Examples with Secrets org.bf2.cos.fleetshard.support.resources.Secrets used on opensource projects

Example 1 with Secrets

use of org.bf2.cos.fleetshard.support.resources.Secrets in project kas-fleetshard by bf2fc6cc711aee1a0c2a.

the class ImagePullSecretManagerTest method testWithSecrets.

@Test
void testWithSecrets() {
    Deployment deployment = new DeploymentBuilder().withNewMetadata().withName(OperandUtils.FLEETSHARD_OPERATOR_NAME).endMetadata().withNewSpec().withNewTemplate().withNewSpec().withImagePullSecrets(new LocalObjectReferenceBuilder().withName("name").build(), new LocalObjectReferenceBuilder().withName("other").build()).endSpec().endTemplate().endSpec().build();
    client.apps().deployments().inNamespace(client.getNamespace()).create(deployment);
    imagePullSecretManager.initialize();
    ManagedKafka managedKafka = new ManagedKafka();
    managedKafka.setMetadata(new ObjectMetaBuilder().withName("mk").withNamespace("testWithSecrets").build());
    assertEquals(Set.of("mk-pull-name", "mk-pull-other"), imagePullSecretManager.getOperatorImagePullSecrets(managedKafka).stream().map(l -> l.getName()).collect(Collectors.toSet()));
    // no-ops - the secrets aren't yet retrieved
    imagePullSecretManager.propagateSecrets(managedKafka);
    imagePullSecretManager.deleteSecrets(managedKafka);
    imagePullSecretManager.checkSecret();
    client.secrets().inNamespace(client.getNamespace()).create(new SecretBuilder().withNewMetadata().withName("name").endMetadata().build());
    client.secrets().inNamespace(client.getNamespace()).create(new SecretBuilder().withNewMetadata().withName("other").endMetadata().build());
    // should succeed, but there's no ManagedKafkas so nothing happens
    imagePullSecretManager.checkSecret();
    assertTrue(client.secrets().inNamespace("testWithSecrets").list().getItems().isEmpty());
    imagePullSecretManager.propagateSecrets(managedKafka);
    assertEquals(Set.of("mk-pull-name", "mk-pull-other"), client.secrets().inNamespace("testWithSecrets").list().getItems().stream().map(s -> s.getMetadata().getName()).collect(Collectors.toSet()));
}

Example 2 with Secrets

use of org.bf2.cos.fleetshard.support.resources.Secrets in project kas-fleetshard by bf2fc6cc711aee1a0c2a.

the class SuiteUnitTest method setupMockServer.

@BeforeAll
void setupMockServer() throws Exception {
    PodList expectedPodList = new PodListBuilder().withItems(new PodBuilder().withNewMetadata().withName("pod1").withNamespace(TEST_NS).endMetadata().build(), new PodBuilder().withNewMetadata().withName("pod2").withNamespace(TEST_NS).endMetadata().build()).build();
    for (Pod p : expectedPodList.getItems()) {
        mockServer.getClient().pods().inNamespace(TEST_NS).create(p);
    }
    mockServer.getClient().namespaces().createOrReplace(new NamespaceBuilder().withNewMetadata().withName("keycloak").endMetadata().build());
    mockServer.getClient().pods().inNamespace("keycloak").createOrReplace(new PodBuilder().withNewMetadata().withName("keycloak-0").withNamespace("keycloak").endMetadata().build());
    SecurityUtils.TlsConfig tls = SecurityUtils.getTLSConfig("keycloak.svc");
    Secret keycloakCert = new SecretBuilder().withNewMetadata().withName("sso-x509-https-secret").withNamespace("keycloak").endMetadata().withType("kubernetes.io/tls").withData(Map.of("tls.crt", new String(Base64.getEncoder().encode(tls.getCert().getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8), "tls.key", new String(Base64.getEncoder().encode(tls.getKey().getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8))).build();
    mockServer.getClient().secrets().inNamespace("keycloak").createOrReplace(keycloakCert);
    mockServer.getClient().secrets().inNamespace("keycloak").createOrReplace(new SecretBuilder().withNewMetadata().withName("credential-example-keycloak").endMetadata().withData(Map.of("ADMIN_USERNAME", "YWRtaW4=", "ADMIN_PASSWORD", "YWRtaW4=")).build());
}

Example 3 with Secrets

use of org.bf2.cos.fleetshard.support.resources.Secrets in project cos-fleetshard by bf2fc6cc711aee1a0c2a.

the class ConnectorProvisionerTest method updateResources.

