feat: 🎸 add label pods controller to infra and add int tests

terraform/aws-accounts/cloud-platform-aws/vpc/eks/core/components/components.tf

@@ -50,7 +50,8 @@ module "cluster_autoscaler" {
   live_cpu_request    = "200m"
 
   depends_on = [
-    module.monitoring
+    module.monitoring,
+    module.label_pods_controller
   ]
 }
 
@@ -59,7 +60,8 @@ module "descheduler" {
   source = "github.com/ministryofjustice/cloud-platform-terraform-descheduler?ref=0.7.0"
 
   depends_on = [
-    module.monitoring
+    module.monitoring,
+    module.label_pods_controller
   ]
 }
 
@@ -74,6 +76,17 @@ module "cert_manager" {
   depends_on = [module.monitoring.prometheus_operator_crds_status]
 }
 
+module "label_pods_controller" {
+  source = "github.com/ministryofjustice/cloud-platform-terraform-label-pods?ref=1.1.0"
+
+  chart_version = "1.0.1"
+  ecr_url       = "754256621582.dkr.ecr.eu-west-2.amazonaws.com/webops/cloud-platform-label-pods-ecr"
+  image_tag     = "1.1.0"
+
+  depends_on = [module.cert_manager]
+}
+
+
 module "external_dns" {
   source = "github.com/ministryofjustice/cloud-platform-terraform-external-dns?ref=1.15.0"
 
@@ -97,7 +110,8 @@ module "external_secrets_operator" {
   secrets_prefix              = terraform.workspace
 
   depends_on = [
-    module.monitoring.prometheus_operator_crds_status
+    module.monitoring.prometheus_operator_crds_status,
+    module.label_pods_controller
   ]
 }
 module "ingress_controllers_v1" {
@@ -116,7 +130,7 @@ module "ingress_controllers_v1" {
   memory_requests = lookup(local.live_workspace, terraform.workspace, false) ? "5Gi" : "512Mi"
   memory_limits   = lookup(local.live_workspace, terraform.workspace, false) ? "20Gi" : "2Gi"
 
-  depends_on = [module.cert_manager.helm_cert_manager_status]
+  depends_on = [module.cert_manager.helm_cert_manager_status, module.label_pods_controller]
 }
 
 module "production_only_ingress_controllers_v1" {
@@ -139,7 +153,7 @@ module "production_only_ingress_controllers_v1" {
   memory_requests = "5Gi"
   memory_limits   = "20Gi"
 
-  depends_on = [module.cert_manager.helm_cert_manager_status]
+  depends_on = [module.cert_manager.helm_cert_manager_status, module.label_pods_controller]
 }
 
 
@@ -187,7 +201,7 @@ module "logging" {
   opensearch_app_host = lookup(var.opensearch_app_host_map, terraform.workspace, "placeholder-opensearch")
   elasticsearch_host  = lookup(var.elasticsearch_hosts_maps, terraform.workspace, "placeholder-elasticsearch")
 
-  depends_on = [module.monitoring.prometheus_operator_crds_status]
+  depends_on = [module.monitoring.prometheus_operator_crds_status, module.label_pods_controller]
 }
 
 module "monitoring" {
@@ -238,7 +252,7 @@ module "velero" {
   eks_cluster_oidc_issuer_url = data.terraform_remote_state.cluster.outputs.cluster_oidc_issuer_url
   node_agent_cpu_requests     = "2m"
 
-  depends_on = [module.monitoring.prometheus_operator_crds_status]
+  depends_on = [module.monitoring.prometheus_operator_crds_status, module.label_pods_controller]
 }
 
 module "kuberhealthy" {
@@ -256,7 +270,8 @@ module "trivy-operator" {
   source = "github.com/ministryofjustice/cloud-platform-terraform-trivy-operator?ref=0.8.2"
 
   depends_on = [
-    module.monitoring.prometheus_operator_crds_status
+    module.monitoring.prometheus_operator_crds_status,
+    module.label_pods_controller
   ]
 
   cluster_domain_name         = data.terraform_remote_state.cluster.outputs.cluster_domain_name

test/fixtures/helloworld-deployment-v1.yaml.tmpl

@@ -66,4 +66,4 @@ spec:
           service:
             name: integration-test-svc
             port:
-              number: 80
+              number: 80

test/fixtures/namespace.yaml.tmpl

@@ -9,22 +9,31 @@ metadata:
 
 ---
 
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: test-webops
-  namespace: {{ .namespace }}
-  labels:
-subjects:
-  - kind: Group
-    name: "github:test-webops"
+{{ if .disableRoleBinding }}
+
+{{else}}
+  kind: RoleBinding
+  apiVersion: rbac.authorization.k8s.io/v1
+  metadata:
+    name: test-webops
+    namespace: {{ .namespace }}
+    labels:
+  subjects:
+    - kind: Group
+      name: "github:test-webops"
+      apiGroup: rbac.authorization.k8s.io
+  {{ if .multiGithubRbac }}
+    - kind: Group
+      name: "github:test-webops-2"
+      apiGroup: rbac.authorization.k8s.io
+  {{ end }}
+  roleRef:
+    kind: ClusterRole
+    name: "admin"
     apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: ClusterRole
-  name: "admin"
-  apiGroup: rbac.authorization.k8s.io
 
