feat(e2e): e2e tests to support http mode

.github/workflows/e2e.yaml

@@ -28,6 +28,8 @@ jobs:
     strategy:
       matrix:
         k8s-version: [ 'v1.16.15', 'v1.17.11', 'v1.18.8', 'v1.19.4', 'v1.20.7', 'v1.21.2', 'v1.22.0' ]
+        capsule-proxy-mode: [ 'https', 'http' ]
+        test-clients: [ 'kubectl', 'curl' ]
     runs-on: ubuntu-18.04
     steps:
       - uses: actions/checkout@v2
@@ -51,4 +53,4 @@ jobs:
       - name: Installing jq
         run: sudo apt-get install -y jq        
       - name: e2e testing
-        run: make e2e/${{ matrix.k8s-version }}
+        run: CLIENT_TEST=${{ matrix.test-clients }} CAPSULE_PROXY_MODE=${{ matrix.capsule-proxy-mode }} KIND_K8S_VERSION=${{ matrix.k8s-version }} make e2e

Makefile

@@ -8,30 +8,61 @@ endif
 dlv-build:
 	docker build . --build-arg "GCFLAGS=all=-N -l" --tag quay.io/clastix/capsule-proxy:dlv --target dlv
 
-docker-build:
-	docker build . -t quay.io/clastix/capsule-proxy:latest
 
-e2e/clean:
-	kind delete cluster --name capsule
+docker/build:
+	@echo "Building docker image..."
+	@docker build . -t quay.io/clastix/capsule-proxy:latest
 
