Merge pull request #43 from gruntwork-io/yori-address-create-resources

yorinasub17 · web-flow · commit 720588a3c16e · 2019-10-21T11:23:33.000-07:00
Add test for checking create_resources does not actually create any resources
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -8,7 +8,7 @@ defaults: &defaults
     KUBERGRUNT_VERSION: v0.5.1
     HELM_VERSION: v2.12.2
     MODULE_CI_VERSION: v0.14.1
-    TERRAFORM_VERSION: 0.12.9
+    TERRAFORM_VERSION: 0.12.11
     TERRAGRUNT_VERSION: NONE
     PACKER_VERSION: NONE
     GOLANG_VERSION: 1.11.2
diff --git a/examples/k8s-namespace-with-service-account/main.tf b/examples/k8s-namespace-with-service-account/main.tf
@@ -28,7 +28,8 @@ module "namespace" {
   # source = "git::https://github.com/gruntwork-io/terraform-kubernetes-helm.git//modules/k8s-namespace?ref=v0.0.1"
   source = "../../modules/k8s-namespace"
 
-  name = var.name
+  create_resources = var.create_resources
+  name             = var.name
 }
 
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -41,9 +42,10 @@ module "service_account_access_all" {
   # source = "git::https://github.com/gruntwork-io/terraform-kubernetes-helm.git//modules/k8s-service-account?ref=v0.0.1"
   source = "../../modules/k8s-service-account"
 
-  name           = "${var.name}-admin"
-  namespace      = module.namespace.name
-  num_rbac_roles = 1
+  create_resources = var.create_resources
+  name             = "${var.name}-admin"
+  namespace        = module.namespace.name
+  num_rbac_roles   = 1
 
   rbac_roles = [
     {
@@ -64,9 +66,10 @@ module "service_account_access_read_only" {
   # source = "git::https://github.com/gruntwork-io/terraform-kubernetes-helm.git//modules/k8s-service-account?ref=v0.0.1"
   source = "../../modules/k8s-service-account"
 
-  name           = "${var.name}-read-only"
-  namespace      = module.namespace.name
-  num_rbac_roles = 1
+  create_resources = var.create_resources
+  name             = "${var.name}-read-only"
+  namespace        = module.namespace.name
+  num_rbac_roles   = 1
 
   rbac_roles = [
     {
diff --git a/examples/k8s-namespace-with-service-account/variables.tf b/examples/k8s-namespace-with-service-account/variables.tf
@@ -19,3 +19,14 @@ variable "kubectl_config_path" {
   type        = string
   default     = "~/.kube/config"
 }
+
+# ---------------------------------------------------------------------------------------------------------------------
+# TEST PARAMETERS
+# These variables are only used for testing purposes and should not be touched in normal operations.
+# ---------------------------------------------------------------------------------------------------------------------
+
+variable "create_resources" {
+  description = "Set to false to have this module skip creating resources."
+  type        = bool
+  default     = true
+}
diff --git a/modules/k8s-namespace-roles/variables.tf b/modules/k8s-namespace-roles/variables.tf
@@ -26,7 +26,7 @@ variable "annotations" {
 }
 
 variable "create_resources" {
-  description = "Set to false to have this module create no resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace roles should be created or not."
+  description = "Set to false to have this module skip creating resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace roles should be created or not."
   type        = bool
   default     = true
 }
diff --git a/modules/k8s-namespace/main.tf b/modules/k8s-namespace/main.tf
@@ -49,7 +49,7 @@ resource "kubernetes_namespace" "namespace" {
 module "namespace_roles" {
   source = "../k8s-namespace-roles"
 
-  namespace   = kubernetes_namespace.namespace[0].id
+  namespace   = var.create_resources ? kubernetes_namespace.namespace[0].id : ""
   labels      = var.labels
   annotations = var.annotations
 
diff --git a/modules/k8s-namespace/variables.tf b/modules/k8s-namespace/variables.tf
@@ -26,7 +26,7 @@ variable "annotations" {
 }
 
 variable "create_resources" {
-  description = "Set to false to have this module create no resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace should be created or not."
+  description = "Set to false to have this module skip creating resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace should be created or not."
   type        = bool
   default     = true
 }
diff --git a/modules/k8s-service-account/main.tf b/modules/k8s-service-account/main.tf
@@ -31,6 +31,8 @@ resource "null_resource" "dependency_getter" {
 # ---------------------------------------------------------------------------------------------------------------------
 
