e2e: add tests to verify metrics endpoint

test/e2e/metrics_endpoint_test.go

@@ -0,0 +1,80 @@
+package e2e
+
+import (
+	"bytes"
+	"os/exec"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// nolint:gosec
+// TestCatalogdMetricsExportedEndpoint tests that the metrics endpoint is exported and can be accessed by users authorized
+// by the RBAC/ServiceAccount Token.
+func TestCatalogdMetricsExportedEndpoint(t *testing.T) {
+	var (
+		token     string
+		curlPod   = "curl-metrics"
+		namespace = "olmv1-system"
+	)
+
+	cmd := exec.Command("kubectl", "create", "clusterrolebinding", "catalogd-metrics-binding",
+		"--clusterrole=catalogd-metrics-reader",
+		"--serviceaccount="+namespace+":catalogd-controller-manager")
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, "Error creating ClusterRoleBinding: %s", string(output))
+
+	defer func() {
+		_ = exec.Command("kubectl", "delete", "clusterrolebinding", "catalogd-metrics-binding", "--ignore-not-found=true").Run()
+	}()
+
+	tokenCmd := exec.Command("kubectl", "create", "token", "catalogd-controller-manager", "-n", namespace)
+	tokenOutput, err := tokenCmd.Output()
+	require.NoError(t, err, "Error creating token: %s", string(tokenOutput))
+	token = string(bytes.TrimSpace(tokenOutput))
+
+	cmd = exec.Command("kubectl", "run", curlPod,
+		"--image=curlimages/curl:7.87.0", "-n", namespace,
+		"--restart=Never",
+		"--overrides", `{
+			"spec": {
+				"containers": [{
+					"name": "curl",
+					"image": "curlimages/curl:7.87.0",
+					"command": ["sh", "-c", "sleep 3600"],
+					"securityContext": {
+						"allowPrivilegeEscalation": false,
+						"capabilities": {
+							"drop": ["ALL"]
+						},
+						"runAsNonRoot": true,
+						"runAsUser": 1000,
+						"seccompProfile": {
+							"type": "RuntimeDefault"
+						}
+					}
+				}],
+				"serviceAccountName": "catalogd-controller-manager"
+			}
+		}`)
+	output, err = cmd.CombinedOutput()
+	require.NoError(t, err, "Error creating curl pod: %s", string(output))
+
+	defer func() {
+		_ = exec.Command("kubectl", "delete", "pod", curlPod, "-n", namespace, "--ignore-not-found=true").Run()
+	}()
+
+	require.Eventually(t, func() bool {
+		statusCmd := exec.Command("kubectl", "get", "pod", curlPod, "-n", namespace, "-o", "jsonpath={.status.phase}")
+		statusOutput, _ := statusCmd.Output()
+		return string(bytes.TrimSpace(statusOutput)) == "Running"
+	}, 60*time.Second, 5*time.Second, "Curl pod is not running")
+
+	metricsURL := "https://catalogd-service.olmv1-system.svc.cluster.local:7443/metrics"
+	curlCmd := exec.Command("kubectl", "exec", curlPod, "-n", namespace, "--",
+		"curl", "-v", "-k", "-H", "Authorization: Bearer "+token, metricsURL)
+	output, err = curlCmd.CombinedOutput()
+	require.NoError(t, err, "Error calling metrics endpoint: %s", string(output))
+	require.Contains(t, string(output), "200 OK", "Metrics endpoint did not return 200 OK")
+}