Skip to content

Commit 89fd098

Browse files
felixfonteinfelixfontein
committed
Address review feedback, extend tests.
Signed-off-by: Felix Fontein <[email protected]>
1 parent fae9afa commit 89fd098

File tree

2 files changed

+136
-50
lines changed

2 files changed

+136
-50
lines changed

‎config/config_test.go‎

Lines changed: 135 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
package config
22

33
import (
4+
"fmt"
45
"os"
56
"path"
67
"testing"
78

9+
"github.com/getsops/sops/v3/keys"
810
"github.com/stretchr/testify/assert"
911
)
1012

@@ -97,6 +99,17 @@ creation_rules:
9799
- arn: foo
98100
context:
99101
baz: bam
102+
- arn: foo
103+
aws_profile: bar
104+
context:
105+
baz: bam
106+
- arn: foo
107+
role: '123'
108+
- arn: foo
109+
aws_profile: bar
110+
context:
111+
baz: bam
112+
role: '123'
100113
pgp:
101114
- bar
102115
gcp_kms:
@@ -132,113 +145,124 @@ creation_rules:
132145
- 'https://foo.vault:8200/v1/foo/keys/foo-key'
133146
- merge:
134147
- merge:
135-
- kms:
148+
- pgp:
136149
# key01
150+
- foo
151+
kms:
152+
# key02
137153
- arn: foo
138154
aws_profile: foo
139-
pgp:
140-
# key02
141-
- foo
142-
gcp_kms:
143155
# key03
156+
- arn: foo
157+
aws_profile: bar
158+
context:
159+
baz: bam
160+
role: '123'
161+
gcp_kms:
162+
# key04
144163
- resource_id: foo
145164
azure_keyvault:
146-
# key04
165+
# key05
147166
- vaultUrl: https://foo.vault.azure.net
148167
key: foo-key
149168
version: fooversion
150169
hc_vault:
151-
# key05
152-
- 'https://bar.vault:8200/v1/bar/keys/bar-key'
153-
- kms:
154170
# key06
155-
- arn: bar
156-
aws_profile: bar
157-
pgp:
171+
- 'https://bar.vault:8200/v1/bar/keys/bar-key'
172+
- pgp:
158173
# key07
159174
- bar
160-
gcp_kms:
175+
kms:
161176
# key08
162-
- resource_id: bar
177+
- arn: bar
178+
aws_profile: bar
179+
gcp_kms:
163180
# key09
181+
- resource_id: bar
182+
# key10
164183
- resource_id: baz
165184
azure_keyvault:
166-
# key10
185+
# key11
167186
- vaultUrl: https://bar.vault.azure.net
168187
key: bar-key
169188
version: barversion
170189
hc_vault:
171-
# key01 - duplicate#1
190+
# key12
172191
- 'https://baz.vault:8200/v1/baz/keys/baz-key'
192+
pgp:
193+
# key13
194+
- baz
173195
kms:
174-
# key11
196+
# key14
175197
- arn: baz
176198
aws_profile: baz
177-
pgp:
178-
# key12
179-
- baz
180199
gcp_kms:
181-
# key03 - duplicate#2
182-
# --> should be removed when loading config
200+
# duplicate of key09
183201
- resource_id: bar
184202
azure_keyvault:
185-
# key04 - duplicate#3
203+
# duplicate of key05
186204
- vaultUrl: https://foo.vault.azure.net
187205
key: foo-key
188206
version: fooversion
189207
hc_vault:
190-
# key13 - duplicate#4 - but from different key_group
191-
# --> should stay
208+
# key15 (duplicate of key00, but that's in a different key_group)
192209
- 'https://foo.vault:8200/v1/foo/keys/foo-key'
193-
- kms:
194-
# key14
210+
- pgp:
211+
# key16
212+
- qux
213+
kms:
214+
# key17
195215
- arn: qux
196216
aws_profile: qux
197-
# key14 - duplicate#5
217+
# key18
198218
- arn: baz
199219
aws_profile: bar
200-
pgp:
201-
# key15
202-
- qux
220+
# key19
221+
- arn: baz
222+
role: '123'
203223
gcp_kms:
204-
# key16
224+
# key20
205225
- resource_id: qux
206-
# key17
226+
# key21
207227
- resource_id: fnord
208228
azure_keyvault:
209-
# key18
229+
# key22
210230
- vaultUrl: https://baz.vault.azure.net
211231
key: baz-key
212232
version: bazversion
213233
hc_vault:
214-
# key19
234+
# key23
215235
- 'https://qux.vault:8200/v1/qux/keys/qux-key'
216-
# everything below this should be loaded,
217-
# since it is not in a merge block
236+
pgp:
237+
# duplicate of key07
238+
- bar
218239
kms:
219-
# duplicated key06
240+
# duplicate of key08
220241
- arn: bar
221242
aws_profile: bar
222-
# key20
243+
# key24
223244
- arn: fnord
224245
aws_profile: fnord
225-
pgp:
226-
# duplicated key07
227-
- bar
246+
# duplicate of key03
247+
- arn: foo
248+
aws_profile: bar
249+
context:
250+
baz: bam
251+
role: '123'
228252
gcp_kms:
229-
# duplicated key08
253+
# duplicate of key09
230254
- resource_id: bar
231-
# key21
255+
# duplicate of key21
232256
- resource_id: fnord
233257
azure_keyvault:
234-
# duplicated key10
258+
# duplicate of key11
235259
- vaultUrl: https://bar.vault.azure.net
236260
key: bar-key
237261
version: barversion
238262
hc_vault:
239-
# duplicated 'key01 - duplicate#2'
263+
# duplicate of key12
240264
- 'https://baz.vault:8200/v1/baz/keys/baz-key'
241-
# key22
265+
# key25
242266
- 'https://fnord.vault:8200/v1/fnord/keys/fnord-key'
243267
`)
244268

