@@ -15,9 +15,11 @@ import (
1515 controllers "github.com/openstack-k8s-operators/barbican-operator/controllers"
1616 "github.com/openstack-k8s-operators/barbican-operator/pkg/barbican"
1717 topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
18+ keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
1819 condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
1920 mariadb_test "github.com/openstack-k8s-operators/mariadb-operator/api/test/helpers"
2021 corev1 "k8s.io/api/core/v1"
22+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2123 "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
2224 "k8s.io/apimachinery/pkg/types"
2325)
@@ -1589,6 +1591,117 @@ var _ = Describe("Barbican controller", func() {
15891591 })
15901592 })
15911593
1594+ When ("An ApplicationCredential is created for Barbican" , func () {
1595+ var (
1596+ acName string
1597+ acSecretName string
1598+ servicePasswordSecret string
1599+ passwordSelector string
1600+ )
1601+ BeforeEach (func () {
1602+ servicePasswordSecret = "ac-test-osp-secret" //nolint:gosec // G101
1603+ passwordSelector = "BarbicanPassword"
1604+
1605+ DeferCleanup (k8sClient .Delete , ctx ,
1606+ CreateBarbicanMessageBusSecret (
1607+ barbicanTest .Instance .Namespace ,
1608+ barbicanTest .RabbitmqSecretName ,
1609+ ),
1610+ )
1611+ DeferCleanup (k8sClient .Delete , ctx ,
1612+ CreateBarbicanSecret (
1613+ barbicanTest .Instance .Namespace , servicePasswordSecret ))
1614+ DeferCleanup (th .DeleteInstance ,
1615+ CreateBarbican (barbicanTest .Instance , GetDefaultBarbicanSpec ()))
1616+ DeferCleanup (
1617+ mariadb .DeleteDBService ,
1618+ mariadb .CreateDBService (
1619+ barbicanTest .Instance .Namespace ,
1620+ GetBarbican (barbicanTest .Instance ).Spec .DatabaseInstance ,
1621+ corev1.ServiceSpec {
1622+ Ports : []corev1.ServicePort {{Port : 3306 }}}))
1623+
1624+ DeferCleanup (keystone .DeleteKeystoneAPI ,
1625+ keystone .CreateKeystoneAPI (barbicanTest .Instance .Namespace ),
1626+ )
1627+
1628+ acName = fmt .Sprintf ("ac-%s" , barbican .ServiceName )
1629+ acSecretName = acName + "-secret"
1630+ secret := & corev1.Secret {
1631+ ObjectMeta : metav1.ObjectMeta {
1632+ Namespace : barbicanTest .Instance .Namespace ,
1633+ Name : acSecretName ,
1634+ },
1635+ Data : map [string ][]byte {
1636+ "AC_ID" : []byte ("test-ac-id" ),
1637+ "AC_SECRET" : []byte ("test-ac-secret" ),
1638+ },
1639+ }
1640+ DeferCleanup (k8sClient .Delete , ctx , secret )
1641+ Expect (k8sClient .Create (ctx , secret )).To (Succeed ())
1642+
1643+ ac := & keystonev1.KeystoneApplicationCredential {
1644+ ObjectMeta : metav1.ObjectMeta {
1645+ Namespace : barbicanTest .Instance .Namespace ,
1646+ Name : acName ,
1647+ },
1648+ Spec : keystonev1.KeystoneApplicationCredentialSpec {
1649+ UserName : barbican .ServiceName ,
1650+ Secret : servicePasswordSecret ,
1651+ PasswordSelector : passwordSelector ,
1652+ Roles : []string {"admin" , "member" },
1653+ AccessRules : []keystonev1.ACRule {{Service : "identity" , Method : "POST" , Path : "/auth/tokens" }},
1654+ ExpirationDays : 30 ,
1655+ GracePeriodDays : 5 ,
1656+ },
1657+ }
1658+ DeferCleanup (k8sClient .Delete , ctx , ac )
1659+ Expect (k8sClient .Create (ctx , ac )).To (Succeed ())
1660+
1661+ fetched := & keystonev1.KeystoneApplicationCredential {}
1662+ key := types.NamespacedName {Namespace : ac .Namespace , Name : ac .Name }
1663+ Expect (k8sClient .Get (ctx , key , fetched )).To (Succeed ())
1664+
1665+ fetched .Status .SecretName = acSecretName
1666+ now := metav1 .Now ()
1667+ readyCond := condition.Condition {
1668+ Type : condition .ReadyCondition ,
1669+ Status : corev1 .ConditionTrue ,
1670+ Reason : condition .ReadyReason ,
1671+ Message : condition .ReadyMessage ,
1672+ LastTransitionTime : now ,
1673+ }
1674+ fetched .Status .Conditions = condition.Conditions {readyCond }
1675+ Expect (k8sClient .Status ().Update (ctx , fetched )).To (Succeed ())
1676+
1677+ infra .SimulateTransportURLReady (barbicanTest .BarbicanTransportURL )
1678+ mariadb .SimulateMariaDBAccountCompleted (barbicanTest .BarbicanDatabaseAccount )
1679+ mariadb .SimulateMariaDBDatabaseCompleted (barbicanTest .BarbicanDatabaseName )
1680+
1681+ th .SimulateJobSuccess (barbicanTest .BarbicanDBSync )
1682+
1683+ keystone .SimulateKeystoneEndpointReady (barbicanTest .BarbicanKeystoneEndpoint )
1684+ })
1685+
1686+ It ("should render ApplicationCredential auth in 00-default.conf" , func () {
1687+ keystone .SimulateKeystoneEndpointReady (barbicanTest .BarbicanKeystoneEndpoint )
1688+
1689+ Eventually (func (g Gomega ) {
1690+ cfgSecret := th .GetSecret (barbicanTest .BarbicanAPIConfigSecret )
1691+ g .Expect (cfgSecret ).NotTo (BeNil ())
1692+
1693+ conf := string (cfgSecret .Data ["00-default.conf" ])
1694+
1695+ g .Expect (conf ).To (ContainSubstring (
1696+ "application_credential_id = test-ac-id" ),
1697+ )
1698+ g .Expect (conf ).To (ContainSubstring (
1699+ "application_credential_secret = test-ac-secret" ),
1700+ )
1701+ }, timeout , interval ).Should (Succeed ())
1702+ })
1703+ })
1704+
15921705 // Run MariaDBAccount suite tests. these are pre-packaged ginkgo tests
15931706 // that exercise standard account create / update patterns that should be
15941707 // common to all controllers that ensure MariaDBAccount CRs.
0 commit comments