|
| 1 | +package postgres |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + . "github.com/onsi/ginkgo/v2" |
| 7 | + . "github.com/onsi/gomega" |
| 8 | + "github.com/onsi/gomega/types" |
| 9 | + core_v1 "k8s.io/api/core/v1" |
| 10 | + "k8s.io/apimachinery/pkg/api/meta" |
| 11 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 12 | + "k8s.io/client-go/kubernetes" |
| 13 | + "k8s.io/client-go/kubernetes/fake" |
| 14 | + "net/url" |
| 15 | + "strings" |
| 16 | +) |
| 17 | + |
| 18 | +const ( |
| 19 | + namespace = "password-ns" |
| 20 | + secretName = "google-sql-password-app" |
| 21 | + appName = "password-app" |
| 22 | + newPassword = "new-password" |
| 23 | + oldPassword = "old-password" |
| 24 | + |
| 25 | + jdbcUrlTmpl = "jdbc:postgresql://localhost:5432/my-database?user=my-user&password=%s" |
| 26 | + pgUrlTmpl = "postgresql://my-user:%s@localhost:5432/my-database" |
| 27 | +) |
| 28 | + |
| 29 | +var newJdbcUrl *url.URL |
| 30 | +var newPgUrl *url.URL |
| 31 | + |
| 32 | +func init() { |
| 33 | + var err error |
| 34 | + newJdbcUrl, err = url.Parse(fmt.Sprintf(jdbcUrlTmpl, newPassword)) |
| 35 | + if err != nil { |
| 36 | + panic(err) |
| 37 | + } |
| 38 | + |
| 39 | + newPgUrl, err = url.Parse(fmt.Sprintf(pgUrlTmpl, newPassword)) |
| 40 | + if err != nil { |
| 41 | + panic(err) |
| 42 | + } |
| 43 | +} |
| 44 | + |
| 45 | +type test struct { |
| 46 | + secretPrep []SecretPrep |
| 47 | + assertSecret []AssertSecret |
| 48 | +} |
| 49 | + |
| 50 | +var _ = Describe("Password", func() { |
| 51 | + var k8sClient *fake.Clientset |
| 52 | + var secret *core_v1.Secret |
| 53 | + |
| 54 | + BeforeEach(func() { |
| 55 | + k8sClient = fake.NewSimpleClientset() |
| 56 | + secret = &core_v1.Secret{ |
| 57 | + TypeMeta: metav1.TypeMeta{ |
| 58 | + Kind: "Secret", |
| 59 | + APIVersion: "v1", |
| 60 | + }, |
| 61 | + ObjectMeta: metav1.ObjectMeta{ |
| 62 | + Name: secretName, |
| 63 | + Namespace: namespace, |
| 64 | + }, |
| 65 | + Data: map[string][]byte{ |
| 66 | + "DB_HOST": []byte("localhost"), |
| 67 | + "DB_PORT": []byte("5432"), |
| 68 | + "DB_DATABASE": []byte("my-database"), |
| 69 | + "DB_USERNAME": []byte("my-user"), |
| 70 | + }, |
| 71 | + } |
| 72 | + }) |
| 73 | + |
| 74 | + DescribeTableSubtree("", |
| 75 | + func(test test) { |
| 76 | + var dbInfo *DBInfo |
| 77 | + var dbConnectionInfo *ConnectionInfo |
| 78 | + |
| 79 | + BeforeEach(func() { |
| 80 | + for _, prep := range test.secretPrep { |
| 81 | + prep(secret) |
| 82 | + } |
| 83 | + |
| 84 | + err := k8sClient.Tracker().Add(secret) |
| 85 | + Expect(err).To(BeNil()) |
| 86 | + |
| 87 | + dbInfo = createDbInfo(k8sClient) |
| 88 | + dbConnectionInfo = createConnectionInfo(*secret, dbInfo.instanceName) |
| 89 | + }) |
| 90 | + |
| 91 | + It("rotating password", func(ctx context.Context) { |
| 92 | + dbConnectionInfo.SetPassword(newPassword) |
| 93 | + |
| 94 | + err := updateKubernetesSecret(ctx, dbInfo, dbConnectionInfo) |
| 95 | + Expect(err).To(BeNil()) |
| 96 | + |
| 97 | + gvr, _ := meta.UnsafeGuessKindToResource(secret.GroupVersionKind()) |
| 98 | + actual, err := k8sClient.Tracker().Get(gvr, secret.Namespace, secret.Name) |
| 99 | + Expect(err).To(BeNil()) |
| 100 | + |
| 101 | + actualSecret, ok := actual.(*core_v1.Secret) |
| 102 | + Expect(ok).To(BeTrue()) |
| 103 | + |
| 104 | + for _, assert := range test.assertSecret { |
| 105 | + assert(actualSecret) |
| 106 | + } |
| 107 | + }) |
| 108 | + }, |
| 109 | + Entry("has only password", test{ |
| 110 | + secretPrep: []SecretPrep{AddPassword}, |
| 111 | + assertSecret: []AssertSecret{HasPassword, HasNoUrl, HasNoJdbcUrl}, |
| 112 | + }), |
| 113 | + Entry("has password and url", test{ |
| 114 | + secretPrep: []SecretPrep{AddPassword, AddUrl}, |
