{"id":20098629,"url":"https://github.com/pfnet/kaptest","last_synced_at":"2025-05-06T05:32:22.507Z","repository":{"id":257811142,"uuid":"848022426","full_name":"pfnet/kaptest","owner":"pfnet","description":null,"archived":false,"fork":false,"pushed_at":"2025-02-18T10:39:24.000Z","size":189,"stargazers_count":10,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-05T04:42:10.271Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pfnet.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-27T01:42:10.000Z","updated_at":"2025-02-18T10:39:26.000Z","dependencies_parsed_at":"2024-10-05T20:56:12.172Z","dependency_job_id":null,"html_url":"https://github.com/pfnet/kaptest","commit_stats":null,"previous_names":["pfnet/kaptest"],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfnet%2Fkaptest","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfnet%2Fkaptest/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfnet%2Fkaptest/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pfnet%2Fkaptest/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pfnet","download_url":"https://codeload.github.com/pfnet/kaptest/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252629304,"owners_count":21779191,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T17:06:05.831Z","updated_at":"2025-05-06T05:32:22.495Z","avatar_url":"https://github.com/pfnet.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Kaptest\n\n**Kubernetes Admission Policy TESTing tool**\n\nKaptest is a testing tool to check the CEL expressions of [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).\n\nKaptest specializes in evaluating CEL expressions.\nIt allows you to perform fast and simple testing of CEL expressions,\nwithout having to start the kube-apiserver, create the `ValidatingAdmissionPolicy` and parameter resources, or link it to the target resources using `ValidatingAdmissionPolicyBinding`.\n\n## Installation\n\nYou can install Kaptest by downloading the compiled binary from the [release page](https://github.com/pfnet/kaptest/releases). It can also be installed by using the following script:\n\n```shell\ncurl -sLO \"https://github.com/pfnet/kaptest/releases/download/${KAPTEST_VERSION}/kaptest_${KAPTEST_VERSION}_${OS}_${ARCH}.tar.gz\"\ntar -xvf \"kaptest_${KAPTEST_VERSION}_${OS}_${ARCH}.tar.gz\"\n```\n\n## How to Use\n\n### Setup Test Manifests\n\nIf you want to create a test for `./validatingadmissionpolicy.yaml`, run the following command:\n\n```shell\nkaptest init validatingadmissionpolicy.yaml\n```\n\nThis will create a `./validatingadmissionpolicy.test` directory and generate a skeleton for writing test cases.\n\n```shell\n$ tree validationgadmissionpolicy.test/\nvalidationgadmissionpolicy.test/\n├── kaptest.yaml\n└── resources.yaml\n\n$ cat validationgadmissionpolicy.test/kaptest.yaml\nvalidatingAdmissionPolicies:\n- ../validationgadmissionpolicy.yaml\nresources:\n- resources.yaml\ntestSuites:\n- policy: simple-policy\n  tests:\n  - object:\n      kind: CHANGEME\n      name: ok\n    expect: admit\n  - object:\n      kind: CHANGEME\n      name: bad\n    expect: deny\n```\n\n### Test File Structures\n\nThere are no restrictions on the test file names. Although the skeleton created by `kaptest init` uses `kaptest.yaml`, other names can also be used.\n\nTest files should be written in the following format:\n\n```yaml\nvalidatingAdmissionPolicies:\n- \u003cpath/to/policy.yaml\u003e\n- \u003cpath/to/policy.yaml\u003e\nresources:\n- \u003cpath/to/resource.yaml\u003e\n- \u003cpath/to/resource.yaml\u003e\ntestSuites:\n- policy: \u003cname\u003e # ValidatingAdmissionPolicy's name\n  tests:\n  - object:\n      group: \u003cgroup\u003e # Optional\n      version: \u003cversion\u003e # Optional\n      kind: \u003ckind\u003e # Required\n      namespace: \u003cnamespace\u003e # Optional: It is needed to match with a resource whose namespace is set.\n      name: \u003cname\u003e # Required\n    oldObject:\n      group: \u003cgroup\u003e # Optional\n      version: \u003cversion\u003e # Optional\n      kind: \u003ckind\u003e # Required\n      namespace: \u003cnamespace\u003e # Optional\n      name: \u003cname\u003e # Required\n    params: # GVK of Params is omitted since it is defined by `spec.ParamKind` field in ValidatingAdmissionPolicy\n      namespace: \u003cnamespace\u003e # Optional\n      name: \u003cname\u003e # Required\n    userInfo: # The same struct as request.userInfo\n      user: \u003csub\u003e\n      groups: \u003cgroups\u003e\n      extra: ...\n    expect: \u003callow|deny|skip|error\u003e\n```\n\nResources specified in the `object`, `oldObject`, `params`, and `namespace` fields of the test cases must be described in the YAML files specified in the `resources` field.\n\n### Run test\n\nThe tests defined in the above manifest can be run with the following command:\n\n```shell\nkaptest run \u003cpath/to/test_manifest.yaml\u003e ...\n```\n\nYou can run test cases of multiple YAML files at once and display the test results together.\n\n### Operation Type\n\nYou can describe the cases for CREATE, UPDATE, and DELETE operations based on whether object and oldObject are specified. These are determined by the following conditions:\n\n- **CREATE**: Specify only object\n- **UPDATE**: Specify both object and oldObject\n- **DELETE**: Specify only oldObject\n\n### Evaluation Results\n\nKaptest focuses on evaluating CEL expressions, so even when an error occurs or `matchConditions` are not met it does not change the result to `allow` or `deny`. The test results of Kaptest will be one of the following four values:\n\n- **allow**: When all `matchConditions` and `validations` are evaluated as `true`\n- **deny**: When all `matchConditions` are evaluated as `true`, and at least one `validation` is evaluated as `false`\n- **skip**: When at least one `matchCondition` is evaluated as `false`\n- **error**: When at least one `matchCondition` or `validation` cannot be evaluated\n\nEven if you configure the `spec.failurePolicy`, it will not affect the test results.\n\n## Examples\n\nExamples are [here](./examples/).\n\n## Caveats\n\n- Note that `matchExpressions` are never evaluated in this tool. This means you can specify any objects or oldObjects that do not satisfy `matchExpressions` in your test cases, though this is not recommended as it does not constitute a valid test case.\n\n\n- The following [CEL variables](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/#validation-expression) are not supported for now.\n\n  - `request.requestResource`\n  - `request.subResource`\n  - `request.requestSubResource`\n  - `request.options`\n  - `authorizer`\n\n- The following attributes are fixed and cannot be changed.\n\n  - `request.dryRun` = `True`\n    - Since Kaptest is a testing tool, dryRun is always set to true.\n\n## License\n\nCopyright (c) 2024 Preferred Networks. All rights reserved. See [LICENSE](./LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpfnet%2Fkaptest","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpfnet%2Fkaptest","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpfnet%2Fkaptest/lists"}