k8s: Drop support for Casablanca

[integration.git] / test / security / k8s / src / check / validators / master / api / api_test.go

diff --git a/test/security/k8s/src/check/validators/master/api/api_test.go b/test/security/k8s/src/check/validators/master/api/api_test.go
index 4ba5070..01fe9b1 100644 (file)
--- a/test/security/k8s/src/check/validators/master/api/api_test.go
+++ b/test/security/k8s/src/check/validators/master/api/api_test.go
@@ -45,39 +45,7 @@ var _ = Describe("Api", func() {
                                "TLS_RSA_WITH_AES_128_GCM_SHA256",
                }
 
-               // kubeApiServerCasablanca was obtained from virtual environment for testing
-               // (introduced in Change-Id: I57f9f3caac0e8b391e9ed480f6bebba98e006882).
-               kubeApiServerCasablanca = []string{
-                       "--storage-backend=etcd2",
-                       "--storage-media-type=application/json",
-                       "--service-cluster-ip-range=10.43.0.0/16",
-                       "--etcd-servers=https://etcd.kubernetes.rancher.internal:2379",
-                       "--insecure-bind-address=0.0.0.0",
-                       "--insecure-port=0",
-                       "--cloud-provider=rancher",
-                       "--allow-privileged=true",
-                       "--admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount," +
-                               "PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,ResourceQuota",
-                       "--client-ca-file=/etc/kubernetes/ssl/ca.pem",
-                       "--tls-cert-file=/etc/kubernetes/ssl/cert.pem",
-                       "--tls-private-key-file=/etc/kubernetes/ssl/key.pem",
-                       "--kubelet-client-certificate=/etc/kubernetes/ssl/cert.pem",
-                       "--kubelet-client-key=/etc/kubernetes/ssl/key.pem",
-                       "--runtime-config=batch/v2alpha1",
-                       "--anonymous-auth=false",
-                       "--authentication-token-webhook-config-file=/etc/kubernetes/authconfig",
-                       "--runtime-config=authentication.k8s.io/v1beta1=true",
-                       "--external-hostname=kubernetes.kubernetes.rancher.internal",
-                       "--etcd-cafile=/etc/kubernetes/etcd/ca.pem",
-                       "--etcd-certfile=/etc/kubernetes/etcd/cert.pem",
-                       "--etcd-keyfile=/etc/kubernetes/etcd/key.pem",
-                       "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256," +
-                               "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305," +
-                               "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384," +
-                               "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
-               }
-
-               // kubeApiServerCasablanca was obtained from virtual environment for testing
+               // kubeApiServerDublin was obtained from virtual environment for testing
                // (introduced in Change-Id: I54ada5fade3b984dedd1715f20579e3ce901faa3).
                kubeApiServerDublin = []string{
                        "--requestheader-group-headers=X-Remote-Group",
@@ -130,7 +98,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not absent on insecure cluster", []string{"--insecure-allow-any-token"}, false),
                        Entry("Should be absent on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be absent on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be absent on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -140,7 +107,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not set on insecure cluster", []string{}, false),
                        Entry("Should be set to false on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be set to false on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be set to false on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -150,7 +116,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not set on insecure cluster", []string{}, false),
                        Entry("Is explicitly enabled on insecure cluster", []string{"--profiling=true"}, false),
-                       Entry("Is not set on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be set to false on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be set to false on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -161,7 +126,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is explicitly disabled on insecure cluster", []string{"--kubelet-https=false"}, false),
                        Entry("Should be absent or set to true on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be absent or set to true on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be absent or set to true on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -171,7 +135,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not set on insecure cluster", []string{}, false),
                        Entry("Is explicitly enabled on insecure cluster", []string{"--repair-malformed-updates=true"}, false),
-                       Entry("Is not set on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be set to false on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be set to false on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -182,7 +145,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not set on insecure cluster", []string{}, false),
                        Entry("Is explicitly disabled on insecure cluster", []string{"--service-account-lookup=false"}, false),
-                       Entry("Is not set on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be set to true on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be set to true on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -195,7 +157,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not absent on insecure cluster", []string{"--basic-auth-file=/path/to/file"}, false),
                        Entry("Should be absent on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be absent on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be absent on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -205,7 +166,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not absent on insecure cluster", []string{"--token-auth-file=/path/to/file"}, false),
                        Entry("Should be absent on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be absent on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be absent on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -215,7 +175,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--audit-log-path="}, false),
-                       Entry("Is absent on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is absent on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -226,7 +185,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--kubelet-certificate-authority="}, false),
-                       Entry("Is absent on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is absent on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -238,7 +196,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--client-ca-file="}, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be present on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -249,7 +206,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"-etcd-cafile="}, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be present on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -259,7 +215,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--service-account-key-file="}, false),
-                       Entry("Is absent on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -271,7 +226,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--kubelet-client-certificate= --kubelet-client-key="}, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be present on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -282,7 +236,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--etcd-certfile= --etcd-keyfile="}, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be present on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -293,7 +246,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--tls-cert-file= --tls-private-key-file="}, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be present on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
        })
@@ -304,7 +256,6 @@ var _ = Describe("Api", func() {
                                Expect(IsInsecureBindAddressAbsentOrLoopback(params)).To(Equal(expected))
                        },
                        Entry("Is not absent on insecure cluster", []string{"--insecure-bind-address=1.2.3.4"}, false),
-                       Entry("Is not absent nor set to loopback on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be absent or set to loopback on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be absent or set to loopback on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -316,7 +267,6 @@ var _ = Describe("Api", func() {
                        Entry("Is not set on insecure cluster", []string{}, false),
                        Entry("Is explicitly enabled on insecure cluster", []string{"--insecure-port=1234"}, false),
                        Entry("Should be set to 0 on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be set to 0 on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be set to 0 on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -326,7 +276,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is explicitly disabled on insecure cluster", []string{"--secure-port=0"}, false),
                        Entry("Should be absent or set to valid port on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be absent or set to valid port on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be absent or set to valid port on Dublin cluster", kubeApiServerDublin, true),
                )
        })
@@ -339,7 +288,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--audit-log-maxage="}, false),
                        Entry("Is insufficient on insecure cluster", []string{"--audit-log-maxage=5"}, false),
-                       Entry("Is absent on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is absent on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be set appropriately on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -351,7 +299,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--audit-log-maxbackup="}, false),
                        Entry("Is insufficient on insecure cluster", []string{"--audit-log-maxbackup=2"}, false),
-                       Entry("Is absent on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is absent on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be set appropriately on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -363,7 +310,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--audit-log-maxsize="}, false),
                        Entry("Is insufficient on insecure cluster", []string{"--audit-log-maxsize=5"}, false),
-                       Entry("Is absent on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is absent on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be set appropriately on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -375,7 +321,6 @@ var _ = Describe("Api", func() {
                        Entry("Is empty on insecure cluster", []string{"--request-timeout="}, false),
                        Entry("Is too high on insecure cluster", []string{"--request-timeout=600"}, false),
                        Entry("Should be set only if needed on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be set only if needed on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be set only if needed on Dublin cluster", kubeApiServerDublin, true),
                )
        })
@@ -388,7 +333,6 @@ var _ = Describe("Api", func() {
                        Entry("Is not absent on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar,AlwaysAdmit,Baz,Quuz"}, false),
                        Entry("Is not absent on insecure deprecated cluster", []string{"--admission-control=Foo,Bar,AlwaysAdmit,Baz,Quuz"}, false),
                        Entry("Should be absent on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be absent on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be absent on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -398,7 +342,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
-                       Entry("Is not present on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is not present on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -409,7 +352,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
-                       Entry("Is not present on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is not present on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -420,7 +362,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
-                       Entry("Is not present on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is not present on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -431,7 +372,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
-                       Entry("Is not present on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is not present on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -443,7 +383,6 @@ var _ = Describe("Api", func() {
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should be present on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -453,7 +392,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
-                       Entry("Is not present on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be present on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -464,7 +402,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not present on insecure cluster", []string{"--enable-admission-plugins=Foo,Bar"}, false),
                        Entry("Is not present on insecure deprecated cluster", []string{"--admission-control=Foo,Bar"}, false),
-                       Entry("Is not present on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is not present on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )
@@ -475,7 +412,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is explicitly disabled on insecure cluster", []string{"--disable-admission-plugins=Foo,Bar,NamespaceLifecycle,Baz,Quuz"}, false),
                        Entry("Should not be disabled on CIS-compliant cluster", kubeApiServerCISCompliant, true),
-                       Entry("Should not be disabled on Casablanca cluster", kubeApiServerCasablanca, true),
                        Entry("Should not be disabled on Dublin cluster", kubeApiServerDublin, true),
                )
 
