Skip to content

Commit 86e95c3

Browse files
aramasearamase
committed
add negative e2e tests
1 parent 01ef150 commit 86e95c3

File tree

4 files changed

+103
-46
lines changed

4 files changed

+103
-46
lines changed

‎pkg/secrets-store/nodeserver.go

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -154,9 +154,6 @@ func (ns *nodeServer) NodePublishVolume(ctx context.Context, req *csi.NodePublis
154154
parameters[csipodnamespace] = attrib[csipodnamespace]
155155
parameters[csipoduid] = attrib[csipoduid]
156156
parameters[csipodsa] = attrib[csipodsa]
157-
podName = parameters[csipodname]
158-
podNamespace = parameters[csipodnamespace]
159-
podUID = parameters[csipoduid]
160157

161158
// ensure it's read-only
162159
if !req.GetReadonly() {

‎pkg/secrets-store/nodeserver_test.go

Lines changed: 49 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -51,31 +51,35 @@ func getTestTargetPath(t *testing.T) string {
5151

5252
func TestNodePublishVolume(t *testing.T) {
5353
tests := []struct {
54-
name string
55-
nodePublishVolReq csi.NodePublishVolumeRequest
56-
mountPoints []mount.MountPoint
57-
initObjects []runtime.Object
58-
expectedErr bool
54+
name string
55+
nodePublishVolReq csi.NodePublishVolumeRequest
56+
mountPoints []mount.MountPoint
57+
initObjects []runtime.Object
58+
expectedErr bool
59+
shouldRetryRemount bool
5960
}{
6061
{
61-
name: "volume capabilities nil",
62-
nodePublishVolReq: csi.NodePublishVolumeRequest{},
63-
expectedErr: true,
62+
name: "volume capabilities nil",
63+
nodePublishVolReq: csi.NodePublishVolumeRequest{},
64+
expectedErr: true,
65+
shouldRetryRemount: true,
6466
},
6567
{
6668
name: "volume id is empty",
6769
nodePublishVolReq: csi.NodePublishVolumeRequest{
6870
VolumeCapability: &csi.VolumeCapability{},
6971
},
70-
expectedErr: true,
72+
expectedErr: true,
73+
shouldRetryRemount: true,
7174
},
7275
{
7376
name: "target path is empty",
7477
nodePublishVolReq: csi.NodePublishVolumeRequest{
7578
VolumeCapability: &csi.VolumeCapability{},
7679
VolumeId: "testvolid1",
7780
},
78-
expectedErr: true,
81+
expectedErr: true,
82+
shouldRetryRemount: true,
7983
},
8084
{
8185
name: "volume context is not set",
@@ -84,7 +88,8 @@ func TestNodePublishVolume(t *testing.T) {
8488
VolumeId: "testvolid1",
8589
TargetPath: getTestTargetPath(t),
8690
},
87-
expectedErr: true,
91+
expectedErr: true,
92+
shouldRetryRemount: true,
8893
},
8994
{
9095
name: "secret provider class not found",
@@ -94,7 +99,8 @@ func TestNodePublishVolume(t *testing.T) {
9499
TargetPath: getTestTargetPath(t),
95100
VolumeContext: map[string]string{"secretProviderClass": "provider1"},
96101
},
97-
expectedErr: true,
102+
expectedErr: true,
103+
shouldRetryRemount: true,
98104
},
99105
{
100106
name: "secret provider class in pod namespace not found",
@@ -112,7 +118,8 @@ func TestNodePublishVolume(t *testing.T) {
112118
},
113119
},
114120
},
115-
expectedErr: true,
121+
expectedErr: true,
122+
shouldRetryRemount: true,
116123
},
117124
{
118125
name: "provider not set in secret provider class",
@@ -130,7 +137,8 @@ func TestNodePublishVolume(t *testing.T) {
130137
},
131138
},
132139
},
133-
expectedErr: true,
140+
expectedErr: true,
141+
shouldRetryRemount: true,
134142
},
135143
{
136144
name: "parameters not set in secret provider class",
@@ -151,7 +159,8 @@ func TestNodePublishVolume(t *testing.T) {
151159
},
152160
},
153161
},
154-
expectedErr: true,
162+
expectedErr: true,
163+
shouldRetryRemount: true,
155164
},
156165
{
157166
name: "read only is not set to true",
@@ -173,7 +182,8 @@ func TestNodePublishVolume(t *testing.T) {
173182
},
174183
},
175184
},
176-
expectedErr: true,
185+
expectedErr: true,
186+
shouldRetryRemount: true,
177187
},
178188
{
179189
name: "failed to invoke provider, unmounted to force retry",
@@ -196,7 +206,8 @@ func TestNodePublishVolume(t *testing.T) {
196206
},
197207
},
198208
},
199-
expectedErr: true,
209+
expectedErr: true,
210+
shouldRetryRemount: true,
200211
},
201212
{
202213
name: "volume already mounted, no remount",
@@ -219,8 +230,9 @@ func TestNodePublishVolume(t *testing.T) {
219230
},
220231
},
221232
},
222-
mountPoints: []mount.MountPoint{},
223-
expectedErr: false,
233+
mountPoints: []mount.MountPoint{},
234+
expectedErr: false,
235+
shouldRetryRemount: true,
224236
},
225237
}
226238

