mirror of
https://github.com/stakater/Reloader.git
synced 2026-08-20 04:26:28 +00:00
remove csi tests from e2e suite
This commit is contained in:
Safwan
@@ -110,17 +110,6 @@ rules:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
{{- end}}
|
||||
{{- if .Values.reloader.enableCSIIntegration }}
|
||||
- apiGroups:
|
||||
- "secrets-store.csi.x-k8s.io"
|
||||
resources:
|
||||
- secretproviderclasspodstatuses
|
||||
- secretproviderclasses
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- watch
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
|
||||
@@ -215,7 +215,7 @@ spec:
|
||||
{{- . | toYaml | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or (.Values.reloader.logFormat) (.Values.reloader.logLevel) (.Values.reloader.ignoreSecrets) (.Values.reloader.ignoreNamespaces) (include "reloader-namespaceSelector" .) (.Values.reloader.resourceLabelSelector) (.Values.reloader.ignoreConfigMaps) (.Values.reloader.custom_annotations) (eq .Values.reloader.isArgoRollouts true) (eq .Values.reloader.reloadOnCreate true) (eq .Values.reloader.reloadOnDelete true) (ne .Values.reloader.reloadStrategy "default") (.Values.reloader.enableHA) (.Values.reloader.autoReloadAll) (.Values.reloader.ignoreJobs) (.Values.reloader.ignoreCronJobs) (.Values.reloader.enableCSIIntegration)}}
|
||||
{{- if or (.Values.reloader.logFormat) (.Values.reloader.logLevel) (.Values.reloader.ignoreSecrets) (.Values.reloader.ignoreNamespaces) (include "reloader-namespaceSelector" .) (.Values.reloader.resourceLabelSelector) (.Values.reloader.ignoreConfigMaps) (.Values.reloader.custom_annotations) (eq .Values.reloader.isArgoRollouts true) (eq .Values.reloader.reloadOnCreate true) (eq .Values.reloader.reloadOnDelete true) (ne .Values.reloader.reloadStrategy "default") (.Values.reloader.enableHA) (.Values.reloader.autoReloadAll) (.Values.reloader.ignoreJobs) (.Values.reloader.ignoreCronJobs)}}
|
||||
args:
|
||||
{{- if .Values.reloader.logFormat }}
|
||||
- "--log-format={{ .Values.reloader.logFormat }}"
|
||||
@@ -251,9 +251,6 @@ spec:
|
||||
- "--pprof-addr={{ .Values.reloader.pprofAddr }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.reloader.enableCSIIntegration }}
|
||||
- "--enable-csi-integration=true"
|
||||
{{- end }}
|
||||
{{- if .Values.reloader.custom_annotations }}
|
||||
{{- if .Values.reloader.custom_annotations.configmap }}
|
||||
- "--configmap-annotation"
|
||||
|
||||
@@ -97,17 +97,6 @@ rules:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
{{- end}}
|
||||
{{- if .Values.reloader.enableCSIIntegration }}
|
||||
- apiGroups:
|
||||
- "secrets-store.csi.x-k8s.io"
|
||||
resources:
|
||||
- secretproviderclasspodstatuses
|
||||
- secretproviderclasses
|
||||
verbs:
|
||||
- list
|
||||
- get
|
||||
- watch
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
|
||||
@@ -49,7 +49,6 @@ reloader:
|
||||
enableHA: false
|
||||
# Set to true to enable pprof for profiling
|
||||
enablePProf: false
|
||||
enableCSIIntegration: false
|
||||
# Address to start pprof server on. Default is ":6060"
|
||||
pprofAddr: ":6060"
|
||||
# Set to true if you have a pod security policy that enforces readOnlyRootFilesystem
|
||||
|
||||
@@ -21,7 +21,6 @@ require (
|
||||
k8s.io/client-go v0.36.0
|
||||
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
|
||||
sigs.k8s.io/controller-runtime v0.24.1
|
||||
sigs.k8s.io/secrets-store-csi-driver v1.5.5
|
||||
)
|
||||
|
||||
require (
|
||||
@@ -81,6 +80,7 @@ require (
|
||||
github.com/dlclark/regexp2 v1.11.5 // indirect
|
||||
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
|
||||
github.com/ettle/strcase v0.2.0 // indirect
|
||||
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
|
||||
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
|
||||
github.com/fatih/color v1.18.0 // indirect
|
||||
github.com/fatih/structtag v1.2.0 // indirect
|
||||
@@ -135,7 +135,6 @@ require (
|
||||
github.com/google/pprof v0.0.0-20260106004452-d7df1bf2cac7 // indirect
|
||||
github.com/google/uuid v1.6.0 // indirect
|
||||
github.com/gordonklaus/ineffassign v0.2.0 // indirect
|
||||
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
|
||||
github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
|
||||
github.com/gostaticanalysis/comment v1.5.0 // indirect
|
||||
github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect
|
||||
@@ -178,7 +177,6 @@ require (
|
||||
github.com/mgechev/revive v1.13.0 // indirect
|
||||
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
||||
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
||||
github.com/moby/spdystream v0.5.1 // indirect
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
|
||||
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
|
||||
@@ -270,7 +268,6 @@ require (
|
||||
k8s.io/apiextensions-apiserver v0.36.0 // indirect
|
||||
k8s.io/klog/v2 v2.140.0 // indirect
|
||||
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect
|
||||
k8s.io/streaming v0.36.0 // indirect
|
||||
mvdan.cc/gofumpt v0.9.2 // indirect
|
||||
mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect
|
||||
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
|
||||
|
||||
@@ -54,8 +54,6 @@ github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEW
|
||||
github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg=
|
||||
github.com/argoproj/argo-rollouts v1.9.0 h1:bXgBpwCByXyAUcgBnyP0fxkSW2CEot78InTFjFlag5g=
|
||||
github.com/argoproj/argo-rollouts v1.9.0/go.mod h1:jOalqf2kDSmCp7eQpFF4i3kHnlEqNE/Yjwz1q7CpPIU=
|
||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
|
||||
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
|
||||
github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo=
|
||||
github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c=
|
||||
github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE=
|
||||
@@ -268,8 +266,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs=
|
||||
github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw=
|
||||
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
|
||||
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
|
||||
github.com/gostaticanalysis/analysisutil v0.7.1 h1:ZMCjoue3DtDWQ5WyU16YbjbQEQ3VuzwxALrpYd+HeKk=
|
||||
github.com/gostaticanalysis/analysisutil v0.7.1/go.mod h1:v21E3hY37WKMGSnbsw2S/ojApNWb6C1//mXO48CXbVc=
|
||||
github.com/gostaticanalysis/comment v1.4.2/go.mod h1:KLUTGDv6HOCotCH8h2erHKmpci2ZoR8VPu34YA2uzdM=
|
||||
@@ -382,8 +378,6 @@ github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG
|
||||
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
|
||||
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
|
||||
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
|
||||
github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
|
||||
github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
|
||||
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
|
||||
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||
@@ -743,8 +737,6 @@ k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
|
||||
k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
|
||||
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 h1:V+sn9a/1fEYDGwnllCmqXBk8x7obZ+hl869Q3Abumkg=
|
||||
k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
|
||||
k8s.io/streaming v0.36.0 h1:agnTxU+NFulUrtYzXUGKO3ndEa8jKwht1Kwn9nu9x+4=
|
||||
k8s.io/streaming v0.36.0/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
|
||||
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
|
||||
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
|
||||
mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
|
||||
@@ -765,8 +757,6 @@ sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A
|
||||
sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po=
|
||||
sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
|
||||
sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
|
||||
sigs.k8s.io/secrets-store-csi-driver v1.5.5 h1:LJDpDL5TILhlP68nGvtGSlJFxSDgAD2m148NT0Ts7os=
|
||||
sigs.k8s.io/secrets-store-csi-driver v1.5.5/go.mod h1:i2WqLicYH00hrTG3JAzICPMF4HL4KMEORlDt9UQoZLk=
|
||||
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
|
||||
sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
|
||||
sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
|
||||
|
||||
@@ -9,14 +9,12 @@ import (
|
||||
. "github.com/onsi/gomega"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
kubeClient kubernetes.Interface
|
||||
csiClient csiclient.Interface
|
||||
restConfig *rest.Config
|
||||
testNamespace string
|
||||
ctx context.Context
|
||||
@@ -44,10 +42,6 @@ var _ = SynchronizedBeforeSuite(
|
||||
"reloader.reloadStrategy": "annotations",
|
||||
"reloader.watchGlobally": "false",
|
||||
}
|
||||
if utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) {
|
||||
deployValues["reloader.enableCSIIntegration"] = "true"
|
||||
GinkgoWriter.Println("Deploying Reloader with CSI integration support")
|
||||
}
|
||||
|
||||
Expect(setupEnv.DeployAndWait(deployValues)).To(Succeed(), "Failed to deploy Reloader")
|
||||
|
||||
@@ -68,7 +62,6 @@ var _ = SynchronizedBeforeSuite(
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment")
|
||||
|
||||
kubeClient = testEnv.KubeClient
|
||||
csiClient = testEnv.CSIClient
|
||||
restConfig = testEnv.RestConfig
|
||||
testNamespace = testEnv.Namespace
|
||||
ctx = testEnv.Ctx
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
package advanced
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
|
||||
@@ -12,20 +9,16 @@ import (
|
||||
|
||||
var _ = Describe("Job Workload Recreation Tests", func() {
|
||||
var (
|
||||
jobName string
|
||||
configMapName string
|
||||
secretName string
|
||||
spcName string
|
||||
vaultSecretPath string
|
||||
jobAdapter *utils.JobAdapter
|
||||
jobName string
|
||||
configMapName string
|
||||
secretName string
|
||||
jobAdapter *utils.JobAdapter
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
jobName = utils.RandName("job")
|
||||
configMapName = utils.RandName("cm")
|
||||
secretName = utils.RandName("secret")
|
||||
spcName = utils.RandName("spc")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("vault"))
|
||||
jobAdapter = utils.NewJobAdapter(kubeClient)
|
||||
})
|
||||
|
||||
@@ -33,8 +26,6 @@ var _ = Describe("Job Workload Recreation Tests", func() {
|
||||
_ = utils.DeleteJob(ctx, kubeClient, testNamespace, jobName)
|
||||
_ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName)
|
||||
_ = utils.DeleteSecret(ctx, kubeClient, testNamespace, secretName)
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
})
|
||||
|
||||
Context("Job with ConfigMap reference", func() {
|
||||
@@ -181,68 +172,4 @@ var _ = Describe("Job Workload Recreation Tests", func() {
|
||||
Expect(recreated).To(BeTrue(), "Job with valueFrom.secretKeyRef should be recreated when Secret changes")
|
||||
})
|
||||
})
|
||||
|
||||
Context("Job with SecretProviderClass reference", Label("csi"), func() {
|
||||
BeforeEach(func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed - skipping CSI test")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed - skipping CSI test")
|
||||
}
|
||||
})
|
||||
|
||||
It("should recreate Job when Vault secret changes", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Job with CSI volume and SPC reload annotation")
