|
|
@@ -42,6 +42,11 @@ const (
|
|
|
invalidProp = "INVALPROP"
|
|
|
)
|
|
|
|
|
|
+var (
|
|
|
+ fakeSecretKey = "fakeSecretKey"
|
|
|
+ fakeValue = "fakeValue"
|
|
|
+)
|
|
|
+
|
|
|
type parameterstoreTestCase struct {
|
|
|
fakeClient *fakeps.Client
|
|
|
apiInput *ssm.GetParameterInput
|
|
|
@@ -51,6 +56,7 @@ type parameterstoreTestCase struct {
|
|
|
expectError string
|
|
|
expectedSecret string
|
|
|
expectedData map[string][]byte
|
|
|
+ prefix string
|
|
|
}
|
|
|
|
|
|
func makeValidParameterStoreTestCase() *parameterstoreTestCase {
|
|
|
@@ -60,6 +66,7 @@ func makeValidParameterStoreTestCase() *parameterstoreTestCase {
|
|
|
apiOutput: makeValidAPIOutput(),
|
|
|
remoteRef: makeValidRemoteRef(),
|
|
|
apiErr: nil,
|
|
|
+ prefix: "",
|
|
|
expectError: "",
|
|
|
expectedSecret: "",
|
|
|
expectedData: make(map[string][]byte),
|
|
|
@@ -270,8 +277,6 @@ const remoteKey = "fake-key"
|
|
|
func TestPushSecret(t *testing.T) {
|
|
|
invalidParameters := errors.New(ssm.ErrCodeInvalidParameters)
|
|
|
alreadyExistsError := errors.New(ssm.ErrCodeAlreadyExistsException)
|
|
|
- fakeSecretKey := "fakeSecretKey"
|
|
|
- fakeValue := "fakeValue"
|
|
|
fakeSecret := &corev1.Secret{
|
|
|
Data: map[string][]byte{
|
|
|
fakeSecretKey: []byte(fakeValue),
|
|
|
@@ -518,9 +523,43 @@ func TestPushSecret(t *testing.T) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
+func TestPushSecretWithPrefix(t *testing.T) {
|
|
|
+ fakeSecret := &corev1.Secret{
|
|
|
+ Data: map[string][]byte{
|
|
|
+ fakeSecretKey: []byte(fakeValue),
|
|
|
+ },
|
|
|
+ }
|
|
|
+ managedByESO := ssm.Tag{
|
|
|
+ Key: &managedBy,
|
|
|
+ Value: &externalSecrets,
|
|
|
+ }
|
|
|
+ putParameterOutput := &ssm.PutParameterOutput{}
|
|
|
+ getParameterOutput := &ssm.GetParameterOutput{}
|
|
|
+ describeParameterOutput := &ssm.DescribeParametersOutput{}
|
|
|
+ validListTagsForResourceOutput := &ssm.ListTagsForResourceOutput{
|
|
|
+ TagList: []*ssm.Tag{&managedByESO},
|
|
|
+ }
|
|
|
+
|
|
|
+ client := fakeps.Client{
|
|
|
+ PutParameterWithContextFn: fakeps.NewPutParameterWithContextFn(putParameterOutput, nil),
|
|
|
+ GetParameterWithContextFn: fakeps.NewGetParameterWithContextFn(getParameterOutput, nil),
|
|
|
+ DescribeParametersWithContextFn: fakeps.NewDescribeParametersWithContextFn(describeParameterOutput, nil),
|
|
|
+ ListTagsForResourceWithContextFn: fakeps.NewListTagsForResourceWithContextFn(validListTagsForResourceOutput, nil),
|
|
|
+ }
|
|
|
+
|
|
|
+ psd := fake.PushSecretData{SecretKey: fakeSecretKey, RemoteKey: remoteKey}
|
|
|
+ ps := ParameterStore{
|
|
|
+ client: &client,
|
|
|
+ prefix: "/test/this/thing/",
|
|
|
+ }
|
|
|
+ err := ps.PushSecret(context.TODO(), fakeSecret, psd)
|
|
|
+ require.NoError(t, err)
|
|
|
+
|
|
|
+ input := client.PutParameterWithContextFnCalledWith[0][0]
|
|
|
+ assert.Equal(t, "/test/this/thing/fake-key", *input.Name)
|
|
|
+}
|
|
|
+
|
|
|
func TestPushSecretCalledOnlyOnce(t *testing.T) {
|
|
|
- fakeSecretKey := "fakeSecretKey"
|
|
|
- fakeValue := "fakeValue"
|
|
|
fakeSecret := &corev1.Secret{
|
|
|
Data: map[string][]byte{
|
|
|
fakeSecretKey: []byte(fakeValue),
|
|
|
@@ -569,6 +608,17 @@ func TestGetSecret(t *testing.T) {
|
|
|
pstc.expectedSecret = "RRRRR"
|
|
|
}
|
|
|
|
|
|
+ // good case: key is passed in and prefix is set, output is sent back
|
|
|
+ setSecretStringWithPrefix := func(pstc *parameterstoreTestCase) {
|
|
|
+ pstc.apiInput = &ssm.GetParameterInput{
|
|
|
+ Name: aws.String("/test/this/baz"),
|
|
|
+ WithDecryption: aws.Bool(true),
|
|
|
+ }
|
|
|
+ pstc.prefix = "/test/this"
|
|
|
+ pstc.apiOutput.Parameter.Value = aws.String("RRRRR")
|
|
|
+ pstc.expectedSecret = "RRRRR"
|
|
|
+ }
|
|
|
+
|
|
|
// good case: extract property
|
|
|
setExtractProperty := func(pstc *parameterstoreTestCase) {
|
|
|
pstc.apiOutput.Parameter.Value = aws.String(`{"/shmoo": "bang"}`)
|
|
|
@@ -649,6 +699,7 @@ func TestGetSecret(t *testing.T) {
|
|
|
}
|
|
|
|
|
|
successCases := []*parameterstoreTestCase{
|
|
|
+ makeValidParameterStoreTestCaseCustom(setSecretStringWithPrefix),
|
|
|
makeValidParameterStoreTestCaseCustom(setSecretString),
|
|
|
makeValidParameterStoreTestCaseCustom(setExtractProperty),
|
|
|
makeValidParameterStoreTestCaseCustom(setMissingProperty),
|
|
|
@@ -665,6 +716,7 @@ func TestGetSecret(t *testing.T) {
|
|
|
ps := ParameterStore{}
|
|
|
for k, v := range successCases {
|
|
|
ps.client = v.fakeClient
|
|
|
+ ps.prefix = v.prefix
|
|
|
out, err := ps.GetSecret(context.Background(), *v.remoteRef)
|
|
|
if !ErrorContains(err, v.expectError) {
|
|
|
t.Errorf("[%d] unexpected error: %s, expected: '%s'", k, err.Error(), v.expectError)
|
Gergely Brautigam