/v1
      kind: OAuthClient
      label_selectors:
      - "app.kubernetes.io/instance={{ instance_name }}"
    register: kiali_oauth_client_raw
    when:
    - is_openshift == True

  - name: Test the OAuthClient does not have customized timeouts
    assert:
      that:
      - kiali_oauth_client_raw.resources[0].accessTokenInactivityTimeoutSeconds is not defined
      - kiali_oauth_client_raw.resources[0].accessTokenMaxAgeSeconds is not defined
    when:
    - is_openshift == True

  - name: Test the default deployment.resources is what we expect
    vars:
      kiali_pod_spec: "{{ kiali_pod.resources[0].spec }}"
    assert:
      that:
      - kiali_configmap.deployment.resources | length == 2
      - kiali_configmap.deployment.resources.requests.cpu == "10m"
      - kiali_configmap.deployment.resources.requests.memory == "64Mi"
      - kiali_configmap.deployment.resources.limits.memory == "1Gi"
      - kiali_pod_spec.containers[0].resources | length == 2
      - kiali_pod_spec.containers[0].resources.requests.cpu == "10m"
      - kiali_pod_spec.containers[0].resources.requests.memory == "64Mi"
      - kiali_pod_spec.containers[0].resources.limits.memory == "1Gi"

  - name: If we are configured with NodePort as service type, make sure its port is correct
    vars:
      http_port: "{{ kiali_service.resources[0].spec.ports | selectattr('name', 'match', '^(http|tcp)$') | first }}"
    assert:
      that:
      - http_port.nodePort == 32444
    when:
    - kiali_configmap.deployment.service_type == "NodePort"
  - name: If we are NOT configured with NodePort as service type, and NOT on KinD, make sure there is no nodePort in the service
    vars:
      http_port: "{{ kiali_service.resources[0].spec.ports | selectattr('name', 'match', '^(http|tcp)$') | first }}"
    assert:
      that:
      - http_port.nodePort is not defined
    when:
    - kiali_configmap.deployment.service_type != "NodePort"
    - is_kind == False

  # default auth strategy for both openshift or non-openshift (openshift or token) will always result in the kiali-viewer role
  - name: Get Kiali Role
    vars:
      instance_name: "{{ kiali.instance_name | default('kiali') }}"
    k8s_info:
      api_version: rbac.authorization.k8s.io/v1
      kind: Role
      namespace: "{{ kiali.install_namespace }}"
      name: "{{ instance_name + '-viewer' }}"
    register: kiali_role_raw

  - name: Make sure Kiali Role has access to pods/log
    assert:
      that:
      - kiali_role_raw.resources[0].rules | to_yaml is search('pods/log')

  - name: Test the default deployment.dns is what we expect
    vars:
      kiali_pod_spec: "{{ kiali_pod.resources[0].spec }}"
    assert:
      that:
      - kiali_configmap.deployment.dns | length == 2
      - kiali_configmap.deployment.dns.policy | length == 0
      - kiali_configmap.deployment.dns.config | length == 0
      - kiali_pod_spec.dnsPolicy == "ClusterFirst"
      - kiali_pod_spec.dnsConfig is not defined

  - name: Test the default extensions list is empty
    assert:
      that:
      - kiali_configmap.extensions | length == 0

  - name: Test the default configs for the probes
    vars:
      kiali_pod_container: "{{ kiali_pod.resources[0].spec.containers[0] }}"
    assert:
      that:
      - kiali_pod_container.livenessProbe.initialDelaySeconds == 5
      - kiali_pod_container.livenessProbe.periodSeconds == 30
      - kiali_pod_container.readinessProbe.initialDelaySeconds == 5
      - kiali_pod_container.readinessProbe.periodSeconds == 30
      - kiali_pod_container.startupProbe.failureThreshold == 6
      - kiali_pod_container.startupProbe.initialDelaySeconds == 30
      - kiali_pod_container.startupProbe.periodSeconds == 10

  # This test will change some config settings to make sure things work like we expect.
  # We will add additional tasks and asserts in the future to test other config changes.
  # We load in the current kiali CR and then alter it with new config and deploy that new CR.