-e2e/%: docker-build
-	kind create cluster --name capsule --image kindest/node:$* --config ./e2e/kind.yaml --wait=120s \
-	&& kubectl taint nodes capsule-worker2 key1=value1:NoSchedule
-	helm repo add bitnami https://charts.bitnami.com/bitnami
-	helm upgrade --install --namespace metrics-system --create-namespace metrics-server bitnami/metrics-server \
-	--set apiService.create=true --set extraArgs.kubelet-insecure-tls=true
-	helm repo add clastix https://clastix.github.io/charts
-	helm upgrade --install --create-namespace --namespace capsule-system capsule clastix/capsule \
+kind/clean:
+	@echo "Deleting cluser..."
+	@kind delete cluster --name capsule
+
+kind:
+ 	# build environment
+	@echo "Building kubernetes env using Kind $${KIND_K8S_VERSION:-v1.22.0}..."
+	@kind create cluster --name capsule --image kindest/node:$${KIND_K8S_VERSION:-v1.22.0} --config ./e2e/kind.yaml --wait=120s \
+		&& kubectl taint nodes capsule-worker2 key1=value1:NoSchedule
+	@helm repo add bitnami https://charts.bitnami.com/bitnami
+	@helm upgrade --install --namespace metrics-system --create-namespace metrics-server bitnami/metrics-server \
+		--set apiService.create=true --set extraArgs.kubelet-insecure-tls=true	
+
+capsule:
+	@echo "Installing capsule..."
+	@helm repo add clastix https://clastix.github.io/charts
+	@helm upgrade --install --create-namespace --namespace capsule-system capsule clastix/capsule \
 		--set "manager.resources=null" \
 		--set "manager.options.forceTenantPrefix=true" \
 		--set "options.logLevel=8"
-	# capsule-proxy certificates
-	cd hack \
-        && mkcert -install && mkcert 127.0.0.1 \
-    	&& kubectl --namespace capsule-system create secret tls capsule-proxy --key=./127.0.0.1-key.pem --cert ./127.0.0.1.pem
-	# fake kubeconfig
-	cd hack \
-        && curl -s https://raw.githubusercontent.com/clastix/capsule/master/hack/create-user.sh | bash -s -- alice oil capsule.clastix.io \
+
+
+capsule-proxy:
+	@echo "Installing Capsule-Proxy..."
+	@echo "Loading Docker image..."
+	@kind load docker-image --name capsule --nodes capsule-worker quay.io/clastix/capsule-proxy:latest
+ifeq ($(CAPSULE_PROXY_MODE),http)
+	@echo "Running in HTTP mode"
+	@echo "kubeconfig configurations..."
+	@cd hack \
+		&& curl -s https://raw.githubusercontent.com/clastix/capsule/master/hack/create-user.sh | bash -s -- alice oil capsule.clastix.io \
+		&& mv alice-oil.kubeconfig alice.kubeconfig \
+		&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.server http://127.0.0.1:9001
+	@echo "Installing Capsule-Proxy using HELM..."
+	@helm upgrade --install capsule-proxy ./charts/capsule-proxy -n capsule-system \
+		--set "image.pullPolicy=Never" \
+		--set "image.tag=latest" \
+		--set "options.enableSSL=false" \
+		--set "service.type=NodePort" \
+		--set "service.nodePort=" \
+		--set "kind=DaemonSet" \
+		--set "daemonset.hostNetwork=true"
+else
+	@echo "Running in HTTPS mode"
+	@echo "capsule proxy certificates..."
+	cd hack && mkcert -install && mkcert 127.0.0.1 \
+		&& kubectl --namespace capsule-system create secret tls capsule-proxy --key=./127.0.0.1-key.pem --cert ./127.0.0.1.pem
+	@echo "kubeconfig configurations..."
+	@cd hack \
+		&& curl -s https://raw.githubusercontent.com/clastix/capsule/master/hack/create-user.sh | bash -s -- alice oil capsule.clastix.io \
 		&& mv alice-oil.kubeconfig alice.kubeconfig \
 		&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
 		&& KUBECONFIG=alice.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
@@ -40,26 +71,30 @@ e2e/%: docker-build
 		&& KUBECONFIG=bob.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
 		&& KUBECONFIG=bob.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
 		&& curl -s https://raw.githubusercontent.com/clastix/capsule/master/hack/create-user.sh | bash -s -- joe gas capsule.clastix.io,foo.clastix.io \
-        && mv joe-gas.kubeconfig foo.clastix.io.kubeconfig \
-        && KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
-        && KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
+		&& mv joe-gas.kubeconfig foo.clastix.io.kubeconfig \
+		&& KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
+		&& KUBECONFIG=foo.clastix.io.kubeconfig kubectl config set clusters.kind-capsule.server https://127.0.0.1:9001 \
 		&& curl -s https://raw.githubusercontent.com/clastix/capsule/master/hack/create-user.sh | bash -s -- dave soil capsule.clastix.io,bar.clastix.io \
-        && mv dave-soil.kubeconfig dave.kubeconfig \
-        && kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
-        && kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.server https://127.0.0.1:9001
-	# capsule-proxy installation
-	kind load docker-image --name capsule --nodes capsule-worker quay.io/clastix/capsule-proxy:latest
-	helm upgrade --install capsule-proxy ./charts/capsule-proxy -n capsule-system \
+		&& mv dave-soil.kubeconfig dave.kubeconfig \
+		&& kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.certificate-authority-data $$(cat $(ROOTCA) | base64 |tr -d '\n') \
+		&& kubectl --kubeconfig=dave.kubeconfig config set clusters.kind-capsule.server https://127.0.0.1:9001
+	@echo "Installing Capsule-Proxy using HELM..."
+	@helm upgrade --install capsule-proxy ./charts/capsule-proxy -n capsule-system \
 		--set "image.pullPolicy=Never" \
 		--set "image.tag=latest" \
-		--set "options.enableSSL=true" \
 		--set "service.type=NodePort" \
 		--set "service.nodePort=" \
 		--set "kind=DaemonSet" \
 		--set "daemonset.hostNetwork=true"
-	# kubectl RBAC fix
-	kubectl create clusterrole capsule-selfsubjectaccessreviews --verb=create --resource=selfsubjectaccessreviews.authorization.k8s.io
-	kubectl create clusterrole capsule-apis --verb="get" --non-resource-url="/api/*" --non-resource-url="/api" --non-resource-url="/apis/*" --non-resource-url="/apis" --non-resource-url="/version"
-	kubectl create clusterrolebinding capsule:selfsubjectaccessreviews --clusterrole=capsule-selfsubjectaccessreviews --group=capsule.clastix.io
-	kubectl create clusterrolebinding capsule:apis --clusterrole=capsule-apis --group=capsule.clastix.io
-	./e2e/run.bash
+endif
+
+rbac-fix:
+	@echo "RBAC customization..."
+	@kubectl create clusterrole capsule-selfsubjectaccessreviews --verb=create --resource=selfsubjectaccessreviews.authorization.k8s.io
+	@kubectl create clusterrole capsule-apis --verb="get" --non-resource-url="/api/*" --non-resource-url="/api" --non-resource-url="/apis/*" --non-resource-url="/apis" --non-resource-url="/version"
+	@kubectl create clusterrolebinding capsule:selfsubjectaccessreviews --clusterrole=capsule-selfsubjectaccessreviews --group=capsule.clastix.io
+	@kubectl create clusterrolebinding capsule:apis --clusterrole=capsule-apis --group=capsule.clastix.io
+
+
+e2e: docker/build kind capsule capsule-proxy rbac-fix
+	@./e2e/run.bash $${CLIENT_TEST:-kubectl}-$${CAPSULE_PROXY_MODE:-https}

