@@ -151,6 +151,15 @@ func Test_ensureDecryption(t *testing.T) {
151151 }
152152
153153 kubeClient = fake .NewSimpleClientset (
154+ & v1.Secret {
155+ ObjectMeta : metaV1.ObjectMeta {
156+ Name : "strongbox-secret" ,
157+ Namespace : "bar" ,
158+ },
159+ Data : map [string ][]byte {
160+ "keyring" : kr ,
161+ },
162+ },
154163 & v1.Secret {
155164 ObjectMeta : metaV1.ObjectMeta {
156165 Name : "strongbox-secret" ,
@@ -174,7 +183,7 @@ func Test_ensureDecryption(t *testing.T) {
174183 },
175184 )
176185
177- // withRemoteBase doesn't have enc files so it should not look for "missing-secrets" secret
186+ // withRemoteBase doesn't have encrypted files so it should not error for "missing-secrets" secret
178187 bar := applicationInfo {
179188 name : "bar" ,
180189 destinationNamespace : "bar" ,
@@ -183,12 +192,35 @@ func Test_ensureDecryption(t *testing.T) {
183192 key : "invalid" ,
184193 },
185194 }
186- err = ensureDecryption (context .Background (), withRemoteBaseTestDir , bar )
187- if err != nil {
188- t .Fatal (err )
195+ t .Run ("no-encrypted-files-no-secret" , func (t * testing.T ) {
196+ err = ensureDecryption (context .Background (), withRemoteBaseTestDir , bar )
197+ if err != nil {
198+ t .Fatal (err )
199+ }
200+ })
201+
202+ // withRemoteBase doesn't have encrypted files but namespace contains secret so it should setup
203+ // strongbox for remote base's encrypted secrets
204+ bar2 := applicationInfo {
205+ name : "bar" ,
206+ destinationNamespace : "bar" ,
207+ keyringSecret : secretInfo {
208+ name : "strongbox-secret" ,
209+ key : "keyring" ,
210+ },
189211 }
212+ t .Run ("no-encrypted-files-with-secret" , func (t * testing.T ) {
213+ err = ensureDecryption (context .Background (), withRemoteBaseTestDir , bar2 )
214+ if err != nil {
215+ t .Fatal (err )
216+ }
217+ // make sure .strongbox_keyring file exists with correct keyring data
218+ if ! bytes .Contains (getFileContent (t , withRemoteBaseTestDir + "/.strongbox_keyring" ), kr ) {
219+ t .Error (withRemoteBaseTestDir + "/.strongbox_keyring should contain keyring data" )
220+ }
221+ })
190222
191- // encryptedTestDir1 has enc files so it should look for secret and then decrypt content
223+ // encryptedTestDir1 has encrypted files so it should look for secret and then decrypt content
192224 // keyring secret in app's destination NS
193225 foo := applicationInfo {
194226 name : "foo" ,
@@ -198,29 +230,31 @@ func Test_ensureDecryption(t *testing.T) {
198230 key : "keyring" ,
199231 },
200232 }
201- err = ensureDecryption (context .Background (), encryptedTestDir1 , foo )
202- if err != nil {
203- t .Fatal (err )
204- }
233+ t .Run ("encrypted-files-with-secret" , func (t * testing.T ) {
234+ err = ensureDecryption (context .Background (), encryptedTestDir1 , foo )
235+ if err != nil {
236+ t .Fatal (err )
237+ }
205238
206- if ! bytes .Contains (getFileContent (t , encryptedTestDir1 + "/secrets/strongbox-keyring" ), kr ) {
207- t .Error (encryptedTestDir1 + "/secrets/strongbox-keyring should contain keyring data" )
208- }
239+ if ! bytes .Contains (getFileContent (t , encryptedTestDir1 + "/secrets/strongbox-keyring" ), kr ) {