 ---
+{{ end }}
 
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

test/fixtures/unprivileged-deployment.yaml.tmpl

@@ -12,6 +12,10 @@ spec:
     metadata:
       labels:
         app: unprivileged-integration-test
+    {{ if .preexistingAnnotations }}
+      annotations:
+        foo: bar
+    {{ end }}
     spec:
       securityContext:
         runAsUser: 1000

test/label_pod_test.go

@@ -0,0 +1,136 @@
+package integration_tests
+
+import (
+	"fmt"
+	"html/template"
+	"strings"
+
+	"github.com/gruntwork-io/terratest/modules/k8s"
+	"github.com/gruntwork-io/terratest/modules/logger"
+	"github.com/gruntwork-io/terratest/modules/random"
+	"github.com/ministryofjustice/cloud-platform-infrastructure/test/helpers"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("GIVEN a pod", func() {
+	var (
+		namespace string
+		options   *k8s.KubectlOptions
+		oldLogger *logger.Logger
+	)
+	BeforeEach(func() {
+		namespace = fmt.Sprintf("%s-label-pod-%s", c.Prefix, strings.ToLower(random.UniqueId()))
+		options = k8s.NewKubectlOptions("", "", namespace)
+		oldLogger = options.Logger
+		options.Logger = logger.Discard
+	})
+
+	AfterEach(func() {
+		err := k8s.DeleteNamespaceE(GinkgoT(), options, namespace)
+		Expect(err).NotTo(HaveOccurred())
+		defer func() { options.Logger = oldLogger }()
+	})
+
+	Context("WHEN a pod has a SINGLE github team in it's rbac", func() {
+		It("THEN add an annotation with that github team", func() {
+			nsTpl, err := helpers.TemplateFile("./fixtures/namespace.yaml.tmpl", "namespace.yaml.tmpl", template.FuncMap{
+				"namespace": namespace,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, nsTpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			tpl, err := helpers.TemplateFile("./fixtures/unprivileged-deployment.yaml.tmpl", "unprivileged-deployment.yaml.tmpl", template.FuncMap{
+				"namespace": namespace,
+			})
+
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, tpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			pod, err := k8s.RunKubectlAndGetOutputE(GinkgoT(), options, "get", "pod", "-n", namespace, "-oyaml")
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(pod).To(ContainSubstring(`github_teams: test-webops`))
+		})
+
+		It("THEN add an annotation even when annotations previously exist", func() {
+			nsTpl, err := helpers.TemplateFile("./fixtures/namespace.yaml.tmpl", "namespace.yaml.tmpl", template.FuncMap{
+				"namespace": namespace,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, nsTpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			tpl, err := helpers.TemplateFile("./fixtures/unprivileged-deployment.yaml.tmpl", "unprivileged-deployment.yaml.tmpl", template.FuncMap{
+				"namespace":              namespace,
+				"preexistingAnnotations": true,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, tpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			pod, err := k8s.RunKubectlAndGetOutputE(GinkgoT(), options, "get", "pod", "-n", namespace, "-oyaml")
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(pod).To(ContainSubstring(`github_teams: test-webops`))
+		})
+	})
+
+	Context("WHEN a pod has a MULTIPLE github teams in it's rbac", func() {
+		It("THEN add an annotation with multiple teams", func() {
+			nsTpl, err := helpers.TemplateFile("./fixtures/namespace.yaml.tmpl", "namespace.yaml.tmpl", template.FuncMap{
+				"namespace":       namespace,
+				"multiGithubRbac": true,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, nsTpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			tpl, err := helpers.TemplateFile("./fixtures/unprivileged-deployment.yaml.tmpl", "unprivileged-deployment.yaml.tmpl", template.FuncMap{
+				"namespace": namespace,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, tpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			pod, err := k8s.RunKubectlAndGetOutputE(GinkgoT(), options, "get", "pod", "-n", namespace, "-oyaml")
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(pod).To(ContainSubstring(`github_teams: test-webops_test-webops-2`))
+		})
+	})
+
+	Context("WHEN a pod has a NO github teams in it's rbac", func() {
+		It("THEN add an annotation with multiple teams", func() {
+			nsTpl, err := helpers.TemplateFile("./fixtures/namespace.yaml.tmpl", "namespace.yaml.tmpl", template.FuncMap{
+				"namespace":          namespace,
+				"disableRoleBinding": true,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, nsTpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			tpl, err := helpers.TemplateFile("./fixtures/unprivileged-deployment.yaml.tmpl", "unprivileged-deployment.yaml.tmpl", template.FuncMap{
+				"namespace": namespace,
+			})
+			Expect(err).NotTo(HaveOccurred())
+
+			err = k8s.KubectlApplyFromStringE(GinkgoT(), options, tpl)
+			Expect(err).NotTo(HaveOccurred())
+
+			pod, err := k8s.RunKubectlAndGetOutputE(GinkgoT(), options, "get", "pod", "-n", namespace, "-oyaml")
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(pod).To(ContainSubstring(`github_teams: all-org-members`))
+		})
+	})
+})