test: Add missing tests for SSABasedGenericKubernetesResourceMatcher

Signed-off-by: David Sondermann <david.sondermann@hivemq.com>

Author: Donnerbart

operator-framework-core/src/main/java/io/javaoperatorsdk/operator/processing/dependent/kubernetes/SSABasedGenericKubernetesResourceMatcher.java

@@ -226,7 +226,7 @@ private void sanitizeState(R actual, R desired, Map<String, Object> actualMap) {
   }
 
   @SuppressWarnings("unchecked")
-  private static void keepOnlyManagedFields(
+  static void keepOnlyManagedFields(
       Map<String, Object> result,
       Map<String, Object> actualMap,
       Map<String, Object> managedFields,

operator-framework-core/src/test/java/io/javaoperatorsdk/operator/processing/dependent/kubernetes/SSABasedGenericKubernetesResourceMatcherTest.java

@@ -1,6 +1,5 @@
 package io.javaoperatorsdk.operator.processing.dependent.kubernetes;
 
-import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -11,17 +10,20 @@
 
 import io.fabric8.kubernetes.api.model.ConfigMap;
 import io.fabric8.kubernetes.api.model.HasMetadata;
+import io.fabric8.kubernetes.api.model.Secret;
 import io.fabric8.kubernetes.api.model.apps.DaemonSet;
 import io.fabric8.kubernetes.api.model.apps.Deployment;
 import io.fabric8.kubernetes.api.model.apps.ReplicaSet;
 import io.fabric8.kubernetes.api.model.apps.StatefulSet;
 import io.javaoperatorsdk.operator.MockKubernetesClient;
+import io.javaoperatorsdk.operator.OperatorException;
 import io.javaoperatorsdk.operator.ReconcilerUtils;
 import io.javaoperatorsdk.operator.api.config.ConfigurationService;
 import io.javaoperatorsdk.operator.api.config.ControllerConfiguration;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -45,6 +47,54 @@ void setup() {
     when(mockedContext.getControllerConfiguration()).thenReturn(controllerConfiguration);
   }
 
+  @Test
+  void noMatchWhenNoMatchingController() {
+    var desired = loadResource("nginx-deployment.yaml", Deployment.class);
+    var actual =
+        loadResource("deployment-with-managed-fields-additional-controller.yaml", Deployment.class);
+    actual
+        .getMetadata()
+        .getManagedFields()
+        .removeIf(managedFieldsEntry -> managedFieldsEntry.getManager().equals("controller"));
+
+    assertThat(matcher.matches(actual, desired, mockedContext)).isFalse();
+  }
+
+  @Test
+  void exceptionWhenDuplicateController() {
+    var desired = loadResource("nginx-deployment.yaml", Deployment.class);
+    var actual =
+        loadResource("deployment-with-managed-fields-additional-controller.yaml", Deployment.class);
+    actual.getMetadata().getManagedFields().stream()
+        .filter(managedFieldsEntry -> managedFieldsEntry.getManager().equals("controller"))
+        .findFirst()
+        .ifPresent(
+            managedFieldsEntry -> actual.getMetadata().getManagedFields().add(managedFieldsEntry));
+
+    assertThatThrownBy(() -> matcher.matches(actual, desired, mockedContext))
+        .isInstanceOf(OperatorException.class)
+        .hasMessage(
+            "More than one field manager exists with name: controller in resource: Deployment with"
+                + " name: test");
+  }
+
+  @Test
+  void matchWithSensitiveResource() {
+    var desired = loadResource("secret-desired.yaml", Secret.class);
+    var actual = loadResource("secret.yaml", Secret.class);
+
+    assertThat(matcher.matches(actual, desired, mockedContext)).isTrue();
+  }
+
+  @Test
+  void noMatchWithSensitiveResource() {
+    var desired = loadResource("secret-desired.yaml", Secret.class);
+    var actual = loadResource("secret.yaml", Secret.class);
+    actual.getData().put("key1", "dmFsMg==");
+
+    assertThat(matcher.matches(actual, desired, mockedContext)).isFalse();
+  }
+
   @Test
   void checksIfAddsNotAddedByController() {
     var desired = loadResource("nginx-deployment.yaml", Deployment.class);
@@ -54,7 +104,40 @@ void checksIfAddsNotAddedByController() {
     assertThat(matcher.matches(actual, desired, mockedContext)).isTrue();
   }
 