e2e/curl-http-tests/00_root.bats

@@ -0,0 +1,28 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../libs/poll.bash"
+load "$BATS_TEST_DIRNAME/../libs/serviceaccount_utils.bash"
+
+setup() {
+  create_serviceaccount sa default
+  token=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.users[?(@.name == "sa")].user.token}')
+  endpoint=http://127.0.0.1:9001
+}
+
+@test "Checking api-resources" {
+  echo "Endpoint Checking api-resources $endpoint" >&3
+  curl -H "Authorization: Bearer $token" $endpoint/apis >&3
+  run sh -c "curl -s -H \"Authorization: Bearer $token\" $endpoint/apis"
+  echo "output: $output" >&3
+  echo "status: $status" >&3  
+  [ $status -eq 0 ]
+}
+
+@test "Checking version" {
+  echo "Endpoint Checking version $endpoint" >&3
+  curl -H "Authorization: Bearer $token" $endpoint/version >&3
+  run sh -c "curl -s -H \"Authorization: Bearer $token\" $endpoint/version"
+  echo "output: $output" >&3
+  echo "status: $status" >&3
+  [ $status -eq 0 ]
+}

e2e/curl-http-tests/namespaces/get.bats

@@ -0,0 +1,32 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../../libs/namespaces_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/poll.bash"
+load "$BATS_TEST_DIRNAME/../../libs/tenants_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/rolebinding_utils.bash"
+
+setup() {
+  create_tenant oil alice User
+  create_namespace alice oil-dev
+  create_namespace alice oil-staging
+  create_namespace alice oil-production
+  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:default:sa"}}]'
+  create_serviceaccount sa default
+  token=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.users[?(@.name == "sa")].user.token}')
+  endpoint=http://127.0.0.1:9001
+}
+
+teardown() {
+  delete_tenant oil
+}
+
+@test "List allowed namespace" {
+  poll_until_equals "SA" "oil-dev" "curl -s -H \"Authorization: Bearer $token\" $endpoint/api/v1/namespaces/oil-dev | jq -r '.metadata.name'" 3 5
+  poll_until_equals "SA" "oil-production" "curl -s -H \"Authorization: Bearer $token\" $endpoint/api/v1/namespaces/oil-production | jq -r '.metadata.name'" 3 5
+  poll_until_equals "SA" "oil-staging" "curl -s -H \"Authorization: Bearer $token\" $endpoint/api/v1/namespaces/oil-staging | jq -r '.metadata.name'" 3 5
+}
+
+@test "List non-allowed namespaces" {
+  poll_until_equals "SA" "Forbidden" "curl -s -H \"Authorization: Bearer $token\"  $endpoint/api/v1/namespaces/kube-system | jq -r '.reason'" 3 5
+}

e2e/curl-http-tests/namespaces/list.bats

@@ -0,0 +1,29 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../../libs/namespaces_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/poll.bash"
+load "$BATS_TEST_DIRNAME/../../libs/tenants_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/rolebinding_utils.bash"
+
+setup() {
+  create_tenant oil alice User
+  create_namespace alice oil-dev
+  create_namespace alice oil-staging
+  create_namespace alice oil-production
+  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:default:sa"}}]'
+  create_serviceaccount sa default
+  token=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.users[?(@.name == "sa")].user.token}')
+  endpoint=http://127.0.0.1:9001
+}
+
+teardown() {
+  delete_tenant oil
+}
+
+@test "List allowed namespaces" {
+  local sa="oil-dev
+oil-production
+oil-staging"
+  poll_until_equals "SA" "$sa" "curl -s -H "Authorization: Bearer $token"  $endpoint/api/v1/namespaces | jq -r '.items[].metadata.name'" 3 5
+}

