Update simple_fleet_app_operator_permissions_test.go

Author: tonybayvas

test/integration/simple_fleet_app_operator_permissions/simple_fleet_app_operator_permissions_test.go

@@ -39,58 +39,37 @@ func TestSimpleFleetAppOperatorPermissions(t *testing.T) {
 		appOperatorPrincipal := fmt.Sprintf("serviceAccount:%s", appOperatorEmail)
 		scopeLevelRole := "roles/gkehub.scopeViewer"
 		projectLevelRole := "roles/gkehub.scopeViewerProjectLevel"
+		customAppOperatorEmail := fmt.Sprintf("custom-app-operator-id@%s.iam.gserviceaccount.com", projectId)
+		customAppOperatorPrincipal := fmt.Sprintf("serviceAccount:%s", appOperatorEmail)
+		customScopeLevelRole := "roles/gkehub.scopeViewer"
+		customProjectLevelRole := "roles/gkehub.scopeEditorProjectLevel"
 		logViewRole := "roles/logging.viewAccessor"
 		logViewContainerBucket := fmt.Sprintf("projects/%s/locations/global/buckets/fleet-o11y-scope-%s/views/fleet-o11y-scope-%s-k8s_container", projectId, scopeId, scopeId)
 		logViewPodBucket := fmt.Sprintf("projects/%s/locations/global/buckets/fleet-o11y-scope-%s/views/fleet-o11y-scope-%s-k8s_pod", projectId, scopeId, scopeId)
+		filterFormat := "\"bindings.members:%s\""
+		flattenOpt := "bindings[].members"
 
 		scopeRrbList := gcloud.Runf(t, "container fleet scopes rbacrolebindings list --scope %s --project %s", scopeId, projectId).String()
 		assert.Equal(strings.Contains(scopeRrbList, appOperatorEmail), true, "app operator email should be in the list of Scope RBAC Role Bindings")
+		assert.Equal(strings.Contains(scopeRrbList, customAppOperatorEmail), true, "custom app operator email should be in the list of Scope RBAC Role Bindings")
 
-		scopeIam := gcloud.Runf(t, "container fleet scopes get-iam-policy %s --project %s", scopeId, projectId).String()
-		assert.Equal(strings.Contains(scopeIam, appOperatorPrincipal), true, "app operator principal should be in the Scope IAM policy")
+		scopeIam := gcloud.Runf(t, "container fleet scopes get-iam-policy %s --project %s --filter %s", scopeId, projectId, fmt.Sprintf(filterFormat, appOperatorPrincipal)).String()
 		assert.Equal(strings.Contains(scopeIam, scopeLevelRole), true, "app operator Scope role should be in the Scope IAM policy")
 
-		projectIam := gcloud.Runf(t, "projects get-iam-policy %s", projectId).String()
-		assert.Equal(strings.Contains(projectIam, appOperatorPrincipal), true, "app operator principal should be in the project IAM policy")
-		assert.Equal(strings.Contains(projectIam, projectLevelRole), true, "app operator Scope role should be in the project IAM policy")
-		assert.Equal(strings.Contains(projectIam, logViewRole), true, "app operator log view role should be in the project IAM policy")
-		assert.Equal(strings.Contains(projectIam, logViewContainerBucket), true, "app operator log view container bucket should be in the project IAM policy")
-		assert.Equal(strings.Contains(projectIam, logViewPodBucket), true, "app operator log view pod bucket should be in the project IAM policy")
-	})
-
-	appOppT.Test()
-}
-
-func TestCustomFleetAppOperatorPermissions(t *testing.T) {
-	appOppT := tft.NewTFBlueprintTest(t,
-		tft.WithRetryableTerraformErrors(testutils.RetryableTransientErrors, 3, 2*time.Minute),
-	)
-	appOppT.DefineVerify(func(assert *assert.Assertions) {
-		appOppT.DefaultVerify(assert)
+		customScopeIam := gcloud.Runf(t, "container fleet scopes get-iam-policy %s --project %s --filter %s", scopeId, projectId, fmt.Sprintf(filterFormat, customAppOperatorPrincipal)).String()
+		assert.Equal(strings.Contains(customScopeIam, customScopeLevelRole), true, "custom app operator Scope role should be in the Scope IAM policy")
 
