diff --git a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml index 8f31764f..11e8a5d4 100644 --- a/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml +++ b/deployments/kubernetes/chart/reloader/templates/clusterrole.yaml @@ -110,17 +110,6 @@ rules: - create - get - update -{{- end}} -{{- if .Values.reloader.enableCSIIntegration }} - - apiGroups: - - "secrets-store.csi.x-k8s.io" - resources: - - secretproviderclasspodstatuses - - secretproviderclasses - verbs: - - list - - get - - watch {{- end}} - apiGroups: - "" diff --git a/deployments/kubernetes/chart/reloader/templates/deployment.yaml b/deployments/kubernetes/chart/reloader/templates/deployment.yaml index 7f57b3f5..c1b14502 100644 --- a/deployments/kubernetes/chart/reloader/templates/deployment.yaml +++ b/deployments/kubernetes/chart/reloader/templates/deployment.yaml @@ -215,7 +215,7 @@ spec: {{- . | toYaml | nindent 10 }} {{- end }} {{- end }} - {{- if or (.Values.reloader.logFormat) (.Values.reloader.logLevel) (.Values.reloader.ignoreSecrets) (.Values.reloader.ignoreNamespaces) (include "reloader-namespaceSelector" .) (.Values.reloader.resourceLabelSelector) (.Values.reloader.ignoreConfigMaps) (.Values.reloader.custom_annotations) (eq .Values.reloader.isArgoRollouts true) (eq .Values.reloader.reloadOnCreate true) (eq .Values.reloader.reloadOnDelete true) (ne .Values.reloader.reloadStrategy "default") (.Values.reloader.enableHA) (.Values.reloader.autoReloadAll) (.Values.reloader.ignoreJobs) (.Values.reloader.ignoreCronJobs) (.Values.reloader.enableCSIIntegration)}} + {{- if or (.Values.reloader.logFormat) (.Values.reloader.logLevel) (.Values.reloader.ignoreSecrets) (.Values.reloader.ignoreNamespaces) (include "reloader-namespaceSelector" .) (.Values.reloader.resourceLabelSelector) (.Values.reloader.ignoreConfigMaps) (.Values.reloader.custom_annotations) (eq .Values.reloader.isArgoRollouts true) (eq .Values.reloader.reloadOnCreate true) (eq .Values.reloader.reloadOnDelete true) (ne .Values.reloader.reloadStrategy "default") (.Values.reloader.enableHA) (.Values.reloader.autoReloadAll) (.Values.reloader.ignoreJobs) (.Values.reloader.ignoreCronJobs)}} args: {{- if .Values.reloader.logFormat }} - "--log-format={{ .Values.reloader.logFormat }}" @@ -251,9 +251,6 @@ spec: - "--pprof-addr={{ .Values.reloader.pprofAddr }}" {{- end }} {{- end }} - {{- if .Values.reloader.enableCSIIntegration }} - - "--enable-csi-integration=true" - {{- end }} {{- if .Values.reloader.custom_annotations }} {{- if .Values.reloader.custom_annotations.configmap }} - "--configmap-annotation" diff --git a/deployments/kubernetes/chart/reloader/templates/role.yaml b/deployments/kubernetes/chart/reloader/templates/role.yaml index 495a3855..c6cfed64 100644 --- a/deployments/kubernetes/chart/reloader/templates/role.yaml +++ b/deployments/kubernetes/chart/reloader/templates/role.yaml @@ -97,17 +97,6 @@ rules: - create - get - update -{{- end}} -{{- if .Values.reloader.enableCSIIntegration }} - - apiGroups: - - "secrets-store.csi.x-k8s.io" - resources: - - secretproviderclasspodstatuses - - secretproviderclasses - verbs: - - list - - get - - watch {{- end}} - apiGroups: - "" diff --git a/deployments/kubernetes/chart/reloader/values.yaml b/deployments/kubernetes/chart/reloader/values.yaml index 66d00f21..1e57c5d6 100644 --- a/deployments/kubernetes/chart/reloader/values.yaml +++ b/deployments/kubernetes/chart/reloader/values.yaml @@ -49,7 +49,6 @@ reloader: enableHA: false # Set to true to enable pprof for profiling enablePProf: false - enableCSIIntegration: false # Address to start pprof server on. Default is ":6060" pprofAddr: ":6060" # Set to true if you have a pod security policy that enforces readOnlyRootFilesystem diff --git a/go.mod b/go.mod index a6d752df..e8703a8d 100644 --- a/go.mod +++ b/go.mod @@ -21,7 +21,6 @@ require ( k8s.io/client-go v0.36.0 k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 sigs.k8s.io/controller-runtime v0.24.1 - sigs.k8s.io/secrets-store-csi-driver v1.5.5 ) require ( @@ -81,6 +80,7 @@ require ( github.com/dlclark/regexp2 v1.11.5 // indirect github.com/emicklei/go-restful/v3 v3.13.0 // indirect github.com/ettle/strcase v0.2.0 // indirect + github.com/evanphx/json-patch v4.12.0+incompatible // indirect github.com/evanphx/json-patch/v5 v5.9.11 // indirect github.com/fatih/color v1.18.0 // indirect github.com/fatih/structtag v1.2.0 // indirect @@ -135,7 +135,6 @@ require ( github.com/google/pprof v0.0.0-20260106004452-d7df1bf2cac7 // indirect github.com/google/uuid v1.6.0 // indirect github.com/gordonklaus/ineffassign v0.2.0 // indirect - github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect github.com/gostaticanalysis/analysisutil v0.7.1 // indirect github.com/gostaticanalysis/comment v1.5.0 // indirect github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect @@ -178,7 +177,6 @@ require ( github.com/mgechev/revive v1.13.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/mapstructure v1.5.0 // indirect - github.com/moby/spdystream v0.5.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect @@ -270,7 +268,6 @@ require ( k8s.io/apiextensions-apiserver v0.36.0 // indirect k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 // indirect - k8s.io/streaming v0.36.0 // indirect mvdan.cc/gofumpt v0.9.2 // indirect mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect diff --git a/go.sum b/go.sum index be593f22..458c1664 100644 --- a/go.sum +++ b/go.sum @@ -54,8 +54,6 @@ github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEW github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg= github.com/argoproj/argo-rollouts v1.9.0 h1:bXgBpwCByXyAUcgBnyP0fxkSW2CEot78InTFjFlag5g= github.com/argoproj/argo-rollouts v1.9.0/go.mod h1:jOalqf2kDSmCp7eQpFF4i3kHnlEqNE/Yjwz1q7CpPIU= -github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= -github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/ashanbrown/forbidigo/v2 v2.3.0 h1:OZZDOchCgsX5gvToVtEBoV2UWbFfI6RKQTir2UZzSxo= github.com/ashanbrown/forbidigo/v2 v2.3.0/go.mod h1:5p6VmsG5/1xx3E785W9fouMxIOkvY2rRV9nMdWadd6c= github.com/ashanbrown/makezero/v2 v2.1.0 h1:snuKYMbqosNokUKm+R6/+vOPs8yVAi46La7Ck6QYSaE= @@ -268,8 +266,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs= github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw= -github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo= -github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA= github.com/gostaticanalysis/analysisutil v0.7.1 h1:ZMCjoue3DtDWQ5WyU16YbjbQEQ3VuzwxALrpYd+HeKk= github.com/gostaticanalysis/analysisutil v0.7.1/go.mod h1:v21E3hY37WKMGSnbsw2S/ojApNWb6C1//mXO48CXbVc= github.com/gostaticanalysis/comment v1.4.2/go.mod h1:KLUTGDv6HOCotCH8h2erHKmpci2ZoR8VPu34YA2uzdM= @@ -382,8 +378,6 @@ github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= -github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y= -github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -743,8 +737,6 @@ k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31 h1:V+sn9a/1fEYDGwnllCmqXBk8x7obZ+hl869Q3Abumkg= k8s.io/kube-openapi v0.0.0-20260330154417-16be699c7b31/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0= -k8s.io/streaming v0.36.0 h1:agnTxU+NFulUrtYzXUGKO3ndEa8jKwht1Kwn9nu9x+4= -k8s.io/streaming v0.36.0/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s= k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM= k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= mvdan.cc/gofumpt v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4= @@ -765,8 +757,6 @@ sigs.k8s.io/kustomize/kyaml v0.20.1 h1:PCMnA2mrVbRP3NIB6v9kYCAc38uvFLVs8j/CD567A sigs.k8s.io/kustomize/kyaml v0.20.1/go.mod h1:0EmkQHRUsJxY8Ug9Niig1pUMSCGHxQ5RklbpV/Ri6po= sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= -sigs.k8s.io/secrets-store-csi-driver v1.5.5 h1:LJDpDL5TILhlP68nGvtGSlJFxSDgAD2m148NT0Ts7os= -sigs.k8s.io/secrets-store-csi-driver v1.5.5/go.mod h1:i2WqLicYH00hrTG3JAzICPMF4HL4KMEORlDt9UQoZLk= sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8= sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= diff --git a/test/e2e/advanced/advanced_suite_test.go b/test/e2e/advanced/advanced_suite_test.go index bac2aaa2..d2eca110 100644 --- a/test/e2e/advanced/advanced_suite_test.go +++ b/test/e2e/advanced/advanced_suite_test.go @@ -9,14 +9,12 @@ import ( . "github.com/onsi/gomega" "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" - csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned" "github.com/stakater/Reloader/test/e2e/utils" ) var ( kubeClient kubernetes.Interface - csiClient csiclient.Interface restConfig *rest.Config testNamespace string ctx context.Context @@ -44,10 +42,6 @@ var _ = SynchronizedBeforeSuite( "reloader.reloadStrategy": "annotations", "reloader.watchGlobally": "false", } - if utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) { - deployValues["reloader.enableCSIIntegration"] = "true" - GinkgoWriter.Println("Deploying Reloader with CSI integration support") - } Expect(setupEnv.DeployAndWait(deployValues)).To(Succeed(), "Failed to deploy Reloader") @@ -68,7 +62,6 @@ var _ = SynchronizedBeforeSuite( Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment") kubeClient = testEnv.KubeClient - csiClient = testEnv.CSIClient restConfig = testEnv.RestConfig testNamespace = testEnv.Namespace ctx = testEnv.Ctx diff --git a/test/e2e/advanced/job_reload_test.go b/test/e2e/advanced/job_reload_test.go index a54136ab..87b5c724 100644 --- a/test/e2e/advanced/job_reload_test.go +++ b/test/e2e/advanced/job_reload_test.go @@ -1,9 +1,6 @@ package advanced import ( - "fmt" - "time" - . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -12,20 +9,16 @@ import ( var _ = Describe("Job Workload Recreation Tests", func() { var ( - jobName string - configMapName string - secretName string - spcName string - vaultSecretPath string - jobAdapter *utils.JobAdapter + jobName string + configMapName string + secretName string + jobAdapter *utils.JobAdapter ) BeforeEach(func() { jobName = utils.RandName("job") configMapName = utils.RandName("cm") secretName = utils.RandName("secret") - spcName = utils.RandName("spc") - vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("vault")) jobAdapter = utils.NewJobAdapter(kubeClient) }) @@ -33,8 +26,6 @@ var _ = Describe("Job Workload Recreation Tests", func() { _ = utils.DeleteJob(ctx, kubeClient, testNamespace, jobName) _ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName) _ = utils.DeleteSecret(ctx, kubeClient, testNamespace, secretName) - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName) - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath) }) Context("Job with ConfigMap reference", func() { @@ -181,68 +172,4 @@ var _ = Describe("Job Workload Recreation Tests", func() { Expect(recreated).To(BeTrue(), "Job with valueFrom.secretKeyRef should be recreated when Secret changes") }) }) - - Context("Job with SecretProviderClass reference", Label("csi"), func() { - BeforeEach(func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed - skipping CSI test") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed - skipping CSI test") - } - }) - - It("should recreate Job when Vault secret changes", func() { - By("Creating a secret in Vault") - err := utils.CreateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret( - ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key", - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Job with CSI volume and SPC reload annotation") - job, err := utils.CreateJob(ctx, kubeClient, testNamespace, jobName, - utils.WithJobCommand("sleep 300"), - utils.WithJobCSIVolume(spcName), - utils.WithJobAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName))) - Expect(err).NotTo(HaveOccurred()) - originalUID := string(job.UID) - - By("Waiting for Job to be ready") - err = jobAdapter.WaitReady(ctx, testNamespace, jobName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForSPC( - ctx, csiClient, testNamespace, spcName, utils.WorkloadReadyTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Println("CSI driver synced new secret version") - - By("Waiting for Job to be recreated (new UID)") - _, recreated, err := jobAdapter.WaitRecreated(ctx, testNamespace, jobName, originalUID, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(recreated).To(BeTrue(), "Job should be recreated with new UID when Vault secret changes") - }) - }) }) diff --git a/test/e2e/advanced/multi_container_test.go b/test/e2e/advanced/multi_container_test.go index 98ed6391..cef05184 100644 --- a/test/e2e/advanced/multi_container_test.go +++ b/test/e2e/advanced/multi_container_test.go @@ -1,9 +1,6 @@ package advanced import ( - "fmt" - "time" - . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -95,125 +92,4 @@ var _ = Describe("Multi-Container Tests", Serial, func() { Expect(reloaded).To(BeTrue(), "Deployment should be reloaded when first container's ConfigMap changes") }) }) - - Context("Init container with CSI volume", Label("csi"), func() { - var ( - spcName string - vaultSecretPath string - ) - - BeforeEach(func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - spcName = utils.RandName("spc") - vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test")) - }) - - AfterEach(func() { - if spcName != "" { - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName) - } - if vaultSecretPath != "" { - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath) - } - }) - - It("should reload when SecretProviderClassPodStatus used by init container changes", func() { - By("Creating a Vault secret") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "initial-init-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with init container using CSI volume") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithInitContainerCSIVolume(spcName), - utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "updated-init-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync (SPCPS version change)") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment with init container using CSI volume should be reloaded") - }) - - It("should reload with auto annotation when init container CSI volume changes", func() { - By("Creating a Vault secret") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "initial-init-auto-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with init container using CSI volume and auto annotation") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithInitContainerCSIVolume(spcName), - utils.WithAnnotations(utils.BuildAutoTrueAnnotation()), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "updated-init-auto-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync (SPCPS version change)") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment with init container CSI volume and auto=true should be reloaded") - }) - }) }) diff --git a/test/e2e/annotations/annotations_suite_test.go b/test/e2e/annotations/annotations_suite_test.go index 8c9bc33e..49c7f3c0 100644 --- a/test/e2e/annotations/annotations_suite_test.go +++ b/test/e2e/annotations/annotations_suite_test.go @@ -9,14 +9,12 @@ import ( . "github.com/onsi/gomega" "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" - csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned" "github.com/stakater/Reloader/test/e2e/utils" ) var ( kubeClient kubernetes.Interface - csiClient csiclient.Interface restConfig *rest.Config testNamespace string ctx context.Context @@ -45,10 +43,6 @@ var _ = SynchronizedBeforeSuite( "reloader.reloadStrategy": "annotations", "reloader.watchGlobally": "false", } - if utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) { - deployValues["reloader.enableCSIIntegration"] = "true" - GinkgoWriter.Println("Deploying Reloader with CSI integration support") - } Expect(setupEnv.DeployAndWait(deployValues)).To(Succeed(), "Failed to deploy Reloader") @@ -69,7 +63,6 @@ var _ = SynchronizedBeforeSuite( Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment") kubeClient = testEnv.KubeClient - csiClient = testEnv.CSIClient restConfig = testEnv.RestConfig testNamespace = testEnv.Namespace ctx = testEnv.Ctx diff --git a/test/e2e/annotations/auto_reload_test.go b/test/e2e/annotations/auto_reload_test.go index c407fa39..af4b7ac3 100644 --- a/test/e2e/annotations/auto_reload_test.go +++ b/test/e2e/annotations/auto_reload_test.go @@ -1,9 +1,6 @@ package annotations import ( - "fmt" - "time" - . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" @@ -12,20 +9,16 @@ import ( var _ = Describe("Auto Reload Annotation Tests", func() { var ( - deploymentName string - configMapName string - secretName string - spcName string - vaultSecretPath string - adapter *utils.DeploymentAdapter + deploymentName string + configMapName string + secretName string + adapter *utils.DeploymentAdapter ) BeforeEach(func() { deploymentName = utils.RandName("deploy") configMapName = utils.RandName("cm") secretName = utils.RandName("secret") - spcName = utils.RandName("spc") - vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test")) adapter = utils.NewDeploymentAdapter(kubeClient) }) @@ -33,10 +26,6 @@ var _ = Describe("Auto Reload Annotation Tests", func() { _ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, deploymentName) _ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName) _ = utils.DeleteSecret(ctx, kubeClient, testNamespace, secretName) - if csiClient != nil { - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName) - } - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath) }) Context("with reloader.stakater.com/auto=true annotation", func() { @@ -202,169 +191,6 @@ var _ = Describe("Auto Reload Annotation Tests", func() { }) }) - Context("with secretproviderclass.reloader.stakater.com/auto=true annotation", Label("csi"), func() { - BeforeEach(func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - }) - - It("should reload Deployment when SecretProviderClassPodStatus changes", func() { - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with secretproviderclass auto=true annotation") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Println("CSI driver synced new secret version") - - By("Waiting for Deployment to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded for Vault secret change") - }) - - It("should NOT reload Deployment when ConfigMap changes (only SPC auto enabled)", func() { - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a ConfigMap") - _, err = utils.CreateConfigMap(ctx, kubeClient, testNamespace, configMapName, - map[string]string{"key": "initial"}, nil) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with CSI volume AND ConfigMap, but only SPC auto annotation") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithConfigMapEnvFrom(configMapName), - utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the ConfigMap (should NOT trigger reload with SPC auto only)") - err = utils.UpdateConfigMap(ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"}) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment was NOT reloaded for ConfigMap change") - time.Sleep(utils.NegativeTestWait) - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ShortTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeFalse(), "Deployment with SPC auto only should NOT have been reloaded for ConfigMap change") - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret (should trigger reload)") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be reloaded for SPC change") - reloaded, err = adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded for Vault secret change") - }) - - It("should reload when using combined auto=true annotation for SPC", func() { - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with CSI volume and general auto=true annotation") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.BuildAutoTrueAnnotation()), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment with auto=true should have been reloaded for Vault secret change") - }) - }) - Context("with auto annotation and explicit reload annotation together", func() { It("should reload when auto-detected resource changes", func() { configMapName2 := utils.RandName("cm2") diff --git a/test/e2e/annotations/exclude_test.go b/test/e2e/annotations/exclude_test.go index 73e0e8f0..5a336514 100644 --- a/test/e2e/annotations/exclude_test.go +++ b/test/e2e/annotations/exclude_test.go @@ -242,144 +242,4 @@ var _ = Describe("Exclude Annotation Tests", func() { Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig), ) }) - - Context("SecretProviderClass exclude annotation", Label("csi"), func() { - var ( - spcName string - spcName2 string - vaultSecretPath string - vaultSecretPath2 string - ) - - BeforeEach(func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - spcName = utils.RandName("spc") - spcName2 = utils.RandName("spc2") - vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test")) - vaultSecretPath2 = fmt.Sprintf("secret/%s", utils.RandName("test2")) - }) - - AfterEach(func() { - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName) - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName2) - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath) - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath2) - }) - - It("should NOT reload when excluded SecretProviderClassPodStatus changes", func() { - By("Creating Vault secret for the excluded SPC") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "initial-excluded-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Creating SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with auto=true and secretproviderclasses.exclude annotation") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.MergeAnnotations( - utils.BuildAutoTrueAnnotation(), - utils.BuildSecretProviderClassExcludeAnnotation(spcName), - )), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret for excluded SPC") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "updated-excluded-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync (SPCPS version change)") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment was NOT reloaded (excluded SPC)") - time.Sleep(utils.NegativeTestWait) - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ShortTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeFalse(), "Deployment should NOT reload when excluded SecretProviderClassPodStatus changes") - }) - - It("should reload when non-excluded SecretProviderClassPodStatus changes", func() { - By("Creating two Vault secrets") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{ - "api_key": "initial-excluded-value", - }) - Expect(err).NotTo(HaveOccurred()) - - err = utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath2, map[string]string{ - "api_key": "initial-nonexcluded-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Creating two SecretProviderClasses") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName2, vaultSecretPath2, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating a Deployment with auto=true and secretproviderclasses.exclude for first SPC only") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithCSIVolume(spcName2), - utils.WithAnnotations(utils.MergeAnnotations( - utils.BuildAutoTrueAnnotation(), - utils.BuildSecretProviderClassExcludeAnnotation(spcName), - )), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS for non-excluded SPC") - - spcpsName2, err := utils.FindSPCPSForSPC(ctx, csiClient, testNamespace, spcName2, 30*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version for non-excluded SPC") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName2) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret for non-excluded SPC") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath2, map[string]string{ - "api_key": "updated-nonexcluded-value", - }) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync (SPCPS version change)") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName2, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment should reload when non-excluded SecretProviderClassPodStatus changes") - }) - }) }) diff --git a/test/e2e/core/core_suite_test.go b/test/e2e/core/core_suite_test.go index acf7bf6e..d4bac17f 100644 --- a/test/e2e/core/core_suite_test.go +++ b/test/e2e/core/core_suite_test.go @@ -9,14 +9,12 @@ import ( . "github.com/onsi/gomega" "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" - csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned" "github.com/stakater/Reloader/test/e2e/utils" ) var ( kubeClient kubernetes.Interface - csiClient csiclient.Interface restConfig *rest.Config testNamespace string ctx context.Context @@ -49,10 +47,6 @@ var _ = SynchronizedBeforeSuite( deployValues["reloader.isArgoRollouts"] = "true" GinkgoWriter.Println("Deploying Reloader with Argo Rollouts support") } - if utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) { - deployValues["reloader.enableCSIIntegration"] = "true" - GinkgoWriter.Println("Deploying Reloader with CSI integration support") - } Expect(setupEnv.DeployAndWait(deployValues)).To(Succeed(), "Failed to deploy Reloader") @@ -73,7 +67,6 @@ var _ = SynchronizedBeforeSuite( Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment") kubeClient = testEnv.KubeClient - csiClient = testEnv.CSIClient restConfig = testEnv.RestConfig testNamespace = testEnv.Namespace ctx = testEnv.Ctx diff --git a/test/e2e/core/workloads_test.go b/test/e2e/core/workloads_test.go index 1a7f7b37..fdbe98ec 100644 --- a/test/e2e/core/workloads_test.go +++ b/test/e2e/core/workloads_test.go @@ -12,28 +12,20 @@ import ( var _ = Describe("Workload Reload Tests", Serial, func() { var ( - configMapName string - secretName string - workloadName string - spcName string - vaultSecretPath string + configMapName string + secretName string + workloadName string ) BeforeEach(func() { configMapName = utils.RandName("cm") secretName = utils.RandName("secret") workloadName = utils.RandName("workload") - spcName = utils.RandName("spc") - vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test")) }) AfterEach(func() { _ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName) _ = utils.DeleteSecret(ctx, kubeClient, testNamespace, secretName) - if csiClient != nil { - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName) - } - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath) }) // ============================================================ @@ -131,75 +123,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() { Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig), ) - // SecretProviderClassPodStatus (CSI) reload tests with real Vault - DescribeTable("should reload when SecretProviderClassPodStatus changes", func(workloadType utils.WorkloadType) { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(workloadType) - if adapter == nil { - Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType)) - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, - "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating workload with CSI volume and SPC reload annotation") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for workload to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, - 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Println("CSI driver synced new secret version") - - By("Waiting for workload to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName, utils.AnnotationLastReloadedFrom, - utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "%s should have been reloaded when Vault secret changed", workloadType) - }, Entry("Deployment", Label("csi"), utils.WorkloadDeployment), - Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet), - Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet), - Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout), - Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig), - ) - // Auto=true annotation tests DescribeTable("should reload with auto=true annotation when ConfigMap changes", func(workloadType utils.WorkloadType) { @@ -330,65 +253,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() { Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig), ) - // Negative test: SPCPS label-only changes should NOT trigger reload - DescribeTable("should NOT reload when only SecretProviderClassPodStatus labels change", - func(workloadType utils.WorkloadType) { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(workloadType) - if adapter == nil { - Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType)) - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating workload with CSI volume and SPC reload annotation") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for workload to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Updating only the SPCPS labels (no objects change)") - err = utils.UpdateSecretProviderClassPodStatusLabels(ctx, csiClient, testNamespace, spcpsName, map[string]string{"new-label": "new-value"}) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying workload was NOT reloaded (negative test)") - time.Sleep(utils.NegativeTestWait) - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName, - utils.AnnotationLastReloadedFrom, utils.ShortTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeFalse(), "%s should NOT reload when only SPCPS labels change", workloadType) - }, Entry("Deployment", Label("csi"), utils.WorkloadDeployment), - Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet), - Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet), - Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout), - Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig), - ) - // CronJob special handling - triggers a Job instead of annotation Context("CronJob (special handling)", func() { var cronJobAdapter *utils.CronJobAdapter @@ -996,140 +860,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() { Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig), ) - DescribeTable("should reload when SecretProviderClass annotation is on pod template only", - func(workloadType utils.WorkloadType) { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(workloadType) - if adapter == nil { - Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType)) - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating workload with SPC annotation on pod template ONLY") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - PodTemplateAnnotations: utils.BuildSecretProviderClassReloadAnnotation(spcName), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for workload to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, - workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, - initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for workload to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "%s should reload with SPC annotation on pod template", workloadType) - }, - Entry("Deployment", Label("csi"), utils.WorkloadDeployment), - Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet), - Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet), - Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout), - Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig), - ) - - DescribeTable("should reload when secretproviderclass auto annotation is on pod template only", - func(workloadType utils.WorkloadType) { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(workloadType) - if adapter == nil { - Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType)) - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating workload with SPC auto annotation on pod template ONLY") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - PodTemplateAnnotations: utils.BuildSecretProviderClassAutoAnnotation(), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for workload to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, - workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, - initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for workload to be reloaded") - reloaded, err := adapter.WaitReloaded(ctx, testNamespace, workloadName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "%s should reload with SPC auto on pod template", workloadType) - }, - Entry("Deployment", Label("csi"), utils.WorkloadDeployment), - Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet), - Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet), - Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout), - Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig), - ) - DescribeTable("should reload when annotations are on both workload and pod template", func(workloadType utils.WorkloadType) { adapter := registry.Get(workloadType) @@ -1236,10 +966,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() { if utils.IsArgoRolloutsInstalled(ctx, testEnv.RolloutsClient) { deployValues["reloader.isArgoRollouts"] = "true" } - // Enable CSI integration if CSI driver is installed - if utils.IsCSIDriverInstalled(ctx, csiClient) { - deployValues["reloader.enableCSIIntegration"] = "true" - } err := testEnv.DeployAndWait(deployValues) Expect(err).NotTo(HaveOccurred(), "Failed to redeploy Reloader with envvars strategy") }) @@ -1253,10 +979,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() { if utils.IsArgoRolloutsInstalled(ctx, testEnv.RolloutsClient) { deployValues["reloader.isArgoRollouts"] = "true" } - // Preserve CSI integration if CSI driver is installed - if utils.IsCSIDriverInstalled(ctx, csiClient) { - deployValues["reloader.enableCSIIntegration"] = "true" - } err := testEnv.DeployAndWait(deployValues) Expect(err).NotTo(HaveOccurred(), "Failed to restore Reloader to annotations strategy") }) @@ -1351,77 +1073,6 @@ var _ = Describe("Workload Reload Tests", Serial, func() { Entry("DeploymentConfig", Label("openshift"), utils.WorkloadDeploymentConfig), ) - // CSI SecretProviderClassPodStatus env var tests with real Vault - DescribeTable("should add STAKATER_ env var when SecretProviderClassPodStatus changes", - func(workloadType utils.WorkloadType) { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(workloadType) - if adapter == nil { - Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType)) - } - - if !adapter.SupportsEnvVarStrategy() { - Skip("Workload type does not support env var strategy") - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating workload with CSI volume and SPC reload annotation") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for workload to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, - 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for workload to have STAKATER_ env var") - found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix, - utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(found).To(BeTrue(), "%s should have STAKATER_ env var after Vault secret change", workloadType) - }, Entry("Deployment", Label("csi"), utils.WorkloadDeployment), - Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet), - Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet), - Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout), - Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig), - ) - // Negative tests for env var strategy DescribeTable("should NOT add STAKATER_ env var when only ConfigMap labels change", func(workloadType utils.WorkloadType) { @@ -1512,245 +1163,5 @@ var _ = Describe("Workload Reload Tests", Serial, func() { Entry("DaemonSet", utils.WorkloadDaemonSet), Entry("StatefulSet", utils.WorkloadStatefulSet), ) - - // CSI SPCPS label-only change negative test with real Vault - DescribeTable("should NOT add STAKATER_ env var when only SecretProviderClassPodStatus labels change", - func(workloadType utils.WorkloadType) { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(workloadType) - if adapter == nil { - Skip(fmt.Sprintf("%s adapter not available (CRD not installed)", workloadType)) - } - - if !adapter.SupportsEnvVarStrategy() { - Skip("Workload type does not support env var strategy") - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating workload with CSI volume and SPC reload annotation") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - Annotations: utils.BuildSecretProviderClassReloadAnnotation(spcName), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for workload to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Updating only the SPCPS labels (should NOT trigger reload)") - err = utils.UpdateSecretProviderClassPodStatusLabels(ctx, csiClient, testNamespace, spcpsName, map[string]string{"new-label": "new-value"}) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying workload does NOT have STAKATER_ env var") - time.Sleep(utils.NegativeTestWait) - found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix, - utils.ShortTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(found).To(BeFalse(), "%s should NOT have STAKATER_ env var for SPCPS label-only change", - workloadType) - }, Entry("Deployment", Label("csi"), utils.WorkloadDeployment), - Entry("DaemonSet", Label("csi"), utils.WorkloadDaemonSet), - Entry("StatefulSet", Label("csi"), utils.WorkloadStatefulSet), - Entry("ArgoRollout", Label("csi", "argo"), utils.WorkloadArgoRollout), - Entry("DeploymentConfig", Label("csi", "openshift"), utils.WorkloadDeploymentConfig), - ) - - // CSI auto annotation with EnvVar strategy and real Vault - It("should add STAKATER_ env var with secretproviderclass auto annotation", Label("csi"), func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(utils.WorkloadDeployment) - Expect(adapter).NotTo(BeNil()) - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, - "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with CSI volume and SPC auto annotation") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - Annotations: utils.BuildSecretProviderClassAutoAnnotation(), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, - 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to have STAKATER_ env var") - found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix, - utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(found).To(BeTrue(), "Deployment with SPC auto annotation should have STAKATER_ env var") - }) - - // CSI exclude annotation with EnvVar strategy and real Vault - It("should NOT add STAKATER_ env var when excluded SecretProviderClassPodStatus changes", Label("csi"), func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - adapter := registry.Get(utils.WorkloadDeployment) - Expect(adapter).NotTo(BeNil()) - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, vaultSecretPath, - "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with auto=true and SPC exclude annotation") - err = adapter.Create(ctx, testNamespace, workloadName, utils.WorkloadConfig{ - SPCName: spcName, - UseCSIVolume: true, - Annotations: utils.MergeAnnotations(utils.BuildAutoTrueAnnotation(), - utils.BuildSecretProviderClassExcludeAnnotation(spcName)), - }) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = adapter.Delete(ctx, testNamespace, workloadName) }) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret (excluded SPC - should NOT trigger reload)") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, - 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment does NOT have STAKATER_ env var") - time.Sleep(utils.NegativeTestWait) - found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, utils.StakaterEnvVarPrefix, - utils.ShortTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(found).To(BeFalse(), "Deployment should NOT have STAKATER_ env var for excluded SPCPS change") - }) - - // CSI init container with EnvVar strategy and real Vault - It("should add STAKATER_ env var when SecretProviderClassPodStatus used by init container changes", Label("csi"), func() { - if !utils.IsCSIDriverInstalled(ctx, csiClient) { - Skip("CSI secrets store driver not installed") - } - if !utils.IsVaultProviderInstalled(ctx, kubeClient) { - Skip("Vault CSI provider not installed") - } - - By("Creating a secret in Vault") - err := utils.CreateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret(ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key") - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with init container using CSI volume") - _, err = utils.CreateDeployment(ctx, kubeClient, testNamespace, workloadName, - utils.WithInitContainerCSIVolume(spcName), - utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName))) - Expect(err).NotTo(HaveOccurred()) - DeferCleanup(func() { _ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, workloadName) }) - - adapter := utils.NewDeploymentAdapter(kubeClient) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, workloadName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment(ctx, csiClient, kubeClient, testNamespace, workloadName, - utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, - 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to have STAKATER_ env var") - found, err := adapter.WaitEnvVar(ctx, testNamespace, workloadName, - utils.StakaterEnvVarPrefix, utils.ReloadTimeout) - Expect(err).NotTo(HaveOccurred()) - Expect(found).To(BeTrue(), "Deployment with init container CSI should have STAKATER_ env var") - }) }) }) diff --git a/test/e2e/csi/csi_suite_test.go b/test/e2e/csi/csi_suite_test.go deleted file mode 100644 index f2e809cf..00000000 --- a/test/e2e/csi/csi_suite_test.go +++ /dev/null @@ -1,95 +0,0 @@ -package csi - -import ( - "context" - "encoding/json" - "testing" - - . "github.com/onsi/ginkgo/v2" - . "github.com/onsi/gomega" - "k8s.io/client-go/kubernetes" - "k8s.io/client-go/rest" - csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned" - - "github.com/stakater/Reloader/test/e2e/utils" -) - -var ( - kubeClient kubernetes.Interface - csiClient csiclient.Interface - restConfig *rest.Config - testNamespace string - ctx context.Context - testEnv *utils.TestEnvironment -) - -func TestCSI(t *testing.T) { - RegisterFailHandler(Fail) - RunSpecs(t, "CSI SecretProviderClass E2E Suite") -} - -// SynchronizedBeforeSuite ensures only process 1 deploys Reloader. -// Process 1 also checks prerequisites (CSI driver, Vault) and calls Skip if -// they are not installed — Ginkgo propagates the skip to all processes. -var _ = SynchronizedBeforeSuite( - // Process 1 only: check prerequisites, create namespace, deploy Reloader. - func() []byte { - setupEnv, err := utils.SetupTestEnvironment(context.Background(), "reloader-csi-test") - Expect(err).NotTo(HaveOccurred(), "Failed to setup test environment") - // Ensure the namespace is deleted even if DeployAndWait fails, so - // orphaned namespaces don't accumulate on long-lived clusters. - DeferCleanup(setupEnv.CleanupOnFailure) - - if !utils.IsCSIDriverInstalled(context.Background(), setupEnv.CSIClient) { - Skip("CSI secrets store driver not installed - skipping CSI suite") - } - if !utils.IsVaultProviderInstalled(context.Background(), setupEnv.KubeClient) { - Skip("Vault CSI provider not installed - skipping CSI suite") - } - - Expect(setupEnv.DeployAndWait(map[string]string{ - "reloader.reloadStrategy": "annotations", - "reloader.watchGlobally": "false", - "reloader.enableCSIIntegration": "true", - })).To(Succeed(), "Failed to deploy Reloader") - - data, err := json.Marshal(utils.SharedEnvData{ - Namespace: setupEnv.Namespace, - ReleaseName: setupEnv.ReleaseName, - }) - Expect(err).NotTo(HaveOccurred()) - return data - }, - // All processes (including #1): connect to the shared environment. - func(data []byte) { - var shared utils.SharedEnvData - Expect(json.Unmarshal(data, &shared)).To(Succeed()) - - var err error - testEnv, err = utils.SetupSharedTestEnvironment(context.Background(), shared.Namespace, shared.ReleaseName) - Expect(err).NotTo(HaveOccurred(), "Failed to setup shared test environment") - - kubeClient = testEnv.KubeClient - csiClient = testEnv.CSIClient - restConfig = testEnv.RestConfig - testNamespace = testEnv.Namespace - ctx = testEnv.Ctx - }, -) - -var _ = SynchronizedAfterSuite( - // All processes: cancel the per-process context. - func() { - if testEnv != nil { - testEnv.Cancel() - } - }, - // Process 1 only (runs last): undeploy Reloader and delete namespace. - func() { - if testEnv != nil { - err := testEnv.Cleanup() - Expect(err).NotTo(HaveOccurred(), "Failed to cleanup test environment") - } - GinkgoWriter.Println("CSI E2E Suite cleanup complete") - }, -) diff --git a/test/e2e/csi/csi_test.go b/test/e2e/csi/csi_test.go deleted file mode 100644 index ef55f2bd..00000000 --- a/test/e2e/csi/csi_test.go +++ /dev/null @@ -1,330 +0,0 @@ -package csi - -import ( - "fmt" - "time" - - . "github.com/onsi/ginkgo/v2" - . "github.com/onsi/gomega" - - "github.com/stakater/Reloader/test/e2e/utils" -) - -var _ = Describe("CSI SecretProviderClass Tests", Label("csi"), Serial, func() { - var ( - deploymentName string - configMapName string - spcName string - vaultSecretPath string - adapter *utils.DeploymentAdapter - ) - - BeforeEach(func() { - deploymentName = utils.RandName("deploy") - configMapName = utils.RandName("cm") - spcName = utils.RandName("spc") - vaultSecretPath = fmt.Sprintf("secret/%s", utils.RandName("test")) - adapter = utils.NewDeploymentAdapter(kubeClient) - }) - - AfterEach(func() { - _ = utils.DeleteDeployment(ctx, kubeClient, testNamespace, deploymentName) - _ = utils.DeleteConfigMap(ctx, kubeClient, testNamespace, configMapName) - _ = utils.DeleteSecretProviderClass(ctx, csiClient, testNamespace, spcName) - _ = utils.DeleteVaultSecret(ctx, kubeClient, restConfig, vaultSecretPath) - }) - - Context("Real Vault Integration Tests", func() { - It("should reload when Vault secret changes", func() { - By("Creating a secret in Vault") - err := utils.CreateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "initial-value-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret( - ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "api_key", - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with CSI volume and SPC reload annotation") - _, err = utils.CreateDeployment( - ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS created by CSI driver") - spcpsName, err := utils.FindSPCPSForDeployment( - ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Found SPCPS: %s\n", spcpsName) - - By("Getting initial SPCPS version") - initialVersion, err := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("Initial SPCPS version: %s\n", initialVersion) - - By("Updating the Vault secret") - err = utils.UpdateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"api_key": "updated-value-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync the new secret version") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Println("CSI driver synced new secret version") - - By("Waiting for Deployment to be reloaded by Reloader") - reloaded, err := adapter.WaitReloaded( - ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Deployment should have been reloaded after Vault secret change") - }) - - It("should handle multiple Vault secret updates", func() { - By("Creating a secret in Vault") - err := utils.CreateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret( - ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "password", - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with CSI volume") - _, err = utils.CreateDeployment( - ctx, kubeClient, testNamespace, deploymentName, - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.BuildSecretProviderClassReloadAnnotation(spcName)), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the SPCPS") - spcpsName, err := utils.FindSPCPSForDeployment( - ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - - By("First update to Vault secret") - initialVersion, _ := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - err = utils.UpdateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for first CSI sync") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for first reload") - reloaded, err := adapter.WaitReloaded( - ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue()) - - By("Getting annotation value after first reload") - deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName) - Expect(err).NotTo(HaveOccurred()) - firstReloadValue := deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom] - Expect(firstReloadValue).NotTo(BeEmpty()) - - By("Waiting for Deployment to stabilize") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Finding the NEW SPCPS after first reload (new pod = new SPCPS)") - newSpcpsName, err := utils.FindSPCPSForDeployment( - ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("New SPCPS after first reload: %s\n", newSpcpsName) - - By("Second update to Vault secret") - err = utils.UpdateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"password": "pass-v3"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for second reload with different annotation value") - Eventually(func() string { - deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName) - if err != nil { - return "" - } - return deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom] - }, utils.ReloadTimeout).ShouldNot(Equal(firstReloadValue), "Annotation should change after second Vault secret update") - }) - }) - - Context("Typed Auto Annotation Tests", func() { - It("should reload only SPC changes with secretproviderclass auto annotation, not ConfigMap", func() { - By("Creating a ConfigMap") - _, err := utils.CreateConfigMap( - ctx, kubeClient, testNamespace, configMapName, - map[string]string{"key": "initial"}, nil, - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a secret in Vault") - err = utils.CreateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"token": "token-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret( - ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "token", - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with ConfigMap envFrom AND CSI volume, but only SPC auto annotation") - _, err = utils.CreateDeployment( - ctx, kubeClient, testNamespace, deploymentName, - utils.WithConfigMapEnvFrom(configMapName), - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.BuildSecretProviderClassAutoAnnotation()), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the ConfigMap (should NOT trigger reload)") - err = utils.UpdateConfigMap( - ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"}) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment was NOT reloaded for ConfigMap change") - time.Sleep(utils.NegativeTestWait) - reloaded, err := adapter.WaitReloaded( - ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ShortTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeFalse(), "SPC auto annotation should not trigger reload for ConfigMap changes") - - By("Finding the SPCPS") - spcpsName, err := utils.FindSPCPSForDeployment( - ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - - By("Getting SPCPS version before Vault update") - initialVersion, _ := utils.GetSPCPSVersion(ctx, csiClient, testNamespace, spcpsName) - - By("Updating the Vault secret (should trigger reload)") - err = utils.UpdateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"token": "token-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for CSI driver to sync") - err = utils.WaitForSPCPSVersionChange(ctx, csiClient, testNamespace, spcpsName, initialVersion, 10*time.Second) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment WAS reloaded for Vault secret change") - reloaded, err = adapter.WaitReloaded( - ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "SPC auto annotation should trigger reload for Vault secret changes") - }) - - It("should reload for both ConfigMap and SPC when using combined auto=true", func() { - By("Creating a ConfigMap") - _, err := utils.CreateConfigMap( - ctx, kubeClient, testNamespace, configMapName, - map[string]string{"key": "initial"}, nil, - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a secret in Vault") - err = utils.CreateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"secret": "secret-v1"}) - Expect(err).NotTo(HaveOccurred()) - - By("Creating a SecretProviderClass pointing to Vault secret") - _, err = utils.CreateSecretProviderClassWithSecret( - ctx, csiClient, testNamespace, spcName, - vaultSecretPath, "secret", - ) - Expect(err).NotTo(HaveOccurred()) - - By("Creating Deployment with ConfigMap envFrom AND CSI volume with