  - set_fact:
      current_kiali_cr: "{{ lookup('kubernetes.core.k8s', api_version='kiali.io/v1alpha1', kind='Kiali', namespace=cr_namespace, resource_name=custom_resource.metadata.name) }}"

  - name: The current Kiali CR to be used as the base of the test
    debug:
      msg: "{{ current_kiali_cr }}"

  # Change the existing CR to get a new config

  - name: Set new deployment.version_label to something longer than k8s maximum of 63 chars
    vars:
      new_version_label: "aaaaaaaaaabbbbbbbbbbccccccccccddddddddddeeeeeeeeee12345678901234"
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'version_label': new_version_label }}}, recursive=True) }}"

  - name: Make sure health_config rates are defined
    vars:
      custom_health_config:
        rates:
        - namespace: "bookinfo"
          tolerance:
          - code: "404"
            failure: 10
            protocol: "http"
          - code: "[45]\\d[^\\D4]"
            protocol: "http"
        - namespace: ".*"
          tolerance:
          - code: "[4]\\d\\d"
            degraded: 30
            failure: 40
            protocol: "http"
          - code: "[5]\\d\\d"
            protocol: "http"
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'health_config': custom_health_config}}, recursive=True) }}"

  - name: Add host_aliases
    vars:
      custom_host_aliases:
      - ip: "192.168.1.111"
        hostnames:
        - "foo.local"
        - "bar.local"
      - ip: "192.168.1.222"
        hostnames:
        - "foo2.local"
        - "bar2.local"
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'host_aliases': custom_host_aliases}}}, recursive=True) }}"

  - name: Add custom_secrets
    vars:
      custom_secrets:
      - name: extra-secret-1
        mount: /extra-secret-1
        optional: true
      - name: extra-secret-2
        mount: /extra-secret-2
        optional: true
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'custom_secrets': custom_secrets}}}, recursive=True) }}"

  - name: Add custom_envs
    vars:
      custom_envs:
      - name: CUSTOM_ENV_VAR_ONE
        value: "true"
      - name: CUSTOM_ENV_VAR_2
        value: "12345"
      - name: CUSTOM_ENV_VAR_THREE
        value: "a: b// :123 *,X,Y,Z"
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'custom_envs': custom_envs}}}, recursive=True) }}"

  - name: Set deployment.resources to empty map which means we want to not define the pod resources at all
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'resources': {}}}}, recursive=True) }}"

  - name: Set a signing key of 16 characters length
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'login_token': {'signing_key': 'qazxsw0123456789'}}}, recursive=True) }}"

  - name: Add configmap annotation
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'configmap_annotations': {'aaa': 'bbb', 'camelCaseName': 'camelCaseValue'}}}}, recursive=True) }}"

  - name: Disable logs-tab feature
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'kiali_feature_flags': {'disabled_features': ['logs-tab'] }}}, recursive=True) }}"

  - name: Change security context - turn off readOnlyRootFilesystem
    vars:
      security_context:
        allowPrivilegeEscalation: false
        privileged: false
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        capabilities:
          drop:
          - ALL
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'security_context': security_context}}}, recursive=True) }}"

  - name: Add timeouts to the OpenShift OAuthClient
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'auth': {'openshift': {'token_inactivity_timeout': 9876, 'token_max_age': 8765}}}}, recursive=True) }}"

  - name: Change DNS config
    vars:
      dns_settings:
        policy: "Default"
        config:
          options:
          - name: "ndots"
            value: "1"
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'dns': dns_settings}}}, recursive=True) }}"

  - name: Add an extension
    vars:
      extensions:
      - name: "skupper"
        enabled: false
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'extensions': extensions}}, recursive=True) }}"

  - name: Customize probes
    vars:
      probes:
        liveness:
          initial_delay_seconds: 11
          period_seconds: 12
        readiness:
          initial_delay_seconds: 13
          period_seconds: 14
        startup:
          failure_threshold: 2
          initial_delay_seconds: 15
          period_seconds: 16
    set_fact:
      current_kiali_cr: "{{ current_kiali_cr | combine({'spec': {'deployment': {'probes': probes }}}, recursive=True) }}"

  - name: The new Kiali CR to be tested
    debug:
      msg: "{{ current_kiali_cr }}"

  # Deploy the new CR and wait for the CR change to take effect

  - import_tasks: ../common/set_kiali_cr.yml
    vars:
      new_kiali_cr: "{{ current_kiali_cr }}"
  - import_tasks: ../common/wait_for_kiali_cr_changes.yml
  - import_tasks: ../common/wait_for_kiali_running.yml
  - import_tasks: ../common/tasks.yml
  - import_tasks: ../asserts/pod_asserts.yml

