Skip to content

Commit 7e3a025

Browse files
deepakraj1997deepakraj1997
authored
Exit loop if none of the secret file pattern matches (#460)
* Exit loop if none of the secret file pattern matches * Adding test cases for profile matching * Add awsSecretDataWithMissingProfile
1 parent cd82f65 commit 7e3a025

File tree

2 files changed

+132
-22
lines changed

2 files changed

+132
-22
lines changed

‎controllers/registry.go

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -547,13 +547,13 @@ func (r *VeleroReconciler) parseAWSSecret(secret corev1.Secret, secretKey string
547547
continue
548548
}
549549
matchedAccessKey := awsAccessKeyRegex.MatchString(profLine)
550+
matchedSecretKey := awsSecretKeyRegex.MatchString(profLine)
550551

551552
if err != nil {
552553
r.Log.Info("Error finding access key id for the supplied AWS credential")
553554
return AWSAccessKey, AWSSecretKey, err
554555
}
555-
// check for access key
556-
if matchedAccessKey {
556+
if matchedAccessKey { // check for access key
557557
cleanedLine := strings.ReplaceAll(profLine, " ", "")
558558
splitLine := strings.Split(cleanedLine, "=")
559559
if len(splitLine) != 2 {
@@ -562,12 +562,7 @@ func (r *VeleroReconciler) parseAWSSecret(secret corev1.Secret, secretKey string
562562
}
563563
AWSAccessKey = splitLine[1]
564564
continue
565-
}
566-
567-
// check for secret key
568-
matchedSecretKey := awsSecretKeyRegex.MatchString(profLine)
569-
570-
if matchedSecretKey {
565+
} else if matchedSecretKey { // check for secret key
571566
cleanedLine := strings.ReplaceAll(profLine, " ", "")
572567
splitLine := strings.Split(cleanedLine, "=")
573568
if len(splitLine) != 2 {
@@ -576,6 +571,8 @@ func (r *VeleroReconciler) parseAWSSecret(secret corev1.Secret, secretKey string
576571
}
577572
AWSSecretKey = splitLine[1]
578573
continue
574+
} else {
575+
break // aws credentials file is only allowed to have profile followed by aws_access_key_id, aws_secret_access_key
579576
}
580577
}
581578
}

‎controllers/registry_test.go

Lines changed: 127 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -49,21 +49,38 @@ func getFakeClientFromObjectsForRegistry(objs ...client.Object) (client.WithWatc
4949
}
5050

5151
const (
52-
testProfile = "someProfile"
53-
testAccessKey = "someAccessKey"
54-
testSecretAccessKey = "someSecretAccessKey"
55-
testStoragekey = "someStorageKey"
56-
testCloudName = "someCloudName"
52+
testProfile = "someProfile"
53+
testAccessKey = "someAccessKey"
54+
testSecretAccessKey = "someSecretAccessKey"
55+
testStoragekey = "someStorageKey"
56+
testCloudName = "someCloudName"
57+
testBslProfile = "bslProfile"
58+
testBslAccessKey = "bslAccessKey"
59+
testBslSecretAccessKey = "bslSecretAccessKey"
5760
)
5861

