Skip to content

Commit b4d8324

Browse files
ContentfulCormacContentfulCormac
committed
feat: [MEC-1478] fix tests
1 parent 38f26ea commit b4d8324

File tree

2 files changed

+152
-54
lines changed

2 files changed

+152
-54
lines changed

‎controllers/syncedsecret_controller.go‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -101,42 +101,42 @@ func (r *SyncedSecretReconciler) Reconcile(ctx context.Context, req ctrl.Request
101101
log = log.WithValues(LogFieldK8SSecret, K8SSecretName.String())
102102

103103
if cs.Spec.AWSAccountID != nil {
104-
// IAMRole := fmt.Sprintf("arn:aws:iam::%s:role/secret-syncer", *cs.Spec.AWSAccountID)
105-
// var secretRef *string // secretID of the secret in secret Manager
104+
IAMRole := fmt.Sprintf("arn:aws:iam::%s:role/secret-syncer", *cs.Spec.AWSAccountID)
105+
var secretRef *string // secretID of the secret in secret Manager
106106

107107
// We need to check each secret in Data and DataFrom to see if they are allowed in the namespace
108-
// if cs.Spec.DataFrom != nil {
109-
// if cs.Spec.DataFrom.SecretRef != nil {
110-
// secretRef = cs.Spec.DataFrom.SecretRef.Name
111-
// if secretRef == nil {
112-
// return ctrl.Result{}, errors.WithMessagef(err, "secretRef name is invalid %s", *secretRef)
113-
// }
114-
115-
// allowed, err := r.secretAllowedInNamespace(*secretRef, IAMRole, cs.Namespace, cs.Name)
116-
117-
// if !allowed || err != nil {
118-
// return ctrl.Result{}, errors.WithMessagef(err, "failed to validate if secret %s with role %s is allowed in namespace %s", *secretRef, IAMRole, cs.Namespace)
119-
// }
120-
// }
121-
122-
// }
123-
124-
// if cs.Spec.Data != nil {
125-
// for _, field := range cs.Spec.Data {
126-
// if field.ValueFrom.SecretRef != nil {
127-
// secretRef = field.ValueFrom.SecretKeyRef.Name
128-
// if secretRef == nil {
129-
// return ctrl.Result{}, errors.WithMessagef(err, "secretRef name is invalid %s", *secretRef)
130-
// }
131-
132-
// allowed, err := r.secretAllowedInNamespace(*secretRef, IAMRole, cs.Namespace, cs.Name)
133-
134-
// if !allowed || err != nil {
135-
// return ctrl.Result{}, errors.WithMessagef(err, "failed to validate if secret %s with role %s is allowed in namespace %s", *secretRef, IAMRole, cs.Namespace)
136-
// }
137-
// }
138-
// }
139-
// }
108+
if cs.Spec.DataFrom != nil {
109+
if cs.Spec.DataFrom.SecretRef != nil {
110+
secretRef = cs.Spec.DataFrom.SecretRef.Name
111+
if secretRef == nil {
112+
return ctrl.Result{}, errors.WithMessagef(err, "secretRef name is invalid %s", *secretRef)
113+
}
114+
115+
allowed, err := r.secretAllowedInNamespace(*secretRef, IAMRole, cs.Namespace, cs.Name)
116+
117+
if !allowed || err != nil {
118+
return ctrl.Result{}, errors.WithMessagef(err, "failed to validate if secret %s with role %s is allowed in namespace %s", *secretRef, IAMRole, cs.Namespace)
119+
}
120+
}
121+
122+
}
123+
124+
if cs.Spec.Data != nil {
125+
for _, field := range cs.Spec.Data {
126+
if field.ValueFrom.SecretRef != nil {
127+
secretRef = field.ValueFrom.SecretKeyRef.Name
128+
if secretRef == nil {
129+
return ctrl.Result{}, errors.WithMessagef(err, "secretRef name is invalid %s", *secretRef)
130+
}
131+
132+
allowed, err := r.secretAllowedInNamespace(*secretRef, IAMRole, cs.Namespace, cs.Name)
133+
134+
if !allowed || err != nil {
135+
return ctrl.Result{}, errors.WithMessagef(err, "failed to validate if secret %s with role %s is allowed in namespace %s", *secretRef, IAMRole, cs.Namespace)
136+
}
137+
}
138+
}
139+
}
140140

