10326604998

Committed 09 Aug 2024 10:39PM UTC coverage: 17.603% (+6.7%) from 10.88%

Build # 10326604998

Build Type

Pull #21

github

Committed by

web-flow

Commit Message

Merge 00e2c851d into 92bb21f26

Pull Request Pull Request #21: :white_check_mark:(core): Add more test to test all CLI commands

Run Details

513 of 7101 branches covered (7.22%)

Branch coverage included in aggregate %.

506 of 530 new or added lines in 6 files covered. (95.47%)

417 existing lines in 2 files now uncovered.

1204 of 2653 relevant lines covered (45.38%)

314.55 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

25.43

/src/cli/external_secret_store.rs

/*
 * Copyright (C) 2024 Alexandre Nicolaie (xunleii@users.noreply.github.com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *         http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * ----------------------------------------------------------------------------
**/

use anyhow::{Context, Result};
use clap::Parser;
use futures::executor::block_on;
use http::Uri;
use k8s_openapi::api::core::v1::Secret;
use kube::{api::ObjectMeta, config::KubeConfigOptions, Api, Client};
use kube_custom_resources_rs::external_secrets_io::v1beta1::clustersecretstores::{
    ClusterSecretStore, ClusterSecretStoreProvider, ClusterSecretStoreProviderKubernetes,
    ClusterSecretStoreProviderKubernetesAuth, ClusterSecretStoreProviderKubernetesAuthToken,
    ClusterSecretStoreProviderKubernetesAuthTokenBearerToken,
    ClusterSecretStoreProviderKubernetesServer,
    ClusterSecretStoreProviderKubernetesServerCaProvider,
    ClusterSecretStoreProviderKubernetesServerCaProviderType, ClusterSecretStoreSpec,
};
use kube_custom_resources_rs::external_secrets_io::v1beta1::secretstores::{
    SecretStore, SecretStoreProvider, SecretStoreProviderKubernetes,
    SecretStoreProviderKubernetesAuth, SecretStoreProviderKubernetesAuthToken,
    SecretStoreProviderKubernetesAuthTokenBearerToken, SecretStoreProviderKubernetesServer,
    SecretStoreProviderKubernetesServerCaProvider,
    SecretStoreProviderKubernetesServerCaProviderType, SecretStoreSpec,
};
use std::path::PathBuf;

#[derive(Debug, Parser)]
#[command(about = "Generate Kubernetes manifests required to use an external-secret")]
pub struct Command {
    #[arg(
        help = "Path to the directory where the kubevault configuration is stored",
        long,
        env = "KUBEVAULT_DIR",
        default_value = "vault",
        value_name = "PATH",
        value_hint = clap::ValueHint::DirPath
    )]
    vault_dir: PathBuf,

    #[arg(
        help = "URL of the kubevault's Kubernetes API",
        long,
        value_name = "URL",
        value_hint = clap::ValueHint::Url,
        value_parser = clap::value_parser!(Uri)
    )]
    vault_url: Option<Uri>,

    #[arg(
        help = "The name of Kubernetes context to use",
        long,
        value_name = "CONTEXT",
        value_parser = clap::builder::NonEmptyStringValueParser::new()
    )]
    context: Option<String>,

    #[arg(
        help = "Namespace where the kvstore is installed",
        long,
        short = 'n',
        env = "KUBEVAULT_NAMESPACE",
        default_value = "kubevault-kvstore",
        value_name = "NAMESPACE",
        value_parser = clap::builder::NonEmptyStringValueParser::new()
    )]
    namespace: String,

    #[arg(help = "Create a ClusterSecretStore instead of a SecretStore", long)]
    clustered: bool,