|
||||
job, err := utils.CreateJob(ctx, kubeClient, testNamespace, jobName,
|
||||
utils.WithJobCommand("sleep 300"),
|
||||
utils.WithJobCSIVolume(spcName),
|
||||
utils.WithJobAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)))
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
originalUID := string(job.UID)
|
||||
|
||||
By("Waiting for Job to be ready")
|
||||
err = jobAdapter.WaitReady(ctx, testNamespace, jobName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForSPC(
|
||||
ctx, csiClient, testNamespace, spcName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName)
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion)
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Println("CSI driver synced new secret version")
|
||||
|
||||
By("Waiting for Job to be recreated (new UID)")
|
||||
_, recreated, err := jobAdapter.WaitRecreated(ctx, testNamespace, jobName, originalUID, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(recreated).To(BeTrue(), "Job should be recreated with new UID when Vault secret changes")
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
package advanced
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
|
||||
@@ -95,125 +92,4 @@ var _ = Describe("Multi-Container Tests", Serial, func() {
|
||||
Expect(reloaded).To(BeTrue(), "Deployment should be reloaded when first container's ConfigMap changes")
|
||||
})
|
||||
})
|
||||
|
||||
Context("Init container with CSI volume", Label("csi"), func() {
|
||||
var (
|
||||
spcName string
|
||||
vaultSecretPath string
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
spcName = utils.RandName("spc")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test"))
|
||||
})
|
||||
|
||||
AfterEach(func() {
|
||||
if spcName != "" {
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
}
|
||||
if vaultSecretPath != "" {
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
}
|
||||
})
|
||||
|
||||
It("should reload when SecretProviderClassPodStatus used by init container changes", func() {
|
||||
By("Creating a Vault secret")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "initial-init-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with init container using CSI volume")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithInitContainerCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "updated-init-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync (SPCPS version change)")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment with init container using CSI volume should be reloaded")
|
||||
})
|
||||
|
||||
It("should reload with auto annotation when init container CSI volume changes", func() {
|
||||
By("Creating a Vault secret")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "initial-init-auto-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with init container using CSI volume and auto annotation")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithInitContainerCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildAutoTrueAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "updated-init-auto-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync (SPCPS version change)")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment with init container CSI volume and auto=true should be reloaded")
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
@@ -9,14 +9,12 @@ import (
|
||||
. "github.com/onsi/gomega"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
kubeClient kubernetes.Interface
|
||||
csiClient csiclient.Interface
|
||||
restConfig *rest.Config
|
||||
testNamespace string
|
||||
ctx context.Context
|
||||
@@ -45,10 +43,6 @@ var _ = SynchronizedBeforeSuite(
|
||||
"reloader.reloadStrategy": "annotations",
|
||||
"reloader.watchGlobally": "false",
|
||||
}
|
||||
if utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) {
|
||||
deployValues["reloader.enableCSIIntegration"] = "true"
|
||||
GinkgoWriter.Println("Deploying Reloader with CSI integration support")
|
||||
}
|
||||
|
||||
Expect(setupEnv.DeployAndWait(deployValues)).To(Succeed(), "Failed to deploy Reloader")
|
||||
|
||||
@@ -69,7 +63,6 @@ var _ = SynchronizedBeforeSuite(
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment")
|
||||
|
||||
kubeClient = testEnv.KubeClient
|
||||
csiClient = testEnv.CSIClient
|
||||
restConfig = testEnv.RestConfig
|
||||
testNamespace = testEnv.Namespace
|
||||
ctx = testEnv.Ctx
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
package annotations
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
|
||||
@@ -12,20 +9,16 @@ import (
|
||||
|
||||
var _ = Describe("Auto Reload Annotation Tests", func() {
|
||||
var (
|
||||
deploymentName string
|
||||
configMapName string
|
||||
secretName string
|
||||
spcName string
|
||||
vaultSecretPath string
|
||||
adapter *utils.DeploymentAdapter
|
||||
deploymentName string
|
||||
configMapName string
|
||||
secretName string
|
||||
adapter *utils.DeploymentAdapter
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
deploymentName = utils.RandName("deploy")
|
||||
configMapName = utils.RandName("cm")
|
||||
secretName = utils.RandName("secret")
|
||||
spcName = utils.RandName("spc")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test"))
|
||||
adapter = utils.NewDeploymentAdapter(kubeClient)
|
||||
})
|
||||
|
||||
@@ -33,10 +26,6 @@ var _ = Describe("Auto Reload Annotation Tests", func() {
|
||||
_ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
_ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName)
|
||||
_ = utils.DeleteSecret(ctx, kubeClient, testNamespace, secretName)
|
||||
if csiClient != nil {
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
}
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
})
|
||||
|
||||
Context("with reloader.stakater.com/auto=true annotation", func() {
|
||||
@@ -202,169 +191,6 @@ var _ = Describe("Auto Reload Annotation Tests", func() {
|
||||
})
|
||||
})
|
||||
|
||||
Context("with secretproviderclass.reloader.stakater.com/auto=true annotation", Label("csi"), func() {
|
||||
BeforeEach(func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
})
|
||||
|
||||
It("should reload Deployment when SecretProviderClassPodStatus changes", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with secretproviderclass auto=true annotation")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName)
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion)
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Println("CSI driver synced new secret version")
|
||||
|
||||
By("Waiting for Deployment to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded for Vault secret change")
|
||||
})
|
||||
|
||||
It("should NOT reload Deployment when ConfigMap changes (only SPC auto enabled)", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a ConfigMap")
|
||||
_, err = utils.CreateConfigMap(ctx, kubeClient, testNamespace, configMapName,
|
||||
map[string]string{"key": "initial"}, nil)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with CSI volume AND ConfigMap, but only SPC auto annotation")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithConfigMapEnvFrom(configMapName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the ConfigMap (should NOT trigger reload with SPC auto only)")
|
||||
err = utils.UpdateConfigMap(ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment was NOT reloaded for ConfigMap change")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ShortTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeFalse(), "Deployment with SPC auto only should NOT have been reloaded for ConfigMap change")
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret (should trigger reload)")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be reloaded for SPC change")
|
||||
reloaded, err = adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded for Vault secret change")
|
||||
})
|
||||
|
||||
It("should reload when using combined auto=true annotation for SPC", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with CSI volume and general auto=true annotation")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildAutoTrueAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment with auto=true should have been reloaded for Vault secret change")
|
||||
})
|
||||
})
|
||||
|
||||
Context("with auto annotation and explicit reload annotation together", func() {
|
||||
It("should reload when auto-detected resource changes", func() {
|
||||
configMapName2 := utils.RandName("cm2")
|
||||
|
||||
@@ -242,144 +242,4 @@ var _ = Describe("Exclude Annotation Tests", func() {
|
||||
Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
})
|
||||
|
||||
Context("SecretProviderClass exclude annotation", Label("csi"), func() {
|
||||
var (
|
||||
spcName string
|
||||
spcName2 string
|
||||
vaultSecretPath string
|
||||
vaultSecretPath2 string
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
spcName = utils.RandName("spc")
|
||||
spcName2 = utils.RandName("spc2")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test"))
|
||||
vaultSecretPath2 = fmt.Sprintf("secret/%s", utils.RandName("test2"))
|
||||
})
|
||||
|
||||
AfterEach(func() {
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName2)
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath2)
|
||||
})
|
||||
|
||||
It("should NOT reload when excluded SecretProviderClassPodStatus changes", func() {
|
||||
By("Creating Vault secret for the excluded SPC")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "initial-excluded-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with auto=true and secretproviderclasses.exclude annotation")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.MergeAnnotations(
|
||||
utils.BuildAutoTrueAnnotation(),
|
||||
utils.BuildSecretProviderClassExcludeAnnotation(spcName),
|
||||
)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret for excluded SPC")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "updated-excluded-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync (SPCPS version change)")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment was NOT reloaded (excluded SPC)")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ShortTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeFalse(), "Deployment should NOT reload when excluded SecretProviderClassPodStatus changes")
|
||||
})
|
||||
|
||||
It("should reload when non-excluded SecretProviderClassPodStatus changes", func() {
|
||||
By("Creating two Vault secrets")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{
|
||||
"api_key": "initial-excluded-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
err = utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath2, map[string]string{
|
||||
"api_key": "initial-nonexcluded-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating two SecretProviderClasses")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName2, vaultSecretPath2, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a Deployment with auto=true and secretproviderclasses.exclude for first SPC only")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithCSIVolume(spcName2),
|
||||
utils.WithAnnotations(utils.MergeAnnotations(
|
||||
utils.BuildAutoTrueAnnotation(),
|
||||
