Skip to content

Commit 721a1e9

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #261 from aramase/multiple-spc
test: add tests for multiple secret provider class
2 parents 1362606 + 84f5cf3 commit 721a1e9

6 files changed

+318
-10
lines changed

‎test/bats/azure.bats

Lines changed: 65 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ IMAGE_TAG=v0.0.8-e2e-$(git rev-parse --short HEAD)
99
NAMESPACE=default
1010
PROVIDER_YAML=https://raw.githubusercontent.com/Azure/secrets-store-csi-driver-provider-azure/master/deployment/provider-azure-installer.yaml
1111
CONTAINER_IMAGE=nginx
12-
EXEC_COMMAND="cat /mnt/secrets-store"
12+
EXEC_COMMAND="cat"
1313
BASE64_FLAGS="-w 0"
1414
if [[ "$OSTYPE" == *"darwin"* ]]; then
1515
BASE64_FLAGS="-b 0"
@@ -18,7 +18,7 @@ fi
1818
if [ $TEST_WINDOWS ]; then
1919
PROVIDER_YAML=https://raw.githubusercontent.com/Azure/secrets-store-csi-driver-provider-azure/master/deployment/provider-azure-installer-windows.yaml
2020
CONTAINER_IMAGE=mcr.microsoft.com/windows/servercore/iis:windowsservercore-ltsc2019
21-
EXEC_COMMAND="powershell.exe cat /mnt/secrets-store"
21+
EXEC_COMMAND="powershell.exe cat"
2222
fi
2323

2424
export KEYVAULT_NAME=${KEYVAULT_NAME:-csi-secrets-store-e2e}
@@ -40,7 +40,6 @@ setup() {
4040
@test "install azure provider" {
4141
run kubectl apply -f $PROVIDER_YAML --namespace $NAMESPACE
4242
assert_success
43-
sleep 5
4443

4544
cmd="kubectl wait --for=condition=Ready --timeout=60s pod -l app=csi-secrets-store-provider-azure --namespace $NAMESPACE"
4645
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
@@ -85,12 +84,12 @@ setup() {
8584
}
8685

8786
@test "CSI inline volume test with pod portability - read azure kv secret from pod" {
88-
result=$(kubectl exec nginx-secrets-store-inline-crd -- $EXEC_COMMAND/$SECRET_NAME)
87+
result=$(kubectl exec nginx-secrets-store-inline-crd -- $EXEC_COMMAND /mnt/secrets-store/$SECRET_NAME)
8988
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
9089
}
9190

9291
@test "CSI inline volume test with pod portability - read azure kv key from pod" {
93-
result=$(kubectl exec nginx-secrets-store-inline-crd -- $EXEC_COMMAND/$KEY_NAME)
92+
result=$(kubectl exec nginx-secrets-store-inline-crd -- $EXEC_COMMAND /mnt/secrets-store/$KEY_NAME)
9493
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
9594
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
9695
}
@@ -113,10 +112,10 @@ setup() {
113112
@test "Sync with K8s secrets - read secret from pod, read K8s secret, read env var, check secret ownerReferences" {
114113
POD=$(kubectl get pod -l app=nginx -o jsonpath="{.items[0].metadata.name}")
115114

116-
result=$(kubectl exec $POD -- $EXEC_COMMAND/secretalias)
115+
result=$(kubectl exec $POD -- $EXEC_COMMAND /mnt/secrets-store/secretalias)
117116
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
118117

119-
result=$(kubectl exec $POD -- $EXEC_COMMAND/$KEY_NAME)
118+
result=$(kubectl exec $POD -- $EXEC_COMMAND /mnt/secrets-store/$KEY_NAME)
120119
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
121120
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
122121

@@ -169,10 +168,10 @@ setup() {
169168
@test "Test Namespaced scope SecretProviderClass - Sync with K8s secrets - read secret from pod, read K8s secret, read env var, check secret ownerReferences" {
170169
POD=$(kubectl get pod -l app=nginx -n test-ns -o jsonpath="{.items[0].metadata.name}")
171170

172-
result=$(kubectl exec -n test-ns $POD -- $EXEC_COMMAND/secretalias)
171+
result=$(kubectl exec -n test-ns $POD -- $EXEC_COMMAND /mnt/secrets-store/secretalias)
173172
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
174173

175-
result=$(kubectl exec -n test-ns $POD -- $EXEC_COMMAND/$KEY_NAME)
174+
result=$(kubectl exec -n test-ns $POD -- $EXEC_COMMAND /mnt/secrets-store/$KEY_NAME)
176175
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
177176
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
178177