141141
} else {
142142
allowed, err := r.RoleValidator.IsWhitelisted(*cs.Spec.IAMRole, cs.Namespace)

‎controllers/syncedsecret_controller_test.go‎

Lines changed: 118 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@ package controllers
22

33
import (
44
"context"
5-
"encoding/base64"
6-
"fmt"
75
"reflect"
86
"time"
97

@@ -219,9 +217,8 @@ var _ = Describe("SyncedSecret Controller", func() {
219217
})
220218
})
221219

222-
Context("For a single SyncedSecret", func() {
220+
Context("For a single SyncedSecret with AWSAccountID", func() {
223221
// TODO do a test for DataFrom as well
224-
// TODO do a test for update secret with new way
225222
secretKey := types.NamespacedName{
226223
Name: "another-secret-name",
227224
Namespace: TEST_NAMESPACE2,
@@ -281,33 +278,17 @@ var _ = Describe("SyncedSecret Controller", func() {
281278
"DB_PASS": []byte("cupofcoffee"),
282279
},
283280
}
284-
// Expect(k8sClient.Create(context.Background(), toCreate)).Should(Succeed())
285281
err := k8sClient.Create(context.Background(), toCreate)
286282
Expect(err).ToNot(HaveOccurred())
287-
// Expect(func() bool {
288-
// return true
289-
// }).Should(Succeed())
290283

291284
fetchedSecret := &corev1.Secret{}
292285
Eventually(func() bool {
293286
err := k8sClient.Get(context.Background(), secretKey, fetchedSecret)
294-
// Expect(err).ToNot(HaveOccurred())
295287
return k8serrors.IsNotFound(err)
296288
}, timeout, interval).Should(BeFalse())
297289

298290
// we need to ensure that that secretExpect.Data is a subset of fetchedSecret.Data
299291
// the kubernetes client.go doesn't base64 values this is something that kubectl maybe does
300-
for k, v := range fetchedSecret.Data {
301-
decoded, _ := base64.StdEncoding.DecodeString(string(v))
302-
fmt.Printf("fetchedSecret.Data[%s]: %s\n", k, decoded)
303-
fmt.Printf("fetchedSecret.Data1[%s]: %s\n", k, v)
304-
}
305-
for k, v := range secretExpect.Data {
306-
decoded, _ := base64.StdEncoding.DecodeString(string(v))
307-
fmt.Printf("secretExpect.Data[%s]: %s\n", k, decoded)
308-
fmt.Printf("secretExpect.Data1[%s]: %s\n", k, v)
309-
}
310-
//fmt.Printf("secretExpect.Data: %v\n", secretExpect.Data)
311292
Expect(reflect.DeepEqual(fetchedSecret.Data, secretExpect.Data)).To(BeTrue())
312293

313294
fetchedCfSecret := &secretsv1.SyncedSecret{}
@@ -316,5 +297,122 @@ var _ = Describe("SyncedSecret Controller", func() {
316297
resourceVersion = fetchedCfSecret.ResourceVersion
317298

318299
})
300+
301+
It("Should update k8s secret object if there is change in AwsSecret CRD with AWSAccountID", func() {
302+
MockSecretsOutput.SecretsValueOutput = &secretsmanager.GetSecretValueOutput{
303+
SecretString: _s(`{"database_name":"secretDB","database_pass":"cupofcoffee", "database_name1":"secretDB02"}`),
304+
VersionId: _s(`005`),
305+
}
306+
toUpdate := &secretsv1.SyncedSecret{
307+
ObjectMeta: metav1.ObjectMeta{
308+
Name: secretKey.Name,
309+
Namespace: secretKey.Namespace,
310+
ResourceVersion: resourceVersion,
311+
},
312+
Spec: secretsv1.SyncedSecretSpec{
313+
SecretMetadata: metav1.ObjectMeta{
314+
Name: secretKey.Name,
315+
Namespace: secretKey.Namespace,
316+
},
317+
IAMRole: _s("test"),
318+
AWSAccountID: _s("12345678910"),
319+
Data: []*secretsv1.SecretField{
320+
{
321+
Name: _s("DB_NAME"),
322+
ValueFrom: &secretsv1.ValueFrom{
323+
SecretKeyRef: &secretsv1.SecretKeyRef{
324+
Name: _s("random/aws/secret003"),
325+
Key: _s("database_name1"),
326+
},
327+
},
328+
},
329+
{
330+
Name: _s("DB_PASS"),
331+
ValueFrom: &secretsv1.ValueFrom{
332+
SecretKeyRef: &secretsv1.SecretKeyRef{
333+
Name: _s("random/aws/secret003"),
334+
Key: _s("database_pass"),
335+
},
336+
},
337+
},
338+
},
339+
},
340+
}
341+
342+
secretExpect := &corev1.Secret{
343+
ObjectMeta: metav1.ObjectMeta{
344+
Name: secretKey.Name,
345+
Namespace: secretKey.Namespace,
346+
},
347+
Type: "Opaque",
348+
Data: map[string][]byte{
349+
"DB_NAME": []byte("secretDB02"),
350+
"DB_PASS": []byte("cupofcoffee"),
351+
},
352+
}
353+
354+
Expect(k8sClient.Update(context.Background(), toUpdate)).Should(Succeed())
355+
356+
fetchedSecret := &corev1.Secret{}
357+
Eventually(func() bool {
358+
k8sClient.Get(context.Background(), secretKey, fetchedSecret)
359+
return reflect.DeepEqual(fetchedSecret.Data, secretExpect.Data)
360+
}, timeout, interval).Should(BeTrue())
361+
362+
fetchedCfSecret := &secretsv1.SyncedSecret{}
363+
err := k8sClient.Get(context.Background(), secretKey, fetchedCfSecret)
364+
Expect(err).ToNot(HaveOccurred())
365+
resourceVersion = fetchedCfSecret.ResourceVersion
366+
})
367+
368+
It("Should update the k8s secret object if the mapped AWS Secret changes with AWSAccountID", func() {
369+
MockSecretsOutput.SecretsValueOutput = &secretsmanager.GetSecretValueOutput{
370+
SecretString: _s(`{"database_pass":"cupoftea", "database_name1":"secretDB02"}`),
371+
VersionId: _s(`006`),
372+
}
373+
374+
MockSecretsOutput.SecretsPageOutput = &secretsmanager.ListSecretsOutput{
375+
SecretList: []*secretsmanager.SecretListEntry{
376+
{
377+
Name: _s("random/aws/secret003"),
378+
LastChangedDate: _t(time_now.AddDate(0, 0, -2)),
379+
SecretVersionsToStages: map[string][]*string{
380+
"002": []*string{
381+
_s("AWSCURRENT"),
382+
},
383+
},
384+
}, {
385+
Name: _s("random/aws/secret003"),
386+
LastChangedDate: _t(time_now.AddDate(0, 0, -1)),
387+
SecretVersionsToStages: map[string][]*string{
388+
"005": {
389+
_s("AWSPREVIOUS"),
390+
},
391+
"006": {
392+
_s("AWSCURRENT"),
393+
},
394+
},
395+
},
396+
},
397+
}
398+
399+
secretExpect := &corev1.Secret{
400+
ObjectMeta: metav1.ObjectMeta{
401+
Name: secretKey.Name,
402+
Namespace: secretKey.Namespace,
403+
},
404+
Type: "Opaque",
405+
Data: map[string][]byte{
406+
"DB_NAME": []byte("secretDB02"),
407+
"DB_PASS": []byte("cupoftea"),
408+
},
409+
}
410+
411+
fetchedSecret := &corev1.Secret{}
412+
Eventually(func() bool {
413+
k8sClient.Get(context.Background(), secretKey, fetchedSecret)
414+
return reflect.DeepEqual(fetchedSecret.Data, secretExpect.Data)
415+
}, timeout, interval).Should(BeTrue())
416+
})
319417
})
320418
})

0 commit comments

Comments
 (0)