Adds ValidateSecretSelector

pkg/provider/kubernetes/kubernetes.go

@@ -275,6 +275,9 @@ func (k *ProviderKubernetes) ValidateStore(store esv1beta1.GenericStore) error {
 		if k8sSpec.Auth.Cert.ClientCert.Key == "" {
 			return fmt.Errorf("ClientCert.Key cannot be empty")
 		}
+		if err := utils.ValidateSecretSelector(store, k8sSpec.Auth.Cert.ClientCert); err != nil {
+			return err
+		}
 	} else if k8sSpec.Auth.Token != nil {
 		if k8sSpec.Auth.Token.BearerToken.Name == "" {
 			return fmt.Errorf("BearerToken.Name cannot be empty")
@@ -282,6 +285,9 @@ func (k *ProviderKubernetes) ValidateStore(store esv1beta1.GenericStore) error {
 		if k8sSpec.Auth.Token.BearerToken.Key == "" {
 			return fmt.Errorf("BearerToken.Key cannot be empty")
 		}
+		if err := utils.ValidateSecretSelector(store, k8sSpec.Auth.Token.BearerToken); err != nil {
+			return err
+		}
 	} else {
 		return fmt.Errorf("an Auth type must be specified")
 	}

pkg/provider/kubernetes/kubernetes_test.go

@@ -300,6 +300,15 @@ func TestValidateStore(t *testing.T) {
 	} else if err.Error() != "ClientCert.Key cannot be empty" {
 		t.Errorf("KeySelector test failed: expected clientCert Key is required, got %v", err)
 	}
+	store.Spec.Provider.Kubernetes.Auth.Cert.ClientCert.Key = "secret-key"
+	ns := "ns-one"
+	store.Spec.Provider.Kubernetes.Auth.Cert.ClientCert.Namespace = &ns
+	err = p.ValidateStore(store)
+	if err == nil {
+		t.Errorf(errExpectedErr)
+	} else if err.Error() != "namespace not allowed with namespaced SecretStore" {
+		t.Errorf("KeySelector test failed: expected namespace not allowed, got %v", err)
+	}
 	store.Spec.Provider.Kubernetes.Auth = esv1beta1.KubernetesAuth{Token: &esv1beta1.TokenAuth{}}
 	err = p.ValidateStore(store)
 	if err == nil {
@@ -314,6 +323,14 @@ func TestValidateStore(t *testing.T) {
 	} else if err.Error() != "BearerToken.Key cannot be empty" {
 		t.Errorf("KeySelector test failed: expected bearer token key is required, got %v", err)
 	}
+	store.Spec.Provider.Kubernetes.Auth.Token.BearerToken.Key = "secret-key"
+	store.Spec.Provider.Kubernetes.Auth.Token.BearerToken.Namespace = &ns
+	err = p.ValidateStore(store)
+	if err == nil {
+		t.Errorf(errExpectedErr)
+	} else if err.Error() != "namespace not allowed with namespaced SecretStore" {
+		t.Errorf("KeySelector test failed: expected namespace not allowed, got %v", err)
+	}
 	store.Spec.Provider.Kubernetes.Auth = esv1beta1.KubernetesAuth{
 		Cert: &esv1beta1.CertAuth{
 			ClientCert: v1.SecretKeySelector{