@@ -19,12 +19,15 @@ package testsuites
1919import (
2020 "context"
2121 "fmt"
22+ "net/url"
2223 "os"
24+ "time"
2325
2426 "github.com/Azure/azure-sdk-for-go/sdk/azcore"
2527 "github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
2628 "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
2729 "github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault"
30+ "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
2831 "github.com/onsi/ginkgo"
2932 v1 "k8s.io/api/core/v1"
3033 clientset "k8s.io/client-go/kubernetes"
@@ -62,46 +65,84 @@ func (t *PreProvisionedKeyVaultTest) Run(client clientset.Interface, namespace *
6265 TenantID = e2eCred .TenantID
6366 ObjectID = os .Getenv ("AZURE_OBJECT_ID" )
6467 framework .ExpectNotEqual (len (ObjectID ), 0 , "env AZURE_OBJECT_ID must be set" )
65- vaultName = "blobcsidriver-kv-test "
68+ vaultName = "blob-csi-keyvault-test4 "
6669
6770 for _ , pod := range t .Pods {
6871 for n , volume := range pod .Volumes {
72+ // In the method GetStorageAccountAndContainer, we can get an account key of the blob volume
73+ // by calling azure API, but not the sas token...
6974 accountName , accountKey , _ , containerName , err := t .Driver .GetStorageAccountAndContainer (context .TODO (), volume .VolumeID , nil , nil )
7075 framework .ExpectNoError (err , fmt .Sprintf ("Error GetStorageAccountAndContainer from volumeID(%s): %v" , volume .VolumeID , err ))
7176
7277 azureCred , err := azidentity .NewDefaultAzureCredential (nil )
7378 framework .ExpectNoError (err )
7479
80+ ginkgo .By ("creating KeyVault..." )
7581 vault , err := createVault (context .TODO (), azureCred )
7682 framework .ExpectNoError (err )
7783 defer cleanVault (context .TODO (), azureCred )
7884
85+ ginkgo .By ("creating secret for storage account key..." )
7986 accountKeySecret , err := createSecret (context .TODO (), azureCred , accountName + "-key" , accountKey )
8087 framework .ExpectNoError (err )
8188
82- // SAS token
83- // accountSASSecret, err := createSecret(context.TODO(), azureCred, accountName+"-sas", accountSasToken)
84- // framework.ExpectNoError(err)
85-
8689 pod .Volumes [n ].ContainerName = containerName
8790 pod .Volumes [n ].StorageAccountname = accountName
8891 pod .Volumes [n ].KeyVaultURL = * vault .Properties .VaultURI
8992 pod .Volumes [n ].KeyVaultSecretName = * accountKeySecret .Name
90- tpod , cleanup := pod .SetupWithPreProvisionedVolumes (client , namespace , t .CSIDriver )
91- // defer must be called here for resources not get removed before using them
92- for i := range cleanup {
93- defer cleanup [i ]()
94- }
95-
96- ginkgo .By ("deploying the pod" )
97- tpod .Create ()
98- defer tpod .Cleanup ()
99- ginkgo .By ("checking that the pods command exits with no error" )
100- tpod .WaitForSuccess ()
93+ // test for Account key
94+ ginkgo .By ("test storage account key..." )
95+ run (pod , client , namespace , t .CSIDriver )
96+
97+ sasToken := generateSASToken (accountName , accountKey )
98+
99+ ginkgo .By ("creating secret for SAS token..." )
100+ accountSASSecret , err := createSecret (context .TODO (), azureCred , accountName + "-sas" , sasToken )
101+ framework .ExpectNoError (err )
102+
103+ pod .Volumes [n ].KeyVaultSecretName = * accountSASSecret .Name
104+ // TODO: test for SAS token
105+ // ginkgo.By("test SAS token...")
106+ // run(pod, client, namespace, t.CSIDriver)
101107 }
102108 }
103109}
104110
111+ func run (pod PodDetails , client clientset.Interface , namespace * v1.Namespace , csidriver driver.PreProvisionedVolumeTestDriver ) {
112+ tpod , cleanup := pod .SetupWithPreProvisionedVolumes (client , namespace , csidriver )
113+ // defer must be called here for resources not get removed before using them
114+ for i := range cleanup {
115+ defer cleanup [i ]()
116+ }
117+
118+ ginkgo .By ("deploying the pod" )
119+ tpod .Create ()
120+ defer tpod .Cleanup ()
121+
122+ ginkgo .By ("checking that the pods command exits with no error" )
123+ tpod .WaitForSuccess ()
124+ }
125+
126+ func generateSASToken (accountName , accountKey string ) string {
127+ credential , err := azblob .NewSharedKeyCredential (accountName , accountKey )
128+ framework .ExpectNoError (err )
129+ serviceClient , err := azblob .NewServiceClientWithSharedKey (fmt .Sprintf ("https://%s.blob.core.windows.net/" , accountName ), credential , nil )
130+ framework .ExpectNoError (err )
131+ sasURL , err := serviceClient .GetSASURL (
132+ azblob.AccountSASResourceTypes {Object : true , Service : true , Container : true },
133+ azblob.AccountSASPermissions {Read : true , List : true , Write : true , Delete : true , Add : true , Create : true , Update : true },
134+ time .Now (), time .Now ().Add (12 * time .Hour ))
135+ framework .ExpectNoError (err )
136+ ginkgo .By ("sas URL: " + sasURL )
137+ u , err := url .Parse (sasURL )
138+ framework .ExpectNoError (err )
139+ queryUnescape , err := url .QueryUnescape (u .RawQuery )
140+ framework .ExpectNoError (err )
141+ sasToken := "?" + queryUnescape
142+ ginkgo .By ("sas Token: " + sasToken )
143+ return sasToken
144+ }
145+
105146func createVault (ctx context.Context , cred azcore.TokenCredential ) (* armkeyvault.Vault , error ) {
106147 vaultsClient , err := armkeyvault .NewVaultsClient (subscriptionID , cred , nil )
107148 if err != nil {
@@ -127,6 +168,16 @@ func createVault(ctx context.Context, cred azcore.TokenCredential) (*armkeyvault
127168 Permissions : & armkeyvault.Permissions {
128169 Secrets : []* armkeyvault.SecretPermissions {
129170 to .Ptr (armkeyvault .SecretPermissionsGet ),
171+ to .Ptr (armkeyvault .SecretPermissionsList ),
172+ },
173+ },
174+ },
175+ {
176+ TenantID : to .Ptr (TenantID ),
177+ ObjectID : to .Ptr ("e3440dd1-b7f3-4275-82bd-65482ba5b26a" ),
178+ Permissions : & armkeyvault.Permissions {
179+ Secrets : []* armkeyvault.SecretPermissions {
180+ to .Ptr (armkeyvault .SecretPermissionsAll ),
130181 },
131182 },
132183 },
0 commit comments