@@ -447,6 +471,25 @@ func TestLoadConfigFileWithGroups(t *testing.T) {
447471
"baz": &bam,
448472
},
449473
},
474+
{
475+
Arn: "foo",
476+
AwsProfile: "bar",
477+
Context: map[string]*string{
478+
"baz": &bam,
479+
},
480+
},
481+
{
482+
Arn: "foo",
483+
Role: "123",
484+
},
485+
{
486+
Arn: "foo",
487+
AwsProfile: "bar",
488+
Context: map[string]*string{
489+
"baz": &bam,
490+
},
491+
Role: "123",
492+
},
450493
},
451494
PGP: []string{"bar"},
452495
GCPKMS: []gcpKmsKey{{ResourceID: "foo"}},
@@ -474,12 +517,52 @@ func TestLoadConfigFileWithGroups(t *testing.T) {
474517
assert.Equal(t, expected, conf)
475518
}
476519

520+
func id(key keys.MasterKey) string {
521+
return fmt.Sprintf("%s: %s", key.TypeToIdentifier(), key.ToString())
522+
}
523+
524+
func ids(keys []keys.MasterKey) []string {
525+
result := make([]string, 0, len(keys))
526+
for _, key := range keys {
527+
result = append(result, id(key))
528+
}
529+
return result
530+
}
531+
477532
func TestLoadConfigFileWithMerge(t *testing.T) {
478533
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithMergeType, t), "/conf/path", "whatever", nil)
479534
assert.Nil(t, err)
480535
assert.Equal(t, 2, len(conf.KeyGroups))
481-
assert.Equal(t, 1, len(conf.KeyGroups[0]))
482-
assert.Equal(t, 23, len(conf.KeyGroups[1]))
536+
assert.Equal(t, []string{
537+
"hc_vault: https://foo.vault:8200/v1/foo/keys/foo-key",
538+
}, ids(conf.KeyGroups[0]))
539+
assert.Equal(t, []string{
540+
"pgp: foo", // key01
541+
"kms: foo||foo", //key02
542+
"kms: foo+123|baz:bam|bar", //key03
543+
"gcp_kms: foo", //key04
544+
"azure_kv: https://foo.vault.azure.net/keys/foo-key/fooversion", //key05
545+
"hc_vault: https://bar.vault:8200/v1/bar/keys/bar-key", //key06
546+
"pgp: bar", //key07
547+
"kms: bar||bar", //key08
548+
"gcp_kms: bar", //key09
549+
"gcp_kms: baz", //key10
550+
"azure_kv: https://bar.vault.azure.net/keys/bar-key/barversion", //key11
551+
"hc_vault: https://baz.vault:8200/v1/baz/keys/baz-key", //key12
552+
"pgp: baz", //key13
553+
"kms: baz||baz", //key14
554+
"hc_vault: https://foo.vault:8200/v1/foo/keys/foo-key", //key15
555+
"pgp: qux", //key16
556+
"kms: qux||qux", //key17
557+
"kms: baz||bar", //key18
558+
"kms: baz+123", //key19
559+
"gcp_kms: qux", //key20
560+
"gcp_kms: fnord", //key21
561+
"azure_kv: https://baz.vault.azure.net/keys/baz-key/bazversion", //key22
562+
"hc_vault: https://qux.vault:8200/v1/qux/keys/qux-key", //key23
563+
"kms: fnord||fnord", //key24
564+
"hc_vault: https://fnord.vault:8200/v1/fnord/keys/fnord-key", //key25
565+
}, ids(conf.KeyGroups[1]))
483566
}
484567

485568
func TestLoadConfigFileWithNoMatchingRules(t *testing.T) {
@@ -555,6 +638,9 @@ func TestKeyGroupsForFileWithGroups(t *testing.T) {
555638
assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString())
556639
assert.Equal(t, "foo||bar", conf.KeyGroups[0][1].ToString())
557640
assert.Equal(t, "foo|baz:bam", conf.KeyGroups[0][2].ToString())
641+
assert.Equal(t, "foo|baz:bam|bar", conf.KeyGroups[0][3].ToString())
642+
assert.Equal(t, "foo+123", conf.KeyGroups[0][4].ToString())
643+
assert.Equal(t, "foo+123|baz:bam|bar", conf.KeyGroups[0][5].ToString())
558644
assert.Equal(t, "qux", conf.KeyGroups[1][0].ToString())
559645
assert.Equal(t, "baz||foo", conf.KeyGroups[1][1].ToString())
560646
}

‎kms/keysource.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,7 @@ func (key *MasterKey) ToString() string {
319319
if key.AwsProfile != "" {
320320
return fmt.Sprintf("%s|%s|%s", arnRole, context, key.AwsProfile)
321321
}
322-
if len(key.EncryptionContext) > 0 {
322+
if context != "" {
323323
return fmt.Sprintf("%s|%s", arnRole, context)
324324
}
325325
return arnRole

0 commit comments

Comments
 (0)