@Test
void updateResources() {
    // 
    // Given that the resources associated to the provided deployment exist
    // 
    final ConnectorDeployment oldDeployment = createDeployment(0);
    final List<ManagedConnector> connectors = List.of(new ManagedConnectorBuilder().withMetadata(new ObjectMetaBuilder().withName(Connectors.generateConnectorId(oldDeployment.getId())).addToLabels(LABEL_CLUSTER_ID, CLUSTER_ID).addToLabels(LABEL_CONNECTOR_ID, oldDeployment.getSpec().getConnectorId()).addToLabels(LABEL_DEPLOYMENT_ID, oldDeployment.getId()).build()).build());
    final List<Secret> secrets = List.of(new SecretBuilder().withMetadata(new ObjectMetaBuilder().withName(Secrets.generateConnectorSecretId(oldDeployment.getId())).addToLabels(LABEL_CLUSTER_ID, CLUSTER_ID).addToLabels(LABEL_CONNECTOR_ID, oldDeployment.getSpec().getConnectorId()).addToLabels(LABEL_DEPLOYMENT_ID, oldDeployment.getId()).addToLabels(LABEL_DEPLOYMENT_RESOURCE_VERSION, "" + oldDeployment.getMetadata().getResourceVersion()).build()).build());
    final FleetShardClient fleetShard = ConnectorTestSupport.fleetShard(CLUSTER_ID, connectors, secrets);
    final FleetManagerClient fleetManager = ConnectorTestSupport.fleetManagerClient();
    final FleetShardSyncConfig config = ConnectorTestSupport.config();
    final MeterRegistry registry = Mockito.mock(MeterRegistry.class);
    final ConnectorDeploymentProvisioner provisioner = new ConnectorDeploymentProvisioner(config, fleetShard, fleetManager, registry);
    final ArgumentCaptor<Secret> sc = ArgumentCaptor.forClass(Secret.class);
    final ArgumentCaptor<ManagedConnector> mcc = ArgumentCaptor.forClass(ManagedConnector.class);
    // 
    // When deployment is updated
    // 
    final ConnectorDeployment newDeployment = createDeployment(0, d -> {
        d.getSpec().getKafka().setUrl("my-kafka.acme.com:218");
        ((ObjectNode) d.getSpec().getConnectorSpec()).with("connector").put("foo", "connector-baz");
        ((ObjectNode) d.getSpec().getShardMetadata()).put("connector_image", "quay.io/mcs_dev/aws-s3-sink:0.1.0");
    });
    provisioner.provision(newDeployment);
    verify(fleetShard).createSecret(sc.capture());
    verify(fleetShard).createConnector(mcc.capture());
    // 
    // Then the existing resources must be updated to reflect the changes made to the
    // deployment. This scenario could happen when a resource on the connector cluster
    // is amended outside the control of fleet manager (i.e. with kubectl) and in such
    // case, the expected behavior is that the resource is re-set to the configuration
    // from the fleet manager.
    // 
    assertThat(sc.getValue()).satisfies(val -> {
        assertThat(val.getMetadata().getName()).isEqualTo(Secrets.generateConnectorSecretId(oldDeployment.getId()));
        assertThat(val.getMetadata().getLabels()).containsEntry(LABEL_CLUSTER_ID, CLUSTER_ID).containsEntry(LABEL_CONNECTOR_ID, newDeployment.getSpec().getConnectorId()).containsEntry(LABEL_DEPLOYMENT_ID, newDeployment.getId()).containsEntry(LABEL_DEPLOYMENT_RESOURCE_VERSION, "" + newDeployment.getMetadata().getResourceVersion()).containsKey(LABEL_UOW);
        assertThat(val.getData()).containsKey(Secrets.SECRET_ENTRY_SERVICE_ACCOUNT).containsKey(Secrets.SECRET_ENTRY_CONNECTOR);
        var serviceAccountNode = Secrets.extract(val, Secrets.SECRET_ENTRY_SERVICE_ACCOUNT, ServiceAccount.class);
        assertThat(serviceAccountNode.getClientSecret()).isEqualTo(newDeployment.getSpec().getServiceAccount().getClientSecret());
        assertThat(serviceAccountNode.getClientId()).isEqualTo(newDeployment.getSpec().getServiceAccount().getClientId());
        var connectorNode = Secrets.extract(val, Secrets.SECRET_ENTRY_CONNECTOR);
        assertThatJson(Secrets.extract(val, Secrets.SECRET_ENTRY_CONNECTOR)).inPath("connector.foo").isEqualTo("connector-baz");
        assertThatJson(connectorNode).inPath("kafka.topic").isEqualTo("kafka-foo");
        var metaNode = Secrets.extract(val, Secrets.SECRET_ENTRY_META);
        assertThatJson(metaNode).isObject().containsKey("connector_type").containsKey("connector_image").containsKey("kamelets").containsKey("operators");
    });
    assertThat(mcc.getValue()).satisfies(val -> {
        assertThat(val.getMetadata().getName()).isEqualTo(Connectors.generateConnectorId(oldDeployment.getId()));
        assertThat(val.getMetadata().getLabels()).containsEntry(LABEL_CLUSTER_ID, CLUSTER_ID).containsEntry(LABEL_CONNECTOR_ID, oldDeployment.getSpec().getConnectorId()).containsEntry(LABEL_DEPLOYMENT_ID, oldDeployment.getId()).containsKey(LABEL_UOW);
        assertThat(val.getSpec().getDeployment()).satisfies(d -> {
            assertThat(d.getDeploymentResourceVersion()).isEqualTo(oldDeployment.getMetadata().getResourceVersion());
            assertThat(d.getDeploymentResourceVersion()).isEqualTo(newDeployment.getMetadata().getResourceVersion());
            assertThat(d.getSecret()).isEqualTo(sc.getValue().getMetadata().getName());
            assertThat(d.getUnitOfWork()).isNotEmpty().isEqualTo(sc.getValue().getMetadata().getLabels().get(LABEL_UOW));
            assertThat(d.getKafka().getUrl()).isNotEmpty().isEqualTo(newDeployment.getSpec().getKafka().getUrl());
        });
    });
}