@@ -215,3 +214,60 @@ setup() {
215214
run kubectl delete ns negative-test-ns
216215
assert_success
217216
}
217+
218+
@test "deploy multiple azure secretproviderclass crd" {
219+
envsubst < $BATS_TESTS_DIR/azure_v1alpha1_multiple_secretproviderclass.yaml | kubectl apply -f -
220+
221+
cmd="kubectl wait --for condition=established --timeout=60s crd/secretproviderclasses.secrets-store.csi.x-k8s.io"
222+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
223+
224+
cmd="kubectl get secretproviderclasses.secrets-store.csi.x-k8s.io/azure-spc-0 -o yaml | grep azure-spc-0"
225+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
226+
227+
cmd="kubectl get secretproviderclasses.secrets-store.csi.x-k8s.io/azure-spc-1 -o yaml | grep azure-spc-1"
228+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
229+
}
230+
231+
@test "deploy pod with multiple secret provider class" {
232+
envsubst < $BATS_TESTS_DIR/nginx-pod-azure-inline-volume-multiple-spc.yaml | kubectl apply -f -
233+
234+
cmd="kubectl wait --for=condition=Ready --timeout=60s pod/nginx-secrets-store-inline-multiple-crd"
235+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
236+
237+
run kubectl get pod/nginx-secrets-store-inline-multiple-crd
238+
assert_success
239+
}
240+
241+
@test "CSI inline volume test with multiple secret provider class" {
242+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- $EXEC_COMMAND /mnt/secrets-store-0/secretalias)
243+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
244+
245+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- $EXEC_COMMAND /mnt/secrets-store-0/$KEY_NAME)
246+
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
247+
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
248+
249+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- $EXEC_COMMAND /mnt/secrets-store-1/secretalias)
250+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
251+
252+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- $EXEC_COMMAND /mnt/secrets-store-1/$KEY_NAME)
253+
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
254+
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
255+
256+
result=$(kubectl get secret foosecret-0 -o jsonpath="{.data.username}" | base64 -d)
257+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
258+
259+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- printenv | grep SECRET_USERNAME_0) | awk -F"=" '{ print $2}'
260+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
261+
262+
result=$(kubectl get secret foosecret-0 -o json | jq '.metadata.ownerReferences | length')
263+
[[ "$result" -eq 1 ]]
264+
265+
result=$(kubectl get secret foosecret-1 -o jsonpath="{.data.username}" | base64 -d)
266+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
267+
268+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- printenv | grep SECRET_USERNAME_1) | awk -F"=" '{ print $2}'
269+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
270+
271+
result=$(kubectl get secret foosecret-1 -o json | jq '.metadata.ownerReferences | length')
272+
[[ "$result" -eq 1 ]]
273+
}

‎test/bats/tests/azure/azure_v1alpha1_multiple_secretproviderclass.yaml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
2+
kind: SecretProviderClass
3+
metadata:
4+
name: azure-spc-0
5+
spec:
6+
provider: azure
7+
secretObjects:
8+
- secretName: foosecret-0
9+
type: Opaque
10+
data:
11+
- objectName: secretalias
12+
key: username
13+
parameters:
14+
usePodIdentity: "false"
15+
keyvaultName: "$KEYVAULT_NAME"
16+
objects: |
17+
array:
18+
- |
19+
objectName: $SECRET_NAME
20+
objectType: secret
21+
objectVersion: $SECRET_VERSION
22+
objectAlias: secretalias
23+
- |
24+
objectName: $KEY_NAME
25+
objectType: key
26+
objectVersion: $KEY_VERSION
27+
tenantId: "$TENANT_ID"
28+
---
29+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
30+
kind: SecretProviderClass
31+
metadata:
32+
name: azure-spc-1
33+
spec:
34+
provider: azure
35+
secretObjects:
36+
- secretName: foosecret-1
37+
type: Opaque
38+
data:
39+
- objectName: secretalias
40+
key: username
41+
parameters:
42+
usePodIdentity: "false"
43+
keyvaultName: "$KEYVAULT_NAME"
44+
objects: |
45+
array:
46+
- |
47+
objectName: $SECRET_NAME
48+
objectType: secret
49+
objectVersion: $SECRET_VERSION
50+
objectAlias: secretalias
51+
- |
52+
objectName: $KEY_NAME
53+
objectType: key
54+
objectVersion: $KEY_VERSION
55+
tenantId: "$TENANT_ID"

