public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Add single tenant SecureValueClient (#108099)

Browse Source 
* Secrets: Add single tenant SecureValueClient

* SecureValueClient: Rename file

* SecureValueClient: Move original type to contracts package and export it by aliasing
This commit is contained in:
Matheus Macabu
2025-07-17 10:56:49 +02:00
committed by GitHub
parent a0873736aa
commit 6c69ae244e
6 changed files with 376 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/secret/validator/keeper_test.go
+2 -17
View File
@@ -11,6 +11,8 @@ import (
)
func TestValidateKeeper(t *testing.T) {
validator := ProvideKeeperValidator()
t.Run("when creating a new keeper", func(t *testing.T) {
t.Run("the `description` must be present", func(t *testing.T) {
keeper := &secretv1beta1.Keeper{
@@ -23,7 +25,6 @@ func TestValidateKeeper(t *testing.T) {
},
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.description", errs[0].Field)
@@ -41,7 +42,6 @@ func TestValidateKeeper(t *testing.T) {
},
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -54,7 +54,6 @@ func TestValidateKeeper(t *testing.T) {
},
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -81,7 +80,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperAWS.DeepCopy()
keeper.Spec.Aws.AccessKeyID = secretv1beta1.KeeperCredentialValue{}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.aws.accessKeyID", errs[0].Field)
@@ -95,7 +93,6 @@ func TestValidateKeeper(t *testing.T) {
ValueFromConfig: "c",
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.aws.accessKeyID", errs[0].Field)
@@ -107,7 +104,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperAWS.DeepCopy()
keeper.Spec.Aws.SecretAccessKey = secretv1beta1.KeeperCredentialValue{}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.aws.secretAccessKey", errs[0].Field)
@@ -121,7 +117,6 @@ func TestValidateKeeper(t *testing.T) {
ValueFromConfig: "c",
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.aws.secretAccessKey", errs[0].Field)
@@ -148,7 +143,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperAzure.DeepCopy()
keeper.Spec.Azure.KeyVaultName = ""
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.azure.keyVaultName", errs[0].Field)
@@ -158,7 +152,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperAzure.DeepCopy()
keeper.Spec.Azure.TenantID = ""
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.azure.tenantID", errs[0].Field)
@@ -168,7 +161,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperAzure.DeepCopy()
keeper.Spec.Azure.ClientID = ""
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.azure.clientID", errs[0].Field)
@@ -179,7 +171,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperAzure.DeepCopy()
keeper.Spec.Azure.ClientSecret = secretv1beta1.KeeperCredentialValue{}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.azure.clientSecret", errs[0].Field)
@@ -193,7 +184,6 @@ func TestValidateKeeper(t *testing.T) {
ValueFromConfig: "c",
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.azure.clientSecret", errs[0].Field)
@@ -216,7 +206,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperGCP.DeepCopy()
keeper.Spec.Gcp.ProjectID = ""
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.gcp.projectID", errs[0].Field)
@@ -226,7 +215,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperGCP.DeepCopy()
keeper.Spec.Gcp.CredentialsFile = ""
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.gcp.credentialsFile", errs[0].Field)
@@ -250,7 +238,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperHashiCorp.DeepCopy()
keeper.Spec.HashiCorpVault.Address = ""
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.hashiCorpVault.address", errs[0].Field)
@@ -261,7 +248,6 @@ func TestValidateKeeper(t *testing.T) {
keeper := validKeeperHashiCorp.DeepCopy()
keeper.Spec.HashiCorpVault.Token = secretv1beta1.KeeperCredentialValue{}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.hashiCorpVault.token", errs[0].Field)
@@ -275,7 +261,6 @@ func TestValidateKeeper(t *testing.T) {
ValueFromConfig: "c",
}
validator := ProvideKeeperValidator()
errs := validator.Validate(keeper, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.hashiCorpVault.token", errs[0].Field)
pkg/registry/apis/secret/validator/secure_value.go
+7
View File
@@ -38,6 +38,13 @@ func (v *secureValueValidator) Validate(sv, oldSv *secretv1beta1.SecureValue, op
}
// General validations.
if sv.Name == "" {
errs = append(errs, field.Required(field.NewPath("metadata", "name"), "a `name` is required"))
}
if sv.Namespace == "" {
errs = append(errs, field.Required(field.NewPath("metadata", "namespace"), "a `namespace` is required"))
}
if sv.Spec.Value != nil && len(*sv.Spec.Value) > contracts.SECURE_VALUE_RAW_INPUT_MAX_SIZE_BYTES {
errs = append(
errs,
pkg/registry/apis/secret/validator/secure_value_test.go
+21 -16
View File
@@ -6,6 +6,7 @@ import (
"testing"
"github.com/stretchr/testify/require"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apiserver/pkg/admission"
"k8s.io/utils/ptr"
@@ -14,9 +15,13 @@ import (
)
func TestValidateSecureValue(t *testing.T) {
objectMeta := metav1.ObjectMeta{Name: "test", Namespace: "test"}
validator := ProvideSecureValueValidator()
t.Run("when creating a new securevalue", func(t *testing.T) {
keeper := "keeper"
validSecureValue := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "description",
Value: ptr.To(secretv1beta1.NewExposedSecureValue("value")),
@@ -29,7 +34,6 @@ func TestValidateSecureValue(t *testing.T) {
sv := validSecureValue.DeepCopy()