Example 4 with Secrets

use of org.bf2.cos.fleetshard.support.resources.Secrets in project cos-fleetshard by bf2fc6cc711aee1a0c2a.

the class ConnectorProvisionerTest method updateAndCreateResources.

@Test
void updateAndCreateResources() {
    // 
    // Given that the resources associated to the provided deployment exist
    // 
    final ConnectorDeployment oldDeployment = createDeployment(0);
    final List<ManagedConnector> connectors = List.of(new ManagedConnectorBuilder().withMetadata(new ObjectMetaBuilder().withName(Connectors.generateConnectorId(oldDeployment.getId())).addToLabels(LABEL_CLUSTER_ID, CLUSTER_ID).addToLabels(LABEL_CONNECTOR_ID, oldDeployment.getSpec().getConnectorId()).addToLabels(LABEL_DEPLOYMENT_ID, oldDeployment.getId()).build()).build());
    final List<Secret> secrets = List.of(new SecretBuilder().withMetadata(new ObjectMetaBuilder().withName(Secrets.generateConnectorSecretId(oldDeployment.getId())).addToLabels(LABEL_CLUSTER_ID, CLUSTER_ID).addToLabels(LABEL_CONNECTOR_ID, oldDeployment.getSpec().getConnectorId()).addToLabels(LABEL_DEPLOYMENT_ID, oldDeployment.getId()).addToLabels(LABEL_DEPLOYMENT_RESOURCE_VERSION, "" + oldDeployment.getMetadata().getResourceVersion()).build()).build());
    final FleetShardClient fleetShard = ConnectorTestSupport.fleetShard(CLUSTER_ID, connectors, secrets);
    final FleetManagerClient fleetManager = ConnectorTestSupport.fleetManagerClient();
    final FleetShardSyncConfig config = ConnectorTestSupport.config();
    final MeterRegistry registry = Mockito.mock(MeterRegistry.class);
    final ConnectorDeploymentProvisioner provisioner = new ConnectorDeploymentProvisioner(config, fleetShard, fleetManager, registry);
    final ArgumentCaptor<Secret> sc = ArgumentCaptor.forClass(Secret.class);
    final ArgumentCaptor<ManagedConnector> mcc = ArgumentCaptor.forClass(ManagedConnector.class);
    // 
    // When a change to the deployment happen that ends up with a new resource version
    // 
    final ConnectorDeployment newDeployment = createDeployment(1, d -> {
        d.getMetadata().setResourceVersion(1L);
        d.getSpec().getKafka().setUrl("my-kafka.acme.com:218");
        ((ObjectNode) d.getSpec().getConnectorSpec()).with("connector").put("foo", "connector-baz");
        ((ObjectNode) d.getSpec().getShardMetadata()).put("connector_image", "quay.io/mcs_dev/aws-s3-sink:0.1.0");
    });
    provisioner.provision(newDeployment);
    verify(fleetShard).createSecret(sc.capture());
    verify(fleetShard).createConnector(mcc.capture());
    // 
    // Then the managed connector resource is expected to be updated to reflect the
    // changes made to the deployment
    // 
    assertThat(sc.getValue()).satisfies(val -> {