@@ -248,16 +260,25 @@ func TestNodePublishVolume(t *testing.T) {
248260
t.Fatalf("expected error to be nil, got: %+v", err)
249261
}
250262

251-
_, err = ns.NodePublishVolume(context.TODO(), &test.nodePublishVolReq)
252-
if test.expectedErr && err == nil || !test.expectedErr && err != nil {
253-
t.Fatalf("expected err: %v, got: %+v", test.expectedErr, err)
263+
numberOfAttempts := 1
264+
// to ensure the remount is tried after previous failure and still fails
265+
if test.shouldRetryRemount {
266+
numberOfAttempts = 2
254267
}
255-
mnts, err := ns.mounter.List()
256-
if err != nil {
257-
t.Fatalf("expected err to be nil, got: %v", err)
258-
}
259-
if test.expectedErr && len(test.mountPoints) == 0 && len(mnts) != 0 {
260-
t.Fatalf("expected mount points to be 0")
268+
269+
for numberOfAttempts > 0 {
270+
_, err = ns.NodePublishVolume(context.TODO(), &test.nodePublishVolReq)
271+
if test.expectedErr && err == nil || !test.expectedErr && err != nil {
272+
t.Fatalf("expected err: %v, got: %+v", test.expectedErr, err)
273+
}
274+
mnts, err := ns.mounter.List()
275+
if err != nil {
276+
t.Fatalf("expected err to be nil, got: %v", err)
277+
}
278+
if test.expectedErr && len(test.mountPoints) == 0 && len(mnts) != 0 {
279+
t.Fatalf("expected mount points to be 0")
280+
}
281+
numberOfAttempts--
261282
}
262283
})
263284
}

‎test/bats/azure.bats

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ setup() {
8686

8787
@test "CSI inline volume test with pod portability - read azure kv secret from pod" {
8888
result=$(kubectl exec nginx-secrets-store-inline-crd -- $EXEC_COMMAND/$SECRET_NAME)
89-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
89+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
9090
}
9191

9292
@test "CSI inline volume test with pod portability - read azure kv key from pod" {
@@ -114,20 +114,20 @@ setup() {
114114
POD=$(kubectl get pod -l app=nginx -o jsonpath="{.items[0].metadata.name}")
115115

116116
result=$(kubectl exec $POD -- $EXEC_COMMAND/secretalias)
117-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
117+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
118118

119119
result=$(kubectl exec $POD -- $EXEC_COMMAND/$KEY_NAME)
120120
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
121121
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
122122

123123
result=$(kubectl get secret foosecret -o jsonpath="{.data.username}" | base64 -d)
124-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
124+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
125125

126126
result=$(kubectl exec -it $POD printenv | grep SECRET_USERNAME) | awk -F"=" '{ print $2}'
127-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
127+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
128128

129129
result=$(kubectl get secret foosecret -o json | jq '.metadata.ownerReferences | length')
130-
[[ "$result" == "2" ]]
130+
[[ "$result" -eq 2 ]]
131131
}
132132

133133
@test "Sync with K8s secrets - delete deployment, check secret deleted" {
@@ -139,7 +139,7 @@ setup() {
139139

140140
sleep 20
141141
result=$(kubectl get secret | grep foosecret | wc -l)
142-
[[ "$result" -eq "0" ]]
142+
[[ "$result" -eq 0 ]]
143143
}
144144

145145
@test "Test Namespaced scope SecretProviderClass - create deployment" {
@@ -170,20 +170,20 @@ setup() {
170170
POD=$(kubectl get pod -l app=nginx -n test-ns -o jsonpath="{.items[0].metadata.name}")
171171

172172
result=$(kubectl exec -n test-ns $POD -- $EXEC_COMMAND/secretalias)
173-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
173+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
174174

175175
result=$(kubectl exec -n test-ns $POD -- $EXEC_COMMAND/$KEY_NAME)
176176
result_base64_encoded=$(echo "${result//$'\r'}" | base64 ${BASE64_FLAGS})
177177
[[ "${result_base64_encoded}" == *"${KEY_VALUE_CONTAINS}"* ]]
178178