sv.Spec.Description = ""
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.description", errs[0].Field)
@@ -41,7 +45,6 @@ func TestValidateSecureValue(t *testing.T) {
sv.Spec.Value = nil
sv.Spec.Ref = nil
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -50,7 +53,6 @@ func TestValidateSecureValue(t *testing.T) {
sv.Spec.Value = ptr.To(secretv1beta1.NewExposedSecureValue(""))
sv.Spec.Ref = nil
validator = ProvideSecureValueValidator()
errs = validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -60,7 +62,6 @@ func TestValidateSecureValue(t *testing.T) {
sv.Spec.Value = ptr.To(secretv1beta1.NewExposedSecureValue("value"))
sv.Spec.Ref = &ref
validator = ProvideSecureValueValidator()
errs = validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -71,7 +72,6 @@ func TestValidateSecureValue(t *testing.T) {
sv.Spec.Value = ptr.To(secretv1beta1.NewExposedSecureValue(strings.Repeat("a", contracts.SECURE_VALUE_RAW_INPUT_MAX_SIZE_BYTES+1)))
sv.Spec.Ref = nil
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.value", errs[0].Field)
@@ -81,6 +81,7 @@ func TestValidateSecureValue(t *testing.T) {
t.Run("when updating a securevalue", func(t *testing.T) {
t.Run("when trying to switch from a `value` (old) to a `ref` (new), it returns an error", func(t *testing.T) {
oldSv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Ref: nil, // empty `ref` means a `value` was present.
},
@@ -88,6 +89,7 @@ func TestValidateSecureValue(t *testing.T) {
ref := "ref"
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Ref: &ref,
},
@@ -102,18 +104,19 @@ func TestValidateSecureValue(t *testing.T) {
t.Run("when trying to switch from a `ref` (old) to a `value` (new), it returns an error", func(t *testing.T) {
ref := "non-empty"
oldSv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Ref: &ref,
},
}
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Value: ptr.To(secretv1beta1.NewExposedSecureValue("value")),
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, oldSv, admission.Update)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -122,6 +125,7 @@ func TestValidateSecureValue(t *testing.T) {
t.Run("when both `value` and `ref` are set, it returns an error", func(t *testing.T) {
refNonEmpty := "non-empty"
oldSv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Ref: &refNonEmpty,
},
@@ -129,24 +133,24 @@ func TestValidateSecureValue(t *testing.T) {
ref := "ref"
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Value: ptr.To(secretv1beta1.NewExposedSecureValue("value")),
Ref: &ref,
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, oldSv, admission.Update)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
oldSv = &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Value: ptr.To(secretv1beta1.NewExposedSecureValue("non-empty")),
},
}
validator = ProvideSecureValueValidator()
errs = validator.Validate(sv, oldSv, admission.Update)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -154,26 +158,26 @@ func TestValidateSecureValue(t *testing.T) {
t.Run("when no changes are made, it returns no errors", func(t *testing.T) {
oldSv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "old-description",
},
}
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "new-description",
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, oldSv, admission.Update)
require.Empty(t, errs)
})
t.Run("when the old object is `nil` it returns an error", func(t *testing.T) {
sv := &secretv1beta1.SecureValue{}
sv := &secretv1beta1.SecureValue{ObjectMeta: objectMeta}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Update)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -183,18 +187,19 @@ func TestValidateSecureValue(t *testing.T) {
keeperA := "a-keeper"
keeperAnother := "another-keeper"
oldSv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Keeper: &keeperA,
},
}
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Keeper: &keeperAnother,
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, oldSv, admission.Update)
require.Len(t, errs, 1)
require.Equal(t, "spec", errs[0].Field)
@@ -204,6 +209,7 @@ func TestValidateSecureValue(t *testing.T) {
t.Run("`decrypters` must have unique items", func(t *testing.T) {
ref := "ref"
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "description", Ref: &ref,
@@ -214,7 +220,6 @@ func TestValidateSecureValue(t *testing.T) {
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.decrypters.[1]", errs[0].Field)
@@ -223,6 +228,7 @@ func TestValidateSecureValue(t *testing.T) {
t.Run("`decrypters` list can be empty", func(t *testing.T) {
ref := "ref"
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "description", Ref: &ref,
@@ -230,7 +236,6 @@ func TestValidateSecureValue(t *testing.T) {
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Empty(t, errs)
})
@@ -251,6 +256,7 @@ func TestValidateSecureValue(t *testing.T) {
ref := "ref"
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "description", Ref: &ref,
@@ -258,7 +264,6 @@ func TestValidateSecureValue(t *testing.T) {
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 3)
})
@@ -271,6 +276,7 @@ func TestValidateSecureValue(t *testing.T) {
ref := "ref"
sv := &secretv1beta1.SecureValue{
ObjectMeta: objectMeta,
Spec: secretv1beta1.SecureValueSpec{
Description: "description", Ref: &ref,
@@ -278,7 +284,6 @@ func TestValidateSecureValue(t *testing.T) {
},
}
validator := ProvideSecureValueValidator()
errs := validator.Validate(sv, nil, admission.Create)
require.Len(t, errs, 1)
require.Equal(t, "spec.decrypters", errs[0].Field)