test-pod.yaml

# MIT License
#
# Copyright (c) 2023 Matheus Pimenta
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

# This file is not only a core part of our test automation in this project,
# but also an example of how to configure Pods in a cluster where the emulator
# is deployed. Use this as reference for how to configure your production Pods.

# ServiceAccount configuration is the exact same of Workload Identity in GKE.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test
  namespace: default
  annotations:
    # This annotation is how Workload Identity is configured in GKE.
    # This project also uses this annotation to know which Google Service Account to impersonate.
    iam.gke.io/gcp-service-account: test-sa@gke-metadata-server.iam.gserviceaccount.com
---
apiVersion: v1
kind: Pod
metadata:
  name: test
  namespace: default
  labels:
    # This label is used by the MutatingWebhookConfiguration to select which Pods to mutate.
    # The mutation injects metadata.google.internal->169.254.169.254 to .spec.hostAliases and
    # an initContainer that creates iptables rules to redirect outbound traffic targeting
    # metadata.google.internal to the emulator.
    gke-metadata-server.matheuscscp.io/webhook: Mutate
spec:
  serviceAccountName: test
  restartPolicy: Never

  # This container demonstrates that automatic authentication using Google libraries works.
  # The tests running here perform authentication by simply communicating with the well-known
  # GCE/GKE Metadata APIs backed by the emulator, which are installed by an init container
  # added by the mutation mentioned above. The custom APIs of the emulator are also tested.
  containers:
  - name: test
    image: ghcr.io/matheuscscp/gke-metadata-server/test@<GO_TEST_DIGEST>
    env:
    - name: TEST_ID
      value: <TEST_ID>

  # This container demonstrates vanilla "Workload Identity Federation with Kubernetes".
  # The custom API of the emulator shown below returns a (non-secret) JSON with a
  # Google credential configuration, containing the full name of the Workload Identity
  # Provider resource. The "gcloud auth login" command below configures the Pod with
  # the credentials that can be acquired by the parameters described inside this JSON
  # file. After performing login the container uses this authentication to make calls
  # to the GCS API via the gsutil binary from the Google CloudSDK image below. The
  # choice of gsutil here has meaning: gsutil does not work seamlessly with GKE's
  # native implementation of Workload Identity ("gcloud storage" does). This test
  # demonstrates how our Google Credential Configuration API allows gsutil to work
  # with Workload Identity. gsutil should not be used, though. Use "gcloud storage"
  # instead.
  - name: test-gcloud
    image: google/cloud-sdk:457.0.0-slim
    command: [/bin/bash]
    args:
    - -c
    - |
      set -ex

      METADATA_ENDPOINT="http://metadata.google.internal"
      CRED_CONFIG_API="/gkeMetadataEmulator/v1/pod/service-account/google-cred-config"
      curl -H "Metadata-Flavor: Emulator" "${METADATA_ENDPOINT}${CRED_CONFIG_API}?pretty" > creds.json
      cat creds.json
      gcloud auth login --cred-file=creds.json

      # upload a random object to gcs
      BUCKET="gke-metadata-server-test"
      while :; do
        key=$(openssl rand -hex 16)
        value=$(openssl rand -hex 16)
        echo -n $value > ./localfile.txt
        output=$(gsutil cp -n ./localfile.txt gs://${BUCKET}/${key} 2>&1)
        if [[ $output == *"Skipping existing item:"* ]]; then
          continue
        else
          break
        fi
      done

      # check if upload was successful
      if [ "$(gsutil cat gs://${BUCKET}/${key})" != "$value" ]; then
        echo "Error: Retrieved value does not match the expected value."
        gsutil rm gs://${BUCKET}/${key}
        exit 1
      fi
      echo "Retrieved value matches the expected value. Success!"
      gsutil rm gs://${BUCKET}/${key}