-  // In the example the owner reference in a list is referenced by "k:", while all the fields are
+  @Test
+  void throwExceptionWhenManagedListEntryNotFound() {
+    var desired = loadResource("nginx-deployment.yaml", Deployment.class);
+    var actual =
+        loadResource("deployment-with-managed-fields-additional-controller.yaml", Deployment.class);
+    final var container = actual.getSpec().getTemplate().getSpec().getContainers().get(0);
+    container.setName("foobar");
+
+    assertThatThrownBy(() -> matcher.matches(actual, desired, mockedContext))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessage(
+            "Cannot find list element for key: {\"name\":\"nginx\"} in map: [[image,"
+                + " imagePullPolicy, name, ports, resources, terminationMessagePath,"
+                + " terminationMessagePolicy]]");
+  }
+
+  @Test
+  void throwExceptionWhenDuplicateManagedListEntryFound() {
+    var desired = loadResource("nginx-deployment.yaml", Deployment.class);
+    var actual =
+        loadResource("deployment-with-managed-fields-additional-controller.yaml", Deployment.class);
+    final var container = actual.getSpec().getTemplate().getSpec().getContainers().get(0);
+    actual.getSpec().getTemplate().getSpec().getContainers().add(container);
+
+    assertThatThrownBy(() -> matcher.matches(actual, desired, mockedContext))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessage(
+            "More targets found in list element for key: {\"name\":\"nginx\"} in map: [[image,"
+                + " imagePullPolicy, name, ports, resources, terminationMessagePath,"
+                + " terminationMessagePolicy], [image, imagePullPolicy, name, ports, resources,"
+                + " terminationMessagePath, terminationMessagePolicy]]");
+  }
+
+  // in the example the owner reference in a list is referenced by "k:", while all the fields are
   // managed but not listed
   @Test
   void emptyListElementMatchesAllFields() {
@@ -115,6 +198,14 @@ void addedLabelInDesiredMakesMatchFail() {
     assertThat(matcher.matches(actualConfigMap, desiredConfigMap, mockedContext)).isFalse();
   }
 
+  @Test
+  void withFinalizer() {
+    var desired = loadResource("secret-with-finalizer-desired.yaml", Secret.class);
+    var actual = loadResource("secret-with-finalizer.yaml", Secret.class);
+
+    assertThat(matcher.matches(actual, desired, mockedContext)).isTrue();
+  }
+
   @ParameterizedTest
   @ValueSource(
       strings = {
@@ -161,6 +252,23 @@ void testSanitizeState_statefulSetWithResources_withMismatch() {
     assertThat(matcher.matches(actualStatefulSet, desiredStatefulSet, mockedContext)).isFalse();
   }
 
+  @Test
+  void testSanitizeState_statefulSet_withResourceTypeMismatch() {
+    var desiredReplicaSet = loadResource("sample-rs-resources-desired.yaml", ReplicaSet.class);
+    var actualStatefulSet = loadResource("sample-sts-resources.yaml", StatefulSet.class);
+
+    assertThat(matcher.matches(actualStatefulSet, desiredReplicaSet, mockedContext)).isFalse();
+  }
+
+  @Test
+  void testSanitizeState_deployment_withResourceTypeMismatch() {
+    var desiredReplicaSet = loadResource("sample-rs-resources-desired.yaml", ReplicaSet.class);
+    var actualDeployment =
+        loadResource("deployment-with-managed-fields-additional-controller.yaml", Deployment.class);
+
+    assertThat(matcher.matches(actualDeployment, desiredReplicaSet, mockedContext)).isFalse();
+  }
+
   @Test
   void testSanitizeState_replicaSetWithResources() {
     var desiredReplicaSet = loadResource("sample-rs-resources-desired.yaml", ReplicaSet.class);
@@ -178,6 +286,14 @@ void testSanitizeState_replicaSetWithResources_withMismatch() {
     assertThat(matcher.matches(actualReplicaSet, desiredReplicaSet, mockedContext)).isFalse();
   }
 
