test: only allow certain jobs to use certain labels/presets at presub…

…mit time

Signed-off-by: Ernest Wong <chuwon@microsoft.com>

config/tests/jobs/jobs_test.go

@@ -1279,3 +1279,56 @@ func TestKubernetesProwJobsShouldNotUseDeprecatedScenarios(t *testing.T) {
 		t.Logf("%v/%v jobs using deprecated scenarios", fails, total)
 	}
 }
+
+// Only allow certain prow jobs to use certain labels/presets
+func TestJobPresetsRestricted(t *testing.T) {
+	presetsRestricted := map[string]sets.String{
+		"preset-azure-cred": sets.NewString(
+			"kubernetes-csi/csi-driver-nfs",
+			"kubernetes-csi/csi-driver-smb",
+			"kubernetes-sigs/azuredisk-csi-driver",
+			"kubernetes-sigs/azurefile-csi-driver",
+			"kubernetes-sigs/blob-csi-driver",
+			"kubernetes-sigs/cloud-provider-azure",
+			"kubernetes-sigs/image-builder",
+			"kubernetes-sigs/secrets-store-csi-driver",
+			"kubernetes-sigs/sig-windows",
+			"kubernetes/sig-cloud-provider",
+			"kubernetes/sig-network",
+		),
+		"preset-azure-cred-only": sets.NewString(
+			"kubernetes-sigs/cluster-api-provider-azure",
+		),
+	}
+
+	jobs := []cfg.JobBase{}
+	for _, job := range c.AllStaticPresubmits(nil) {
+		jobs = append(jobs, job.JobBase)
+	}
+	for _, job := range c.AllStaticPostsubmits(nil) {
+		jobs = append(jobs, job.JobBase)
+	}
+	for _, job := range c.AllPeriodics() {
+		jobs = append(jobs, job.JobBase)
+	}
+
+	for _, job := range jobs {
+		cleanPath := strings.Trim(strings.TrimPrefix(job.SourcePath, *jobConfigPath), string(filepath.Separator))
+		seps := strings.Split(cleanPath, string(filepath.Separator))
+		if len(seps) <= 2 {
+			continue
+		}
+
+		org := seps[0]
+		project := seps[1]
+		for label := range job.Labels {
+			if allowedOrgProject, ok := presetsRestricted[label]; ok {
+				if allowedOrgProject.Has(filepath.Join(org, project)) {
+					t.Logf("allow preset %s for job defined %s in %s", label, job.Name, job.SourcePath)
+				} else {
+					t.Errorf("%s defined in %s may not use preset %s", job.Name, job.SourcePath, label)
+				}
+			}
+		}
+	}
+}