combined auto=true") - _, err = utils.CreateDeployment( - ctx, kubeClient, testNamespace, deploymentName, - utils.WithConfigMapEnvFrom(configMapName), - utils.WithCSIVolume(spcName), - utils.WithAnnotations(utils.BuildAutoTrueAnnotation()), - ) - Expect(err).NotTo(HaveOccurred()) - - By("Waiting for Deployment to be ready") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Updating the ConfigMap (should trigger reload with auto=true)") - err = utils.UpdateConfigMap( - ctx, kubeClient, testNamespace, configMapName, map[string]string{"key": "updated"}) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment WAS reloaded for ConfigMap change") - reloaded, err := adapter.WaitReloaded( - ctx, testNamespace, deploymentName, - utils.AnnotationLastReloadedFrom, utils.ReloadTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - Expect(reloaded).To(BeTrue(), "Combined auto=true should trigger reload for ConfigMap changes") - - By("Waiting for Deployment to stabilize") - err = adapter.WaitReady(ctx, testNamespace, deploymentName, utils.WorkloadReadyTimeout) - Expect(err).NotTo(HaveOccurred()) - - By("Getting current annotation value") - deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName) - Expect(err).NotTo(HaveOccurred()) - firstReloadValue := deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom] - - By("Finding the NEW SPCPS after ConfigMap reload (new pod = new SPCPS)") - newSpcpsName, err := utils.FindSPCPSForDeployment( - ctx, csiClient, kubeClient, testNamespace, deploymentName, utils.WorkloadReadyTimeout, - ) - Expect(err).NotTo(HaveOccurred()) - GinkgoWriter.Printf("New SPCPS after ConfigMap reload: %s\n", newSpcpsName) - - By("Updating the Vault secret (should also trigger reload with auto=true)") - err = utils.UpdateVaultSecret( - ctx, kubeClient, restConfig, vaultSecretPath, map[string]string{"secret": "secret-v2"}) - Expect(err).NotTo(HaveOccurred()) - - By("Verifying Deployment WAS reloaded for Vault secret change") - Eventually(func() string { - deploy, err := utils.GetDeployment(ctx, kubeClient, testNamespace, deploymentName) - if err != nil { - return "" - } - return deploy.Spec.Template.Annotations[utils.AnnotationLastReloadedFrom] - }, utils.ReloadTimeout).ShouldNot(Equal(firstReloadValue), - "Combined auto=true should trigger reload for Vault secret changes", - ) - }) - }) -}) diff --git a/test/e2e/utils/accessors.go b/test/e2e/utils/accessors.go index 445f86a9..9852aff7 100644 --- a/test/e2e/utils/accessors.go +++ b/test/e2e/utils/accessors.go @@ -1,13 +1,10 @@ package utils import ( - "strings" - appsv1 "k8s.io/api/apps/v1" batchv1 "k8s.io/api/batch/v1" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/types" - csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1" rolloutsv1alpha1 "github.com/argoproj/argo-rollouts/pkg/apis/rollouts/v1alpha1" openshiftappsv1 "github.com/openshift/api/apps/v1" @@ -150,27 +147,3 @@ var ( return d.Status.ReadyReplicas == d.Spec.Replicas } ) - -// SecretProviderClassPodStatus accessors -var ( - SPCPSIsMounted StatusAccessor[*csiv1.SecretProviderClassPodStatus] = func(s *csiv1.SecretProviderClassPodStatus) bool { - return s.Status.Mounted - } - SPCPSClassName ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string { - return s.Status.SecretProviderClassName - } - SPCPSPodName ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string { - return s.Status.PodName - } - // SPCPSVersions returns concatenated versions of all objects for change detection. - SPCPSVersions ValueAccessor[*csiv1.SecretProviderClassPodStatus, string] = func(s *csiv1.SecretProviderClassPodStatus) string { - if len(s.Status.Objects) == 0 { - return "" - } - var versions []string - for _, obj := range s.Status.Objects { - versions = append(versions, obj.Version) - } - return strings.Join(versions, ",") - } -) diff --git a/test/e2e/utils/annotations.go b/test/e2e/utils/annotations.go index 60c0132b..1be04157 100644 --- a/test/e2e/utils/annotations.go +++ b/test/e2e/utils/annotations.go @@ -20,11 +20,6 @@ const ( // Value: comma-separated list of Secret names, e.g., "secret1,secret2" AnnotationSecretReload = "secret.reloader.stakater.com/reload" - // AnnotationSecretProviderClassReload triggers reload when specified SecretProviderClass(es) change. - // Value: comma-separated list of SecretProviderClass names, e.g., "spc1,spc2" - // Note: Reloader actually watches SecretProviderClassPodStatus resources, not SecretProviderClass. - AnnotationSecretProviderClassReload = "secretproviderclass.reloader.stakater.com/reload" - // ============================================================ // Auto-reload annotations // ============================================================ @@ -41,10 +36,6 @@ const ( // Value: "true" or "false" AnnotationSecretAuto = "secret.reloader.stakater.com/auto" - // AnnotationSecretProviderClassAuto enables auto-reload for all referenced SecretProviderClasses only. - // Value: "true" or "false" - AnnotationSecretProviderClassAuto = "secretproviderclass.reloader.stakater.com/auto" - // ============================================================ // Exclude annotations (used with auto=true to exclude specific resources) // ============================================================ @@ -57,10 +48,6 @@ const ( // Value: comma-separated list of Secret names AnnotationSecretExclude = "secrets.exclude.reloader.stakater.com/reload" - // AnnotationSecretProviderClassExclude excludes specified SecretProviderClasses from auto-reload. - // Value: comma-separated list of SecretProviderClass names - AnnotationSecretProviderClassExclude = "secretproviderclasses.exclude.reloader.stakater.com/reload" - // ============================================================ // Search annotations (for regex matching) // ============================================================ @@ -130,13 +117,6 @@ func BuildSecretReloadAnnotation(secretNames ...string) map[string]string { } } -// BuildSecretProviderClassReloadAnnotation creates an annotation map for SecretProviderClass reload. -func BuildSecretProviderClassReloadAnnotation(spcNames ...string) map[string]string { - return map[string]string{ - AnnotationSecretProviderClassReload: joinNames(spcNames), - } -} - // BuildAutoTrueAnnotation creates an annotation map with auto=true. func BuildAutoTrueAnnotation() map[string]string { return map[string]string{ @@ -165,13 +145,6 @@ func BuildSecretAutoAnnotation() map[string]string { } } -// BuildSecretProviderClassAutoAnnotation creates an annotation map with secretproviderclass auto=true. -func BuildSecretProviderClassAutoAnnotation() map[string]string { - return map[string]string{ - AnnotationSecretProviderClassAuto: AnnotationValueTrue, - } -} - // BuildSearchAnnotation creates an annotation map to enable search mode. func BuildSearchAnnotation() map[string]string { return map[string]string{ @@ -214,13 +187,6 @@ func BuildSecretExcludeAnnotation(secretNames ...string) map[string]string { } } -// BuildSecretProviderClassExcludeAnnotation creates an annotation to exclude SecretProviderClasses from auto-reload. -func BuildSecretProviderClassExcludeAnnotation(spcNames ...string) map[string]string { - return map[string]string{ - AnnotationSecretProviderClassExclude: joinNames(spcNames), - } -} - // BuildPausePeriodAnnotation creates an annotation for deployment pause period. func BuildPausePeriodAnnotation(duration string) map[string]string { return map[string]string{ diff --git a/test/e2e/utils/conditions.go b/test/e2e/utils/conditions.go index 5736b022..7afd146f 100644 --- a/test/e2e/utils/conditions.go +++ b/test/e2e/utils/conditions.go @@ -6,7 +6,6 @@ import ( batchv1 "k8s.io/api/batch/v1" corev1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/types" - csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1" ) // PodTemplateAccessor extracts PodTemplateSpec from a workload. @@ -216,43 +215,3 @@ func IsTriggeredJobForCronJob(cronJobName string) Condition[*batchv1.Job] { return false } } - -// SPCPSVersionChanged returns a condition that checks if the SPCPS version has changed -// from the initial version and the SPCPS is mounted. -func SPCPSVersionChanged(initialVersion string) Condition[*csiv1.SecretProviderClassPodStatus] { - return func(spcps *csiv1.SecretProviderClassPodStatus) bool { - if !spcps.Status.Mounted || len(spcps.Status.Objects) == 0 { - return false - } - for _, obj := range spcps.Status.Objects { - if obj.Version != initialVersion { - return true - } - } - return false - } -} - -// SPCPSForSPC returns a condition that checks if the SPCPS references a specific -// SecretProviderClass and is mounted. -func SPCPSForSPC(spcName string) Condition[*csiv1.SecretProviderClassPodStatus] { - return func(spcps *csiv1.SecretProviderClassPodStatus) bool { - return spcps.Status.SecretProviderClassName == spcName && spcps.Status.Mounted - } -} - -// SPCPSForPod returns a condition that checks if the SPCPS references a specific -// pod and is mounted. -func SPCPSForPod(podName string) Condition[*csiv1.SecretProviderClassPodStatus] { - return func(spcps *csiv1.SecretProviderClassPodStatus) bool { - return spcps.Status.PodName == podName && spcps.Status.Mounted - } -} - -// SPCPSForPods returns a condition that checks if the SPCPS references any of the -// specified pods and is mounted. -func SPCPSForPods(podNames map[string]bool) Condition[*csiv1.SecretProviderClassPodStatus] { - return func(spcps *csiv1.SecretProviderClassPodStatus) bool { - return podNames[spcps.Status.PodName] && spcps.Status.Mounted - } -} diff --git a/test/e2e/utils/csi.go b/test/e2e/utils/csi.go deleted file mode 100644 index 3a34ff2a..00000000 --- a/test/e2e/utils/csi.go +++ /dev/null @@ -1,338 +0,0 @@ -package utils - -import ( - "bytes" - "context" - "errors" - "fmt" - "strings" - "time" - - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/watch" - "k8s.io/client-go/kubernetes" - "k8s.io/client-go/kubernetes/scheme" - "k8s.io/client-go/rest" - "k8s.io/client-go/tools/clientcmd" - "k8s.io/client-go/tools/remotecommand" - csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1" - csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned" -) - -// CSI Driver constants -const ( - // CSIDriverName is the name of the secrets-store CSI driver - CSIDriverName = "secrets-store.csi.k8s.io" - - // DefaultCSIProvider is the default provider name for testing (Vault) - DefaultCSIProvider = "vault" - - // VaultAddress is the default Vault address in the cluster - VaultAddress = "http://vault.vault:8200" - - // VaultRole is the Kubernetes auth role configured in Vault for testing - VaultRole = "test-role" - - // VaultNamespace is the namespace where Vault is deployed - VaultNamespace = "vault" - - // VaultPodName is the name of the Vault pod (dev mode) - VaultPodName = "vault-0" - - // CSIVolumeName is the default volume name for CSI volumes in tests - CSIVolumeName = "csi-secrets-store" - - // CSIMountPath is the default mount path for CSI volumes in tests - CSIMountPath = "/mnt/secrets-store" - - // CSIRotationPollInterval is how often CSI driver checks for secret changes - CSIRotationPollInterval = 2 * time.Second -) - -// NewCSIClient creates a new CSI client using the default kubeconfig. -func NewCSIClient() (csiclient.Interface, error) { - kubeconfig := GetKubeconfig() - config, err := clientcmd.BuildConfigFromFlags("", kubeconfig) - if err != nil { - return nil, fmt.Errorf("building config from kubeconfig: %w", err) - } - return NewCSIClientFromConfig(config) -} - -// NewCSIClientFromConfig creates a new CSI client from a rest.Config. -func NewCSIClientFromConfig(config *rest.Config) (csiclient.Interface, error) { - client, err := csiclient.NewForConfig(config) - if err != nil { - return nil, fmt.Errorf("creating CSI client: %w", err) - } - return client, nil -} - -// IsCSIDriverInstalled checks if the CSI secrets store driver CRDs are available in the cluster. -// This checks for the SecretProviderClass CRD which is required for CSI tests. -func IsCSIDriverInstalled(ctx context.Context, client csiclient.Interface) bool { - if client == nil { - return false - } - - // Try to list SecretProviderClasses - if CRD doesn't exist, this will fail - _, err := client.SecretsstoreV1().SecretProviderClasses("default").List(ctx, metav1.ListOptions{Limit: 1}) - return err == nil -} - -// IsVaultProviderInstalled checks if Vault CSI provider is installed by checking for the vault-csi-provider DaemonSet. -// This is used to determine if CSI tests with actual volume mounting can run. -func IsVaultProviderInstalled(ctx context.Context, kubeClient kubernetes.Interface) bool { - if kubeClient == nil { - return false - } - - // Check if vault-csi-provider DaemonSet exists in vault namespace - _, err := kubeClient.AppsV1().DaemonSets("vault").Get(ctx, "vault-csi-provider", metav1.GetOptions{}) - return err == nil -} - -// CreateSecretProviderClass creates a SecretProviderClass in the given namespace. -// If params is nil, it creates a Vault-compatible SecretProviderClass with default test settings. -func CreateSecretProviderClass(ctx context.Context, client csiclient.Interface, namespace, name string, params map[string]string) ( - *csiv1.SecretProviderClass, error, -) { - if params == nil { - params = map[string]string{ - "vaultAddress": VaultAddress, - "roleName": VaultRole, - "objects": `- objectName: "test-secret" - secretPath: "secret/data/test" - secretKey: "username"`, - } - } - - spc := &csiv1.SecretProviderClass{ - ObjectMeta: metav1.ObjectMeta{ - Name: name, - Namespace: namespace, - }, - Spec: csiv1.SecretProviderClassSpec{ - Provider: DefaultCSIProvider, - Parameters: params, - }, - } - - created, err := client.SecretsstoreV1().SecretProviderClasses(namespace).Create(ctx, spc, metav1.CreateOptions{}) - if err != nil { - return nil, fmt.Errorf("creating SecretProviderClass %s/%s: %w", namespace, name, err) - } - return created, nil -} - -// CreateSecretProviderClassWithSecret creates a SecretProviderClass that fetches a specific secret from Vault. -// secretPath should be like "secret/mysecret" (the function converts it to KV v2 format "secret/data/mysecret"). -// secretKey is the key within that secret to fetch. -func CreateSecretProviderClassWithSecret(ctx context.Context, client csiclient.Interface, namespace, name, secretPath, secretKey string) ( - *csiv1.SecretProviderClass, error, -) { - kvV2Path := secretPath - if strings.HasPrefix(secretPath, "secret/") && !strings.HasPrefix(secretPath, "secret/data/") { - kvV2Path = strings.Replace(secretPath, "secret/", "secret/data/", 1) - } - - params := map[string]string{ - "vaultAddress": VaultAddress, - "roleName": VaultRole, - "objects": fmt.Sprintf( - `- objectName: "%s" - secretPath: "%s" - secretKey: "%s"`, secretKey, kvV2Path, secretKey, - ), - } - return CreateSecretProviderClass(ctx, client, namespace, name, params) -} - -// DeleteSecretProviderClass deletes a SecretProviderClass by name. -func DeleteSecretProviderClass(ctx context.Context, client csiclient.Interface, namespace, name string) error { - err := client.SecretsstoreV1().SecretProviderClasses(namespace).Delete(ctx, name, metav1.DeleteOptions{}) - if err != nil { - return fmt.Errorf("deleting SecretProviderClass %s/%s: %w", namespace, name, err) - } - return nil -} - -// UpdateSecretProviderClassPodStatusLabels updates only the labels on a SecretProviderClassPodStatus. -// This should NOT trigger a reload (used for negative testing to verify Reloader ignores label-only changes). -func UpdateSecretProviderClassPodStatusLabels(ctx context.Context, client csiclient.Interface, namespace, name string, labels map[string]string) error { - spcps, err := client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Get(ctx, name, metav1.GetOptions{}) - if err != nil { - return fmt.Errorf("getting SecretProviderClassPodStatus %s/%s: %w", namespace, name, err) - } - - if spcps.Labels == nil { - spcps.Labels = make(map[string]string) - } - for k, v := range labels { - spcps.Labels[k] = v - } - - _, err = client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Update(ctx, spcps, metav1.UpdateOptions{}) - if err != nil { - return fmt.Errorf("updating SecretProviderClassPodStatus labels %s/%s: %w", namespace, name, err) - } - return nil -} - -// ============================================================================= -// Vault Integration Helpers -// ============================================================================= - -// CreateVaultSecret creates a new secret in Vault. -// secretPath should be like "secret/test" (without "data" prefix - it's added automatically). -// data is a map of key-value pairs to store in the secret. -func CreateVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string, data map[string]string) error { - return UpdateVaultSecret(ctx, kubeClient, restConfig, secretPath, data) -} - -// UpdateVaultSecret updates a secret in Vault. This triggers the CSI driver to -// sync the new secret version, which creates/updates the SecretProviderClassPodStatus. -// secretPath should be like "secret/test" (without "data" prefix - it's added automatically). -// data is a map of key-value pairs to store in the secret. -func UpdateVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string, data map[string]string) error { - args := []string{"kv", "put", secretPath} - for k, v := range data { - args = append(args, fmt.Sprintf("%s=%s", k, v)) - } - - if err := execInVaultPod(ctx, kubeClient, restConfig, args); err != nil { - return fmt.Errorf("updating Vault secret %s: %w", secretPath, err) - } - return nil -} - -// DeleteVaultSecret deletes a secret from Vault. -// secretPath should be like "secret/test". -func DeleteVaultSecret(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, secretPath string) error { - args := []string{"kv", "metadata", "delete", secretPath} - if err := execInVaultPod(ctx, kubeClient, restConfig, args); err != nil { - if strings.Contains(err.Error(), "No value found") { - return nil - } - return fmt.Errorf("deleting Vault secret %s: %w", secretPath, err) - } - return nil -} - -// execInVaultPod executes a vault command in the Vault pod. -func execInVaultPod(ctx context.Context, kubeClient kubernetes.Interface, restConfig *rest.Config, args []string) error { - req := kubeClient.CoreV1().RESTClient().Post(). - Resource("pods"). - Name(VaultPodName). - Namespace(VaultNamespace). - SubResource("exec"). - VersionedParams( - &corev1.PodExecOptions{ - Container: "vault", - Command: append([]string{"vault"}, args...), - Stdout: true, - Stderr: true, - }, scheme.ParameterCodec, - ) - - exec, err := remotecommand.NewSPDYExecutor(restConfig, "POST", req.URL()) - if err != nil { - return fmt.Errorf("creating executor: %w", err) - } - - var stdout, stderr bytes.Buffer - err = exec.StreamWithContext( - ctx, remotecommand.StreamOptions{ - Stdout: &stdout, - Stderr: &stderr, - }, - ) - if err != nil { - return fmt.Errorf("executing command: %w (stderr: %s)", err, stderr.String()) - } - - return nil -} - -// WaitForSPCPSVersionChange waits for the SecretProviderClassPodStatus version to change -// from the initial version using watches. This is used after updating a Vault secret to -// wait for CSI driver to sync the new version. -func WaitForSPCPSVersionChange(ctx context.Context, client csiclient.Interface, namespace, spcpsName, initialVersion string, timeout time.Duration) error { - watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) { - return client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts) - } - - _, err := WatchUntil(ctx, watchFunc, spcpsName, SPCPSVersionChanged(initialVersion), timeout) - if errors.Is(err, ErrWatchTimeout) { - return fmt.Errorf("timeout waiting for SecretProviderClassPodStatus %s/%s version to change from %s", namespace, spcpsName, initialVersion) - } - return err -} - -// FindSPCPSForDeployment finds the SecretProviderClassPodStatus created by CSI driver -// for pods of a given deployment using watches. Returns the first matching SPCPS name. -func FindSPCPSForDeployment(ctx context.Context, csiClient csiclient.Interface, kubeClient kubernetes.Interface, namespace, deploymentName string, timeout time.Duration) ( - string, error, -) { - pods, err := kubeClient.CoreV1().Pods(namespace).List( - ctx, metav1.ListOptions{ - LabelSelector: fmt.Sprintf("app=%s", deploymentName), - }, - ) - if err != nil { - return "", fmt.Errorf("listing pods for deployment %s: %w", deploymentName, err) - } - - podNames := make(map[string]bool) - for _, pod := range pods.Items { - podNames[pod.Name] = true - } - - watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) { - return csiClient.