utils.BuildSecretProviderClassExcludeAnnotation(spcName),
|
||||
)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS for non-excluded SPC")
|
||||
|
||||
spcpsName2, err := utils.FindSPCPSForSPC(ctx, csiClient, testNamespace, spcName2, 30*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version for non-excluded SPC")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName2)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret for non-excluded SPC")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath2, map[string]string{
|
||||
"api_key": "updated-nonexcluded-value",
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync (SPCPS version change)")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName2, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment should reload when non-excluded SecretProviderClassPodStatus changes")
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
@@ -9,14 +9,12 @@ import (
|
||||
. "github.com/onsi/gomega"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
kubeClient kubernetes.Interface
|
||||
csiClient csiclient.Interface
|
||||
restConfig *rest.Config
|
||||
testNamespace string
|
||||
ctx context.Context
|
||||
@@ -49,10 +47,6 @@ var _ = SynchronizedBeforeSuite(
|
||||
deployValues["reloader.isArgoRollouts"] = "true"
|
||||
GinkgoWriter.Println("Deploying Reloader with Argo Rollouts support")
|
||||
}
|
||||
if utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) {
|
||||
deployValues["reloader.enableCSIIntegration"] = "true"
|
||||
GinkgoWriter.Println("Deploying Reloader with CSI integration support")
|
||||
}
|
||||
|
||||
Expect(setupEnv.DeployAndWait(deployValues)).To(Succeed(), "Failed to deploy Reloader")
|
||||
|
||||
@@ -73,7 +67,6 @@ var _ = SynchronizedBeforeSuite(
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment")
|
||||
|
||||
kubeClient = testEnv.KubeClient
|
||||
csiClient = testEnv.CSIClient
|
||||
restConfig = testEnv.RestConfig
|
||||
testNamespace = testEnv.Namespace
|
||||
ctx = testEnv.Ctx
|
||||
|
||||
@@ -12,28 +12,20 @@ import (
|
||||
|
||||
var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
var (
|
||||
configMapName string
|
||||
secretName string
|
||||
workloadName string
|
||||
spcName string
|
||||
vaultSecretPath string
|
||||
configMapName string
|
||||
secretName string
|
||||
workloadName string
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
configMapName = utils.RandName("cm")
|
||||
secretName = utils.RandName("secret")
|
||||
workloadName = utils.RandName("workload")
|
||||
spcName = utils.RandName("spc")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test"))
|
||||
})
|
||||
|
||||
AfterEach(func() {
|
||||
_ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName)
|
||||
_ = utils.DeleteSecret(ctx, kubeClient, testNamespace, secretName)
|
||||
if csiClient != nil {
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
}
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
})
|
||||
|
||||
// ============================================================
|
||||
@@ -131,75 +123,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// SecretProviderClassPodStatus (CSI) reload tests with real Vault
|
||||
DescribeTable("should reload when SecretProviderClassPodStatus changes", func(workloadType utils.WorkloadType) {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(workloadType)
|
||||
if adapter == nil {
|
||||
Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType))
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath,
|
||||
"api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating workload with CSI volume and SPC reload annotation")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for workload to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName)
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion)
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion,
|
||||
10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Println("CSI driver synced new secret version")
|
||||
|
||||
By("Waiting for workload to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName, utils.AnnotationLastReloadedFrom,
|
||||
utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "%s should have been reloaded when Vault secret changed", workloadType)
|
||||
}, Entry("Deployment", Label("csi"), utils.WorkloadDeployment),
|
||||
Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet),
|
||||
Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout),
|
||||
Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// Auto=true annotation tests
|
||||
DescribeTable("should reload with auto=true annotation when ConfigMap changes",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
@@ -330,65 +253,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// Negative test: SPCPS label-only changes should NOT trigger reload
|
||||
DescribeTable("should NOT reload when only SecretProviderClassPodStatus labels change",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(workloadType)
|
||||
if adapter == nil {
|
||||
Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType))
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating workload with CSI volume and SPC reload annotation")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for workload to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating only the SPCPS labels (no objects change)")
|
||||
err = utils.UpdateSecretProviderClassPodStatusLabels(ctx, csiClient, testNamespace, spcpsName, map[string]string{"new-label": "new-value"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying workload was NOT reloaded (negative test)")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ShortTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeFalse(), "%s should NOT reload when only SPCPS labels change", workloadType)
|
||||
}, Entry("Deployment", Label("csi"), utils.WorkloadDeployment),
|
||||
Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet),
|
||||
Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout),
|
||||
Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// CronJob special handling - triggers a Job instead of annotation
|
||||
Context("CronJob (special handling)", func() {
|
||||
var cronJobAdapter *utils.CronJobAdapter
|
||||
@@ -996,140 +860,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
DescribeTable("should reload when SecretProviderClass annotation is on pod template only",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(workloadType)
|
||||
if adapter == nil {
|
||||
Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType))
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating workload with SPC annotation on pod template ONLY")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
PodTemplateAnnotations: utils.BuildSecretProviderClassReloadAnnotation(spcName),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for workload to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace,
|
||||
workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName,
|
||||
initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for workload to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "%s should reload with SPC annotation on pod template", workloadType)
|
||||
},
|
||||
Entry("Deployment", Label("csi"), utils.WorkloadDeployment),
|
||||
Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet),
|
||||
Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout),
|
||||
Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
DescribeTable("should reload when secretproviderclass auto annotation is on pod template only",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(workloadType)
|
||||
if adapter == nil {
|
||||
Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType))
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating workload with SPC auto annotation on pod template ONLY")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
PodTemplateAnnotations: utils.BuildSecretProviderClassAutoAnnotation(),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for workload to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace,
|
||||
workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName,
|
||||
initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for workload to be reloaded")
|
||||
reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "%s should reload with SPC auto on pod template", workloadType)
|
||||
},
|
||||
Entry("Deployment", Label("csi"), utils.WorkloadDeployment),
|
||||
Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet),
|
||||
Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout),
|
||||
Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
DescribeTable("should reload when annotations are on both workload and pod template",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
adapter := registry.Get(workloadType)
|
||||
@@ -1236,10 +966,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
if utils.IsArgoRolloutsInstalled(ctx, testEnv.RolloutsClient) {
|
||||
deployValues["reloader.isArgoRollouts"] = "true"
|
||||
}
|
||||
// Enable CSI integration if CSI driver is installed
|
||||
if utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
deployValues["reloader.enableCSIIntegration"] = "true"
|
||||
}
|
||||
err := testEnv.DeployAndWait(deployValues)
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to redeploy Reloader with envvars strategy")
|
||||
})
|
||||
@@ -1253,10 +979,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
if utils.IsArgoRolloutsInstalled(ctx, testEnv.RolloutsClient) {
|
||||
deployValues["reloader.isArgoRollouts"] = "true"
|
||||
}
|
||||
// Preserve CSI integration if CSI driver is installed
|
||||
if utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
deployValues["reloader.enableCSIIntegration"] = "true"
|
||||
}
|
||||
err := testEnv.DeployAndWait(deployValues)
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to restore Reloader to annotations strategy")
|
||||
})
|
||||
@@ -1351,77 +1073,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// CSI SecretProviderClassPodStatus env var tests with real Vault
|
||||
DescribeTable("should add STAKATER_ env var when SecretProviderClassPodStatus changes",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(workloadType)
|
||||
if adapter == nil {
|
||||
Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType))
|
||||
}
|
||||
|
||||
if !adapter.SupportsEnvVarStrategy() {
|
||||
Skip("Workload type does not support env var strategy")
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating workload with CSI volume and SPC reload annotation")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for workload to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion,
|
||||
10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for workload to have STAKATER_ env var")
|
||||
found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix,
|
||||
utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(found).To(BeTrue(), "%s should have STAKATER_ env var after Vault secret change", workloadType)
|
||||
}, Entry("Deployment", Label("csi"), utils.WorkloadDeployment),
|
||||
Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet),
|
||||
Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout),
|
||||
Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// Negative tests for env var strategy
|
||||
DescribeTable("should NOT add STAKATER_ env var when only ConfigMap labels change",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
@@ -1512,245 +1163,5 @@ var _ = Describe("Workload Reload Tests", Serial, func() {
|
||||
Entry("DaemonSet", utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", utils.WorkloadStatefulSet),
|
||||
)
|
||||
|
||||
// CSI SPCPS label-only change negative test with real Vault
|
||||
DescribeTable("should NOT add STAKATER_ env var when only SecretProviderClassPodStatus labels change",
|
||||
func(workloadType utils.WorkloadType) {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(workloadType)
|
||||
if adapter == nil {
|
||||
Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType))
|
||||
}
|
||||
|
||||
if !adapter.SupportsEnvVarStrategy() {
|
||||
Skip("Workload type does not support env var strategy")
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating workload with CSI volume and SPC reload annotation")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for workload to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating only the SPCPS labels (should NOT trigger reload)")
|
||||
err = utils.UpdateSecretProviderClassPodStatusLabels(ctx, csiClient, testNamespace, spcpsName, map[string]string{"new-label": "new-value"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying workload does NOT have STAKATER_ env var")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix,
|
||||
utils.ShortTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(found).To(BeFalse(), "%s should NOT have STAKATER_ env var for SPCPS label-only change",
|
||||
workloadType)
|
||||
}, Entry("Deployment", Label("csi"), utils.WorkloadDeployment),
|
||||
Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet),
|
||||
Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet),
|
||||
Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout),
|
||||
Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig),
|
||||
)
|
||||
|
||||
// CSI auto annotation with EnvVar strategy and real Vault
|
||||
It("should add STAKATER_ env var with secretproviderclass auto annotation", Label("csi"), func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(utils.WorkloadDeployment)
|
||||
Expect(adapter).NotTo(BeNil())
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath,
|
||||
"api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with CSI volume and SPC auto annotation")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
Annotations: utils.BuildSecretProviderClassAutoAnnotation(),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion,
|
||||
10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to have STAKATER_ env var")
|
||||
found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix,
|
||||
utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(found).To(BeTrue(), "Deployment with SPC auto annotation should have STAKATER_ env var")
|
||||
})
|
||||
|
||||
// CSI exclude annotation with EnvVar strategy and real Vault
|
||||
It("should NOT add STAKATER_ env var when excluded SecretProviderClassPodStatus changes", Label("csi"), func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
adapter := registry.Get(utils.WorkloadDeployment)
|
||||
Expect(adapter).NotTo(BeNil())
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath,
|
||||
"api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with auto=true and SPC exclude annotation")
|
||||
err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{
|
||||
SPCName: spcName,
|
||||
UseCSIVolume: true,
|
||||
Annotations: utils.MergeAnnotations(utils.BuildAutoTrueAnnotation(),
|
||||
utils.BuildSecretProviderClassExcludeAnnotation(spcName)),
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) })
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret (excluded SPC - should NOT trigger reload)")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion,
|
||||
10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment does NOT have STAKATER_ env var")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix,
|
||||
utils.ShortTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(found).To(BeFalse(), "Deployment should NOT have STAKATER_ env var for excluded SPCPS change")
|
||||
})
|
||||
|
||||
// CSI init container with EnvVar strategy and real Vault
|
||||
It("should add STAKATER_ env var when SecretProviderClassPodStatus used by init container changes", Label("csi"), func() {
|
||||
if !utils.IsCSIDriverInstalled(ctx, csiClient) {
|
||||
Skip("CSI secrets store driver not installed")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(ctx, kubeClient) {
|
||||
Skip("Vault CSI provider not installed")
|
||||
}
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key")
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with init container using CSI volume")
|
||||
_, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, workloadName,
|
||||
utils.WithInitContainerCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)))
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
DeferCleanup(func() { _ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, workloadName) })
|
||||
|
||||
adapter := utils.NewDeploymentAdapter(kubeClient)
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName,
|
||||
utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion,
|
||||
10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to have STAKATER_ env var")
|
||||
found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName,
|
||||
utils.StakaterEnvVarPrefix, utils.ReloadTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(found).To(BeTrue(), "Deployment with init container CSI should have STAKATER_ env var")
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
@@ -1,95 +0,0 @@
|
||||
package csi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"testing"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
kubeClient kubernetes.Interface
|
||||
csiClient csiclient.Interface
|
||||
restConfig *rest.Config
|
||||
testNamespace string
|
||||
ctx context.Context
|
||||
testEnv *utils.TestEnvironment
|
||||
)
|
||||
|
||||
func TestCSI(t *testing.T) {
|
||||
RegisterFailHandler(Fail)
|
||||
RunSpecs(t, "CSI SecretProviderClass E2E Suite")
|
||||
}
|
||||
|
||||
// SynchronizedBeforeSuite ensures only process 1 deploys Reloader.
|
||||
// Process 1 also checks prerequisites (CSI driver, Vault) and calls Skip if
|
||||
// they are not installed — Ginkgo propagates the skip to all processes.
|
||||
var _ = SynchronizedBeforeSuite(
|
||||
// Process 1 only: check prerequisites, create namespace, deploy Reloader.
|
||||
func() []byte {
|
||||
setupEnv, err := utils.SetupTestEnvironment(context.Background(), "reloader-csi-test")
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup test environment")
|
||||
// Ensure the namespace is deleted even if DeployAndWait fails, so
|
||||
// orphaned namespaces don't accumulate on long-lived clusters.
|
||||
DeferCleanup(setupEnv.CleanupOnFailure)
|
||||
|
||||
if !utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) {
|
||||
Skip("CSI secrets store driver not installed - skipping CSI suite")
|
||||
}
|
||||
if !utils.IsVaultProviderInstalled(context.Background(), setupEnv.KubeClient) {
|
||||
Skip("Vault CSI provider not installed - skipping CSI suite")
|
||||
}
|
||||
|
||||
Expect(setupEnv.DeployAndWait(map[string]string{
|
||||
"reloader.reloadStrategy": "annotations",
|
||||
"reloader.watchGlobally": "false",
|
||||
"reloader.enableCSIIntegration": "true",
|
||||
})).To(Succeed(), "Failed to deploy Reloader")
|
||||
|
||||
data, err := json.Marshal(utils.SharedEnvData{
|
||||
Namespace: setupEnv.Namespace,
|
||||
ReleaseName: setupEnv.ReleaseName,
|
||||
})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
return data
|
||||
},
|
||||
// All processes (including #1): connect to the shared environment.
|
||||
func(data []byte) {
|
||||
var shared utils.SharedEnvData
|
||||
Expect(json.Unmarshal(data, &shared)).To(Succeed())
|
||||
|
||||
var err error
|
||||
testEnv, err = utils.SetupSharedTestEnvironment(context.Background(), shared.Namespace, shared.ReleaseName)
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment")
|
||||
|
||||
kubeClient = testEnv.KubeClient
|
||||
csiClient = testEnv.CSIClient
|
||||
restConfig = testEnv.RestConfig
|
||||
testNamespace = testEnv.Namespace
|
||||
ctx = testEnv.Ctx
|
||||
},
|
||||
)
|
||||
|
||||
var _ = SynchronizedAfterSuite(
|
||||
// All processes: cancel the per-process context.
|
||||
func() {
|
||||
if testEnv != nil {
|
||||
testEnv.Cancel()
|
||||
}
|
||||
},
|
||||
// Process 1 only (runs last): undeploy Reloader and delete namespace.
|
||||
func() {
|
||||
if testEnv != nil {
|
||||
err := testEnv.Cleanup()
|
||||
Expect(err).NotTo(HaveOccurred(), "Failed to cleanup test environment")
|
||||
}
|
||||
GinkgoWriter.Println("CSI E2E Suite cleanup complete")
|
||||
},
|
||||
)
|
||||
@@ -1,330 +0,0 @@
|
||||
package csi
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
. "github.com/onsi/ginkgo/v2"
|
||||
. "github.com/onsi/gomega"
|
||||
|
||||
"github.com/stakater/Reloader/test/e2e/utils"
|
||||
)
|
||||
|
||||
var _ = Describe("CSI SecretProviderClass Tests", Label("csi"), Serial, func() {
|
||||
var (
|
||||
deploymentName string
|
||||
configMapName string
|
||||
spcName string
|
||||
vaultSecretPath string
|
||||
adapter *utils.DeploymentAdapter
|
||||
)
|
||||
|
||||
BeforeEach(func() {
|
||||
deploymentName = utils.RandName("deploy")
|
||||
configMapName = utils.RandName("cm")
|
||||
spcName = utils.RandName("spc")
|
||||
vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test"))
|
||||
adapter = utils.NewDeploymentAdapter(kubeClient)
|
||||
})
|
||||
|
||||
AfterEach(func() {
|
||||
_ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
_ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName)
|
||||
_ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName)
|
||||
_ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath)
|
||||
})
|
||||
|
||||
Context("Real Vault Integration Tests", func() {
|
||||
It("should reload when Vault secret changes", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "api_key",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with CSI volume and SPC reload annotation")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS created by CSI driver")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName)
|
||||
|
||||
By("Getting initial SPCPS version")
|
||||
initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion)
|
||||
|
||||
By("Updating the Vault secret")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync the new secret version")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Println("CSI driver synced new secret version")
|
||||
|
||||
By("Waiting for Deployment to be reloaded by Reloader")
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded after Vault secret change")
|
||||
})
|
||||
|
||||
It("should handle multiple Vault secret updates", func() {
|
||||
By("Creating a secret in Vault")
|
||||
err := utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "password",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with CSI volume")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the SPCPS")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("First update to Vault secret")
|
||||
initialVersion, _ := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for first CSI sync")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for first reload")
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue())
|
||||
|
||||
By("Getting annotation value after first reload")
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
firstReloadValue := deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
Expect(firstReloadValue).NotTo(BeEmpty())
|
||||
|
||||
By("Waiting for Deployment to stabilize")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Finding the NEW SPCPS after first reload (new pod = new SPCPS)")
|
||||
newSpcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("New SPCPS after first reload: %s\n", newSpcpsName)
|
||||
|
||||
By("Second update to Vault secret")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v3"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for second reload with different annotation value")
|
||||
Eventually(func() string {
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
}, utils.ReloadTimeout).ShouldNot(Equal(firstReloadValue), "Annotation should change after second Vault secret update")
|
||||
})
|
||||
})
|
||||
|
||||
Context("Typed Auto Annotation Tests", func() {
|
||||
It("should reload only SPC changes with secretproviderclass auto annotation, not ConfigMap", func() {
|
||||
By("Creating a ConfigMap")
|
||||
_, err := utils.CreateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName,
|
||||
map[string]string{"key": "initial"}, nil,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err = utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"token": "token-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "token",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with ConfigMap envFrom AND CSI volume, but only SPC auto annotation")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithConfigMapEnvFrom(configMapName),
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the ConfigMap (should NOT trigger reload)")
|
||||
err = utils.UpdateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment was NOT reloaded for ConfigMap change")
|
||||
time.Sleep(utils.NegativeTestWait)
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ShortTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeFalse(), "SPC auto annotation should not trigger reload for ConfigMap changes")
|
||||
|
||||
By("Finding the SPCPS")
|
||||
spcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting SPCPS version before Vault update")
|
||||
initialVersion, _ := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName)
|
||||
|
||||
By("Updating the Vault secret (should trigger reload)")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"token": "token-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for CSI driver to sync")
|
||||
err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment WAS reloaded for Vault secret change")
|
||||
reloaded, err = adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "SPC auto annotation should trigger reload for Vault secret changes")
|
||||
})
|
||||
|
||||
It("should reload for both ConfigMap and SPC when using combined auto=true", func() {
|
||||
By("Creating a ConfigMap")
|
||||
_, err := utils.CreateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName,
|
||||
map[string]string{"key": "initial"}, nil,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a secret in Vault")
|
||||
err = utils.CreateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"secret": "secret-v1"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating a SecretProviderClass pointing to Vault secret")
|
||||
_, err = utils.CreateSecretProviderClassWithSecret(
|
||||
ctx, csiClient, testNamespace, spcName,
|
||||
vaultSecretPath, "secret",
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Creating Deployment with ConfigMap envFrom AND CSI volume with combined auto=true")
|
||||
_, err = utils.CreateDeployment(
|
||||
ctx, kubeClient, testNamespace, deploymentName,
|
||||
utils.WithConfigMapEnvFrom(configMapName),
|
||||
utils.WithCSIVolume(spcName),
|
||||
utils.WithAnnotations(utils.BuildAutoTrueAnnotation()),
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Waiting for Deployment to be ready")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Updating the ConfigMap (should trigger reload with auto=true)")
|
||||
err = utils.UpdateConfigMap(
|
||||
ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment WAS reloaded for ConfigMap change")
|
||||
reloaded, err := adapter.WaitReloaded(
|
||||
ctx, testNamespace, deploymentName,
|
||||
utils.AnnotationLastReloadedFrom, utils.ReloadTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
Expect(reloaded).To(BeTrue(), "Combined auto=true should trigger reload for ConfigMap changes")
|
||||
|
||||
By("Waiting for Deployment to stabilize")
|
||||
err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Getting current annotation value")
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
firstReloadValue := deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
|
||||
By("Finding the NEW SPCPS after ConfigMap reload (new pod = new SPCPS)")
|
||||
newSpcpsName, err := utils.FindSPCPSForDeployment(
|
||||
ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout,
|
||||
)
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
GinkgoWriter.Printf("New SPCPS after ConfigMap reload: %s\n", newSpcpsName)
|
||||
|
||||
By("Updating the Vault secret (should also trigger reload with auto=true)")
|
||||
err = utils.UpdateVaultSecret(
|
||||
ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"secret": "secret-v2"})
|
||||
Expect(err).NotTo(HaveOccurred())
|
||||
|
||||
By("Verifying Deployment WAS reloaded for Vault secret change")
|
||||
Eventually(func() string {
|
||||
deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName)
|
||||
if err != nil {
|
||||
return ""
|
||||
}
|
||||
return deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom]
|
||||
}, utils.ReloadTimeout).ShouldNot(Equal(firstReloadValue),
|
||||
"Combined auto=true should trigger reload for Vault secret changes",
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -1,13 +1,10 @@
|
||||
package utils
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
appsv1 "k8s.io/api/apps/v1"
|
||||
batchv1 "k8s.io/api/batch/v1"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
|
||||
|
||||
rolloutsv1alpha1 "github.com/argoproj/argo-rollouts/pkg/apis/rollouts/v1alpha1"
|
||||
openshiftappsv1 "github.com/openshift/api/apps/v1"
|
||||
@@ -150,27 +147,3 @@ var (
|
||||
return d.Status.ReadyReplicas == d.Spec.Replicas
|
||||
}
|
||||
)
|
||||
|
||||
// SecretProviderClassPodStatus accessors
|
||||
var (
|
||||
SPCPSIsMounted StatusAccessor[*csiv1.SecretProviderClassPodStatus] = func(s *csiv1.SecretProviderClassPodStatus) bool {
|
||||
return s.Status.Mounted
|
||||
}
|
||||
SPCPSClassName ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string {
|
||||
return s.Status.SecretProviderClassName
|
||||
}
|
||||
SPCPSPodName ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string {
|
||||
return s.Status.PodName
|
||||
}
|
||||
// SPCPSVersions returns concatenated versions of all objects for change detection.
|
||||
SPCPSVersions ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string {
|
||||
if len(s.Status.Objects) == 0 {
|
||||
return ""
|
||||
}
|
||||
var versions []string
|
||||
for _, obj := range s.Status.Objects {
|
||||
versions = append(versions, obj.Version)
|
||||
}
|
||||
return strings.Join(versions, ",")
|
||||
}
|
||||
)
|
||||
|
||||
@@ -20,11 +20,6 @@ const (
|
||||
// Value: comma-separated list of Secret names, e.g., "secret1,secret2"
|
||||
AnnotationSecretReload = "secret.reloader.stakater.com/reload"
|
||||
|
||||
// AnnotationSecretProviderClassReload triggers reload when specified SecretProviderClass(es) change.
|
||||
// Value: comma-separated list of SecretProviderClass names, e.g., "spc1,spc2"
|
||||
// Note: Reloader actually watches SecretProviderClassPodStatus resources, not SecretProviderClass.
|
||||
AnnotationSecretProviderClassReload = "secretproviderclass.reloader.stakater.com/reload"
|
||||
|
||||
// ============================================================
|
||||
// Auto-reload annotations
|
||||
// ============================================================
|
||||
@@ -41,10 +36,6 @@ const (
|
||||
// Value: "true" or "false"
|
||||
AnnotationSecretAuto = "secret.reloader.stakater.com/auto"
|
||||
|
||||
// AnnotationSecretProviderClassAuto enables auto-reload for all referenced SecretProviderClasses only.
|
||||
// Value: "true" or "false"
|
||||
AnnotationSecretProviderClassAuto = "secretproviderclass.reloader.stakater.com/auto"
|
||||
|
||||
// ============================================================
|
||||
// Exclude annotations (used with auto=true to exclude specific resources)
|
||||
// ============================================================
|
||||
@@ -57,10 +48,6 @@ const (
|
||||
// Value: comma-separated list of Secret names
|
||||
AnnotationSecretExclude = "secrets.exclude.reloader.stakater.com/reload"
|
||||
|
||||
// AnnotationSecretProviderClassExclude excludes specified SecretProviderClasses from auto-reload.
|
||||
// Value: comma-separated list of SecretProviderClass names
|
||||
AnnotationSecretProviderClassExclude = "secretproviderclasses.exclude.reloader.stakater.com/reload"
|
||||
|
||||
// ============================================================
|
||||
// Search annotations (for regex matching)
|
||||
// ============================================================
|
||||
@@ -130,13 +117,6 @@ func BuildSecretReloadAnnotation(secretNames ...string) map[string]string {
|
||||
}
|
||||
}
|
||||
|
||||
// BuildSecretProviderClassReloadAnnotation creates an annotation map for SecretProviderClass reload.
|
||||
func BuildSecretProviderClassReloadAnnotation(spcNames ...string) map[string]string {
|
||||
return map[string]string{
|
||||
AnnotationSecretProviderClassReload: joinNames(spcNames),
|
||||
}
|
||||
}
|
||||
|
||||
// BuildAutoTrueAnnotation creates an annotation map with auto=true.
|
||||
func BuildAutoTrueAnnotation() map[string]string {
|
||||
return map[string]string{
|
||||
@@ -165,13 +145,6 @@ func BuildSecretAutoAnnotation() map[string]string {
|
||||
}
|
||||
}
|
||||
|
||||
// BuildSecretProviderClassAutoAnnotation creates an annotation map with secretproviderclass auto=true.
|
||||
func BuildSecretProviderClassAutoAnnotation() map[string]string {
|
||||
return map[string]string{
|
||||
AnnotationSecretProviderClassAuto: AnnotationValueTrue,
|
||||
}
|
||||
}
|
||||
|
||||
// BuildSearchAnnotation creates an annotation map to enable search mode.
|
||||
func BuildSearchAnnotation() map[string]string {
|
||||
return map[string]string{
|
||||
@@ -214,13 +187,6 @@ func BuildSecretExcludeAnnotation(secretNames ...string) map[string]string {
|
||||
}
|
||||
}
|
||||
|
||||
// BuildSecretProviderClassExcludeAnnotation creates an annotation to exclude SecretProviderClasses from auto-reload.