+  @Test
+  void testSanitizeState_replicaSet_withResourceTypeMismatch() {
+    var desiredDaemonSet = loadResource("sample-ds-resources-desired.yaml", DaemonSet.class);
+    var actualReplicaSet = loadResource("sample-rs-resources.yaml", ReplicaSet.class);
+
+    assertThat(matcher.matches(actualReplicaSet, desiredDaemonSet, mockedContext)).isFalse();
+  }
+
   @Test
   void testSanitizeState_daemonSetWithResources() {
     var desiredDaemonSet = loadResource("sample-ds-resources-desired.yaml", DaemonSet.class);
@@ -194,6 +310,14 @@ void testSanitizeState_daemonSetWithResources_withMismatch() {
     assertThat(matcher.matches(actualDaemonSet, desiredDaemonSet, mockedContext)).isFalse();
   }
 
+  @Test
+  void testSanitizeState_daemonSet_withResourceTypeMismatch() {
+    var desiredReplicaSet = loadResource("sample-rs-resources-desired.yaml", ReplicaSet.class);
+    var actualDaemonSet = loadResource("sample-ds-resources.yaml", DaemonSet.class);
+
+    assertThat(matcher.matches(actualDaemonSet, desiredReplicaSet, mockedContext)).isFalse();
+  }
+
   @ParameterizedTest
   @ValueSource(booleans = {true, false})
   void testCustomMatcher_returnsExpectedMatchBasedOnReadOnlyLabel(boolean readOnly) {
@@ -209,16 +333,22 @@ void testCustomMatcher_returnsExpectedMatchBasedOnReadOnlyLabel(boolean readOnly
   }
 
   @Test
-  @SuppressWarnings("unchecked")
-  void testSortMapWithNestedMap() {
-    var nestedMap = new HashMap<String, Object>();
-    nestedMap.put("z", 26);
-    nestedMap.put("y", 25);
+  void keepOnlyManagedFields_withInvalidManagedFieldsKey() {
+    assertThatThrownBy(
+            () ->
+                SSABasedGenericKubernetesResourceMatcher.keepOnlyManagedFields(
+                    Map.of(),
+                    Map.of(),
+                    Map.of("invalid", 1),
+                    mockedContext.getClient().getKubernetesSerialization())) //
+        .isInstanceOf(IllegalStateException.class) //
+        .hasMessage("Key: invalid has no prefix: f:");
+  }
 
-    var unsortedMap = new HashMap<String, Object>();
-    unsortedMap.put("b", nestedMap);
-    unsortedMap.put("a", 1);
-    unsortedMap.put("c", 2);
+  @Test
+  @SuppressWarnings("unchecked")
+  void testSortMap() {
+    final var unsortedMap = Map.of("b", Map.of("z", 26, "y", 25), "a", List.of("w", "v"), "c", 2);
 
     var sortedMap = SSABasedGenericKubernetesResourceMatcher.sortMap(unsortedMap);
     assertThat(sortedMap.keySet()).containsExactly("a", "b", "c");
@@ -229,18 +359,11 @@ void testSortMapWithNestedMap() {
 