        assertThat(val.getMetadata().getName()).isEqualTo(Secrets.generateConnectorSecretId(oldDeployment.getId()));
        assertThat(val.getMetadata().getLabels()).containsEntry(LABEL_CLUSTER_ID, CLUSTER_ID).containsEntry(LABEL_CONNECTOR_ID, newDeployment.getSpec().getConnectorId()).containsEntry(LABEL_DEPLOYMENT_ID, newDeployment.getId()).containsEntry(LABEL_DEPLOYMENT_RESOURCE_VERSION, "" + newDeployment.getMetadata().getResourceVersion()).containsKey(LABEL_UOW);
        assertThat(val.getData()).containsKey(Secrets.SECRET_ENTRY_SERVICE_ACCOUNT).containsKey(Secrets.SECRET_ENTRY_CONNECTOR);
        var serviceAccountNode = Secrets.extract(val, Secrets.SECRET_ENTRY_SERVICE_ACCOUNT, ServiceAccount.class);
        assertThat(serviceAccountNode.getClientSecret()).isEqualTo(newDeployment.getSpec().getServiceAccount().getClientSecret());
        assertThat(serviceAccountNode.getClientId()).isEqualTo(newDeployment.getSpec().getServiceAccount().getClientId());
        var connectorNode = Secrets.extract(val, Secrets.SECRET_ENTRY_CONNECTOR);
        assertThatJson(Secrets.extract(val, Secrets.SECRET_ENTRY_CONNECTOR)).inPath("connector.foo").isEqualTo("connector-baz");
        assertThatJson(connectorNode).inPath("kafka.topic").isEqualTo("kafka-foo");
        var metaNode = Secrets.extract(val, Secrets.SECRET_ENTRY_META);
        assertThatJson(metaNode).isObject().containsKey("connector_type").containsKey("connector_image").containsKey("kamelets").containsKey("operators");
    });
    assertThat(mcc.getValue()).satisfies(val -> {
        assertThat(val.getMetadata().getName()).isEqualTo(Connectors.generateConnectorId(oldDeployment.getId()));
        assertThat(val.getMetadata().getLabels()).containsEntry(LABEL_CLUSTER_ID, CLUSTER_ID).containsEntry(LABEL_CONNECTOR_ID, oldDeployment.getSpec().getConnectorId()).containsEntry(LABEL_DEPLOYMENT_ID, oldDeployment.getId()).containsKey(LABEL_UOW);
        assertThat(val.getSpec().getDeployment()).satisfies(d -> {
            assertThat(d.getDeploymentResourceVersion()).isEqualTo(newDeployment.getMetadata().getResourceVersion());
            assertThat(d.getDeploymentResourceVersion()).isNotEqualTo(oldDeployment.getMetadata().getResourceVersion());
            assertThat(d.getSecret()).isEqualTo(sc.getValue().getMetadata().getName());
            assertThat(d.getUnitOfWork()).isNotEmpty().isEqualTo(sc.getValue().getMetadata().getLabels().get(LABEL_UOW));
            assertThat(d.getKafka().getUrl()).isNotEmpty().isEqualTo(newDeployment.getSpec().getKafka().getUrl());
        });
    });
}

Example 5 with Secrets

use of org.bf2.cos.fleetshard.support.resources.Secrets in project cos-fleetshard by bf2fc6cc711aee1a0c2a.

the class ConnectorProvisionerTest method createResources.