    #[arg(
        help = "The name of the user to generate the manifests for",
        value_name = "NAME",
        value_parser = clap::builder::NonEmptyStringValueParser::new()
    )]
    user: String,
}

impl Command {
    pub fn run(&self, io_out: impl std::io::Write) -> Result<()> {
        block_on(async {
            let config: kube::Config = match self.context.clone() {
                Some(context) => kube::Config::from_kubeconfig(&KubeConfigOptions {
                    context: Some(context.clone()),
                    ..Default::default()
                })
                .await
                .with_context(|| {
                    format!(
                        "Failed to create a Kubernetes client using the Kubernetes context '{}'",
                        context
                    )
                })?,

                None => kube::Config::infer()
                    .await
                    .with_context(|| "Failed to infer configuration from the environment")?,
            };

            let client = Client::try_from(config.clone()).with_context(|| {
                format!(
                    "Failed to create a Kubernetes client using the Kubernetes context '{}'",
                    self.context.as_deref().unwrap()
                )
            })?;

            let vault_url = self.vault_url.clone().unwrap_or(config.cluster_url);
            self.async_run(io_out, client, vault_url).await
        })
    }

    async fn async_run(
        &self,
        mut io_out: impl std::io::Write,
        client: Client,
        vault_url: Uri,
    ) -> Result<()> {
        let secrets: Api<Secret> = Api::namespaced(client, self.namespace.as_str());
        let user_secret = secrets.get(&self.user).await.with_context(|| {
            format!(
                "User '{:?}' does not exist or not deployed in namespace {:?}",
                self.user, self.namespace
            )
        })?;

        if user_secret.type_.as_deref().unwrap_or_default() != "kubernetes.io/service-account-token"
        {
            anyhow::bail!(
                "Secret {:?} is not a service account token secret",
                self.user
            );
        }

        let mut secret = user_secret.clone();
        let secret_name = format!("kubevault-{}", self.user);
        let mut secret_data = secret.data.unwrap_or_default();
        secret_data.remove_entry("namespace");

        secret.type_ = Some("Opaque".to_string());
        secret.metadata = ObjectMeta {
            name: Some(secret_name.clone()),
            ..Default::default()
        };
        secret.data = Some(secret_data);

        let secret_yaml = serde_yaml::to_string(&secret)?;
        writeln!(io_out, "---\n{}", secret_yaml)?;

        let namespace = self.namespace.clone();
        if self.clustered {
            let store = ClusterSecretStore::new(
                vault_url.host().unwrap(),
                ClusterSecretStoreSpec {
                    provider: ClusterSecretStoreProvider {
                        kubernetes: Some(ClusterSecretStoreProviderKubernetes {
                            remote_namespace: Some(namespace),
                            server: Some(ClusterSecretStoreProviderKubernetesServer {
                                url: Some(vault_url.to_string()),
                                ca_provider: Some(ClusterSecretStoreProviderKubernetesServerCaProvider {
                                    r#type: ClusterSecretStoreProviderKubernetesServerCaProviderType::Secret,
                                    name: secret_name.clone(),
                                    namespace: None,
                                    key: Some("ca.crt".to_string()),
                                }),
                                ca_bundle: None,
                            }),
                            auth: ClusterSecretStoreProviderKubernetesAuth {
                                token: Some(ClusterSecretStoreProviderKubernetesAuthToken {
                                    bearer_token: Some(ClusterSecretStoreProviderKubernetesAuthTokenBearerToken {
                                        name: Some(secret_name),
                                        namespace: None,
                                        key: Some("token".to_string()),
                                    }),
                                }),
                                cert: None,
                                service_account: None
                            },
                        }),
                        ..Default::default()
                    },
                    ..Default::default()
                });