e2e/curl-https-tests/00_root.bats

@@ -0,0 +1,19 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../libs/poll.bash"
+load "$BATS_TEST_DIRNAME/../libs/serviceaccount_utils.bash"
+
+setup() {
+  create_serviceaccount sa default
+  token=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.users[?(@.name == "sa")].user.token}')
+  endpoint=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.clusters[?(@.name == "kind-capsule")].cluster.server}')
+}
+@test "Checking api-resources" {
+  run sh -c "curl -s -H \"Authorization: Bearer $token\" $endpoint/apis"
+  [ $status -eq 0 ]
+}
+
+@test "Checking version" {
+  run sh -c "curl -s -H \"Authorization: Bearer $token\" $endpoint/version"
+  [ $status -eq 0 ]
+}

e2e/curl-https-tests/namespaces/get.bats

@@ -0,0 +1,32 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../../libs/namespaces_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/poll.bash"
+load "$BATS_TEST_DIRNAME/../../libs/tenants_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/rolebinding_utils.bash"
+
+setup() {
+  create_tenant oil alice User
+  create_namespace alice oil-dev
+  create_namespace alice oil-staging
+  create_namespace alice oil-production
+  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:default:sa"}}]' 
+  create_serviceaccount sa default
+  token=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.users[?(@.name == "sa")].user.token}')
+  endpoint=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.clusters[?(@.name == "kind-capsule")].cluster.server}')
+}
+
+teardown() {
+  delete_tenant oil
+}
+
+@test "List allowed namespace" {
+  poll_until_equals "SA" "oil-dev" "curl -s -H \"Authorization: Bearer $token\" $endpoint/api/v1/namespaces/oil-dev | jq -r '.metadata.name'" 3 5
+  poll_until_equals "SA" "oil-production" "curl -s -H \"Authorization: Bearer $token\" $endpoint/api/v1/namespaces/oil-production | jq -r '.metadata.name'" 3 5
+  poll_until_equals "SA" "oil-staging" "curl -s -H \"Authorization: Bearer $token\" $endpoint/api/v1/namespaces/oil-staging | jq -r '.metadata.name'" 3 5
+}
+
+@test "List non-allowed namespaces" {
+  poll_until_equals "SA" "Forbidden" "curl -s -H \"Authorization: Bearer $token\"  $endpoint/api/v1/namespaces/kube-system | jq -r '.reason'" 3 5
+}

e2e/curl-https-tests/namespaces/list.bats

@@ -0,0 +1,30 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../../libs/namespaces_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/poll.bash"
+load "$BATS_TEST_DIRNAME/../../libs/tenants_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/serviceaccount_utils.bash"
+load "$BATS_TEST_DIRNAME/../../libs/rolebinding_utils.bash"
+
+setup() {
+  create_tenant oil alice User
+  create_namespace alice oil-dev
+  create_namespace alice oil-staging
+  create_namespace alice oil-production
+  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:default:sa"}}]'
+  create_serviceaccount sa default
+  token=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.users[?(@.name == "sa")].user.token}')
+  endpoint=$(KUBECONFIG=${HACK_DIR}/sa.kubeconfig kubectl config view -o json --raw -o jsonpath='{.clusters[?(@.name == "kind-capsule")].cluster.server}')
+}
+
+teardown() {
+  delete_tenant oil
+}
+
+@test "List allowed namespaces" {
+  local sa="oil-dev
+oil-production
+oil-staging"
+  echo "Endpoint List allowed namespaces $endpoint" >&3
+  poll_until_equals "SA" "$sa" "curl -s -H "Authorization: Bearer $token"  $endpoint/api/v1/namespaces | jq -r '.items[].metadata.name'" 3 5
+}