| 115 | + assertSecret: []AssertSecret{HasPassword, HasUrl, HasJdbcUrl}, |
| 116 | + }), |
| 117 | + Entry("has all", test{ |
| 118 | + secretPrep: []SecretPrep{AddPassword, AddUrl, AddJdbcUrl}, |
| 119 | + assertSecret: []AssertSecret{HasPassword, HasUrl, HasJdbcUrl}, |
| 120 | + }), |
| 121 | + Entry("has password and jdbc url", test{ |
| 122 | + secretPrep: []SecretPrep{AddPassword, AddJdbcUrl}, |
| 123 | + assertSecret: []AssertSecret{HasPassword, HasNoUrl, HasJdbcUrl}, |
| 124 | + }), |
| 125 | + ) |
| 126 | +}) |
| 127 | + |
| 128 | +func createDbInfo(k8sClient kubernetes.Interface) *DBInfo { |
| 129 | + return &DBInfo{ |
| 130 | + k8sClient: k8sClient, |
| 131 | + dynamicClient: nil, |
| 132 | + config: nil, |
| 133 | + namespace: namespace, |
| 134 | + appName: appName, |
| 135 | + projectID: "project-id", |
| 136 | + connectionName: "connection:name", |
| 137 | + multiDB: false, |
| 138 | + instanceName: "my-instance", |
| 139 | + databaseName: "my-database", |
| 140 | + user: "my-user", |
| 141 | + } |
| 142 | +} |
| 143 | + |
| 144 | +type SecretPrep func(secret *core_v1.Secret) |
| 145 | + |
| 146 | +func AddPassword(secret *core_v1.Secret) { |
| 147 | + secret.Data["DB_PASSWORD"] = []byte(oldPassword) |
| 148 | +} |
| 149 | + |
| 150 | +func AddUrl(secret *core_v1.Secret) { |
| 151 | + secret.Data["DB_URL"] = []byte(fmt.Sprintf(pgUrlTmpl, oldPassword)) |
| 152 | +} |
| 153 | + |
| 154 | +func AddJdbcUrl(secret *core_v1.Secret) { |
| 155 | + secret.Data["DB_JDBC_URL"] = []byte(fmt.Sprintf(jdbcUrlTmpl, oldPassword)) |
| 156 | +} |
| 157 | + |
| 158 | +type AssertSecret func(actual *core_v1.Secret) |
| 159 | + |
| 160 | +func EqualUrlNoQuery(expected *url.URL) types.GomegaMatcher { |
| 161 | + expectedNoQuery, _, _ := strings.Cut(expected.String(), "?") |
| 162 | + return WithTransform(func(actual *url.URL) string { |
| 163 | + actualNoQuery, _, _ := strings.Cut(actual.String(), "?") |
| 164 | + return actualNoQuery |
| 165 | + }, Equal(expectedNoQuery)) |
| 166 | +} |
| 167 | + |
| 168 | +func EqualQuery(expected *url.URL) types.GomegaMatcher { |
| 169 | + expectedQuery := expected.Query() |
| 170 | + return WithTransform(func(actual *url.URL) url.Values { |
| 171 | + return actual.Query() |
| 172 | + }, Equal(expectedQuery)) |
| 173 | +} |
| 174 | + |
| 175 | +func HasPassword(actual *core_v1.Secret) { |
| 176 | + By("should have new password in DB_PASSWORD", func() { |
| 177 | + Expect(actual.Data["DB_PASSWORD"]).To(Equal([]byte(newPassword))) |
| 178 | + }) |
| 179 | +} |
| 180 | + |
| 181 | +func HasUrl(actual *core_v1.Secret) { |
| 182 | + By("should have new password in DB_URL", func() { |
| 183 | + u, err := url.Parse(string(actual.Data["DB_URL"])) |
| 184 | + Expect(err).To(BeNil()) |
| 185 | + Expect(u).To(SatisfyAll( |
| 186 | + EqualUrlNoQuery(newPgUrl), |
| 187 | + EqualQuery(newPgUrl), |
| 188 | + )) |
| 189 | + }) |
| 190 | +} |
| 191 | + |
| 192 | +func HasNoUrl(actual *core_v1.Secret) { |
| 193 | + By("should not have DB_URL", func() { |
| 194 | + _, ok := actual.Data["DB_URL"] |
| 195 | + Expect(ok).To(BeFalse()) |
| 196 | + }) |
| 197 | +} |
| 198 | + |
| 199 | +func HasJdbcUrl(actual *core_v1.Secret) { |
| 200 | + By("should have new password in DB_JDBC_URL", func() { |
| 201 | + u, err := url.Parse(string(actual.Data["DB_JDBC_URL"])) |
| 202 | + Expect(err).To(BeNil()) |
| 203 | + Expect(u).To(SatisfyAll( |
| 204 | + EqualUrlNoQuery(newJdbcUrl), |
| 205 | + EqualQuery(newJdbcUrl), |
| 206 | + )) |
| 207 | + }) |
| 208 | +} |
| 209 | + |
| 210 | +func HasNoJdbcUrl(actual *core_v1.Secret) { |
| 211 | + By("should not have DB_JDBC_URL", func() { |
| 212 | + _, ok := actual.Data["DB_JDBC_URL"] |
| 213 | + Expect(ok).To(BeFalse()) |
| 214 | + }) |
| 215 | +} |
0 commit comments