-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: handle different vault injection cases #75
fix: handle different vault injection cases #75
Conversation
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
The test scenario in func TestEnvStore_GetProviderPaths(t *testing.T) {
tests := []struct {
name string
envs map[string]string
wantPaths map[string][]string
}{
{
name: "file provider",
envs: map[string]string{
"AWS_SECRET_ACCESS_KEY_ID": "file:FILEPATH",
}
wantPaths: map[string][]string{
"file": {
"FILEPATH"
},
},
},
{
name: "vault provider",
envs: map[string]string{
// Add all the envs from https://github.com/bank-vaults/internal/blob/1d4670005e01baaa08bac7e17d0876d444d3286b/injector/injector_test.go#L92-L101
}
wantPaths: map[string][]string{
"vault": {
// fill expected
},
},
},
{
name: "multi provider",
envs: map[string]string{
"AWS_SECRET_ACCESS_KEY_ID": "file:FILEPATH",
"MYSQL_PASSWORD": "vault:secret/data/test/mysql#MYSQL_PASSWORD",
"AWS_SECRET_ACCESS_KEY: "vault:secret/data/test/aws#AWS_SECRET_ACCESS_KEY",
}
wantPaths: map[string][]string{
"vault": {
// fill expected
},
"file": {
// fill expected
},
},
},
}
for _, tt := range tests {
ttp := tt
t.Run(ttp.name, func(t *testing.T) {
// prepare envs
for envKey, envVal := range ttp.envs {
os.Setenv(envKey, envVal)
t.Cleanup(func() {
os.Unsetenv(envKey)
})
}
paths := NewEnvStore().GetProviderPaths()
for key, expectedSlice := range ttp.wantPaths {
actualSlice, ok := paths[key]
assert.True(t, ok, "Key not found in actual paths")
assert.ElementsMatch(t, expectedSlice, actualSlice, "Slices for key %s do not match", key)
}
})
}
} |
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
great work!
Overview
injector
already utilizes a bunch of things, to detect vault secret references.secret-init
it's sufficient if we use a regex to detectvault:something/something/...
like substrings in the env-values, since it won't mistakevault
like env-values for vault references, and if somehow a non-vault reference would be detected, the injector would just ignore it.Fixes #68