@@ -485,7 +421,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not explicitly disabled on insecure cluster", []string{}, false),
                        Entry("Is not absent on insecure cluster", []string{"--authorization-mode=Foo,Bar,AlwaysAllow,Baz,Quuz"}, false),
-                       Entry("Is not explicitly disabled on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should be absent on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should be absent on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -496,7 +431,6 @@ var _ = Describe("Api", func() {
                        },
                        Entry("Is not explicitly enabled on insecure cluster", []string{}, false),
                        Entry("Is not present on insecure cluster", []string{"--authorization-mode=Foo,Bar"}, false),
-                       Entry("Is not explicitly enabled on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Should present on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                        Entry("Should present on Dublin cluster", kubeApiServerDublin, true),
                )
@@ -510,7 +444,6 @@ var _ = Describe("Api", func() {
                        Entry("Is absent on insecure cluster", []string{}, false),
                        Entry("Is empty on insecure cluster", []string{"--tls-cipher-suites="}, false),
                        Entry("Is incomplete on insecure cluster", []string{"--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"}, false),
-                       Entry("Is incomplete on Casablanca cluster", kubeApiServerCasablanca, false),
                        Entry("Is incomplete on Dublin cluster", kubeApiServerDublin, false),
                        Entry("Should be complete on CIS-compliant cluster", kubeApiServerCISCompliant, true),
                )