240+ t .Error (encryptedTestDir1 + "/secrets/strongbox-keyring should contain keyring data" )
241+ }
209242
210- encryptedFiles := []string {
211- encryptedTestDir1 + "/app/secrets/env_secrets" ,
212- encryptedTestDir1 + "/app/secrets/kube_secret.yaml" ,
213- encryptedTestDir1 + "/app/secrets/s1.json" ,
214- encryptedTestDir1 + "/app/secrets/s2.yaml" ,
215- }
243+ encryptedFiles := []string {
244+ encryptedTestDir1 + "/app/secrets/env_secrets" ,
245+ encryptedTestDir1 + "/app/secrets/kube_secret.yaml" ,
246+ encryptedTestDir1 + "/app/secrets/s1.json" ,
247+ encryptedTestDir1 + "/app/secrets/s2.yaml" ,
248+ }
216249
217- for _ , f := range encryptedFiles {
218- if ! bytes .Contains (getFileContent (t , f ), []byte ("PlainText" )) {
219- t .Errorf ("%s should be decrypted" , f )
250+ for _ , f := range encryptedFiles {
251+ if ! bytes .Contains (getFileContent (t , f ), []byte ("PlainText" )) {
252+ t .Errorf ("%s should be decrypted" , f )
253+ }
220254 }
221- }
255+ })
222256
223- // encryptedTestDir2 has enc files so it should look for secret and then decrypt content
257+ // encryptedTestDir2 has encrypted files so it should look for secret and then decrypt content
224258 // keyring secret in different namespace then app's destination NS
225259 baz := applicationInfo {
226260 name : "foo" ,
@@ -231,26 +265,28 @@ func Test_ensureDecryption(t *testing.T) {
231265 key : "keyring" ,
232266 },
233267 }
234- err = ensureDecryption (context .Background (), encryptedTestDir2 , baz )
235- if err != nil {
236- t .Fatal (err )
237- }
268+ t .Run ("encrypted-files-with-secret-from-diff-ns" , func (t * testing.T ) {
269+ err = ensureDecryption (context .Background (), encryptedTestDir2 , baz )
270+ if err != nil {
271+ t .Fatal (err )
272+ }
238273
239- if ! bytes .Contains (getFileContent (t , encryptedTestDir2 + "/secrets/strongbox-keyring" ), kr ) {
240- t .Error (encryptedTestDir2 + "/secrets/strongbox-keyring should contain keyring data" )
241- }
274+ if ! bytes .Contains (getFileContent (t , encryptedTestDir2 + "/secrets/strongbox-keyring" ), kr ) {
275+ t .Error (encryptedTestDir2 + "/secrets/strongbox-keyring should contain keyring data" )
276+ }
242277
243- encryptedFiles = []string {
244- encryptedTestDir2 + "/app/secrets/env_secrets" ,
245- encryptedTestDir2 + "/app/secrets/kube_secret.yaml" ,
246- encryptedTestDir2 + "/app/secrets/s1.json" ,
247- encryptedTestDir2 + "/app/secrets/s2.yaml" ,
248- }
278+ encryptedFiles : =string {
279+ encryptedTestDir2 + "/app/secrets/env_secrets" ,
280+ encryptedTestDir2 + "/app/secrets/kube_secret.yaml" ,
281+ encryptedTestDir2 + "/app/secrets/s1.json" ,
282+ encryptedTestDir2 + "/app/secrets/s2.yaml" ,
283+ }
249284
250- for _ , f := range encryptedFiles {
251- if ! bytes .Contains (getFileContent (t , f ), []byte ("PlainText" )) {
252- t .Errorf ("%s should be decrypted" , f )
285+ for _ , f := range encryptedFiles {
286+ if ! bytes .Contains (getFileContent (t , f ), []byte ("PlainText" )) {
287+ t .Errorf ("%s should be decrypted" , f )
288+ }
253289 }
254- }
290+ })
255291
256292}
0 commit comments