 resource "kubernetes_service_account" "service_account" {
+  count = var.create_resources ? 1 : 0
+
   metadata {
     name        = var.name
     namespace   = var.namespace
@@ -62,7 +64,7 @@ resource "kubernetes_service_account" "service_account" {
 # ---------------------------------------------------------------------------------------------------------------------
 
 resource "kubernetes_role_binding" "service_account_role_binding" {
-  count = var.num_rbac_roles
+  count = var.create_resources ? var.num_rbac_roles : 0
 
   metadata {
     name        = "${var.name}-${var.rbac_roles[count.index]["name"]}-role-binding"
@@ -80,7 +82,7 @@ resource "kubernetes_role_binding" "service_account_role_binding" {
   subject {
     api_group = ""
     kind      = "ServiceAccount"
-    name      = kubernetes_service_account.service_account.metadata[0].name
+    name      = kubernetes_service_account.service_account[0].metadata[0].name
     namespace = var.namespace
   }
 
diff --git a/modules/k8s-service-account/outputs.tf b/modules/k8s-service-account/outputs.tf
@@ -1,13 +1,13 @@
 output "name" {
   description = "The name of the created service account"
-  value       = kubernetes_service_account.service_account.metadata[0].name
+  value       = var.create_resources ? kubernetes_service_account.service_account[0].metadata[0].name : ""
 
   depends_on = [kubernetes_role_binding.service_account_role_binding]
 }
 
 output "token_secret_name" {
   description = "The name of the secret that holds the default ServiceAccount token that can be used to authenticate to the Kubernetes API."
-  value       = kubernetes_service_account.service_account.default_secret_name
+  value       = var.create_resources ? kubernetes_service_account.service_account[0].default_secret_name : ""
 
   depends_on = [kubernetes_role_binding.service_account_role_binding]
 }
diff --git a/modules/k8s-service-account/variables.tf b/modules/k8s-service-account/variables.tf
@@ -68,6 +68,12 @@ variable "secrets_for_pods" {
   default     = []
 }
 
+variable "create_resources" {
+  description = "Set to false to have this module skip creating resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace should be created or not."
+  type        = bool
+  default     = true
+}
+
 # ---------------------------------------------------------------------------------------------------------------------
 # MODULE DEPENDENCIES
 # Workaround Terraform limitation where there is no module depends_on.
diff --git a/test/Gopkg.lock b/test/Gopkg.lock
diff --git a/test/Gopkg.toml b/test/Gopkg.toml
@@ -27,7 +27,7 @@
 
 [[constraint]]
   name = "github.com/gruntwork-io/terratest"
-  version = "0.16.0"
+  version = "0.20.1"
 
 [prune]
   go-tests = true
diff --git a/test/k8s_namespace_with_service_account_test.go b/test/k8s_namespace_with_service_account_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/gruntwork-io/terratest/modules/logger"
 	"github.com/gruntwork-io/terratest/modules/random"
 	"github.com/gruntwork-io/terratest/modules/terraform"
-	"github.com/gruntwork-io/terratest/modules/test-structure"
+	test_structure "github.com/gruntwork-io/terratest/modules/test-structure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	authv1 "k8s.io/api/authorization/v1"
@@ -25,6 +25,53 @@ type TemplateArgs struct {
 	ServiceAccountName string
 }
 