|
||||
func BuildSecretProviderClassExcludeAnnotation(spcNames ...string) map[string]string {
|
||||
return map[string]string{
|
||||
AnnotationSecretProviderClassExclude: joinNames(spcNames),
|
||||
}
|
||||
}
|
||||
|
||||
// BuildPausePeriodAnnotation creates an annotation for deployment pause period.
|
||||
func BuildPausePeriodAnnotation(duration string) map[string]string {
|
||||
return map[string]string{
|
||||
|
||||
@@ -6,7 +6,6 @@ import (
|
||||
batchv1 "k8s.io/api/batch/v1"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
|
||||
)
|
||||
|
||||
// PodTemplateAccessor extracts PodTemplateSpec from a workload.
|
||||
@@ -216,43 +215,3 @@ func IsTriggeredJobForCronJob(cronJobName string) Condition[*batchv1.Job] {
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// SPCPSVersionChanged returns a condition that checks if the SPCPS version has changed
|
||||
// from the initial version and the SPCPS is mounted.
|
||||
func SPCPSVersionChanged(initialVersion string) Condition[*csiv1.SecretProviderClassPodStatus] {
|
||||
return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
|
||||
if !spcps.Status.Mounted || len(spcps.Status.Objects) == 0 {
|
||||
return false
|
||||
}
|
||||
for _, obj := range spcps.Status.Objects {
|
||||
if obj.Version != initialVersion {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// SPCPSForSPC returns a condition that checks if the SPCPS references a specific
|
||||
// SecretProviderClass and is mounted.
|
||||
func SPCPSForSPC(spcName string) Condition[*csiv1.SecretProviderClassPodStatus] {
|
||||
return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
|
||||
return spcps.Status.SecretProviderClassName == spcName && spcps.Status.Mounted
|
||||
}
|
||||
}
|
||||
|
||||
// SPCPSForPod returns a condition that checks if the SPCPS references a specific
|
||||
// pod and is mounted.
|
||||
func SPCPSForPod(podName string) Condition[*csiv1.SecretProviderClassPodStatus] {
|
||||
return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
|
||||
return spcps.Status.PodName == podName && spcps.Status.Mounted
|
||||
}
|
||||
}
|
||||
|
||||
// SPCPSForPods returns a condition that checks if the SPCPS references any of the
|
||||
// specified pods and is mounted.
|
||||
func SPCPSForPods(podNames map[string]bool) Condition[*csiv1.SecretProviderClassPodStatus] {
|
||||
return func(spcps *csiv1.SecretProviderClassPodStatus) bool {
|
||||
return podNames[spcps.Status.PodName] && spcps.Status.Mounted
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,338 +0,0 @@
|
||||
package utils
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/watch"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/kubernetes/scheme"
|
||||
"k8s.io/client-go/rest"
|
||||
"k8s.io/client-go/tools/clientcmd"
|
||||
"k8s.io/client-go/tools/remotecommand"
|
||||
csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
)
|
||||
|
||||
// CSI Driver constants
|
||||
const (
|
||||
// CSIDriverName is the name of the secrets-store CSI driver
|
||||
CSIDriverName = "secrets-store.csi.k8s.io"
|
||||
|
||||
// DefaultCSIProvider is the default provider name for testing (Vault)
|
||||
DefaultCSIProvider = "vault"
|
||||
|
||||
// VaultAddress is the default Vault address in the cluster
|
||||
VaultAddress = "http://vault.vault:8200"
|
||||
|
||||
// VaultRole is the Kubernetes auth role configured in Vault for testing
|
||||
VaultRole = "test-role"
|
||||
|
||||
// VaultNamespace is the namespace where Vault is deployed
|
||||
VaultNamespace = "vault"
|
||||
|
||||
// VaultPodName is the name of the Vault pod (dev mode)
|
||||
VaultPodName = "vault-0"
|
||||
|
||||
// CSIVolumeName is the default volume name for CSI volumes in tests
|
||||
CSIVolumeName = "csi-secrets-store"
|
||||
|
||||
// CSIMountPath is the default mount path for CSI volumes in tests
|
||||
CSIMountPath = "/mnt/secrets-store"
|
||||
|
||||
// CSIRotationPollInterval is how often CSI driver checks for secret changes
|
||||
CSIRotationPollInterval = 2 * time.Second
|
||||
)
|
||||
|
||||
// NewCSIClient creates a new CSI client using the default kubeconfig.
|
||||
func NewCSIClient() (csiclient.Interface, error) {
|
||||
kubeconfig := GetKubeconfig()
|
||||
config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("building config from kubeconfig: %w", err)
|
||||
}
|
||||
return NewCSIClientFromConfig(config)
|
||||
}
|
||||
|
||||
// NewCSIClientFromConfig creates a new CSI client from a rest.Config.
|
||||
func NewCSIClientFromConfig(config *rest.Config) (csiclient.Interface, error) {
|
||||
client, err := csiclient.NewForConfig(config)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("creating CSI client: %w", err)
|
||||
}
|
||||
return client, nil
|
||||
}
|
||||
|
||||
// IsCSIDriverInstalled checks if the CSI secrets store driver CRDs are available in the cluster.
|
||||
// This checks for the SecretProviderClass CRD which is required for CSI tests.
|
||||
func IsCSIDriverInstalled(ctx context.Context, client csiclient.Interface) bool {
|
||||
if client == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
// Try to list SecretProviderClasses - if CRD doesn't exist, this will fail
|
||||
_, err := client.SecretsstoreV1().SecretProviderClasses("default").List(ctx, metav1.ListOptions{Limit: 1})
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// IsVaultProviderInstalled checks if Vault CSI provider is installed by checking for the vault-csi-provider DaemonSet.
|
||||
// This is used to determine if CSI tests with actual volume mounting can run.
|
||||
func IsVaultProviderInstalled(ctx context.Context, kubeClient kubernetes.Interface) bool {
|
||||
if kubeClient == nil {
|
||||
return false
|
||||
}
|
||||
|
||||
// Check if vault-csi-provider DaemonSet exists in vault namespace
|
||||
_, err := kubeClient.AppsV1().DaemonSets("vault").Get(ctx, "vault-csi-provider", metav1.GetOptions{})
|
||||
return err == nil
|
||||
}
|
||||
|
||||
// CreateSecretProviderClass creates a SecretProviderClass in the given namespace.
|
||||
// If params is nil, it creates a Vault-compatible SecretProviderClass with default test settings.
|
||||
func CreateSecretProviderClass(ctx context.Context, client csiclient.Interface, namespace, name string, params map[string]string) (
|
||||
*csiv1.SecretProviderClass, error,
|
||||
) {
|
||||
if params == nil {
|
||||
params = map[string]string{
|
||||
"vaultAddress": VaultAddress,
|
||||
"roleName": VaultRole,
|
||||
"objects": `- objectName: "test-secret"
|
||||
secretPath: "secret/data/test"
|
||||
secretKey: "username"`,
|
||||
}
|
||||
}
|
||||
|
||||
spc := &csiv1.SecretProviderClass{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Namespace: namespace,
|
||||
},
|
||||
Spec: csiv1.SecretProviderClassSpec{
|
||||
Provider: DefaultCSIProvider,
|
||||
Parameters: params,
|
||||
},
|
||||
}
|
||||
|
||||
created, err := client.SecretsstoreV1().SecretProviderClasses(namespace).Create(ctx, spc, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("creating SecretProviderClass %s/%s: %w", namespace, name, err)
|
||||
}
|
||||
return created, nil
|
||||
}
|
||||
|
||||
// CreateSecretProviderClassWithSecret creates a SecretProviderClass that fetches a specific secret from Vault.
|
||||
// secretPath should be like "secret/mysecret" (the function converts it to KV v2 format "secret/data/mysecret").
|
||||
// secretKey is the key within that secret to fetch.
|
||||
func CreateSecretProviderClassWithSecret(ctx context.Context, client csiclient.Interface, namespace, name, secretPath, secretKey string) (
|
||||
*csiv1.SecretProviderClass, error,
|
||||
) {
|
||||
kvV2Path := secretPath
|
||||
if strings.HasPrefix(secretPath, "secret/") && !strings.HasPrefix(secretPath, "secret/data/") {
|
||||
kvV2Path = strings.Replace(secretPath, "secret/", "secret/data/", 1)
|
||||
}
|
||||
|
||||
params := map[string]string{
|
||||
"vaultAddress": VaultAddress,
|
||||
"roleName": VaultRole,
|
||||
"objects": fmt.Sprintf(
|
||||
`- objectName: "%s"
|
||||
secretPath: "%s"
|
||||
secretKey: "%s"`, secretKey, kvV2Path, secretKey,
|
||||
),
|
||||
}
|
||||
return CreateSecretProviderClass(ctx, client, namespace, name, params)
|
||||
}
|
||||
|
||||
// DeleteSecretProviderClass deletes a SecretProviderClass by name.
|
||||
func DeleteSecretProviderClass(ctx context.Context, client csiclient.Interface, namespace, name string) error {
|
||||
err := client.SecretsstoreV1().SecretProviderClasses(namespace).Delete(ctx, name, metav1.DeleteOptions{})
|
||||
if err != nil {
|
||||
return fmt.Errorf("deleting SecretProviderClass %s/%s: %w", namespace, name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// UpdateSecretProviderClassPodStatusLabels updates only the labels on a SecretProviderClassPodStatus.
|
||||
// This should NOT trigger a reload (used for negative testing to verify Reloader ignores label-only changes).
