diff --git a/test/e2e/e2e_common_test.go b/test/e2e/e2e_common_test.go index 9c175107..839dd881 100644 --- a/test/e2e/e2e_common_test.go +++ b/test/e2e/e2e_common_test.go @@ -179,6 +179,285 @@ func (c crConfig) validateInitContainerReadOnlyRootFilesystem() { ExpectWithOffset(1, string(output)).To(Equal("true")) } +// validateDefaultValues checks that CRD schema defaults are applied from kubebuilder:default annotations. +func (cr crConfig) validateDefaultValues() { + By(fmt.Sprintf("validating default spec values for %s", cr.kind)) + + if cr.kind != "FalconImageAnalyzer" { + By("validating falcon.trace default is 'none'") + cmd := exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.falcon.trace}") + output, err := utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("none"), + "spec.falcon.trace should default to 'none'") + + By("validating falcon.apd default is 'false'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.falcon.apd}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("false"), + "spec.falcon.apd should default to false") + } + + switch cr.kind { + case "FalconNodeSensor": + By("validating installNamespace default is 'falcon-system'") + cmd := exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.installNamespace}") + output, err := utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("falcon-system"), + "spec.installNamespace should default to 'falcon-system'") + + By("validating node.backend default is 'bpf'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.node.backend}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("bpf"), + "spec.node.backend should default to 'bpf'") + + By("validating node.imagePullPolicy default is 'Always'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.node.imagePullPolicy}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("Always"), + "spec.node.imagePullPolicy should default to 'Always'") + + By("validating node.terminationGracePeriod default is 60") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.node.terminationGracePeriod}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("60"), + "spec.node.terminationGracePeriod should default to 60") + + By("validating node.disableCleanup default is 'false'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.node.disableCleanup}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("false"), + "spec.node.disableCleanup should default to false") + + By("validating node.updateStrategy.type default is 'RollingUpdate'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.node.updateStrategy.type}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("RollingUpdate"), + "spec.node.updateStrategy.type should default to 'RollingUpdate'") + + By("validating node.tolerations include default control-plane tolerations") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.node.tolerations[*].key}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(ContainSubstring("node-role.kubernetes.io/master"), + "spec.node.tolerations should include the master node-role toleration by default") + ExpectWithOffset(1, string(output)).To(ContainSubstring("node-role.kubernetes.io/control-plane"), + "spec.node.tolerations should include the control-plane node-role toleration by default") + + case "FalconContainer": + By("validating installNamespace default is 'falcon-system'") + cmd := exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.installNamespace}") + output, err := utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("falcon-system"), + "spec.installNamespace should default to 'falcon-system'") + + By("validating injector.listenPort default is 4433") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.injector.listenPort}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("4433"), + "spec.injector.listenPort should default to 4433") + + By("validating injector.imagePullPolicy default is 'Always'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.injector.imagePullPolicy}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("Always"), + "spec.injector.imagePullPolicy should default to 'Always'") + + By("validating injector.imagePullSecret default is 'crowdstrike-falcon-pull-secret'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.injector.imagePullSecret}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("crowdstrike-falcon-pull-secret"), + "spec.injector.imagePullSecret should default to 'crowdstrike-falcon-pull-secret'") + + By("validating injector.replicas default is 2") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.injector.replicas}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("2"), + "spec.injector.replicas should default to 2") + + By("validating injector.disableDefaultNamespaceInjection default is 'false'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.injector.disableDefaultNamespaceInjection}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("false"), + "spec.injector.disableDefaultNamespaceInjection should default to false") + + By("validating injector.disableDefaultPodInjection default is 'false'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.injector.disableDefaultPodInjection}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("false"), + "spec.injector.disableDefaultPodInjection should default to false") + + case "FalconAdmission": + By("validating installNamespace default is 'falcon-kac'") + cmd := exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.installNamespace}") + output, err := utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("falcon-kac"), + "spec.installNamespace should default to 'falcon-kac'") + + By("validating admissionConfig.servicePort default is 443") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.servicePort}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("443"), + "spec.admissionConfig.servicePort should default to 443") + + By("validating admissionConfig.containerPort default is 4443") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.containerPort}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("4443"), + "spec.admissionConfig.containerPort