-		projectId := appOppT.GetStringOutput("project_id")
-		scopeId := "app-operator-team"
-		appOperatorEmail := fmt.Sprintf("custom-app-operator-id@%s.iam.gserviceaccount.com", projectId)
-		appOperatorPrincipal := fmt.Sprintf("serviceAccount:%s", appOperatorEmail)
-		scopeLevelRole := "roles/gkehub.scopeViewer"
-		projectLevelRole := "roles/gkehub.scopeEditorProjectLevel"
-		logViewRole := "roles/logging.viewAccessor"
-		logViewContainerBucket := fmt.Sprintf("projects/%s/locations/global/buckets/fleet-o11y-scope-%s/views/fleet-o11y-scope-%s-k8s_container", projectId, scopeId, scopeId)
-		logViewPodBucket := fmt.Sprintf("projects/%s/locations/global/buckets/fleet-o11y-scope-%s/views/fleet-o11y-scope-%s-k8s_pod", projectId, scopeId, scopeId)
-
-		scopeRrbList := gcloud.Runf(t, "container fleet scopes rbacrolebindings list --scope %s --project %s", scopeId, projectId).String()
-		assert.Equal(strings.Contains(scopeRrbList, appOperatorEmail), true, "app operator email should be in the list of Scope RBAC Role Bindings")
-
-		scopeIam := gcloud.Runf(t, "container fleet scopes get-iam-policy %s --project %s", scopeId, projectId).String()
-		assert.Equal(strings.Contains(scopeIam, appOperatorPrincipal), true, "app operator principal should be in the Scope IAM policy")
-		assert.Equal(strings.Contains(scopeIam, scopeLevelRole), true, "app operator Scope role should be in the Scope IAM policy")
-
-		projectIam := gcloud.Runf(t, "projects get-iam-policy %s", projectId).String()
-		assert.Equal(strings.Contains(projectIam, appOperatorPrincipal), true, "app operator principal should be in the project IAM policy")
+		projectIam := gcloud.Runf(t, "projects get-iam-policy %s --filter %s --flatten %s", projectId, fmt.Sprintf(filterFormat, appOperatorPrincipal), flattenOpt).String()
 		assert.Equal(strings.Contains(projectIam, projectLevelRole), true, "app operator Scope role should be in the project IAM policy")
 		assert.Equal(strings.Contains(projectIam, logViewRole), true, "app operator log view role should be in the project IAM policy")
 		assert.Equal(strings.Contains(projectIam, logViewContainerBucket), true, "app operator log view container bucket should be in the project IAM policy")
 		assert.Equal(strings.Contains(projectIam, logViewPodBucket), true, "app operator log view pod bucket should be in the project IAM policy")
+
+		customProjectIam := gcloud.Runf(t, "projects get-iam-policy %s --filter %s --flatten %s", projectId, fmt.Sprintf(filterFormat, customAppOperatorPrincipal), flattenOpt).String()
+		assert.Equal(strings.Contains(projectIam, customProjectLevelRole), true, "custom app operator Scope role should be in the project IAM policy")
+		assert.Equal(strings.Contains(projectIam, logViewRole), true, "custom app operator log view role should be in the project IAM policy")
+		assert.Equal(strings.Contains(projectIam, logViewContainerBucket), true, "custom app operator log view container bucket should be in the project IAM policy")
+		assert.Equal(strings.Contains(projectIam, logViewPodBucket), true, "custom app operator log view pod bucket should be in the project IAM policy")
 	})
 
 	appOppT.Test()