cli: helm install and upgrade unification (#2244)

cli/internal/helm/helm_test.go

@@ -7,9 +7,21 @@ SPDX-License-Identifier: AGPL-3.0-only
 package helm
 
 import (
+	"errors"
 	"testing"
 
+	"github.com/edgelesssys/constellation/v2/cli/internal/clusterid"
+	"github.com/edgelesssys/constellation/v2/cli/internal/terraform"
+	"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
+	"github.com/edgelesssys/constellation/v2/internal/compatibility"
+	"github.com/edgelesssys/constellation/v2/internal/config"
+	"github.com/edgelesssys/constellation/v2/internal/kms/uri"
+	"github.com/edgelesssys/constellation/v2/internal/logger"
+	"github.com/edgelesssys/constellation/v2/internal/semver"
+	"github.com/edgelesssys/constellation/v2/internal/versions"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"helm.sh/helm/v3/pkg/action"
 )
 
 func TestMergeMaps(t *testing.T) {
@@ -107,3 +119,145 @@ func TestMergeMaps(t *testing.T) {
 		})
 	}
 }
+
+func TestHelmApply(t *testing.T) {
+	cliVersion := semver.NewFromInt(1, 99, 0, "")
+	csp := cloudprovider.AWS // using AWS since it has an additional chart: aws-load-balancer-controller
+	microserviceCharts := []string{
+		"constellation-services",
+		"constellation-operators",
+		"constellation-csi",
+	}
+	testCases := map[string]struct {
+		clusterMicroServiceVersion string
+		expectedActions            []string
+		expectUpgrade              bool
+		clusterCertManagerVersion  *string
+		clusterAWSLBVersion        *string
+		allowDestructive           bool
+		expectError                bool
+	}{
+		"CLI microservices are 1 minor version newer than cluster ones": {
+			clusterMicroServiceVersion: "v1.98.1",
+			expectedActions:            microserviceCharts,
+			expectUpgrade:              true,
+		},
+		"CLI microservices are 2 minor versions newer than cluster ones": {
+			clusterMicroServiceVersion: "v1.97.0",
+			expectedActions:            []string{},
+		},
+		"cluster microservices are newer than CLI": {
+			clusterMicroServiceVersion: "v1.100.0",
+		},
+		"cluster and CLI microservices have the same version": {
+			clusterMicroServiceVersion: "v1.99.0",
+			expectedActions:            []string{},
+		},
+		"cert-manager upgrade is ignored when denying destructive upgrades": {
+			clusterMicroServiceVersion: "v1.99.0",
+			clusterCertManagerVersion:  toPtr("v1.9.0"),
+			allowDestructive:           false,
+			expectError:                true,
+		},
+		"both microservices and cert-manager are upgraded in destructive mode": {
+			clusterMicroServiceVersion: "v1.98.1",
+			clusterCertManagerVersion:  toPtr("v1.9.0"),
+			expectedActions:            append(microserviceCharts, "cert-manager"),
+			expectUpgrade:              true,
+			allowDestructive:           true,
+		},
+		"only missing aws-load-balancer-controller is installed": {
+			clusterMicroServiceVersion: "v1.99.0",
+			clusterAWSLBVersion:        toPtr(""),
+			expectedActions:            []string{"aws-load-balancer-controller"},
+		},
+	}
+
+	cfg := config.Default()
+	cfg.RemoveProviderAndAttestationExcept(csp)
+	log := logger.NewTest(t)
+	options := Options{
+		Conformance:      false,
+		HelmWaitMode:     WaitModeWait,
+		AllowDestructive: true,
+		Force:            false,
+	}
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			lister := &ReleaseVersionStub{}
+			sut := Client{
+				factory:    newActionFactory(nil, lister, &action.Configuration{}, cliVersion, log),
+				log:        log,
+				cliVersion: cliVersion,
+			}
+			awsLbVersion := "v1.5.4" // current version
+			if tc.clusterAWSLBVersion != nil {
+				awsLbVersion = *tc.clusterAWSLBVersion
+			}
+
+			certManagerVersion := "v1.10.0" // current version
+			if tc.clusterCertManagerVersion != nil {
+				certManagerVersion = *tc.clusterCertManagerVersion
+			}
+			helmListVersion(lister, "cilium", "v1.12.1")
+			helmListVersion(lister, "cert-manager", certManagerVersion)
+			helmListVersion(lister, "constellation-services", tc.clusterMicroServiceVersion)
+			helmListVersion(lister, "constellation-operators", tc.clusterMicroServiceVersion)
+			helmListVersion(lister, "constellation-csi", tc.clusterMicroServiceVersion)
+			helmListVersion(lister, "aws-load-balancer-controller", awsLbVersion)
+
+			options.AllowDestructive = tc.allowDestructive
+			ex, includesUpgrade, err := sut.PrepareApply(cfg, versions.ValidK8sVersion("v1.27.4"),
+				clusterid.File{UID: "testuid", MeasurementSalt: []byte("measurementSalt")}, options,
+				fakeTerraformOutput(csp), fakeServiceAccURI(csp),
+				uri.MasterSecret{Key: []byte("secret"), Salt: []byte("masterSalt")})
+			var upgradeErr *compatibility.InvalidUpgradeError
+			if tc.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.True(t, err == nil || errors.As(err, &upgradeErr))
+			}
+			assert.Equal(t, tc.expectUpgrade, includesUpgrade)
+			chartExecutor, ok := ex.(*ChartApplyExecutor)
+			assert.True(t, ok)
+			assert.ElementsMatch(t, tc.expectedActions, getActionReleaseNames(chartExecutor.actions))
+		})
+	}
+}
+
+func fakeTerraformOutput(csp cloudprovider.Provider) terraform.ApplyOutput {
+	switch csp {
+	case cloudprovider.AWS:
+		return terraform.ApplyOutput{}
+	case cloudprovider.GCP:
+		return terraform.ApplyOutput{GCP: &terraform.GCPApplyOutput{}}
+	default:
+		panic("invalid csp")
+	}
+}
+
+func getActionReleaseNames(actions []applyAction) []string {
+	releaseActionNames := []string{}
+	for _, action := range actions {
+		releaseActionNames = append(releaseActionNames, action.ReleaseName())
+	}
+	return releaseActionNames
+}
+
+func helmListVersion(l *ReleaseVersionStub, releaseName string, installedVersion string) {
+	if installedVersion == "" {
+		l.On("currentVersion", releaseName).Return(semver.Semver{}, errReleaseNotFound)
+		return
+	}
+	v, _ := semver.New(installedVersion)
+	l.On("currentVersion", releaseName).Return(v, nil)
+}
+
+type ReleaseVersionStub struct {
+	mock.Mock
+}
+
+func (s *ReleaseVersionStub) currentVersion(release string) (semver.Semver, error) {
+	args := s.Called(release)
+	return args.Get(0).(semver.Semver), args.Error(1)
+}