|
||||
func UpdateSecretProviderClassPodStatusLabels(ctx context.Context, client csiclient.Interface, namespace, name string, labels map[string]string) error {
|
||||
spcps, err := client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Get(ctx, name, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
return fmt.Errorf("getting SecretProviderClassPodStatus %s/%s: %w", namespace, name, err)
|
||||
}
|
||||
|
||||
if spcps.Labels == nil {
|
||||
spcps.Labels = make(map[string]string)
|
||||
}
|
||||
for k, v := range labels {
|
||||
spcps.Labels[k] = v
|
||||
}
|
||||
|
||||
_, err = client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Update(ctx, spcps, metav1.UpdateOptions{})
|
||||
if err != nil {
|
||||
return fmt.Errorf("updating SecretProviderClassPodStatus labels %s/%s: %w", namespace, name, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// Vault Integration Helpers
|
||||
// =============================================================================
|
||||
|
||||
// CreateVaultSecret creates a new secret in Vault.
|
||||
// secretPath should be like "secret/test" (without "data" prefix - it's added automatically).
|
||||
// data is a map of key-value pairs to store in the secret.
|
||||
func CreateVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string, data map[string]string) error {
|
||||
return UpdateVaultSecret(ctx, kubeClient, restConfig, secretPath, data)
|
||||
}
|
||||
|
||||
// UpdateVaultSecret updates a secret in Vault. This triggers the CSI driver to
|
||||
// sync the new secret version, which creates/updates the SecretProviderClassPodStatus.
|
||||
// secretPath should be like "secret/test" (without "data" prefix - it's added automatically).
|
||||
// data is a map of key-value pairs to store in the secret.
|
||||
func UpdateVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string, data map[string]string) error {
|
||||
args := []string{"kv", "put", secretPath}
|
||||
for k, v := range data {
|
||||
args = append(args, fmt.Sprintf("%s=%s", k, v))
|
||||
}
|
||||
|
||||
if err := execInVaultPod(ctx, kubeClient, restConfig, args); err != nil {
|
||||
return fmt.Errorf("updating Vault secret %s: %w", secretPath, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeleteVaultSecret deletes a secret from Vault.
|
||||
// secretPath should be like "secret/test".
|
||||
func DeleteVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string) error {
|
||||
args := []string{"kv", "metadata", "delete", secretPath}
|
||||
if err := execInVaultPod(ctx, kubeClient, restConfig, args); err != nil {
|
||||
if strings.Contains(err.Error(), "No value found") {
|
||||
return nil
|
||||
}
|
||||
return fmt.Errorf("deleting Vault secret %s: %w", secretPath, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// execInVaultPod executes a vault command in the Vault pod.
|
||||
func execInVaultPod(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, args []string) error {
|
||||
req := kubeClient.CoreV1().RESTClient().Post().
|
||||
Resource("pods").
|
||||
Name(VaultPodName).
|
||||
Namespace(VaultNamespace).
|
||||
SubResource("exec").
|
||||
VersionedParams(
|
||||
&corev1.PodExecOptions{
|
||||
Container: "vault",
|
||||
Command: append([]string{"vault"}, args...),
|
||||
Stdout: true,
|
||||
Stderr: true,
|
||||
}, scheme.ParameterCodec,
|
||||
)
|
||||
|
||||
exec, err := remotecommand.NewSPDYExecutor(restConfig, "POST", req.URL())
|
||||
if err != nil {
|
||||
return fmt.Errorf("creating executor: %w", err)
|
||||
}
|
||||
|
||||
var stdout, stderr bytes.Buffer
|
||||
err = exec.StreamWithContext(
|
||||
ctx, remotecommand.StreamOptions{
|
||||
Stdout: &stdout,
|
||||
Stderr: &stderr,
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("executing command: %w (stderr: %s)", err, stderr.String())
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// WaitForSPCPSVersionChange waits for the SecretProviderClassPodStatus version to change
|
||||
// from the initial version using watches. This is used after updating a Vault secret to
|
||||
// wait for CSI driver to sync the new version.
|
||||
func WaitForSPCPSVersionChange(ctx context.Context, client csiclient.Interface, namespace, spcpsName, initialVersion string, timeout time.Duration) error {
|
||||
watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
|
||||
return client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts)
|
||||
}
|
||||
|
||||
_, err := WatchUntil(ctx, watchFunc, spcpsName, SPCPSVersionChanged(initialVersion), timeout)
|
||||
if errors.Is(err, ErrWatchTimeout) {
|
||||
return fmt.Errorf("timeout waiting for SecretProviderClassPodStatus %s/%s version to change from %s", namespace, spcpsName, initialVersion)
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
// FindSPCPSForDeployment finds the SecretProviderClassPodStatus created by CSI driver
|
||||
// for pods of a given deployment using watches. Returns the first matching SPCPS name.
|
||||
func FindSPCPSForDeployment(ctx context.Context, csiClient csiclient.Interface, kubeClient kubernetes.Interface, namespace, deploymentName string, timeout time.Duration) (
|
||||
string, error,
|
||||
) {
|
||||
pods, err := kubeClient.CoreV1().Pods(namespace).List(
|
||||
ctx, metav1.ListOptions{
|
||||
LabelSelector: fmt.Sprintf("app=%s", deploymentName),
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("listing pods for deployment %s: %w", deploymentName, err)
|
||||
}
|
||||
|
||||
podNames := make(map[string]bool)
|
||||
for _, pod := range pods.Items {
|
||||
podNames[pod.Name] = true
|
||||
}
|
||||
|
||||
watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
|
||||
return csiClient.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts)
|
||||
}
|
||||
|
||||
spcps, err := WatchUntil(ctx, watchFunc, "", SPCPSForPods(podNames), timeout)
|
||||
if errors.Is(err, ErrWatchTimeout) {
|
||||
return "", fmt.Errorf("timeout finding SecretProviderClassPodStatus for deployment %s/%s", namespace, deploymentName)
|
||||
}
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return spcps.Name, nil
|
||||
}
|
||||
|
||||
// FindSPCPSForSPC finds the SecretProviderClassPodStatus created by CSI driver
|
||||
// that references a specific SecretProviderClass using watches. Returns the first matching SPCPS name.
|
||||
func FindSPCPSForSPC(ctx context.Context, csiClient csiclient.Interface, namespace, spcName string, timeout time.Duration) (string, error) {
|
||||
watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
|
||||
return csiClient.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts)
|
||||
}
|
||||
|
||||
spcps, err := WatchUntil(ctx, watchFunc, "", SPCPSForSPC(spcName), timeout)
|
||||
if errors.Is(err, ErrWatchTimeout) {
|
||||
return "", fmt.Errorf("timeout finding SecretProviderClassPodStatus for SPC %s/%s", namespace, spcName)
|
||||
}
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return spcps.Name, nil
|
||||
}
|
||||
|
||||
// GetSPCPSVersion gets the current version string from a SecretProviderClassPodStatus.
|
||||
// Returns the version of the first object, or empty string if not found.
|
||||
func GetSPCPSVersion(ctx context.Context, client csiclient.Interface, namespace, name string) (string, error) {
|
||||
spcps, err := client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Get(ctx, name, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("getting SecretProviderClassPodStatus %s/%s: %w", namespace, name, err)
|
||||
}
|
||||
if len(spcps.Status.Objects) == 0 {
|
||||
return "", nil
|
||||
}
|
||||
var versions []string
|
||||
for _, obj := range spcps.Status.Objects {
|
||||
versions = append(versions, obj.Version)
|
||||
}
|
||||
return strings.Join(versions, ","), nil
|
||||
}
|
||||
@@ -4,7 +4,6 @@ import (
|
||||
"fmt"
|
||||
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/utils/ptr"
|
||||
)
|
||||
|
||||
// AddEnvFromSource adds ConfigMap or Secret envFrom to a container.
|
||||
@@ -107,69 +106,6 @@ func AddKeyRef(spec *corev1.PodSpec, containerIdx int, resourceName, key, envVar
|
||||
spec.Containers[containerIdx].Env = append(spec.Containers[containerIdx].Env, envVar)
|
||||
}
|
||||
|
||||
// AddCSIVolume adds CSI volume referencing SecretProviderClass.
|
||||
func AddCSIVolume(spec *corev1.PodSpec, containerIdx int, spcName string) {
|
||||
volumeName := "csi-" + spcName
|
||||
mountPath := "/mnt/secrets-store/" + spcName
|
||||
spec.Volumes = append(spec.Volumes, corev1.Volume{
|
||||
Name: volumeName,
|
||||
VolumeSource: corev1.VolumeSource{
|
||||
CSI: &corev1.CSIVolumeSource{
|
||||
Driver: CSIDriverName,
|
||||
ReadOnly: ptr.To(true),
|
||||
VolumeAttributes: map[string]string{
|
||||
"secretProviderClass": spcName,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
if containerIdx < len(spec.Containers) {
|
||||
spec.Containers[containerIdx].VolumeMounts = append(
|
||||
spec.Containers[containerIdx].VolumeMounts,
|
||||
corev1.VolumeMount{Name: volumeName, MountPath: mountPath, ReadOnly: true},
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// AddCSIInitContainer adds an init container that mounts a CSI SecretProviderClass volume.
|
||||
// The init container is named "init-csi-{spcName}" to avoid collisions when multiple CSI
|
||||
// volumes are mounted. The volume is only added if not already present (idempotent).
|
||||
// This is distinct from AddCSIVolume which mounts into a regular container.