should default to 4443") + + By("validating admissionConfig.failurePolicy default is 'Ignore'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.failurePolicy}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("Ignore"), + "spec.admissionConfig.failurePolicy should default to 'Ignore'") + + By("validating admissionConfig.imagePullPolicy default is 'Always'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.imagePullPolicy}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("Always"), + "spec.admissionConfig.imagePullPolicy should default to 'Always'") + + By("validating admissionConfig.deployWatcher default is 'true'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.deployWatcher}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("true"), + "spec.admissionConfig.deployWatcher should default to true") + + By("validating admissionConfig.watcherEnabled default is 'true'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.watcherEnabled}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("true"), + "spec.admissionConfig.watcherEnabled should default to true") + + By("validating admissionConfig.snapshotsEnabled default is 'true'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.snapshotsEnabled}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("true"), + "spec.admissionConfig.snapshotsEnabled should default to true") + + By("validating admissionConfig.admissionControlEnabled default is 'true'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.admissionConfig.admissionControlEnabled}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("true"), + "spec.admissionConfig.admissionControlEnabled should default to true") + + By("validating resourcequota.pods default is '2'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.resourcequota.pods}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("2"), + "spec.resourcequota.pods should default to '2'") + + case "FalconImageAnalyzer": + By("validating installNamespace default is 'falcon-iar'") + cmd := exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.installNamespace}") + output, err := utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("falcon-iar"), + "spec.installNamespace should default to 'falcon-iar'") + + By("validating imageAnalyzerConfig.imagePullPolicy default is 'Always'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.imageAnalyzerConfig.imagePullPolicy}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("Always"), + "spec.imageAnalyzerConfig.imagePullPolicy should default to 'Always'") + + By("validating imageAnalyzerConfig.sizeLimit default is '20Gi'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.imageAnalyzerConfig.sizeLimit}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("20Gi"), + "spec.imageAnalyzerConfig.sizeLimit should default to '20Gi'") + + By("validating imageAnalyzerConfig.mountPath default is '/tmp'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.imageAnalyzerConfig.mountPath}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("/tmp"), + "spec.imageAnalyzerConfig.mountPath should default to '/tmp'") + + By("validating imageAnalyzerConfig.registryConfig.autoDiscoverCredentials default is 'true'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.imageAnalyzerConfig.registryConfig.autoDiscoverCredentials}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("true"), + "spec.imageAnalyzerConfig.registryConfig.autoDiscoverCredentials should default to true") + + By("validating imageAnalyzerConfig.iarAgentService.port default is 8001") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.imageAnalyzerConfig.iarAgentService.port}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("8001"), + "spec.imageAnalyzerConfig.iarAgentService.port should default to 8001") + + By("validating imageAnalyzerConfig.kac.namespace default is 'falcon-kac'") + cmd = exec.Command("kubectl", "get", strings.ToLower(cr.kind), cr.metadataName, + "-o", "jsonpath={.spec.imageAnalyzerConfig.kac.namespace}") + output, err = utils.Run(cmd) + ExpectWithOffset(1, err).NotTo(HaveOccurred()) + ExpectWithOffset(1, string(output)).To(Equal("falcon-kac"), + "spec.imageAnalyzerConfig.kac.namespace should default to 'falcon-kac'") + } +} + // loadManifest reads a manifest file, unmarshals it into the provided object, and updates credentials func loadManifest(manifest string, obj any) error { manifestPath := filepath.Join(projectDir, manifest) diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go index b116c2e3..60452be0 100644 --- a/test/e2e/e2e_test.go +++ b/test/e2e/e2e_test.go @@ -509,6 +509,7 @@ var _ = Describe("falcon", Ordered, func() { updateManifestApiCreds(manifest) nodeConfig.manageCrdInstance(crApply, manifest) nodeConfig.validateCrStatus() + nodeConfig.validateDefaultValues() }) It("should cleanup successfully", func() { nodeConfig.manageCrdInstance(crDelete, manifest) @@ -539,6 +540,7 @@ var _ = Describe("falcon", Ordered, func() { kacConfig.manageCrdInstance(crApply, manifest) kacConfig.validateRunningStatus(shouldBeRunning) kacConfig.validateCrStatus() + kacConfig.validateDefaultValues() }) }) @@ -586,6 +588,7 @@ var _ = Describe("falcon", Ordered, func() { sidecarConfig.manageCrdInstance(crApply, manifest) sidecarConfig.validateRunningStatus(shouldBeRunning) sidecarConfig.validateCrStatus() + sidecarConfig.validateDefaultValues() }) It("should cleanup successfully", func() { sidecarConfig.manageCrdInstance(crDelete, manifest) @@ -663,6 +666,7 @@ var _ = Describe("falcon", Ordered, func() { nodeConfig.validateCrStatus() iarConfig.validateRunningStatus(shouldBeRunning) iarConfig.validateCrStatus() + iarConfig.validateDefaultValues() }) It("should cleanup successfully", func() { falconDeploymentConfig.manageCrdInstance(crDelete, manifest) @@ -714,6 +718,7 @@ var _ = Describe("falcon", Ordered, func() { iarConfig.validateRunningStatus(shouldBeRunning) iarConfig.validateCrStatus() + iarConfig.validateDefaultValues() if reconcileLoopCheck { By("validating no reconcile loop after IAR deployment")