            let store_yaml = serde_yaml::to_string(&store)?;
            writeln!(io_out, "---\n{}", store_yaml)?;
        } else {
            let store = SecretStore::new(
                vault_url.host().unwrap(),
                SecretStoreSpec {
                    provider: SecretStoreProvider {
                        kubernetes: Some(SecretStoreProviderKubernetes {
                            remote_namespace: Some(namespace),
                            server: Some(SecretStoreProviderKubernetesServer {
                                url: Some(vault_url.to_string()),
                                ca_provider: Some(SecretStoreProviderKubernetesServerCaProvider {
                                    r#type:
                                        SecretStoreProviderKubernetesServerCaProviderType::Secret,
                                    name: secret_name.clone(),
                                    namespace: None,
                                    key: Some("ca.crt".to_string()),
                                }),
                                ca_bundle: None,
                            }),
                            auth: SecretStoreProviderKubernetesAuth {
                                token: Some(SecretStoreProviderKubernetesAuthToken {
                                    bearer_token: Some(
                                        SecretStoreProviderKubernetesAuthTokenBearerToken {
                                            name: Some(secret_name),
                                            namespace: None,
                                            key: Some("token".to_string()),
                                        },
                                    ),
                                }),
                                cert: None,
                                service_account: None,
                            },
                        }),
                        ..Default::default()
                    },
                    ..Default::default()
                },
            );

            let store_yaml = serde_yaml::to_string(&store)?;
            writeln!(io_out, "---\n{}", store_yaml)?;
        }

        Ok(())
    }
}

#[cfg(test)]
mod test {
    use assert_fs::TempDir;
    use similar_asserts::assert_eq;
    use std::fs;

    #[tokio::test]
    async fn test_external_secret_store_no_kubeconfig() {
        let command = super::Command {
            vault_dir: std::path::PathBuf::from("vault"),
            vault_url: None,
            context: None,
            namespace: "kubevault-kvstore".to_string(),
            clustered: false,
            user: "default".to_string(),
        };

        std::env::remove_var("KUBECONFIG");
        let result = command.run(std::io::sink());
        assert!(result.is_err());
        assert_eq!(
            result.unwrap_err().to_string(),
            "Failed to infer configuration from the environment"
        );
    }

    #[tokio::test]
    async fn test_external_secret_store_with_invalid_context() {
        let temp_dir = TempDir::new().expect("Failed to create temporary directory");
        let kubeconfig_path = temp_dir.path().join("kubeconfig");
        fs::write(
            &kubeconfig_path,
            "---
---
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: ''
    server: https://localhost:6443
  name: default
contexts:
- context:
    cluster: default
    user: admin@default
  name: default
users:
- name: admin@default
  user:
    client-certificate-data: ''
    client-key-data: ''
",
        )
        .expect("Failed to write kubeconfig");
        std::env::set_var("KUBECONFIG", kubeconfig_path.as_os_str());

        let command = super::Command {
            vault_dir: std::path::PathBuf::from("vault"),
            vault_url: None,
            context: Some("invalid".to_string()),
            namespace: "kubevault-kvstore".to_string(),
            clustered: false,
            user: "default".to_string(),
        };

        let result = command.run(std::io::sink());
        assert!(result.is_err());
        assert_eq!(
            result.unwrap_err().to_string(),
            "Failed to create a Kubernetes client using the Kubernetes context 'invalid'"
        );
    }
}