@Test
void createResources() {
    // 
    // Given that no resources associated to the provided deployment exist
    // 
    final ConnectorDeployment deployment = createDeployment(0);
    final List<ManagedConnector> connectors = List.of();
    final List<Secret> secrets = List.of();
    final FleetShardClient fleetShard = ConnectorTestSupport.fleetShard(CLUSTER_ID, connectors, secrets);
    final FleetManagerClient fleetManager = ConnectorTestSupport.fleetManagerClient();
    final FleetShardSyncConfig config = ConnectorTestSupport.config();
    final MeterRegistry registry = Mockito.mock(MeterRegistry.class);
    final ArgumentCaptor<Secret> sc = ArgumentCaptor.forClass(Secret.class);
    final ArgumentCaptor<ManagedConnector> mcc = ArgumentCaptor.forClass(ManagedConnector.class);
    final ConnectorDeploymentProvisioner provisioner = new ConnectorDeploymentProvisioner(config, fleetShard, fleetManager, registry);
    // 
    // When deployment is applied
    // 
    provisioner.provision(deployment);
    verify(fleetShard).createSecret(sc.capture());
    verify(fleetShard).createConnector(mcc.capture());
    // 
    // Then resources must be created according to the deployment
    // 
    assertThat(sc.getValue()).satisfies(val -> {
        assertThat(val.getMetadata().getName()).isEqualTo(Secrets.generateConnectorSecretId(deployment.getId()));
        assertThat(val.getMetadata().getLabels()).containsEntry(LABEL_CLUSTER_ID, CLUSTER_ID).containsEntry(LABEL_CONNECTOR_ID, deployment.getSpec().getConnectorId()).containsEntry(LABEL_DEPLOYMENT_ID, deployment.getId()).containsEntry(LABEL_DEPLOYMENT_RESOURCE_VERSION, "" + deployment.getMetadata().getResourceVersion()).containsKey(LABEL_UOW);
        assertThat(val.getData()).containsKey(Secrets.SECRET_ENTRY_SERVICE_ACCOUNT).containsKey(Secrets.SECRET_ENTRY_CONNECTOR);
        var serviceAccountNode = Secrets.extract(val, Secrets.SECRET_ENTRY_SERVICE_ACCOUNT, ServiceAccount.class);
        assertThat(serviceAccountNode.getClientSecret()).isEqualTo(deployment.getSpec().getServiceAccount().getClientSecret());
        assertThat(serviceAccountNode.getClientId()).isEqualTo(deployment.getSpec().getServiceAccount().getClientId());
        var connectorNode = Secrets.extract(val, Secrets.SECRET_ENTRY_CONNECTOR);
        assertThatJson(Secrets.extract(val, Secrets.SECRET_ENTRY_CONNECTOR)).inPath("connector.foo").isEqualTo("connector-foo");
        assertThatJson(connectorNode).inPath("kafka.topic").isEqualTo("kafka-foo");
        var metaNode = Secrets.extract(val, Secrets.SECRET_ENTRY_META);
        assertThatJson(metaNode).isObject().containsKey("connector_type").containsKey("connector_image").containsKey("kamelets").containsKey("operators");
    });
    assertThat(mcc.getValue()).satisfies(val -> {
        assertThat(val.getMetadata().getName()).isEqualTo(Connectors.generateConnectorId(deployment.getId()));
        assertThat(val.getMetadata().getLabels()).containsEntry(LABEL_CLUSTER_ID, CLUSTER_ID).containsEntry(LABEL_CONNECTOR_ID, deployment.getSpec().getConnectorId()).containsEntry(LABEL_DEPLOYMENT_ID, deployment.getId()).containsKey(LABEL_UOW);
        assertThat(val.getSpec().getDeployment()).satisfies(d -> {
            assertThat(d.getSecret()).isEqualTo(sc.getValue().getMetadata().getName());
            assertThat(d.getUnitOfWork()).isNotEmpty().isEqualTo(sc.getValue().getMetadata().getLabels().get(LABEL_UOW));
            assertThat(d.getKafka().getUrl()).isNotEmpty().isEqualTo(deployment.getSpec().getKafka().getUrl());
        });
    });
}