  - name: The new Kiali ConfigMap
    debug:
      msg: "{{ kiali_configmap }}"

  # Assert the new config

  - name: Make sure version_label was truncated properly
    assert:
      that:
      - kiali_configmap.deployment.version_label == "aaaaaaaaaabbbbbbbbbbccccccccccddddddddddeeeeeeeeee1234567890XXX"
      - "{{ kiali_deployment.resources[0].metadata.labels.version | length == 63 }}"

  - name: Make sure the custom health config made it to the config map
    assert:
      that:
      - kiali_configmap.health_config.rates | length == 2
      - kiali_configmap.health_config.rates[0].namespace == "bookinfo"
      - kiali_configmap.health_config.rates[0].tolerance | length == 2
      - kiali_configmap.health_config.rates[0].tolerance[0].code == "404"
      - kiali_configmap.health_config.rates[0].tolerance[0].failure == 10
      - kiali_configmap.health_config.rates[0].tolerance[0].protocol == "http"
      - kiali_configmap.health_config.rates[0].tolerance[1].code == "[45]\\d[^\\D4]"
      - kiali_configmap.health_config.rates[0].tolerance[1].failure is not defined
      - kiali_configmap.health_config.rates[0].tolerance[1].protocol == "http"
      - kiali_configmap.health_config.rates[1].namespace == ".*"
      - kiali_configmap.health_config.rates[1].tolerance | length == 2
      - kiali_configmap.health_config.rates[1].tolerance[0].degraded == 30
      - kiali_configmap.health_config.rates[1].tolerance[1].code == "[5]\\d\\d"

  - name: Make sure the host aliases made it to the pod
    vars:
      kiali_pod_spec: "{{ kiali_pod.resources[0].spec }}"
    assert:
      that:
      - kiali_pod_spec.hostAliases | length == 2
      - kiali_pod_spec.hostAliases[0].ip == "192.168.1.111"
      - kiali_pod_spec.hostAliases[0].hostnames | length == 2
      - kiali_pod_spec.hostAliases[0].hostnames[0] == "foo.local"
      - kiali_pod_spec.hostAliases[0].hostnames[1] == "bar.local"
      - kiali_pod_spec.hostAliases[1].ip == "192.168.1.222"
      - kiali_pod_spec.hostAliases[1].hostnames | length == 2
      - kiali_pod_spec.hostAliases[1].hostnames[0] == "foo2.local"
      - kiali_pod_spec.hostAliases[1].hostnames[1] == "bar2.local"

  - name: Make sure the custom secrets made it to the pod
    vars:
      es1_volume_secretName_query: "volumes[?name=='extra-secret-1'].secret.secretName"
      es2_volume_secretName_query: "volumes[?name=='extra-secret-2'].secret.secretName"
      es1_volume_optional_query: "volumes[?name=='extra-secret-1'].secret.optional"
      es2_volume_optional_query: "volumes[?name=='extra-secret-2'].secret.optional"
      es1_mountPath_query: "containers[0].volumeMounts[?name=='extra-secret-1'].mountPath"
      es2_mountPath_query: "containers[0].volumeMounts[?name=='extra-secret-2'].mountPath"
    assert:
      that:
      - kiali_pod.resources[0].spec | json_query(es1_volume_secretName_query) | join == 'extra-secret-1'
      - kiali_pod.resources[0].spec | json_query(es2_volume_secretName_query) | join == 'extra-secret-2'
      - kiali_pod.resources[0].spec | json_query(es1_volume_optional_query) | join
      - kiali_pod.resources[0].spec | json_query(es2_volume_optional_query) | join
      - kiali_pod.resources[0].spec | json_query(es1_mountPath_query) | join == '/extra-secret-1'
      - kiali_pod.resources[0].spec | json_query(es2_mountPath_query) | join == '/extra-secret-2'

  - name: Test the default deployment.resources is now empty
    vars:
      kiali_pod_spec: "{{ kiali_pod.resources[0].spec }}"
    assert:
      that:
      - kiali_configmap.deployment.resources | length == 0
      - kiali_pod_spec.containers[0].resources | length == 0

  - name: Test the signing key is set
    assert:
      that:
      - kiali_configmap.login_token.signing_key == 'qazxsw0123456789'