1	/*
2	* Copyright (C) 2024 Alexandre Nicolaie (xunleii@users.noreply.github.com)
3	*
4	* Licensed under the Apache License, Version 2.0 (the "License");
5	* you may not use this file except in compliance with the License.
6	* You may obtain a copy of the License at
7	*
8	* http://www.apache.org/licenses/LICENSE-2.0
9	*
10	* Unless required by applicable law or agreed to in writing, software
11	* distributed under the License is distributed on an "AS IS" BASIS,
12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	* See the License for the specific language governing permissions and
14	* limitations under the License.
15	* ----------------------------------------------------------------------------
16	**/
17
18	use anyhow::{Context, Result};
19	use clap::Parser;
20	use futures::executor::block_on;
21	use http::Uri;
22	use k8s_openapi::api::core::v1::Secret;
23	use kube::{api::ObjectMeta, config::KubeConfigOptions, Api, Client};
24	use kube_custom_resources_rs::external_secrets_io::v1beta1::clustersecretstores::{
25	ClusterSecretStore, ClusterSecretStoreProvider, ClusterSecretStoreProviderKubernetes,
26	ClusterSecretStoreProviderKubernetesAuth, ClusterSecretStoreProviderKubernetesAuthToken,
27	ClusterSecretStoreProviderKubernetesAuthTokenBearerToken,
28	ClusterSecretStoreProviderKubernetesServer,
29	ClusterSecretStoreProviderKubernetesServerCaProvider,
30	ClusterSecretStoreProviderKubernetesServerCaProviderType, ClusterSecretStoreSpec,
31	};
32	use kube_custom_resources_rs::external_secrets_io::v1beta1::secretstores::{
33	SecretStore, SecretStoreProvider, SecretStoreProviderKubernetes,
34	SecretStoreProviderKubernetesAuth, SecretStoreProviderKubernetesAuthToken,
35	SecretStoreProviderKubernetesAuthTokenBearerToken, SecretStoreProviderKubernetesServer,
36	SecretStoreProviderKubernetesServerCaProvider,
37	SecretStoreProviderKubernetesServerCaProviderType, SecretStoreSpec,
38	};
39	use std::path::PathBuf;
40
41	#[derive(Debug, Parser)]	75!
42	#[command(about = "Generate Kubernetes manifests required to use an external-secret")]
43	pub struct Command {
44	#[arg(	10✔
45	help = "Path to the directory where the kubevault configuration is stored",
46	long,
47	env = "KUBEVAULT_DIR",
48	default_value = "vault",
49	value_name = "PATH",
50	value_hint = clap::ValueHint::DirPath	5✔
51	)]
52	vault_dir: PathBuf,	×
53
54	#[arg(	5✔
55	help = "URL of the kubevault's Kubernetes API",
56	long,
57	value_name = "URL",
58	value_hint = clap::ValueHint::Url,	5✔
59	value_parser = clap::value_parser!(Uri)	10✔
60	)]
61	vault_url: Option<Uri>,	×
62
63	#[arg(	5✔
64	help = "The name of Kubernetes context to use",
65	long,
66	value_name = "CONTEXT",
67	value_parser = clap::builder::NonEmptyStringValueParser::new()	10✔
68	)]
69	context: Option<String>,	×
70
71	#[arg(	5✔
72	help = "Namespace where the kvstore is installed",
73	long,
74	short = 'n',
75	env = "KUBEVAULT_NAMESPACE",
76	default_value = "kubevault-kvstore",
77	value_name = "NAMESPACE",
78	value_parser = clap::builder::NonEmptyStringValueParser::new()	10✔
79	)]
80	namespace: String,	×
81
82	#[arg(help = "Create a ClusterSecretStore instead of a SecretStore", long)]	10✔
83	clustered: bool,	×
84
85	#[arg(	10✔
86	help = "The name of the user to generate the manifests for",
87	value_name = "NAME",
88	value_parser = clap::builder::NonEmptyStringValueParser::new()	15✔
89	)]
90	user: String,	×
91	}
92
93	impl Command {