|
||||
func AddCSIInitContainer(spec *corev1.PodSpec, spcName string) {
|
||||
volumeName := "csi-" + spcName
|
||||
mountPath := "/mnt/secrets-store/" + spcName
|
||||
|
||||
hasVolume := false
|
||||
for _, v := range spec.Volumes {
|
||||
if v.Name == volumeName {
|
||||
hasVolume = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !hasVolume {
|
||||
spec.Volumes = append(spec.Volumes, corev1.Volume{
|
||||
Name: volumeName,
|
||||
VolumeSource: corev1.VolumeSource{
|
||||
CSI: &corev1.CSIVolumeSource{
|
||||
Driver: CSIDriverName,
|
||||
ReadOnly: ptr.To(true),
|
||||
VolumeAttributes: map[string]string{
|
||||
"secretProviderClass": spcName,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
}
|
||||
spec.InitContainers = append(spec.InitContainers, corev1.Container{
|
||||
Name: "init-csi-" + spcName,
|
||||
Image: DefaultImage,
|
||||
Command: []string{"sh", "-c", "echo init done"},
|
||||
VolumeMounts: []corev1.VolumeMount{
|
||||
{Name: volumeName, MountPath: mountPath, ReadOnly: true},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// AddInitContainer adds init container with optional envFrom references.
|
||||
func AddInitContainer(spec *corev1.PodSpec, cmName, secretName string) {
|
||||
init := corev1.Container{
|
||||
@@ -282,18 +218,12 @@ func ApplyWorkloadConfig(template *corev1.PodTemplateSpec, cfg WorkloadConfig) {
|
||||
}
|
||||
AddKeyRef(spec, 0, cfg.SecretName, key, envVar, true)
|
||||
}
|
||||
if cfg.UseCSIVolume && cfg.SPCName != "" {
|
||||
AddCSIVolume(spec, 0, cfg.SPCName)
|
||||
}
|
||||
if cfg.UseInitContainer {
|
||||
AddInitContainer(spec, cfg.ConfigMapName, cfg.SecretName)
|
||||
}
|
||||
if cfg.UseInitContainerVolume {
|
||||
AddInitContainerWithVolumes(spec, cfg.ConfigMapName, cfg.SecretName)
|
||||
}
|
||||
if cfg.UseInitContainerCSI && cfg.SPCName != "" {
|
||||
AddCSIInitContainer(spec, cfg.SPCName)
|
||||
}
|
||||
if cfg.MultipleContainers > 1 {
|
||||
for i := 1; i < cfg.MultipleContainers; i++ {
|
||||
spec.Containers = append(spec.Containers, corev1.Container{
|
||||
|
||||
@@ -516,42 +516,6 @@ func WithInitContainerProjectedVolume(cmName, secretName string) DeploymentOptio
|
||||
}
|
||||
}
|
||||
|
||||
// WithCSIVolume adds a CSI volume referencing a SecretProviderClass to a Deployment.
|
||||
func WithCSIVolume(spcName string) DeploymentOption {
|
||||
return func(d *appsv1.Deployment) {
|
||||
volumeName := csiVolumeName(spcName)
|
||||
mountPath := csiMountPath(spcName)
|
||||
|
||||
d.Spec.Template.Spec.Volumes = append(d.Spec.Template.Spec.Volumes, corev1.Volume{
|
||||
Name: volumeName,
|
||||
VolumeSource: corev1.VolumeSource{
|
||||
CSI: &corev1.CSIVolumeSource{
|
||||
Driver: CSIDriverName,
|
||||
ReadOnly: ptr.To(true),
|
||||
VolumeAttributes: map[string]string{
|
||||
"secretProviderClass": spcName,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
d.Spec.Template.Spec.Containers[0].VolumeMounts = append(
|
||||
d.Spec.Template.Spec.Containers[0].VolumeMounts,
|
||||
corev1.VolumeMount{
|
||||
Name: volumeName,
|
||||
MountPath: mountPath,
|
||||
ReadOnly: true,
|
||||
},
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// WithInitContainerCSIVolume adds an init container with a CSI volume mount.
|
||||
func WithInitContainerCSIVolume(spcName string) DeploymentOption {
|
||||
return func(d *appsv1.Deployment) {
|
||||
AddCSIInitContainer(&d.Spec.Template.Spec, spcName)
|
||||
}
|
||||
}
|
||||
|
||||
func baseDeploymentResource(namespace, name string) *appsv1.Deployment {
|
||||
labels := map[string]string{"app": name}
|
||||
return &appsv1.Deployment{
|
||||
@@ -868,35 +832,6 @@ func WithJobCommand(command string) JobOption {
|
||||
}
|
||||
}
|
||||
|
||||
// WithJobCSIVolume adds a CSI volume referencing a SecretProviderClass to a Job.
|
||||
func WithJobCSIVolume(spcName string) JobOption {
|
||||
return func(j *batchv1.Job) {
|
||||
volumeName := csiVolumeName(spcName)
|
||||
mountPath := csiMountPath(spcName)
|
||||
|
||||
j.Spec.Template.Spec.Volumes = append(j.Spec.Template.Spec.Volumes, corev1.Volume{
|
||||
Name: volumeName,
|
||||
VolumeSource: corev1.VolumeSource{
|
||||
CSI: &corev1.CSIVolumeSource{
|
||||
Driver: CSIDriverName,
|
||||
ReadOnly: ptr.To(true),
|
||||
VolumeAttributes: map[string]string{
|
||||
"secretProviderClass": spcName,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
j.Spec.Template.Spec.Containers[0].VolumeMounts = append(
|
||||
j.Spec.Template.Spec.Containers[0].VolumeMounts,
|
||||
corev1.VolumeMount{
|
||||
Name: volumeName,
|
||||
MountPath: mountPath,
|
||||
ReadOnly: true,
|
||||
},
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// baseJobResource creates a base Job template.
|
||||
func baseJobResource(namespace, name string) *batchv1.Job {
|
||||
labels := map[string]string{"app": name}
|
||||
@@ -933,14 +868,6 @@ func DeleteJob(ctx context.Context, client kubernetes.Interface, namespace, name
|
||||
})
|
||||
}
|
||||
|
||||
func csiVolumeName(spcName string) string {
|
||||
return fmt.Sprintf("csi-%s", spcName)
|
||||
}
|
||||
|
||||
func csiMountPath(spcName string) string {
|
||||
return fmt.Sprintf("/mnt/secrets-store/%s", spcName)
|
||||
}
|
||||
|
||||
// GetDeployment retrieves a deployment by name.
|
||||
func GetDeployment(ctx context.Context, client kubernetes.Interface, namespace, name string) (*appsv1.Deployment, error) {
|
||||
return client.AppsV1().Deployments(namespace).Get(ctx, name, metav1.GetOptions{})
|
||||
|
||||
@@ -13,7 +13,6 @@ import (
|
||||
"k8s.io/client-go/kubernetes"
|
||||
"k8s.io/client-go/rest"
|
||||
"k8s.io/client-go/tools/clientcmd"
|
||||
csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned"
|
||||
)
|
||||
|
||||
// TestEnvironment holds the common test environment state.
|
||||
@@ -22,7 +21,6 @@ type TestEnvironment struct {
|
||||
Cancel context.CancelFunc
|
||||
KubeClient kubernetes.Interface
|
||||
DiscoveryClient discovery.DiscoveryInterface
|
||||
CSIClient csiclient.Interface
|
||||
RolloutsClient rolloutsclient.Interface
|
||||
OpenShiftClient openshiftclient.Interface
|
||||
RestConfig *rest.Config
|
||||
@@ -84,9 +82,6 @@ func SetupSharedTestEnvironment(ctx context.Context, namespace, releaseName stri
|
||||
}
|
||||
|
||||
// Optional clients — failures are non-fatal.
|
||||
if env.CSIClient, err = csiclient.NewForConfig(config); err != nil {
|
||||
env.CSIClient = nil
|
||||
}
|
||||
if env.RolloutsClient, err = rolloutsclient.NewForConfig(config); err != nil {
|
||||
env.RolloutsClient = nil
|
||||
}
|
||||
@@ -135,12 +130,6 @@ func SetupTestEnvironment(ctx context.Context, namespacePrefix string) (*TestEnv
|
||||
return nil, fmt.Errorf("creating discovery client: %w", err)
|
||||
}
|
||||
|
||||
env.CSIClient, err = csiclient.NewForConfig(config)
|
||||
if err != nil {
|
||||
ginkgo.GinkgoWriter.Printf("Warning: Could not create CSI client: %v (CSI tests will be skipped)\n", err)
|
||||
env.CSIClient = nil
|
||||
}
|
||||
|
||||
// Try to create Argo Rollouts client (optional - may not be installed)
|
||||
env.RolloutsClient, err = rolloutsclient.NewForConfig(config)
|
||||
if err != nil {
|
||||
|
||||
@@ -32,7 +32,6 @@ const (
|
||||
type WorkloadConfig struct {
|
||||
ConfigMapName string
|
||||
SecretName string
|
||||
SPCName string
|
||||
Annotations map[string]string // Annotations for workload metadata (e.g., Deployment.metadata.annotations)
|
||||
PodTemplateAnnotations map[string]string // Annotations for pod template metadata (e.g., Deployment.spec.template.metadata.annotations)
|
||||
UseConfigMapEnvFrom bool
|
||||
@@ -44,8 +43,6 @@ type WorkloadConfig struct {
|
||||
UseSecretKeyRef bool
|
||||
UseInitContainer bool
|
||||
UseInitContainerVolume bool
|
||||
UseCSIVolume bool
|
||||
UseInitContainerCSI bool
|
||||
ConfigMapKey string
|
||||
SecretKey string
|
||||
EnvVarName string
|
||||
|
||||
Reference in New Issue
Block a user