5962
var (
6063
secretData = map[string][]byte{
61-
"cloud": []byte("[default]" + "\n" +
62-
"aws_access_key_id=" + testAccessKey + "\n" +
63-
"aws_secret_access_key=" + testSecretAccessKey +
64-
"\n[test-profile]\n" +
65-
"aws_access_key_id=" + testAccessKey + "\n" +
66-
"aws_secret_access_key=" + testSecretAccessKey,
64+
"cloud": []byte(
65+
"\n[" + testBslProfile + "]\n" +
66+
"aws_access_key_id=" + testBslAccessKey + "\n" +
67+
"aws_secret_access_key=" + testBslSecretAccessKey +
68+
"\n[default]" + "\n" +
69+
"aws_access_key_id=" + testAccessKey + "\n" +
70+
"aws_secret_access_key=" + testSecretAccessKey +
71+
"\n[test-profile]\n" +
72+
"aws_access_key_id=" + testAccessKey + "\n" +
73+
"aws_secret_access_key=" + testSecretAccessKey,
74+
),
75+
}
76+
awsSecretDataWithMissingProfile = map[string][]byte{
77+
"cloud": []byte(
78+
"[default]" + "\n" +
79+
"aws_access_key_id=" + testAccessKey + "\n" +
80+
"aws_secret_access_key=" + testSecretAccessKey +
81+
"\n[test-profile]\n" +
82+
"aws_access_key_id=" + testAccessKey + "\n" +
83+
"aws_secret_access_key=" + testSecretAccessKey,
6784
),
6885
}
6986
secretAzureData = map[string][]byte{
@@ -487,6 +504,7 @@ func TestVeleroReconciler_getAWSRegistryEnvVars(t *testing.T) {
487504
wantProfile string
488505
secret *corev1.Secret
489506
wantErr bool
507+
matchProfile bool
490508
}{
491509
{
492510
name: "given aws bsl, appropriate env var for the container are returned",
@@ -517,7 +535,70 @@ func TestVeleroReconciler_getAWSRegistryEnvVars(t *testing.T) {
517535
},
518536
Data: secretData,
519537
},
520-
wantProfile: "test-profile",
538+
wantProfile: "test-profile",
539+
matchProfile: true,
540+
}, {
541+
name: "given aws profile in bsl, appropriate env var for the container are returned",
542+
bsl: &velerov1.BackupStorageLocation{
543+
ObjectMeta: metav1.ObjectMeta{
544+
Name: "test-bsl",
545+
Namespace: "test-ns",
546+
},
547+
Spec: velerov1.BackupStorageLocationSpec{
548+
Provider: AWSProvider,
549+
StorageType: velerov1.StorageType{
550+
ObjectStorage: &velerov1.ObjectStorageLocation{
551+
Bucket: "aws-bucket",
552+
},
553+
},
554+
Config: map[string]string{
555+
Region: "aws-region",
556+
S3URL: "https://sr-url-aws-domain.com",
557+
InsecureSkipTLSVerify: "false",
558+
Profile: testBslProfile,
559+
},
560+
},
561+
},
562+
secret: &corev1.Secret{
563+
ObjectMeta: metav1.ObjectMeta{
564+
Name: "cloud-credentials",
565+
Namespace: "test-ns",
566+
},
567+
Data: secretData,
568+
},
569+
wantProfile: testBslProfile,
570+
matchProfile: true,
571+
}, {
572+
name: "given missing aws profile in bsl, env var should not match",
573+
bsl: &velerov1.BackupStorageLocation{
574+
ObjectMeta: metav1.ObjectMeta{
575+
Name: "test-bsl",
576+
Namespace: "test-ns",
577+
},
578+
Spec: velerov1.BackupStorageLocationSpec{
579+
Provider: AWSProvider,
580+
StorageType: velerov1.StorageType{
581+
ObjectStorage: &velerov1.ObjectStorageLocation{
582+
Bucket: "aws-bucket",
583+
},
584+
},
585+
Config: map[string]string{
586+
Region: "aws-region",
587+
S3URL: "https://sr-url-aws-domain.com",
588+
InsecureSkipTLSVerify: "false",
589+
Profile: testBslProfile,
590+
},
591+
},
592+
},
593+
secret: &corev1.Secret{
594+
ObjectMeta: metav1.ObjectMeta{
595+
Name: "cloud-credentials",
596+
Namespace: "test-ns",
597+
},
598+
Data: awsSecretDataWithMissingProfile,
599+
},
600+
wantProfile: testBslProfile,
601+
matchProfile: false,
521602
},
522603
}
523604
for _, tt := range tests {
@@ -567,15 +648,47 @@ func TestVeleroReconciler_getAWSRegistryEnvVars(t *testing.T) {
567648
Value: "false",
568649
},
569650
}
651+
if tt.wantProfile == testBslProfile {
652+
tt.wantRegistryContainerEnvVar = []corev1.EnvVar{
653+
{
654+
Name: RegistryStorageEnvVarKey,
655+
Value: S3,
656+
},
657+
{
658+
Name: RegistryStorageS3AccesskeyEnvVarKey,
659+
Value: testBslAccessKey,
660+
},
661+
{
662+
Name: RegistryStorageS3BucketEnvVarKey,
663+
Value: "aws-bucket",
664+
},
665+
{
666+
Name: RegistryStorageS3RegionEnvVarKey,
667+
Value: "aws-region",
668+
},
669+
{
670+
Name: RegistryStorageS3SecretkeyEnvVarKey,
671+
Value: testBslSecretAccessKey,
672+
},
673+
{
674+
Name: RegistryStorageS3RegionendpointEnvVarKey,
675+
Value: "https://sr-url-aws-domain.com",
676+
},
677+
{
678+
Name: RegistryStorageS3SkipverifyEnvVarKey,
679+
Value: "false",
680+
},
681+
}
682+
}
570683

571684
gotRegistryContainerEnvVar, gotErr := r.getAWSRegistryEnvVars(tt.bsl, testAWSEnvVar)
572685

573-
if (gotErr != nil) != tt.wantErr {
686+
if tt.matchProfile && (gotErr != nil) != tt.wantErr {
574687
t.Errorf("ValidateBackupStorageLocations() gotErr = %v, wantErr %v", gotErr, tt.wantErr)
575688
return
576689
}
577690

578-
if !reflect.DeepEqual(tt.wantRegistryContainerEnvVar, gotRegistryContainerEnvVar) {
691+
if tt.matchProfile && !reflect.DeepEqual(tt.wantRegistryContainerEnvVar, gotRegistryContainerEnvVar) {
579692
t.Errorf("expected registry container env var to be %#v, got %#v", tt.wantRegistryContainerEnvVar, gotRegistryContainerEnvVar)
580693
}
581694
})

0 commit comments

Comments
 (0)