cnbugs
39 lines
1.4 KiB
Python
39 lines
1.4 KiB
Python
import unittest
|
|
|
|
from backend.agent_tools import classify_kubectl_command, parse_kubectl_command
|
|
|
|
|
|
class KubectlCommandPolicyTest(unittest.TestCase):
|
|
def test_allows_read_only_kubectl_command_for_autonomous_execution(self):
|
|
decision = classify_kubectl_command("kubectl get pods -n production -o wide")
|
|
|
|
self.assertEqual(decision.mode, "read")
|
|
self.assertFalse(decision.requires_approval)
|
|
|
|
def test_requires_approval_for_mutating_kubectl_command(self):
|
|
decision = classify_kubectl_command("kubectl rollout restart deployment/api -n production")
|
|
|
|
self.assertEqual(decision.mode, "write")
|
|
self.assertTrue(decision.requires_approval)
|
|
|
|
def test_rejects_shell_operators_and_non_kubectl_commands(self):
|
|
for command in (
|
|
"kubectl get pods; rm -rf /",
|
|
"kubectl get pods | sh",
|
|
"bash -c kubectl get pods",
|
|
"sudo kubectl get pods",
|
|
):
|
|
with self.subTest(command=command):
|
|
with self.assertRaises(ValueError):
|
|
parse_kubectl_command(command)
|
|
|
|
def test_rejects_exec_even_when_command_looks_read_only(self):
|
|
decision = classify_kubectl_command("kubectl exec api-0 -- cat /etc/hosts")
|
|
|
|
self.assertEqual(decision.mode, "write")
|
|
self.assertTrue(decision.requires_approval)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|