179179
result=$(kubectl get secret foosecret -n test-ns -o jsonpath="{.data.username}" | base64 -d)
180-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
180+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
181181

182182
result=$(kubectl exec -n test-ns $POD -- printenv | grep SECRET_USERNAME) | awk -F"=" '{ print $2}'
183-
[[ "${result//$'\r'}" -eq "${SECRET_VALUE}" ]]
183+
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
184184

185185
result=$(kubectl get secret foosecret -n test-ns -o json | jq '.metadata.ownerReferences | length')
186-
[[ "$result" -eq "2" ]]
186+
[[ "$result" -eq 2 ]]
187187
}
188188

189189
@test "Test Namespaced scope SecretProviderClass - Sync with K8s secrets - delete deployment, check secret deleted" {
@@ -192,5 +192,26 @@ setup() {
192192
sleep 20
193193

194194
result=$(kubectl get secret -n test-ns | grep foosecret | wc -l)
195-
[[ "$result" -eq "0" ]]
195+
[[ "$result" -eq 0 ]]
196+
}
197+
198+
@test "Test Namespaced scope SecretProviderClass - Should fail when no secret provider class in same namespace" {
199+
run kubectl create ns negative-test-ns
200+
assert_success
201+
202+
run kubectl create secret generic secrets-store-creds --from-literal clientid=${AZURE_CLIENT_ID} --from-literal clientsecret=${AZURE_CLIENT_SECRET} -n negative-test-ns
203+
assert_success
204+
205+
envsubst < $BATS_TESTS_DIR/nginx-deployment-synck8s-azure.yaml | kubectl apply -n negative-test-ns -f -
206+
sleep 5
207+
208+
POD=$(kubectl get pod -l app=nginx -n negative-test-ns -o jsonpath="{.items[0].metadata.name}")
209+
cmd="kubectl describe pod $POD -n negative-test-ns | grep 'FailedMount.*failed to get secretproviderclass negative-test-ns/azure-sync.*not found'"
210+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
211+
212+
run kubectl delete -f $BATS_TESTS_DIR/nginx-deployment-synck8s-azure.yaml -n negative-test-ns
213+
assert_success
214+
215+
run kubectl delete ns negative-test-ns
216+
assert_success
196217
}

‎test/bats/vault.bats

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ EOF
185185
[[ "$result" == "hello1" ]]
186186

187187
result=$(kubectl get secret foosecret -o json | jq '.metadata.ownerReferences | length')
188-
[[ "$result" == "2" ]]
188+
[[ "$result" -eq 2 ]]
189189
}
190190

191191
@test "Sync with K8s secrets - delete deployment, check secret is deleted" {
@@ -197,7 +197,7 @@ EOF
197197

198198
sleep 20
199199
result=$(kubectl get secret | grep foosecret | wc -l)
200-
[[ "$result" == "0" ]]
200+
[[ "$result" -eq 0 ]]
201201
}
202202

203203
@test "Test Namespaced scope SecretProviderClass - create deployment" {
@@ -238,7 +238,7 @@ EOF
238238
[[ "$result" == "hello1" ]]
239239

240240
result=$(kubectl get secret -n test-ns foosecret -o json | jq '.metadata.ownerReferences | length')
241-
[[ "$result" == "2" ]]
241+
[[ "$result" -eq 2 ]]
242242
}
243243

244244
@test "Test Namespaced scope SecretProviderClass - Sync with K8s secrets - delete deployment, check secret deleted" {
@@ -247,5 +247,23 @@ EOF
247247
sleep 20
248248

249249
result=$(kubectl get secret -n test-ns | grep foosecret | wc -l)
250-
[[ "$result" -eq "0" ]]
250+
[[ "$result" -eq 0 ]]
251+
}
252+
253+
@test "Test Namespaced scope SecretProviderClass - Should fail when no secret provider class in same namespace" {
254+
run kubectl create ns negative-test-ns
255+
assert_success
256+
257+
envsubst < $BATS_TESTS_DIR/nginx-deployment-synck8s.yaml | kubectl apply -n negative-test-ns -f -
258+
sleep 5
259+
260+
POD=$(kubectl get pod -l app=nginx -n negative-test-ns -o jsonpath="{.items[0].metadata.name}")
261+
cmd="kubectl describe pod $POD -n negative-test-ns | grep 'FailedMount.*failed to get secretproviderclass negative-test-ns/vault-foo-sync.*not found'"
262+
wait_for_process $WAIT_TIME $SLEEP_TIME "$cmd"
263+
264+
run kubectl delete -f $BATS_TESTS_DIR/nginx-deployment-synck8s.yaml -n negative-test-ns
265+
assert_success
266+
267+
run kubectl delete ns negative-test-ns
268+
assert_success
251269
}

0 commit comments

Comments
 (0)