e2e/kubectl-http-tests/00_root.bats

@@ -0,0 +1,13 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../libs/poll.bash"
+
+@test "Checking kubectl api-resources" {
+  run sh -c "KUBECONFIG=${HACK_DIR}/alice.kubeconfig kubectl api-resources"
+  [ $status -ne 0 ]
+}
+
+@test "Checking kubectl version" {
+  run sh -c "KUBECONFIG=${HACK_DIR}/alice.kubeconfig kubectl version"
+  [ $status -ne 0 ]
+}

e2e/kubectl-http-tests/namespaces/list.bats

@@ -0,0 +1,8 @@
+#!/usr/bin/env bats
+
+load "$BATS_TEST_DIRNAME/../../libs/poll.bash"
+
+@test "List namespaces" {
+  namespaces=$(kubectl get ns -o name)
+  poll_until_different "User" "$namespaces" "kubectl --kubeconfig=${HACK_DIR}/alice.kubeconfig get namespaces --output=name" 3 5
+}

e2e/tests/namespaces/list.bats → e2e/kubectl-https-tests/namespaces/list.bats

@@ -8,13 +8,12 @@ load "$BATS_TEST_DIRNAME/../../libs/rolebinding_utils.bash"
 
 setup() {
   create_tenant oil alice User
-  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:oil-dev:sa"}}]'
+  kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/1", "value": {"kind": "ServiceAccount", "name": "system:serviceaccount:default:sa"}}]'
   kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/owners/2", "value": {"kind": "Group", "name": "foo.clastix.io"}}]'
   kubectl patch tenants.capsule.clastix.io oil --type=json -p '[{"op": "add", "path": "/spec/namespaceOptions", "value": {"additionalMetadata": {"labels": {"bizz": "buzz"}}}}]'
   create_namespace alice oil-dev
   create_namespace alice oil-staging
   create_namespace alice oil-production
-  create_serviceaccount sa oil-dev
 
   create_tenant metal alice User
   kubectl patch tenants.capsule.clastix.io metal --type=json -p '[{"op": "add", "path": "/spec/namespaceOptions", "value": {"additionalMetadata": {"labels": {"foo": "bar"}}}}]'
@@ -86,16 +85,16 @@ namespace/oil-staging"
   echo "SA" >&3
   run kubectl --kubeconfig=${HACK_DIR}/sa.kubeconfig get namespace default
   [ $status -eq 1 ]
-  [ "${lines[0]}" = 'Error from server (Forbidden): namespaces "default" is forbidden: User "system:serviceaccount:oil-dev:sa" cannot get resource "namespaces" in API group "" in the namespace "default"' ]
+  [ "${lines[0]}" = 'Error from server (Forbidden): namespaces "default" is forbidden: User "system:serviceaccount:default:sa" cannot get resource "namespaces" in API group "" in the namespace "default"' ]
   run kubectl --kubeconfig=${HACK_DIR}/sa.kubeconfig --namespace default get pods
   [ $status -eq 1 ]
-  [ "${lines[0]}" = 'Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:oil-dev:sa" cannot list resource "pods" in API group "" in the namespace "default"' ]
+  [ "${lines[0]}" = 'Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:default:sa" cannot list resource "pods" in API group "" in the namespace "default"' ]
   run kubectl --kubeconfig=${HACK_DIR}/sa.kubeconfig --namespace default get services
   [ $status -eq 1 ]
-  [ "${lines[0]}" = 'Error from server (Forbidden): services is forbidden: User "system:serviceaccount:oil-dev:sa" cannot list resource "services" in API group "" in the namespace "default"' ]
+  [ "${lines[0]}" = 'Error from server (Forbidden): services is forbidden: User "system:serviceaccount:default:sa" cannot list resource "services" in API group "" in the namespace "default"' ]
   run kubectl --kubeconfig=${HACK_DIR}/sa.kubeconfig --namespace default get configmaps
   [ $status -eq 1 ]
-  [ "${lines[0]}" = 'Error from server (Forbidden): configmaps is forbidden: User "system:serviceaccount:oil-dev:sa" cannot list resource "configmaps" in API group "" in the namespace "default"' ]
+  [ "${lines[0]}" = 'Error from server (Forbidden): configmaps is forbidden: User "system:serviceaccount:default:sa" cannot list resource "configmaps" in API group "" in the namespace "default"' ]
 
   echo "Group" >&3
   run kubectl --kubeconfig=${HACK_DIR}/foo.clastix.io.kubeconfig get namespace default