1 files changed, 78 insertions, 32 deletions

diff --git a/spec/services/ci/generate_kubeconfig_service_spec.rb b/spec/services/ci/generate_kubeconfig_service_spec.rb
index bfde39780dd..c0858b0f0c9 100644
--- a/spec/services/ci/generate_kubeconfig_service_spec.rb
+++ b/spec/services/ci/generate_kubeconfig_service_spec.rb
@@ -4,52 +4,98 @@ require 'spec_helper'
 
 RSpec.describe Ci::GenerateKubeconfigService do
   describe '#execute' do
-    let(:project) { create(:project) }
-    let(:build) { create(:ci_build, project: project) }
-    let(:pipeline) { build.pipeline }
-    let(:agent1) { create(:cluster_agent, project: project) }
-    let(:agent2) { create(:cluster_agent) }
-    let(:authorization1) { create(:agent_project_authorization, agent: agent1) }
-    let(:authorization2) { create(:agent_project_authorization, agent: agent2) }
+    let_it_be(:group) { create(:group) }
+    let_it_be(:project) { create(:project, group: group) }
+    let_it_be(:pipeline) { create(:ci_empty_pipeline, project: project) }
+    let_it_be(:build) { create(:ci_build, project: project, pipeline: pipeline) }
 
-    let(:template) { instance_double(Gitlab::Kubernetes::Kubeconfig::Template) }
+    let_it_be(:agent_project) { create(:project, group: group, name: 'project-containing-agent-config') }
 
-    subject { described_class.new(pipeline, token: build.token).execute }
+    let_it_be(:project_agent_authorization) do
+      agent = create(:cluster_agent, project: agent_project)
+      create(:agent_project_authorization, agent: agent, project: project)
+    end
+
+    let_it_be(:group_agent_authorization) do
+      agent = create(:cluster_agent, project: agent_project)
+      create(:agent_group_authorization, agent: agent, group: group)
+    end
+
+    let(:template) do
+      instance_double(
+        Gitlab::Kubernetes::Kubeconfig::Template,
+        add_cluster: nil,
+        add_user: nil,
+        add_context: nil
+      )
+    end
+
+    let(:agent_authorizations) { [project_agent_authorization, group_agent_authorization] }
+    let(:filter_service) do
+      instance_double(
+        ::Clusters::Agents::FilterAuthorizationsService,
+        execute: agent_authorizations
+      )
+    end
+
+    subject(:execute) { described_class.new(pipeline, token: build.token, environment: nil).execute }
 
     before do
-      expect(Gitlab::Kubernetes::Kubeconfig::Template).to receive(:new).and_return(template)
-      expect(pipeline).to receive(:cluster_agent_authorizations).and_return([authorization1, authorization2])
+      allow(Gitlab::Kubernetes::Kubeconfig::Template).to receive(:new).and_return(template)
+      allow(::Clusters::Agents::FilterAuthorizationsService).to receive(:new).and_return(filter_service)
+    end
+
+    it 'returns a Kubeconfig Template' do
+      expect(execute).to eq(template)
     end
 
-    it 'adds a cluster, and a user and context for each available agent' do
+    it 'adds a cluster' do
       expect(template).to receive(:add_cluster).with(
         name: 'gitlab',
         url: Gitlab::Kas.tunnel_url
       ).once
 
-      expect(template).to receive(:add_user).with(
-        name: "agent:#{agent1.id}",
-        token: "ci:#{agent1.id}:#{build.token}"
-      )
-      expect(template).to receive(:add_user).with(
-        name: "agent:#{agent2.id}",
-        token: "ci:#{agent2.id}:#{build.token}"
-      )
+      execute
+    end
 
-      expect(template).to receive(:add_context).with(
-        name: "#{project.full_path}:#{agent1.name}",
-        namespace: 'production',
-        cluster: 'gitlab',
-        user: "agent:#{agent1.id}"
-      )
-      expect(template).to receive(:add_context).with(
-        name: "#{agent2.project.full_path}:#{agent2.name}",
-        namespace: 'production',
-        cluster: 'gitlab',
-        user: "agent:#{agent2.id}"
+    it "filters the pipeline's agents by `nil` environment" do
+      expect(::Clusters::Agents::FilterAuthorizationsService).to receive(:new).with(
+        pipeline.cluster_agent_authorizations,
+        environment: nil
       )
 
-      expect(subject).to eq(template)
+      execute
+    end
+
+    it 'adds user and context for all eligible agents', :aggregate_failures do
+      agent_authorizations.each do |authorization|
+        expect(template).to receive(:add_user).with(
+          name: "agent:#{authorization.agent.id}",
+          token: "ci:#{authorization.agent.id}:#{build.token}"
+        )
+
+        expect(template).to receive(:add_context).with(
+          name: "#{agent_project.full_path}:#{authorization.agent.name}",
+          namespace: 'production',
+          cluster: 'gitlab',
+          user: "agent:#{authorization.agent.id}"
+        )
+      end
+
+      execute
+    end
+
+    context 'when environment is specified' do
+      subject(:execute) { described_class.new(pipeline, token: build.token, environment: 'production').execute }
+
+      it "filters the pipeline's agents by the specified environment" do
+        expect(::Clusters::Agents::FilterAuthorizationsService).to receive(:new).with(
+          pipeline.cluster_agent_authorizations,
+          environment: 'production'
+        )
+
+        execute
+      end
     end
   end
 end