-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
fix: handle different vault injection cases #75
fix: handle different vault injection cases #75
Conversation
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
The test scenario in func TestEnvStore_GetProviderPaths(t *testing.T) {
tests := []struct {
name string
envs map[string]string
wantPaths map[string][]string
}{
{
name: "file provider",
envs: map[string]string{
"AWS_SECRET_ACCESS_KEY_ID": "file:FILEPATH",
}
wantPaths: map[string][]string{
"file": {
"FILEPATH"
},
},
},
{
name: "vault provider",
envs: map[string]string{
// Add all the envs from https://github.com/bank-vaults/internal/blob/1d4670005e01baaa08bac7e17d0876d444d3286b/injector/injector_test.go#L92-L101
}
wantPaths: map[string][]string{
"vault": {
// fill expected
},
},
},
{
name: "multi provider",
envs: map[string]string{
"AWS_SECRET_ACCESS_KEY_ID": "file:FILEPATH",
"MYSQL_PASSWORD": "vault:secret/data/test/mysql#MYSQL_PASSWORD",
"AWS_SECRET_ACCESS_KEY: "vault:secret/data/test/aws#AWS_SECRET_ACCESS_KEY",
}
wantPaths: map[string][]string{
"vault": {
// fill expected
},
"file": {
// fill expected
},
},
},
}
for _, tt := range tests {
ttp := tt
t.Run(ttp.name, func(t *testing.T) {
// prepare envs
for envKey, envVal := range ttp.envs {
os.Setenv(envKey, envVal)
t.Cleanup(func() {
os.Unsetenv(envKey)
})
}
paths := NewEnvStore().GetProviderPaths()
for key, expectedSlice := range ttp.wantPaths {
actualSlice, ok := paths[key]
assert.True(t, ok, "Key not found in actual paths")
assert.ElementsMatch(t, expectedSlice, actualSlice, "Slices for key %s do not match", key)
}
})
}
} |
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
great work!
Overview
injector
already utilizes a bunch of things, to detect vault secret references.secret-init
it's sufficient if we use a regex to detectvault:something/something/...
like substrings in the env-values, since it won't mistakevault
like env-values for vault references, and if somehow a non-vault reference would be detected, the injector would just ignore it.Fixes #68