   @Test
   @SuppressWarnings("unchecked")
-  void sortListItemsTest() {
-    var nestedMap1 = new HashMap<String, Object>();
-    nestedMap1.put("z", 26);
-    nestedMap1.put("y", 25);
-
-    var nestedMap2 = new HashMap<String, Object>();
-    nestedMap2.put("b", 26);
-    nestedMap2.put("c", 25);
-    nestedMap2.put("a", 24);
-
-    var unsortedListItems = List.<Object>of(1, nestedMap1, nestedMap2);
-    var sortedListItems = SSABasedGenericKubernetesResourceMatcher.sortListItems(unsortedListItems);
+  void testSortListItems() {
+    final var unsortedList =
+        List.of(1, Map.of("z", 26, "y", 25), Map.of("b", 26, "c", 25, "a", 24), List.of("w", "v"));
+
+    var sortedListItems = SSABasedGenericKubernetesResourceMatcher.sortListItems(unsortedList);
     assertThat(sortedListItems).element(0).isEqualTo(1);
 
     var sortedNestedMap1 = (Map<String, Object>) sortedListItems.get(1);
@@ -252,7 +375,7 @@ void sortListItemsTest() {
 
   private static <R> R loadResource(String fileName, Class<R> clazz) {
     return ReconcilerUtils.loadYaml(
-            clazz, SSABasedGenericKubernetesResourceMatcherTest.class, fileName);
+        clazz, SSABasedGenericKubernetesResourceMatcherTest.class, fileName);
   }
 
   private static class ReadOnlyAwareMatcher<T extends HasMetadata>

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/configmap.empty-owner-reference-desired.yaml

@@ -10,5 +10,3 @@ metadata:
       uid: 1ef74cb4-dbbd-45ef-9caf-aa76186594ea
 data:
   key1: "val1"
-
-

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/deployment-with-managed-fields-additional-controller.yaml

@@ -25,6 +25,7 @@ metadata:
                   f:image: {}
                   f:name: {}
                   f:ports:
+                    .: {}
                     k:{"containerPort":80,"protocol":"TCP"}:
                       .: {}
                       f:containerPort: {}

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/multi-container-pod-desired.yaml

@@ -18,4 +18,4 @@ spec:
         - name: shared-data
           mountPath: /data
       command: ["/bin/sh"]
-      args: ["-c", "echo Level Up Blue Team! > /data/index.html"]
+      args: ["-c", "echo Level Up Blue Team! > /data/index.html"]

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/multi-container-pod.yaml

@@ -211,4 +211,4 @@ status:
   podIPs:
     - ip: 10.244.0.3
   qosClass: BestEffort
-  startTime: "2023-06-08T11:50:59Z"
+  startTime: "2023-06-08T11:50:59Z"

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/secret-desired.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: test1
+  namespace: default
+data:
+  key1: "dmFsMQ=="

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/secret-with-finalizer-desired.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  finalizers:
+    - test-finalizer
+  name: test1
+  namespace: default
+data:
+  key1: "dmFsMQ=="

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/secret-with-finalizer.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+data:
+  key1: "dmFsMQ=="
+kind: Secret
+metadata:
+  creationTimestamp: "2023-06-07T11:08:34Z"
+  finalizers:
+    - test-finalizer
+  managedFields:
+    - apiVersion: v1
+      fieldsType: FieldsV1
+      fieldsV1:
+        f:data:
+          f:key1: {}
+        f:metadata:
+          f:finalizers:
+            .: {}
+            v:"test-finalizer": {}
+      manager: controller
+      operation: Apply
+      time: "2023-06-07T11:08:34Z"
+  name: test1
+  namespace: default
+  resourceVersion: "400"
+  uid: 1d47f98f-ff1e-46d8-bbb5-6658ec488ae2

operator-framework-core/src/test/resources/io/javaoperatorsdk/operator/processing/dependent/kubernetes/secret.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+data:
+  key1: "dmFsMQ=="
+kind: Secret
+metadata:
+  creationTimestamp: "2023-06-07T11:08:34Z"
+  managedFields:
+    - apiVersion: v1
+      fieldsType: FieldsV1
+      fieldsV1:
+        f:data:
+          f:key1: {}
+      manager: controller
+      operation: Apply
+      time: "2023-06-07T11:08:34Z"
+  name: test1
+  namespace: default
+  resourceVersion: "400"
+  uid: 1d47f98f-ff1e-46d8-bbb5-6658ec488ae2