+func TestK8SNamespaceWithServiceAccountNoCreate(t *testing.T) {
+	t.Parallel()
+
+	// Uncomment any of the following to skip that section during the test
+	// os.Setenv("SKIP_foo", "true") // This stage doesn't exist, but is useful in ensuring the test directory isn't copied
+	// os.Setenv("SKIP_create_test_copy_of_examples", "true")
+	// os.Setenv("SKIP_create_terratest_options", "true")
+	// os.Setenv("SKIP_terraform_apply", "true")
+	// os.Setenv("SKIP_validate", "true")
+	// os.Setenv("SKIP_cleanup", "true")
+
+	// Create a directory path that won't conflict
+	workingDir := filepath.Join(".", "stages", t.Name())
+
+	test_structure.RunTestStage(t, "create_test_copy_of_examples", func() {
+		testFolder := test_structure.CopyTerraformFolderToTemp(t, "..", "examples")
+		logger.Logf(t, "path to test folder %s\n", testFolder)
+		k8sNamespaceTerraformModulePath := filepath.Join(testFolder, "k8s-namespace-with-service-account")
+		test_structure.SaveString(t, workingDir, "k8sNamespaceTerraformModulePath", k8sNamespaceTerraformModulePath)
+	})
+
+	test_structure.RunTestStage(t, "create_terratest_options", func() {
+		k8sNamespaceTerraformModulePath := test_structure.LoadString(t, workingDir, "k8sNamespaceTerraformModulePath")
+		uniqueID := random.UniqueId()
+		k8sNamespaceTerratestOptions := createExampleK8SNamespaceTerraformOptions(
+			t, uniqueID, k8sNamespaceTerraformModulePath)
+		k8sNamespaceTerratestOptions.Vars["create_resources"] = 0
+		test_structure.SaveString(t, workingDir, "uniqueID", uniqueID)
+		test_structure.SaveTerraformOptions(t, workingDir, k8sNamespaceTerratestOptions)
+	})
+
+	defer test_structure.RunTestStage(t, "cleanup", func() {
+		k8sNamespaceTerratestOptions := test_structure.LoadTerraformOptions(t, workingDir)
+		terraform.Destroy(t, k8sNamespaceTerratestOptions)
+	})
+
+	test_structure.RunTestStage(t, "terraform_apply", func() {
+		k8sNamespaceTerratestOptions := test_structure.LoadTerraformOptions(t, workingDir)
+		counts := terraform.GetResourceCount(t, terraform.InitAndPlan(t, k8sNamespaceTerratestOptions))
+		assert.Equal(t, 0, counts.Change)
+		assert.Equal(t, 0, counts.Destroy)
+		// IMPORTANT NOTE: we don't expect any resources to create, but because of how the dependencies system works, we
+		// expect to see 4 resources created: the 4 null_resources that act as a dependency getter.
+		assert.Equal(t, 4, counts.Add)
+	})
+}
+
 func TestK8SNamespaceWithServiceAccount(t *testing.T) {
 	t.Parallel()
 
@@ -88,15 +135,15 @@ func TestK8SNamespaceWithServiceAccount(t *testing.T) {
 // validateNamespace verifies that the namespace was created and is active.
 func validateNamespace(t *testing.T, k8sNamespaceTerratestOptions *terraform.Options) {
 	namespace := terraform.Output(t, k8sNamespaceTerratestOptions, "name")
-	kubectlOptions := k8s.NewKubectlOptions("", "")
+	kubectlOptions := k8s.NewKubectlOptions("", "", "")
 	k8sNamespace := k8s.GetNamespace(t, kubectlOptions, namespace)
 	assert.Equal(t, k8sNamespace.Name, namespace)
 	assert.Equal(t, k8sNamespace.Status.Phase, corev1.NamespaceActive)
 }
 
 // validateRbacAccessAll verifies that the access all RBAC role has read and write privileges to the namespace
 func validateRbacAccessAll(t *testing.T, k8sNamespaceTerratestOptions *terraform.Options) {
-	kubectlOptions := k8s.NewKubectlOptions("", "")
+	kubectlOptions := k8s.NewKubectlOptions("", "", "")
 	namespace := terraform.Output(t, k8sNamespaceTerratestOptions, "name")
 	serviceAccountName := terraform.Output(t, k8sNamespaceTerratestOptions, "service_account_access_all")
 	templateArgs := TemplateArgs{
@@ -128,7 +175,7 @@ func validateRbacAccessAll(t *testing.T, k8sNamespaceTerratestOptions *terraform
 
 // validateRbacAccessReadOnly verifies that the access read only RBAC role has read only privileges to the namespace
 func validateRbacAccessReadOnly(t *testing.T, k8sNamespaceTerratestOptions *terraform.Options) {
-	kubectlOptions := k8s.NewKubectlOptions("", "")
+	kubectlOptions := k8s.NewKubectlOptions("", "", "")
 	namespace := terraform.Output(t, k8sNamespaceTerratestOptions, "name")
 	serviceAccountName := terraform.Output(t, k8sNamespaceTerratestOptions, "service_account_access_read_only")
 	templateArgs := TemplateArgs{
@@ -181,8 +228,7 @@ func checkAccessForServiceAccount(
 	// Wait for up to 5 minutes for pod to start (60 tries, 5 seconds inbetween each trial)
 	// We explicitly set the namespace to default here, because the Kubernetes API requires an explicit namespace when
 	// looking up pods by name.
-	namespacedKubectlOptions := k8s.NewKubectlOptions("", "")
-	namespacedKubectlOptions.Namespace = namespace
+	namespacedKubectlOptions := k8s.NewKubectlOptions("", "", namespace)
 	k8s.WaitUntilPodAvailable(t, namespacedKubectlOptions, curlPodName, 60, 5*time.Second)
 