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts) - } - - spcps, err := WatchUntil(ctx, watchFunc, "", SPCPSForPods(podNames), timeout) - if errors.Is(err, ErrWatchTimeout) { - return "", fmt.Errorf("timeout finding SecretProviderClassPodStatus for deployment %s/%s", namespace, deploymentName) - } - if err != nil { - return "", err - } - return spcps.Name, nil -} - -// FindSPCPSForSPC finds the SecretProviderClassPodStatus created by CSI driver -// that references a specific SecretProviderClass using watches. Returns the first matching SPCPS name. -func FindSPCPSForSPC(ctx context.Context, csiClient csiclient.Interface, namespace, spcName string, timeout time.Duration) (string, error) { - watchFunc := func(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) { - return csiClient.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Watch(ctx, opts) - } - - spcps, err := WatchUntil(ctx, watchFunc, "", SPCPSForSPC(spcName), timeout) - if errors.Is(err, ErrWatchTimeout) { - return "", fmt.Errorf("timeout finding SecretProviderClassPodStatus for SPC %s/%s", namespace, spcName) - } - if err != nil { - return "", err - } - return spcps.Name, nil -} - -// GetSPCPSVersion gets the current version string from a SecretProviderClassPodStatus. -// Returns the version of the first object, or empty string if not found. -func GetSPCPSVersion(ctx context.Context, client csiclient.Interface, namespace, name string) (string, error) { - spcps, err := client.SecretsstoreV1().SecretProviderClassPodStatuses(namespace).Get(ctx, name, metav1.GetOptions{}) - if err != nil { - return "", fmt.Errorf("getting SecretProviderClassPodStatus %s/%s: %w", namespace, name, err) - } - if len(spcps.Status.Objects) == 0 { - return "", nil - } - var versions []string - for _, obj := range spcps.Status.Objects { - versions = append(versions, obj.Version) - } - return strings.Join(versions, ","), nil -} diff --git a/test/e2e/utils/podspec.go b/test/e2e/utils/podspec.go index 263bed9c..91ca6f6d 100644 --- a/test/e2e/utils/podspec.go +++ b/test/e2e/utils/podspec.go @@ -4,7 +4,6 @@ import ( "fmt" corev1 "k8s.io/api/core/v1" - "k8s.io/utils/ptr" ) // AddEnvFromSource adds ConfigMap or Secret envFrom to a container. @@ -107,69 +106,6 @@ func AddKeyRef(spec *corev1.PodSpec, containerIdx int, resourceName, key, envVar spec.Containers[containerIdx].Env = append(spec.Containers[containerIdx].Env, envVar) } -// AddCSIVolume adds CSI volume referencing SecretProviderClass. -func AddCSIVolume(spec *corev1.PodSpec, containerIdx int, spcName string) { - volumeName := "csi-" + spcName - mountPath := "/mnt/secrets-store/" + spcName - spec.Volumes = append(spec.Volumes, corev1.Volume{ - Name: volumeName, - VolumeSource: corev1.VolumeSource{ - CSI: &corev1.CSIVolumeSource{ - Driver: CSIDriverName, - ReadOnly: ptr.To(true), - VolumeAttributes: map[string]string{ - "secretProviderClass": spcName, - }, - }, - }, - }) - if containerIdx < len(spec.Containers) { - spec.Containers[containerIdx].VolumeMounts = append( - spec.Containers[containerIdx].VolumeMounts, - corev1.VolumeMount{Name: volumeName, MountPath: mountPath, ReadOnly: true}, - ) - } -} - -// AddCSIInitContainer adds an init container that mounts a CSI SecretProviderClass volume. -// The init container is named "init-csi-{spcName}" to avoid collisions when multiple CSI -// volumes are mounted. The volume is only added if not already present (idempotent). -// This is distinct from AddCSIVolume which mounts into a regular container. -func AddCSIInitContainer(spec *corev1.PodSpec, spcName string) { - volumeName := "csi-" + spcName - mountPath := "/mnt/secrets-store/" + spcName - - hasVolume := false - for _, v := range spec.Volumes { - if v.Name == volumeName { - hasVolume = true - break - } - } - if !hasVolume { - spec.Volumes = append(spec.Volumes, corev1.Volume{ - Name: volumeName, - VolumeSource: corev1.VolumeSource{ - CSI: &corev1.CSIVolumeSource{ - Driver: CSIDriverName, - ReadOnly: ptr.To(true), - VolumeAttributes: map[string]string{ - "secretProviderClass": spcName, - }, - }, - }, - }) - } - spec.InitContainers = append(spec.InitContainers, corev1.Container{ - Name: "init-csi-" + spcName, - Image: DefaultImage, - Command: []string{"sh", "-c", "echo init done"}, - VolumeMounts: []corev1.VolumeMount{ - {Name: volumeName, MountPath: mountPath, ReadOnly: true}, - }, - }) -} - // AddInitContainer adds init container with optional envFrom references. func AddInitContainer(spec *corev1.PodSpec, cmName, secretName string) { init := corev1.Container{ @@ -282,18 +218,12 @@ func ApplyWorkloadConfig(template *corev1.PodTemplateSpec, cfg WorkloadConfig) { } AddKeyRef(spec, 0, cfg.SecretName, key, envVar, true) } - if cfg.UseCSIVolume && cfg.SPCName != "" { - AddCSIVolume(spec, 0, cfg.SPCName) - } if cfg.UseInitContainer { AddInitContainer(spec, cfg.ConfigMapName, cfg.SecretName) } if cfg.UseInitContainerVolume { AddInitContainerWithVolumes(spec, cfg.ConfigMapName, cfg.SecretName) } - if cfg.UseInitContainerCSI && cfg.SPCName != "" { - AddCSIInitContainer(spec, cfg.SPCName) - } if cfg.MultipleContainers > 1 { for i := 1; i < cfg.MultipleContainers; i++ { spec.Containers = append(spec.Containers, corev1.Container{ diff --git a/test/e2e/utils/resources.go b/test/e2e/utils/resources.go index 7f0fa946..36ae3be7 100644 --- a/test/e2e/utils/resources.go +++ b/test/e2e/utils/resources.go @@ -516,42 +516,6 @@ func WithInitContainerProjectedVolume(cmName, secretName string) DeploymentOptio } } -// WithCSIVolume adds a CSI volume referencing a SecretProviderClass to a Deployment. -func WithCSIVolume(spcName string) DeploymentOption { - return func(d *appsv1.Deployment) { - volumeName := csiVolumeName(spcName) - mountPath := csiMountPath(spcName) - - d.Spec.Template.Spec.Volumes = append(d.Spec.Template.Spec.Volumes, corev1.Volume{ - Name: volumeName, - VolumeSource: corev1.VolumeSource{ - CSI: &corev1.CSIVolumeSource{ - Driver: CSIDriverName, - ReadOnly: ptr.To(true), - VolumeAttributes: map[string]string{ - "secretProviderClass": spcName, - }, - }, - }, - }) - d.Spec.Template.Spec.Containers[0].VolumeMounts = append( - d.Spec.Template.Spec.Containers[0].VolumeMounts, - corev1.VolumeMount{ - Name: volumeName, - MountPath: mountPath, - ReadOnly: true, - }, - ) - } -} - -// WithInitContainerCSIVolume adds an init container with a CSI volume mount. -func WithInitContainerCSIVolume(spcName string) DeploymentOption { - return func(d *appsv1.Deployment) { - AddCSIInitContainer(&d.Spec.Template.Spec, spcName) - } -} - func baseDeploymentResource(namespace, name string) *appsv1.Deployment { labels := map[string]string{"app": name} return &appsv1.Deployment{ @@ -868,35 +832,6 @@ func WithJobCommand(command string) JobOption { } } -// WithJobCSIVolume adds a CSI volume referencing a SecretProviderClass to a Job. -func WithJobCSIVolume(spcName string) JobOption { - return func(j *batchv1.Job) { - volumeName := csiVolumeName(spcName) - mountPath := csiMountPath(spcName) - - j.Spec.Template.Spec.Volumes = append(j.Spec.Template.Spec.Volumes, corev1.Volume{ - Name: volumeName, - VolumeSource: corev1.VolumeSource{ - CSI: &corev1.CSIVolumeSource{ - Driver: CSIDriverName, - ReadOnly: ptr.To(true), - VolumeAttributes: map[string]string{ - "secretProviderClass": spcName, - }, - }, - }, - }) - j.Spec.Template.Spec.Containers[0].VolumeMounts = append( - j.Spec.Template.Spec.Containers[0].VolumeMounts, - corev1.VolumeMount{ - Name: volumeName, - MountPath: mountPath, - ReadOnly: true, - }, - ) - } -} - // baseJobResource creates a base Job template. func baseJobResource(namespace, name string) *batchv1.Job { labels := map[string]string{"app": name} @@ -933,14 +868,6 @@ func DeleteJob(ctx context.Context, client kubernetes.Interface, namespace, name }) } -func csiVolumeName(spcName string) string { - return fmt.Sprintf("csi-%s", spcName) -} - -func csiMountPath(spcName string) string { - return fmt.Sprintf("/mnt/secrets-store/%s", spcName) -} - // GetDeployment retrieves a deployment by name. func GetDeployment(ctx context.Context, client kubernetes.Interface, namespace, name string) (*appsv1.Deployment, error) { return client.AppsV1().Deployments(namespace).Get(ctx, name, metav1.GetOptions{}) diff --git a/test/e2e/utils/testenv.go b/test/e2e/utils/testenv.go index a8be4551..6f73bd06 100644 --- a/test/e2e/utils/testenv.go +++ b/test/e2e/utils/testenv.go @@ -13,7 +13,6 @@ import ( "k8s.io/client-go/kubernetes" "k8s.io/client-go/rest" "k8s.io/client-go/tools/clientcmd" - csiclient "sigs.k8s.io/secrets-store-csi-driver/pkg/client/clientset/versioned" ) // TestEnvironment holds the common test environment state. @@ -22,7 +21,6 @@ type TestEnvironment struct { Cancel context.CancelFunc KubeClient kubernetes.Interface DiscoveryClient discovery.DiscoveryInterface - CSIClient csiclient.Interface RolloutsClient rolloutsclient.Interface OpenShiftClient openshiftclient.Interface RestConfig *rest.Config @@ -84,9 +82,6 @@ func SetupSharedTestEnvironment(ctx context.Context, namespace, releaseName stri } // Optional clients — failures are non-fatal. - if env.CSIClient, err = csiclient.NewForConfig(config); err != nil { - env.CSIClient = nil - } if env.RolloutsClient, err = rolloutsclient.NewForConfig(config); err != nil { env.RolloutsClient = nil } @@ -135,12 +130,6 @@ func SetupTestEnvironment(ctx context.Context, namespacePrefix string) (*TestEnv return nil, fmt.Errorf("creating discovery client: %w", err) } - env.CSIClient, err = csiclient.NewForConfig(config) - if err != nil { - ginkgo.GinkgoWriter.Printf("Warning: Could not create CSI client: %v (CSI tests will be skipped)\n", err) - env.CSIClient = nil - } - // Try to create Argo Rollouts client (optional - may not be installed) env.RolloutsClient, err = rolloutsclient.NewForConfig(config) if err != nil { diff --git a/test/e2e/utils/workload_adapter.go b/test/e2e/utils/workload_adapter.go index bc7f80ce..2610337f 100644 --- a/test/e2e/utils/workload_adapter.go +++ b/test/e2e/utils/workload_adapter.go @@ -32,7 +32,6 @@ const ( type WorkloadConfig struct { ConfigMapName string SecretName string - SPCName string Annotations map[string]string // Annotations for workload metadata (e.g., Deployment.metadata.annotations) PodTemplateAnnotations map[string]string // Annotations for pod template metadata (e.g., Deployment.spec.template.metadata.annotations) UseConfigMapEnvFrom bool @@ -44,8 +43,6 @@ type WorkloadConfig struct { UseSecretKeyRef bool UseInitContainer bool UseInitContainerVolume bool - UseCSIVolume bool - UseInitContainerCSI bool ConfigMapKey string SecretKey string EnvVarName string