94	pub fn run(&self, io_out: impl std::io::Write) -> Result<()> {	2✔
95	block_on(async {	4!
96	let config: kube::Config = match self.context.clone() {	2!
97	Some(context) => kube::Config::from_kubeconfig(&KubeConfigOptions {	5✔
98	context: Some(context.clone()),	1✔
99	..Default::default()	1✔
100	})
101	.await	2!
102	.with_context(\|\| {	2!
103	format!(	1✔
104	"Failed to create a Kubernetes client using the Kubernetes context '{}'",
105	context
106	)
107	})?,	3✔
108
109	None => kube::Config::infer()	4✔
110	.await	2!
111	.with_context(\|\| "Failed to infer configuration from the environment")?,	2✔
NEW 112	};	×
113
NEW 114	let client = Client::try_from(config.clone()).with_context(\|\| {	×
UNCOV 115	format!(	×
116	"Failed to create a Kubernetes client using the Kubernetes context '{}'",
NEW 117	self.context.as_deref().unwrap()	×
118	)
NEW 119	})?;	×
120
NEW 121	let vault_url = self.vault_url.clone().unwrap_or(config.cluster_url);	×
NEW 122	self.async_run(io_out, client, vault_url).await	×
123	})	2✔
124	}	2✔
125
NEW 126	async fn async_run(	×
NEW 127	&self,	×
NEW 128	mut io_out: impl std::io::Write,	×
NEW 129	client: Client,	×
NEW 130	vault_url: Uri,	×
NEW 131	) -> Result<()> {	×
132	let secrets: Api<Secret> = Api::namespaced(client, self.namespace.as_str());	×
133	let user_secret = secrets.get(&self.user).await.with_context(\|\| {	×
134	format!(	×
135	"User '{:?}' does not exist or not deployed in namespace {:?}",
136	self.user, self.namespace
137	)
138	})?;	×
139
140	if user_secret.type_.as_deref().unwrap_or_default() != "kubernetes.io/service-account-token"	×
141	{
142	anyhow::bail!(	×
143	"Secret {:?} is not a service account token secret",
144	self.user
145	);
146	}
147
148	let mut secret = user_secret.clone();	×
149	let secret_name = format!("kubevault-{}", self.user);	×
150	let mut secret_data = secret.data.unwrap_or_default();	×
151	secret_data.remove_entry("namespace");	×
152
153	secret.type_ = Some("Opaque".to_string());	×
154	secret.metadata = ObjectMeta {	×
155	name: Some(secret_name.clone()),	×
156	..Default::default()	×
157	};	×
158	secret.data = Some(secret_data);	×
159
160	let secret_yaml = serde_yaml::to_string(&secret)?;	×
NEW 161	writeln!(io_out, "---\n{}", secret_yaml)?;	×
162
163	let namespace = self.namespace.clone();	×
164	if self.clustered {	×
165	let store = ClusterSecretStore::new(	×
166	vault_url.host().unwrap(),	×
167	ClusterSecretStoreSpec {	×
168	provider: ClusterSecretStoreProvider {	×
169	kubernetes: Some(ClusterSecretStoreProviderKubernetes {	×
170	remote_namespace: Some(namespace),	×
171	server: Some(ClusterSecretStoreProviderKubernetesServer {	×
172	url: Some(vault_url.to_string()),	×
173	ca_provider: Some(ClusterSecretStoreProviderKubernetesServerCaProvider {	×
174	r#type: ClusterSecretStoreProviderKubernetesServerCaProviderType::Secret,	×
175	name: secret_name.clone(),	×
176	namespace: None,	×
177	key: Some("ca.crt".to_string()),	×
178	}),
179	ca_bundle: None,	×
180	}),
181	auth: ClusterSecretStoreProviderKubernetesAuth {	×
182	token: Some(ClusterSecretStoreProviderKubernetesAuthToken {	×
183	bearer_token: Some(ClusterSecretStoreProviderKubernetesAuthTokenBearerToken {	×
184	name: Some(secret_name),	×
185	namespace: None,	×
186	key: Some("token".to_string()),	×
187	}),
188	}),
189	cert: None,	×
190	service_account: None	×
191	},
192	}),
193	..Default::default()	×
194	},
195	..Default::default()	×
196	});	×
197
198	let store_yaml = serde_yaml::to_string(&store)?;	×
