test-pod.yaml

# MIT License
#
# Copyright (c) 2023 Matheus Pimenta
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

# This file is not only a core part of our test automation in this project,
# but also an example of how to configure Pods in a cluster where the emulator
# is deployed. Use this as reference for how to configure your production Pods.

# ServiceAccount configuration is the exact same of Workload Identity in GKE.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test
  namespace: default
  annotations:
    # This annotation is how Workload Identity is configured in GKE.
    # This project uses the same annotation to know which Google Service Account to impersonate.
    iam.gke.io/gcp-service-account: test-sa@gke-metadata-server.iam.gserviceaccount.com
---
apiVersion: v1
kind: Pod
metadata:
  name: <POD_NAME>
  namespace: default
  labels:
    # This label is used by the MutatingWebhookConfiguration to select which Pods to mutate.
    # The mutation injects the host alias metadata.google.internal ---> 169.254.169.254 and
    # an initContainer that installs iptables rules in the Pod network namespace to redirect
    # outbound traffic targeting 169.254.169.254:80 to the emulator port on the Node.
    gke-metadata-server.matheuscscp.io/webhook: Mutate
spec:
  serviceAccountName: test # Use the ServiceAccount created above.

  # ATTENTION: All the configuration below is test-only and not needed in production!

  restartPolicy: Never
  hostNetwork: <HOST_NETWORK>
  dnsPolicy: ClusterFirstWithHostNet
  containers:
  - name: test
    image: ghcr.io/matheuscscp/gke-metadata-server/test@<GO_TEST_DIGEST>