 	// Run the check function while the curl pod is up
diff --git a/test/k8s_tiller_kubergrunt_test.go b/test/k8s_tiller_kubergrunt_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/gruntwork-io/terratest/modules/random"
 	"github.com/gruntwork-io/terratest/modules/shell"
 	"github.com/gruntwork-io/terratest/modules/terraform"
-	"github.com/gruntwork-io/terratest/modules/test-structure"
+	test_structure "github.com/gruntwork-io/terratest/modules/test-structure"
 	"github.com/stretchr/testify/require"
 )
 
@@ -48,7 +48,7 @@ func TestK8STillerKubergrunt(t *testing.T) {
 		testServiceAccountName := fmt.Sprintf("%s-test-account", strings.ToLower(uniqueID))
 		testServiceAccountNamespace := fmt.Sprintf("%s-test-account-namespace", strings.ToLower(uniqueID))
 		tmpConfigPath := k8s.CopyHomeKubeConfigToTemp(t)
-		kubectlOptions := k8s.NewKubectlOptions("", tmpConfigPath)
+		kubectlOptions := k8s.NewKubectlOptions("", tmpConfigPath, "")
 
 		k8s.CreateNamespace(t, kubectlOptions, testServiceAccountNamespace)
 		kubectlOptions.Namespace = testServiceAccountNamespace
@@ -84,7 +84,7 @@ func TestK8STillerKubergrunt(t *testing.T) {
 		terraform.Destroy(t, k8sTillerTerratestOptions)
 
 		testServiceAccountNamespace := test_structure.LoadString(t, workingDir, "testServiceAccountNamespace")
-		kubectlOptions := k8s.NewKubectlOptions("", "")
+		kubectlOptions := k8s.NewKubectlOptions("", "", "")
 		k8s.DeleteNamespace(t, kubectlOptions, testServiceAccountNamespace)
 	})
 
@@ -99,8 +99,7 @@ func TestK8STillerKubergrunt(t *testing.T) {
 		resourceNamespace := k8sTillerTerratestOptions.Vars["resource_namespace"].(string)
 		tmpConfigPath := test_structure.LoadString(t, workingDir, "tmpKubectlConfigPath")
 		testServiceAccountName := test_structure.LoadString(t, workingDir, "testServiceAccountName")
-		kubectlOptions := k8s.NewKubectlOptions(testServiceAccountName, tmpConfigPath)
-		kubectlOptions.Namespace = resourceNamespace
+		kubectlOptions := k8s.NewKubectlOptions(testServiceAccountName, tmpConfigPath, resourceNamespace)
 
 		runHelm(
 			t,
@@ -116,7 +115,7 @@ func TestK8STillerKubergrunt(t *testing.T) {
 		// Make sure the upgrade command mentioned in the docs actually works
 		helmHome := test_structure.LoadString(t, workingDir, "helmHome")
 		tmpConfigPath := test_structure.LoadString(t, workingDir, "tmpKubectlConfigPath")
-		kubectlOptions := k8s.NewKubectlOptions("", tmpConfigPath)
+		kubectlOptions := k8s.NewKubectlOptions("", tmpConfigPath, "")
 
 		runHelm(
 			t,
diff --git a/test/k8s_tiller_test.go b/test/k8s_tiller_test.go

Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ variable "annotations" {`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`variable "create_resources" {`
`29`		`- description = "Set to false to have this module create no resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace roles should be created or not."`
	`29`	`+ description = "Set to false to have this module skip creating resources. This weird parameter exists solely because Terraform does not support conditional modules. Therefore, this is a hack to allow you to conditionally decide if the Namespace roles should be created or not."`
`30`	`30`	`type = bool`
`31`	`31`	`default = true`
`32`	`32`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,13 +1,13 @@`
`1`	`1`	`output "name" {`
`2`	`2`	`description = "The name of the created service account"`
`3`		`- value = kubernetes_service_account.service_account.metadata[0].name`
	`3`	`+ value = var.create_resources ? kubernetes_service_account.service_account[0].metadata[0].name : ""`
`4`	`4`
`5`	`5`	`depends_on = [kubernetes_role_binding.service_account_role_binding]`
`6`	`6`	`}`
`7`	`7`
`8`	`8`	`output "token_secret_name" {`
`9`	`9`	`description = "The name of the secret that holds the default ServiceAccount token that can be used to authenticate to the Kubernetes API."`
`10`		`- value = kubernetes_service_account.service_account.default_secret_name`
	`10`	`+ value = var.create_resources ? kubernetes_service_account.service_account[0].default_secret_name : ""`
`11`	`11`
`12`	`12`	`depends_on = [kubernetes_role_binding.service_account_role_binding]`
`13`	`13`	`}`