@@ -58,12 +58,18 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
5858 new configv1.TLSProfileSpec
5959 }
6060
61+ type adherencePolicyChange struct {
62+ old configv1.TLSAdherencePolicy
63+ new configv1.TLSAdherencePolicy
64+ }
65+
6166 var (
62- mgrCancel context.CancelFunc
63- mgrDone chan struct {}
64- mgr manager.Manager
65- apiServer * configv1.APIServer
66- profileChanges * atomicSlice [profileChange ]
67+ mgrCancel context.CancelFunc
68+ mgrDone chan struct {}
69+ mgr manager.Manager
70+ apiServer * configv1.APIServer
71+ profileChanges * atomicSlice [profileChange ]
72+ adherencePolicyChanges * atomicSlice [adherencePolicyChange ]
6773 )
6874
6975 BeforeEach (func () {
@@ -88,6 +94,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
8894
8995 // Reset callback tracking.
9096 profileChanges = & atomicSlice [profileChange ]{}
97+ adherencePolicyChanges = & atomicSlice [adherencePolicyChange ]{}
9198 })
9299
93100 AfterEach (func () {
@@ -101,18 +108,22 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
101108 Expect (k8sClient .Delete (ctx , apiServer )).To (Succeed ())
102109 })
103110
104- startManager := func (initialProfile configv1.TLSProfileSpec ) {
111+ startManager := func (initialProfile configv1.TLSProfileSpec , initialAdherencePolicy configv1. TLSAdherencePolicy ) {
105112 var mgrCtx context.Context
106113 mgrCtx , mgrCancel = context .WithCancel (ctx )
107114 mgrDone = make (chan struct {})
108115
109116 // Set up the TLS security profile watcher controller.
110117 watcher := & SecurityProfileWatcher {
111- Client : mgr .GetClient (),
112- InitialTLSProfileSpec : initialProfile ,
118+ Client : mgr .GetClient (),
119+ InitialTLSProfileSpec : initialProfile ,
120+ InitialTLSAdherencePolicy : initialAdherencePolicy ,
113121 OnProfileChange : func (_ context.Context , oldSpec , newSpec configv1.TLSProfileSpec ) {
114122 profileChanges .Append (profileChange {old : oldSpec , new : newSpec })
115123 },
124+ OnAdherencePolicyChange : func (_ context.Context , oldPolicy , newPolicy configv1.TLSAdherencePolicy ) {
125+ adherencePolicyChanges .Append (adherencePolicyChange {old : oldPolicy , new : newPolicy })
126+ },
116127 }
117128 Expect (watcher .SetupWithManager (mgr )).To (Succeed ())
118129
@@ -135,7 +146,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
135146 // Start with the intermediate profile (same as what's configured).
136147 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
137148 Expect (err ).NotTo (HaveOccurred ())
138- startManager (initialProfile )
149+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
139150
140151 // Wait a bit and verify callback was not invoked.
141152 Consistently (profileChanges .Len ).Should (Equal (0 ), "callback should not be invoked" )
@@ -145,7 +156,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
145156 // Start with the intermediate profile.
146157 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
147158 Expect (err ).NotTo (HaveOccurred ())
148- startManager (initialProfile )
159+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
149160
150161 // Get the intermediate profile spec to replicate it exactly.
151162 intermediateSpec := * configv1 .TLSProfiles [configv1 .TLSProfileIntermediateType ]
@@ -179,7 +190,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
179190 // Start with the custom profile.
180191 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
181192 Expect (err ).NotTo (HaveOccurred ())
182- startManager (initialProfile )
193+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
183194
184195 // Switch to the intermediate profile (which has identical settings).
185196 apiServer .Spec .TLSSecurityProfile = & configv1.TLSSecurityProfile {
@@ -197,7 +208,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
197208 // Start with the intermediate profile.
198209 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
199210 Expect (err ).NotTo (HaveOccurred ())
200- startManager (initialProfile )
211+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
201212
202213 // Update the APIServer to use the Modern profile (which has TLS 1.3).
203214 apiServer .Spec .TLSSecurityProfile = & configv1.TLSSecurityProfile {
@@ -220,7 +231,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
220231 // Start with the intermediate profile.
221232 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
222233 Expect (err ).NotTo (HaveOccurred ())
223- startManager (initialProfile )
234+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
224235
225236 // Define the custom profile we'll switch to.
226237 customSpec := configv1.TLSProfileSpec {
@@ -262,7 +273,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
262273 // Start with the custom profile.
263274 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
264275 Expect (err ).NotTo (HaveOccurred ())
265- startManager (initialProfile )
276+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
266277
267278 // Switch back to the intermediate profile.
268279 apiServer .Spec .TLSSecurityProfile = & configv1.TLSSecurityProfile {
@@ -278,7 +289,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
278289 // Start with the intermediate profile (profile A).
279290 initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
280291 Expect (err ).NotTo (HaveOccurred ())
281- startManager (initialProfile )
292+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
282293
283294 // Change from A (Intermediate) to B (Modern).
284295 apiServer .Spec .TLSSecurityProfile = & configv1.TLSSecurityProfile {
@@ -325,7 +336,7 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
325336 // Start with the default (nil -> intermediate) profile.
326337 initialProfile , err := GetTLSProfileSpec (nil )
327338 Expect (err ).NotTo (HaveOccurred ())
328- startManager (initialProfile )
339+ startManager (initialProfile , apiServer . Spec . TLSAdherence )
329340
330341 // Update the APIServer to use the Modern profile.
331342 apiServer .Spec .TLSSecurityProfile = & configv1.TLSSecurityProfile {
@@ -337,4 +348,25 @@ var _ = Describe("SecurityProfileWatcher controller", func() {
337348 Eventually (profileChanges .Len ).Should (Equal (1 ), "callback should be invoked once" )
338349 })
339350 })
351+
352+ Context ("when the TLS adherence policy changes" , func () {
353+ It ("should invoke the callback when policy changes" , func () {
354+ // Start with the intermediate profile.
355+ initialProfile , err := GetTLSProfileSpec (apiServer .Spec .TLSSecurityProfile )
356+ Expect (err ).NotTo (HaveOccurred ())
357+ startManager (initialProfile , apiServer .Spec .TLSAdherence )
358+
359+ // Update the APIServer to use a different adherence policy.
360+ apiServer .Spec .TLSAdherence = configv1 .TLSAdherencePolicyStrictAllComponents
361+ Expect (k8sClient .Update (ctx , apiServer )).To (Succeed ())
362+
363+ // Verify callback was invoked.
364+ Eventually (adherencePolicyChanges .Len ).Should (Equal (1 ), "callback should be invoked once" )
365+
366+ // Verify the callback received the correct policies.
367+ change := adherencePolicyChanges .Index (0 )
368+ Expect (change .old ).To (Equal (configv1 .TLSAdherencePolicyNoOpinion ), "callback should receive the initial policy as old" )
369+ Expect (change .new ).To (Equal (configv1 .TLSAdherencePolicyStrictAllComponents ), "callback should receive the current policy as new" )
370+ })
371+ })
340372})
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments