kubectl/pkg/cmd/create/create_secret_test.go

581 lines
17 KiB
Go

/*
Copyright 2014 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package create
import (
"os"
"testing"
"github.com/stretchr/testify/require"
corev1 "k8s.io/api/core/v1"
apiequality "k8s.io/apimachinery/pkg/api/equality"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
func TestCreateSecretObject(t *testing.T) {
secretObject := newSecretObj("foo", "foo-namespace", corev1.SecretTypeDockerConfigJson)
expectedSecretObject := &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
Namespace: "foo-namespace",
},
Type: corev1.SecretTypeDockerConfigJson,
Data: map[string][]byte{},
}
t.Run("Creating a Secret Object", func(t *testing.T) {
if !apiequality.Semantic.DeepEqual(secretObject, expectedSecretObject) {
t.Errorf("expected:\n%#v\ngot:\n%#v", secretObject, expectedSecretObject)
}
})
}
func TestCreateSecretGeneric(t *testing.T) {
tests := map[string]struct {
secretName string
secretType string
fromLiteral []string
fromFile []string
fromEnvFile []string
appendHash bool
setup func(t *testing.T, secretGenericOptions *CreateSecretOptions) func()
expected *corev1.Secret
expectErr string
}{
"create_secret_foo": {
secretName: "foo",
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Data: map[string][]byte{},
},
},
"create_secret_foo_hash": {
secretName: "foo",
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo-949tdgdkgg",
},
Data: map[string][]byte{},
},
},
"create_secret_foo_type": {
secretName: "foo",
secretType: "my-type",
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Data: map[string][]byte{},
Type: "my-type",
},
},
"create_secret_foo_type_hash": {
secretName: "foo",
secretType: "my-type",
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo-dg474f9t76",
},
Data: map[string][]byte{},
Type: "my-type",
},
},
"create_secret_foo_two_literal": {
secretName: "foo",
fromLiteral: []string{"key1=value1", "key2=value2"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Data: map[string][]byte{
"key1": []byte("value1"),
"key2": []byte("value2"),
},
},
},
"create_secret_foo_two_literal_hash": {
secretName: "foo",
fromLiteral: []string{"key1=value1", "key2=value2"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo-tf72c228m4",
},
Data: map[string][]byte{
"key1": []byte("value1"),
"key2": []byte("value2"),
},
},
},
"create_secret_foo_key1_=value1": {
secretName: "foo",
fromLiteral: []string{"key1==value1"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Data: map[string][]byte{
"key1": []byte("=value1"),
},
},
},
"create_secret_foo_key1_=value1_hash": {
secretName: "foo",
fromLiteral: []string{"key1==value1"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo-fdcc8tkhh5",
},
Data: map[string][]byte{
"key1": []byte("=value1"),
},
},
},
"create_secret_foo_from_file_foo1_foo2_secret": {
secretName: "foo",
setup: setupSecretBinaryFile([]byte{0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64}),
fromFile: []string{"foo1", "foo2"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Data: map[string][]byte{
"foo1": []byte("hello world"),
"foo2": []byte("hello world"),
},
},
},
"create_secret_foo_from_file_foo1_foo2_hash": {
secretName: "foo",
setup: setupSecretBinaryFile([]byte{0x68, 0x65, 0x6c, 0x6c, 0x6f, 0x20, 0x77, 0x6f, 0x72, 0x6c, 0x64}),
fromFile: []string{"foo1", "foo2"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo-hbkh2cdb57",
},
Data: map[string][]byte{
"foo1": []byte("hello world"),
"foo2": []byte("hello world"),
},
},
},
"create_secret_foo_from_file_foo1_foo2_and": {
secretName: "foo",
setup: setupSecretBinaryFile([]byte{0xff, 0xfd}),
fromFile: []string{"foo1", "foo2"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo",
},
Data: map[string][]byte{
"foo1": {0xff, 0xfd},
"foo2": {0xff, 0xfd},
},
},
},
"create_secret_foo_from_file_foo1_foo2_and_hash": {
secretName: "foo",
setup: setupSecretBinaryFile([]byte{0xff, 0xfd}),
fromFile: []string{"foo1", "foo2"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "foo-mkhg4ktk4d",
},
Data: map[string][]byte{
"foo1": {0xff, 0xfd},
"foo2": {0xff, 0xfd},
},
},
},
"create_secret_valid_env_from_env_file": {
secretName: "valid_env",
setup: setupSecretEnvFile([][]string{{"key1=value1", "#", "", "key2=value2"}}),
fromEnvFile: []string{"file.env"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "valid_env",
},
Data: map[string][]byte{
"key1": []byte("value1"),
"key2": []byte("value2"),
},
},
},
"create_secret_valid_env_from_env_file_hash": {
secretName: "valid_env",
setup: setupSecretEnvFile([][]string{{"key1=value1", "#", "", "key2=value2"}}),
fromEnvFile: []string{"file.env"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "valid_env-bkb2m2965h",
},
Data: map[string][]byte{
"key1": []byte("value1"),
"key2": []byte("value2"),
},
},
},
"create_two_secret_valid_env_from_env_file": {
secretName: "two_valid_env",
setup: setupSecretEnvFile([][]string{{"key1=value1", "#", "", "key2=value2"}, {"key3=value3"}}),
fromEnvFile: []string{"file1.env", "file2.env"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "two_valid_env",
},
Data: map[string][]byte{
"key1": []byte("value1"),
"key2": []byte("value2"),
"key3": []byte("value3"),
},
},
},
"create_two_secret_valid_env_from_env_file_hash": {
secretName: "two_valid_env",
setup: setupSecretEnvFile([][]string{{"key1=value1", "#", "", "key2=value2"}, {"key3=value3"}}),
fromEnvFile: []string{"file1.env", "file2.env"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "two_valid_env-gd56gct5cf",
},
Data: map[string][]byte{
"key1": []byte("value1"),
"key2": []byte("value2"),
"key3": []byte("value3"),
},
},
},
"create_secret_get_env_from_env_file": {
secretName: "get_env",
setup: func() func(t *testing.T, secretGenericOptions *CreateSecretOptions) func() {
t.Setenv("g_key1", "1")
t.Setenv("g_key2", "2")
return setupSecretEnvFile([][]string{{"g_key1", "g_key2="}})
}(),
fromEnvFile: []string{"file.env"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "get_env",
},
Data: map[string][]byte{
"g_key1": []byte("1"),
"g_key2": []byte(""),
},
},
},
"create_secret_get_env_from_env_file_hash": {
secretName: "get_env",
setup: func() func(t *testing.T, secretGenericOptions *CreateSecretOptions) func() {
t.Setenv("g_key1", "1")
t.Setenv("g_key2", "2")
return setupSecretEnvFile([][]string{{"g_key1", "g_key2="}})
}(),
fromEnvFile: []string{"file.env"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "get_env-68mt8f2kkt",
},
Data: map[string][]byte{
"g_key1": []byte("1"),
"g_key2": []byte(""),
},
},
},
"create_secret_value_with_space_from_env_file": {
secretName: "value_with_space",
setup: setupSecretEnvFile([][]string{{" key1= value1"}}),
fromEnvFile: []string{"file.env"},
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "value_with_space",
},
Data: map[string][]byte{
"key1": []byte(" value1"),
},
},
},
"create_secret_value_with_space_from_env_file_hash": {
secretName: "valid_with_space",
setup: setupSecretEnvFile([][]string{{" key1= value1"}}),
fromEnvFile: []string{"file.env"},
appendHash: true,
expected: &corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: corev1.SchemeGroupVersion.String(),
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: "valid_with_space-bhkb4gfck6",
},
Data: map[string][]byte{
"key1": []byte(" value1"),
},
},
},
"create_invalid_secret_filepath_contains_=": {
secretName: "foo",
fromFile: []string{"key1=/file=2"},
expectErr: `key names or file paths cannot contain '='`,
},
"create_invalid_secret_filepath_key_contains_=": {
secretName: "foo",
fromFile: []string{"=key=/file1"},
expectErr: `key names or file paths cannot contain '='`,
},
"create_invalid_secret_literal_key_contains_=": {
secretName: "foo",
fromLiteral: []string{"=key=value1"},
expectErr: `invalid literal source =key=value1, expected key=value`,
},
"create_invalid_secret_literal_key_with_invalid_character": {
secretName: "foo",
fromLiteral: []string{"key#1=value1"},
expectErr: `"key#1" is not valid key name for a Secret a valid config key must consist of alphanumeric characters, '-', '_' or '.' (e.g. 'key.name', or 'KEY_NAME', or 'key-name', regex used for validation is '[-._a-zA-Z0-9]+')`,
},
"create_invalid_secret_env_key_contains_#": {
secretName: "invalid_key",
setup: setupSecretEnvFile([][]string{{"key#1=value1"}}),
fromEnvFile: []string{"file.env"},
expectErr: `"key#1" is not a valid key name: a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name', or 'MY_ENV.NAME', or 'MyEnvName1', regex used for validation is '[-._a-zA-Z][-._a-zA-Z0-9]*')`,
},
"create_invalid_secret_env_key_start_with_digit": {
secretName: "invalid_key",
setup: setupSecretEnvFile([][]string{{"1key=value1"}}),
fromEnvFile: []string{"file.env"},
expectErr: `"1key" is not a valid key name: a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name', or 'MY_ENV.NAME', or 'MyEnvName1', regex used for validation is '[-._a-zA-Z][-._a-zA-Z0-9]*')`,
},
"create_invalid_secret_env_key_with_invalid_character": {
secretName: "invalid_key",
setup: setupSecretEnvFile([][]string{{"key@=value1"}}),
fromEnvFile: []string{"file.env"},
expectErr: `"key@" is not a valid key name: a valid environment variable name must consist of alphabetic characters, digits, '_', '-', or '.', and must not start with a digit (e.g. 'my.env-name', or 'MY_ENV.NAME', or 'MyEnvName1', regex used for validation is '[-._a-zA-Z][-._a-zA-Z0-9]*')`,
},
"create_invalid_secret_duplicate_key1": {
secretName: "foo",
fromLiteral: []string{"key1=value1", "key1=value2"},
expectErr: `cannot add key key1, another key by that name already exists`,
},
"create_invalid_secret_no_file": {
secretName: "foo",
fromFile: []string{"key1=/file1"},
expectErr: `error reading /file1: no such file or directory`,
},
"create_invalid_secret_invalid_literal": {
secretName: "foo",
fromLiteral: []string{"key1value1"},
expectErr: `invalid literal source key1value1, expected key=value`,
},
"create_invalid_secret_invalid_filepath": {
secretName: "foo",
fromFile: []string{"key1==file1"},
expectErr: `key names or file paths cannot contain '='`,
},
"create_invalid_secret_no_name": {
expectErr: `name must be specified`,
},
"create_invalid_secret_too_many_args": {
secretName: "too_many_args",
fromFile: []string{"key1=/file1"},
fromEnvFile: []string{"foo"},
expectErr: `from-env-file cannot be combined with from-file or from-literal`,
},
"create_invalid_secret_too_many_args_1": {
secretName: "too_many_args_1",
fromLiteral: []string{"key1=value1"},
fromEnvFile: []string{"foo"},
expectErr: `from-env-file cannot be combined with from-file or from-literal`,
},
"create_invalid_secret_too_many_args_2": {
secretName: "too_many_args_2",
fromFile: []string{"key1=/file1"},
fromLiteral: []string{"key1=value1"},
fromEnvFile: []string{"foo"},
expectErr: `from-env-file cannot be combined with from-file or from-literal`,
},
}
// run all the tests
for name, test := range tests {
t.Run(name, func(t *testing.T) {
var secret *corev1.Secret = nil
secretOptions := CreateSecretOptions{
Name: test.secretName,
Type: test.secretType,
AppendHash: test.appendHash,
FileSources: test.fromFile,
LiteralSources: test.fromLiteral,
EnvFileSources: test.fromEnvFile,
}
if test.setup != nil {
if teardown := test.setup(t, &secretOptions); teardown != nil {
defer teardown()
}
}
err := secretOptions.Validate()
if err == nil {
secret, err = secretOptions.createSecret()
}
if test.expectErr == "" {
require.NoError(t, err)
if !apiequality.Semantic.DeepEqual(secret, test.expected) {
t.Errorf("\nexpected:\n%#v\ngot:\n%#v", test.expected, secret)
}
} else {
require.Error(t, err)
require.EqualError(t, err, test.expectErr)
}
})
}
}
func setupSecretEnvFile(lines [][]string) func(*testing.T, *CreateSecretOptions) func() {
return func(t *testing.T, secretOptions *CreateSecretOptions) func() {
files := []*os.File{}
filenames := secretOptions.EnvFileSources
for _, filename := range filenames {
file, err := os.CreateTemp("", filename)
if err != nil {
t.Errorf("unexpected error: %v", err)
}
files = append(files, file)
}
for i, f := range files {
for _, l := range lines[i] {
f.WriteString(l)
f.WriteString("\r\n")
}
f.Close()
secretOptions.EnvFileSources[i] = f.Name()
}
return func() {
for _, f := range files {
os.Remove(f.Name())
}
}
}
}
func setupSecretBinaryFile(data []byte) func(*testing.T, *CreateSecretOptions) func() {
return func(t *testing.T, secretOptions *CreateSecretOptions) func() {
tmp, _ := os.MkdirTemp("", "")
files := secretOptions.FileSources
for i, file := range files {
f := tmp + "/" + file
os.WriteFile(f, data, 0644)
secretOptions.FileSources[i] = f
}
return func() {
for _, file := range files {
f := tmp + "/" + file
os.RemoveAll(f)
}
}
}
}