  - name: Make sure the configmap annotations made it to the configmap
    assert:
      that:
      - kiali_configmap_resource.metadata.annotations.aaa == 'bbb'
      - kiali_configmap_resource.metadata.annotations.camelCaseName == 'camelCaseValue'
      fail_msg: "Missing configmap annotations: {{ kiali_configmap_resource }}"

  - name: Get Kiali Role
    vars:
      instance_name: "{{ kiali.instance_name | default('kiali') }}"
    k8s_info:
      api_version: rbac.authorization.k8s.io/v1
      kind: Role
      namespace: "{{ kiali.install_namespace }}"
      label_selectors:
      - "app.kubernetes.io/instance={{ instance_name }}"
    register: kiali_role_raw

  - name: Make sure Kiali Role has disabled access to pods/log
    assert:
      that:
      - kiali_role_raw.resources[0].rules | to_yaml is not search('pods/log')

  - name: Make sure the security context was overridden and as expected
    vars:
      kiali_pod_spec: "{{ kiali_pod.resources[0].spec }}"
    assert:
      that:
      - kiali_pod_spec.containers[0].securityContext.readOnlyRootFilesystem == false
      - kiali_pod_spec.containers[0].securityContext.allowPrivilegeEscalation == false
      - kiali_pod_spec.containers[0].securityContext.privileged == false
      - kiali_pod_spec.containers[0].securityContext.runAsNonRoot == true
      - kiali_pod_spec.containers[0].securityContext.capabilities.drop | length > 0

  - name: Get the new Kiali OAuthClient if on OpenShift
    vars:
      instance_name: "{{ kiali.instance_name | default('kiali') }}"
    k8s_info:
      api_version: oauth.openshift.io/v1
      kind: OAuthClient
      label_selectors:
      - "app.kubernetes.io/instance={{ instance_name }}"
    register: kiali_oauth_client_raw
    when:
    - is_openshift == True

  - name: Test the OAuthClient now has the new customized timeouts
    assert:
      that:
      - kiali_oauth_client_raw.resources[0].accessTokenInactivityTimeoutSeconds == 9876
      - kiali_oauth_client_raw.resources[0].accessTokenMaxAgeSeconds == 8765
    when:
    - is_openshift == True

  - name: Test the deployment.dns settings
    vars:
      kiali_pod_spec: "{{ kiali_pod.resources[0].spec }}"
    assert:
      that:
      - kiali_configmap.deployment.dns | length == 2
      - kiali_configmap.deployment.dns.policy == "Default"
      - kiali_configmap.deployment.dns.config.options[0].name == "ndots"
      - kiali_configmap.deployment.dns.config.options[0].value == "1"
      - kiali_pod_spec.dnsPolicy == "Default"
      - kiali_pod_spec.dnsConfig.options[0].name == "ndots"
      - kiali_pod_spec.dnsConfig.options[0].value == "1"

  - name: Test the extensions settings
    assert:
      that:
      - kiali_configmap.extensions | length == 1
      - kiali_configmap.extensions[0].name == "skupper"
      - kiali_configmap.extensions[0].enabled == False

  - name: Test the custom configs for the probes
    vars:
      kiali_pod_container: "{{ kiali_pod.resources[0].spec.containers[0] }}"
    assert:
      that:
      - kiali_pod_container.livenessProbe.initialDelaySeconds == 11
      - kiali_pod_container.livenessProbe.periodSeconds == 12
      - kiali_pod_container.readinessProbe.initialDelaySeconds == 13
      - kiali_pod_container.readinessProbe.periodSeconds == 14
      - kiali_pod_container.startupProbe.failureThreshold == 2
      - kiali_pod_container.startupProbe.initialDelaySeconds == 15
      - kiali_pod_container.startupProbe.periodSeconds == 16

  - name: Test custom_envs
    vars:
      kiali_pod_envs: "{{ kiali_pod.resources[0].spec.containers[0].env }}"
    assert:
      that:
      - kiali_pod_envs | selectattr('name', 'equalto', 'CUSTOM_ENV_VAR_ONE') | selectattr('value', 'equalto', 'true') | list | length > 0
      - kiali_pod_envs | selectattr('name', 'equalto', 'CUSTOM_ENV_VAR_2') | selectattr('value', 'equalto', '12345') | list | length > 0
      - "'a: b// :123 *,X,Y,Z' in kiali_pod_envs | selectattr('name', 'equalto', 'CUSTOM_ENV_VAR_THREE') | map(attribute='value') | list"