NEW 199	writeln!(io_out, "---\n{}", store_yaml)?;	×
200	} else {	×
201	let store = SecretStore::new(	×
202	vault_url.host().unwrap(),	×
203	SecretStoreSpec {	×
204	provider: SecretStoreProvider {	×
205	kubernetes: Some(SecretStoreProviderKubernetes {	×
206	remote_namespace: Some(namespace),	×
207	server: Some(SecretStoreProviderKubernetesServer {	×
208	url: Some(vault_url.to_string()),	×
209	ca_provider: Some(SecretStoreProviderKubernetesServerCaProvider {	×
210	r#type:
211	SecretStoreProviderKubernetesServerCaProviderType::Secret,	×
212	name: secret_name.clone(),	×
213	namespace: None,	×
214	key: Some("ca.crt".to_string()),	×
215	}),
216	ca_bundle: None,	×
217	}),
218	auth: SecretStoreProviderKubernetesAuth {	×
219	token: Some(SecretStoreProviderKubernetesAuthToken {	×
220	bearer_token: Some(	×
221	SecretStoreProviderKubernetesAuthTokenBearerToken {	×
222	name: Some(secret_name),	×
223	namespace: None,	×
224	key: Some("token".to_string()),	×
225	},
226	),
227	}),
228	cert: None,	×
229	service_account: None,	×
230	},
231	}),
232	..Default::default()	×
233	},
234	..Default::default()	×
235	},
236	);	×
237
238	let store_yaml = serde_yaml::to_string(&store)?;	×
NEW 239	writeln!(io_out, "---\n{}", store_yaml)?;	×
240	}	×
241
242	Ok(())	×
243	}	×
244	}
245
246	#[cfg(test)]
247	mod test {
248	use assert_fs::TempDir;
249	use similar_asserts::assert_eq;
250	use std::fs;
251
252	#[tokio::test]	4!
253	async fn test_external_secret_store_no_kubeconfig() {	2✔
254	let command = super::Command {	1✔
255	vault_dir: std::path::PathBuf::from("vault"),	1✔
256	vault_url: None,	1✔
257	context: None,	1✔
258	namespace: "kubevault-kvstore".to_string(),	1✔
259	clustered: false,
260	user: "default".to_string(),	1✔
261	};
262
263	std::env::remove_var("KUBECONFIG");	1✔
264	let result = command.run(std::io::sink());	1✔
265	assert!(result.is_err());	1!
266	assert_eq!(	2✔
267	result.unwrap_err().to_string(),	1!
268	"Failed to infer configuration from the environment"
269	);	1✔
270	}	3✔
271
272	#[tokio::test]	4!
273	async fn test_external_secret_store_with_invalid_context() {	2✔
274	let temp_dir = TempDir::new().expect("Failed to create temporary directory");	1✔
275	let kubeconfig_path = temp_dir.path().join("kubeconfig");	1✔
276	fs::write(	1✔
277	&kubeconfig_path,
278	"---
279	---
280	apiVersion: v1
281	kind: Config
282	clusters:
283	- cluster:
284	certificate-authority-data: ''
285	server: https://localhost:6443
286	name: default
287	contexts:
288	- context:
289	cluster: default
290	user: admin@default
291	name: default
292	users:
293	- name: admin@default
294	user:
295	client-certificate-data: ''
296	client-key-data: ''
297	",
298	)
299	.expect("Failed to write kubeconfig");
300	std::env::set_var("KUBECONFIG", kubeconfig_path.as_os_str());	1✔
301
302	let command = super::Command {	1✔
303	vault_dir: std::path::PathBuf::from("vault"),	1✔
304	vault_url: None,	1✔
305	context: Some("invalid".to_string()),	1✔
306	namespace: "kubevault-kvstore".to_string(),	1✔
307	clustered: false,
308	user: "default".to_string(),	1✔
309	};
310
311	let result = command.run(std::io::sink());	1✔
312	assert!(result.is_err());	1!
313	assert_eq!(	2✔
314	result.unwrap_err().to_string(),	1!
315	"Failed to create a Kubernetes client using the Kubernetes context 'invalid'"
316	);	1✔
317	}	3✔
318	}

chezmoi-sh / kubevault / 10326604998

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous