@@ -15,9 +15,11 @@ import (
1515 controllers "github.com/openstack-k8s-operators/barbican-operator/controllers"
1616 "github.com/openstack-k8s-operators/barbican-operator/pkg/barbican"
1717 topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
18+ keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
1819 condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
1920 mariadb_test "github.com/openstack-k8s-operators/mariadb-operator/api/test/helpers"
2021 corev1 "k8s.io/api/core/v1"
22+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2123 "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
2224 "k8s.io/apimachinery/pkg/types"
2325)
@@ -1589,6 +1591,114 @@ var _ = Describe("Barbican controller", func() {
15891591 })
15901592 })
15911593
1594+ When ("An ApplicationCredential is created for Barbican" , func () {
1595+ var (
1596+ acName string
1597+ acSecretName string
1598+ )
1599+ BeforeEach (func () {
1600+ DeferCleanup (k8sClient .Delete , ctx ,
1601+ CreateBarbicanMessageBusSecret (
1602+ barbicanTest .Instance .Namespace ,
1603+ barbicanTest .RabbitmqSecretName ,
1604+ ),
1605+ )
1606+ DeferCleanup (k8sClient .Delete , ctx ,
1607+ CreateBarbicanSecret (
1608+ barbicanTest .Instance .Namespace , SecretName ))
1609+ DeferCleanup (th .DeleteInstance ,
1610+ CreateBarbican (barbicanTest .Instance , GetDefaultBarbicanSpec ()))
1611+ DeferCleanup (
1612+ mariadb .DeleteDBService ,
1613+ mariadb .CreateDBService (
1614+ barbicanTest .Instance .Namespace ,
1615+ GetBarbican (barbicanTest .Instance ).Spec .DatabaseInstance ,
1616+ corev1.ServiceSpec {
1617+ Ports : []corev1.ServicePort {{Port : 3306 }}}))
1618+
1619+ DeferCleanup (keystone .DeleteKeystoneAPI ,
1620+ keystone .CreateKeystoneAPI (barbicanTest .Instance .Namespace ),
1621+ )
1622+
1623+ acName = fmt .Sprintf ("ac-%s" , barbican .ServiceName )
1624+ acSecretName = acName + "-secret"
1625+ secret := & corev1.Secret {
1626+ ObjectMeta : metav1.ObjectMeta {
1627+ Namespace : barbicanTest .Instance .Namespace ,
1628+ Name : acSecretName ,
1629+ },
1630+ Data : map [string ][]byte {
1631+ "AC_ID" : []byte ("foo" ),
1632+ "AC_SECRET" : []byte ("supersecretacsecret" ),
1633+ },
1634+ }
1635+ DeferCleanup (k8sClient .Delete , ctx , secret )
1636+ Expect (k8sClient .Create (ctx , secret )).To (Succeed ())
1637+
1638+ ac := & keystonev1.KeystoneApplicationCredential {
1639+ ObjectMeta : metav1.ObjectMeta {
1640+ Namespace : barbicanTest .Instance .Namespace ,
1641+ Name : acName ,
1642+ },
1643+ Spec : keystonev1.KeystoneApplicationCredentialSpec {
1644+ UserName : barbican .ServiceName ,
1645+ Secret : SecretName ,
1646+ PasswordSelector : "BarbicanPassword" ,
1647+ Roles : []string {"admin" , "member" },
1648+ AccessRules : []keystonev1.ACRule {{Service : "identity" , Method : "POST" , Path : "/auth/tokens" }},
1649+ ExpirationDays : 30 ,
1650+ GracePeriodDays : 5 ,
1651+ },
1652+ }
1653+ DeferCleanup (k8sClient .Delete , ctx , ac )
1654+ Expect (k8sClient .Create (ctx , ac )).To (Succeed ())
1655+
1656+ fetched := & keystonev1.KeystoneApplicationCredential {}
1657+ key := types.NamespacedName {Namespace : ac .Namespace , Name : ac .Name }
1658+ Expect (k8sClient .Get (ctx , key , fetched )).To (Succeed ())
1659+
1660+ fetched .Status .SecretName = acSecretName
1661+ now := metav1 .Now ()
1662+ readyCond := condition.Condition {
1663+ Type : condition .ReadyCondition ,
1664+ Status : corev1 .ConditionTrue ,
1665+ Reason : condition .ReadyReason ,
1666+ Message : condition .ReadyMessage ,
1667+ LastTransitionTime : now ,
1668+ }
1669+ fetched .Status .Conditions = condition.Conditions {readyCond }
1670+ Expect (k8sClient .Status ().Update (ctx , fetched )).To (Succeed ())
1671+
1672+ infra .SimulateTransportURLReady (barbicanTest .BarbicanTransportURL )
1673+ mariadb .SimulateMariaDBAccountCompleted (barbicanTest .BarbicanDatabaseAccount )
1674+ mariadb .SimulateMariaDBDatabaseCompleted (barbicanTest .BarbicanDatabaseName )
1675+
1676+ th .SimulateJobSuccess (barbicanTest .BarbicanDBSync )
1677+
1678+ keystone .SimulateKeystoneEndpointReady (barbicanTest .BarbicanKeystoneEndpoint )
1679+ })
1680+
1681+ It ("should render ApplicationCredential auth in 00-default.conf" , func () {
1682+ keystone .SimulateKeystoneEndpointReady (barbicanTest .BarbicanKeystoneEndpoint )
1683+
1684+ var cfgSecret corev1.Secret
1685+ Eventually (func (g Gomega ) {
1686+ cfgSecret = th .GetSecret (barbicanTest .BarbicanAPIConfigSecret )
1687+ g .Expect (cfgSecret ).NotTo (BeNil ())
1688+ }, timeout , interval ).Should (Succeed ())
1689+
1690+ conf := string (cfgSecret .Data ["00-default.conf" ])
1691+
1692+ // check for rendered AC lines
1693+ Expect (conf ).To (ContainSubstring (
1694+ "application_credential_id = foo" ),
1695+ )
1696+ Expect (conf ).To (ContainSubstring (
1697+ "application_credential_secret = supersecretacsecret" ),
1698+ )
1699+ })
1700+ })
1701+
15921702 // Run MariaDBAccount suite tests. these are pre-packaged ginkgo tests
15931703 // that exercise standard account create / update patterns that should be
15941704 // common to all controllers that ensure MariaDBAccount CRs.
0 commit comments