‎test/bats/tests/azure/nginx-pod-azure-inline-volume-multiple-spc.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
kind: Pod
2+
apiVersion: v1
3+
metadata:
4+
name: nginx-secrets-store-inline-multiple-crd
5+
spec:
6+
containers:
7+
- image: $CONTAINER_IMAGE
8+
name: nginx
9+
volumeMounts:
10+
- name: secrets-store-inline-0
11+
mountPath: "/mnt/secrets-store-0"
12+
readOnly: true
13+
- name: secrets-store-inline-1
14+
mountPath: "/mnt/secrets-store-1"
15+
readOnly: true
16+
env:
17+
- name: SECRET_USERNAME_0
18+
valueFrom:
19+
secretKeyRef:
20+
name: foosecret-0
21+
key: username
22+
- name: SECRET_USERNAME_1
23+
valueFrom:
24+
secretKeyRef:
25+
name: foosecret-1
26+
key: username
27+
volumes:
28+
- name: secrets-store-inline-0
29+
csi:
30+
driver: secrets-store.csi.k8s.io
31+
readOnly: true
32+
volumeAttributes:
33+
secretProviderClass: "azure-spc-0"
34+
nodePublishSecretRef:
35+
name: secrets-store-creds
36+
- name: secrets-store-inline-1
37+
csi:
38+
driver: secrets-store.csi.k8s.io
39+
readOnly: true
40+
volumeAttributes:
41+
secretProviderClass: "azure-spc-1"
42+
nodePublishSecretRef:
43+
name: secrets-store-creds

‎test/bats/tests/vault/nginx-pod-vault-inline-volume-multiple-spc.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
kind: Pod
2+
apiVersion: v1
3+
metadata:
4+
name: nginx-secrets-store-inline-multiple-crd
5+
spec:
6+
containers:
7+
- image: $CONTAINER_IMAGE
8+
name: nginx
9+
volumeMounts:
10+
- name: secrets-store-inline-0
11+
mountPath: "/mnt/secrets-store-0"
12+
readOnly: true
13+
- name: secrets-store-inline-1
14+
mountPath: "/mnt/secrets-store-1"
15+
readOnly: true
16+
env:
17+
- name: SECRET_USERNAME_0
18+
valueFrom:
19+
secretKeyRef:
20+
name: foosecret-0
21+
key: username
22+
- name: SECRET_USERNAME_1
23+
valueFrom:
24+
secretKeyRef:
25+
name: foosecret-1
26+
key: username
27+
volumes:
28+
- name: secrets-store-inline-0
29+
csi:
30+
driver: secrets-store.csi.k8s.io
31+
readOnly: true
32+
volumeAttributes:
33+
secretProviderClass: "vault-foo-sync-0"
34+
- name: secrets-store-inline-1
35+
csi:
36+
driver: secrets-store.csi.k8s.io
37+
readOnly: true
38+
volumeAttributes:
39+
secretProviderClass: "vault-foo-sync-1"

‎test/bats/tests/vault/vault_v1alpha1_multiple_secretproviderclass.yaml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
2+
kind: SecretProviderClass
3+
metadata:
4+
name: vault-foo-sync-0
5+
spec:
6+
provider: vault
7+
secretObjects:
8+
- secretName: foosecret-0
9+
type: Opaque
10+
data:
11+
- objectName: foo
12+
key: pwd
13+
- objectName: foo1
14+
key: username
15+
parameters:
16+
roleName: "example-role"
17+
vaultAddress: http://${VAULT_SERVICE_IP}:8200
18+
vaultSkipTLSVerify: "true"
19+
objects: |
20+
array:
21+
- |
22+
objectPath: "/foo"
23+
objectName: "bar"
24+
objectVersion: ""
25+
- |
26+
objectPath: "/foo1"
27+
objectName: "bar"
28+
objectVersion: ""
29+
---
30+
apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
31+
kind: SecretProviderClass
32+
metadata:
33+
name: vault-foo-sync-1
34+
spec:
35+
provider: vault
36+
secretObjects:
37+
- secretName: foosecret-1
38+
type: Opaque
39+
data:
40+
- objectName: foo
41+
key: pwd
42+
- objectName: foo1
43+
key: username
44+
parameters:
45+
roleName: "example-role"
46+
vaultAddress: http://${VAULT_SERVICE_IP}:8200
47+
vaultSkipTLSVerify: "true"
48+
objects: |
49+
array:
50+
- |
51+
objectPath: "/foo"
52+
objectName: "bar"
53+
objectVersion: ""
54+
- |
55+
objectPath: "/foo1"
56+
objectName: "bar"
57+
objectVersion: ""

0 commit comments

Comments
 (0)