secrets_provider_test.yaml

# Helm unit test to be used with the 'helm-unittest' Helm plugin.
# Reference: https://github.com/quintush/helm-unittest/blob/master/DOCUMENT.md

suite: test secrets-provider

templates:
  - secrets-provider.yaml

# Default testing values for required chart values
defaults: &defaultRequired
  environment.conjur.account: myConjurAccount
  environment.conjur.applianceUrl: https://conjur.example.com
  environment.conjur.authnLogin: host/conjur/authn-k8s/my-authn-id/my-conjur-policy/my-host-id
  environment.conjur.authnUrl: https://conjur.example.com/authn-k8s/my-authn-id
  environment.conjur.sslCertificate.value: "-----BEGIN CERTIFICATE-----\n
  MIIC/ThisIsAFakeThisIsOnlyAFake==\n
  -----END CERTIFICATE-----\n"
  environment.k8sSecrets: [k8s-secret1,k8s-secret2]

tests:
  #=======================================================================
  - it: succeeds if all required values are provided including Conjur
        connect params
  #=======================================================================
    set:
      # Set required values
      <<: *defaultRequired

    asserts:
      # Confirm that a Secrets Provider Job manifest has been created
      - hasDocuments:
          count: 1
      - isKind:
          of: Job

      # Confirm that required values that were explicitly set have been used
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: CONJUR_ACCOUNT
              value: myConjurAccount
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: CONJUR_APPLIANCE_URL
              value: https://conjur.example.com
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: CONJUR_AUTHN_LOGIN
              value: host/conjur/authn-k8s/my-authn-id/my-conjur-policy/my-host-id
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: CONJUR_AUTHN_URL
              value: https://conjur.example.com/authn-k8s/my-authn-id
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: CONJUR_SSL_CERTIFICATE
              valueFrom:
                  configMapKeyRef:
                      key: ssl-certificate
                      name: cert-config-map
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: K8S_SECRETS
              value: k8s-secret1,k8s-secret2

      # Confirm that default chart values have been used
      - equal:
          path: spec.template.spec.containers[0].image
          value: docker.io/cyberark/secrets-provider-for-k8s:1.6.5
      - equal:
          path: spec.template.spec.containers[0].imagePullPolicy
          value: IfNotPresent
      - equal:
          path: spec.template.spec.containers[0].name
          value: cyberark-secrets-provider-for-k8s

  #=======================================================================
  - it: succeeds if Conjur connect ConfigMap provided instead of Conjur
        connect params
  #=======================================================================
    set:
      # Set required values including Conjur connect ConfigMap
      environment.conjur.authnLogin: host/conjur/authn-k8s/my-authn-id/my-conjur-policy/my-host-id
      environment.conjur.conjurConnConfigMap: conjur-connect
      environment.k8sSecrets: [k8s-secret1,k8s-secret2]

    asserts:
      # Confirm that a Secrets Provider Job manifest has been created
      - hasDocuments:
          count: 1
      - isKind:
          of: Job

      # Confirm that required values that were explicitly set have been used
      - contains:
          path: spec.template.spec.containers[0].envFrom
          content:
              configMapRef:
                  name: conjur-connect
      - contains:
          path: spec.template.spec.containers[0].env
          content:
              name: K8S_SECRETS
              value: k8s-secret1,k8s-secret2

  #=======================================================================
  - it: allows Secrets Provider image spec to be set explicitly
  #=======================================================================
    set:
      # Set required values
      <<: *defaultRequired

      # Explicitly set Secrets Provider image specifications and container name
      secretsProvider.image: my-docker-org/my-docker-image
      secretsProvider.tag: latest
      secretsProvider.imagePullPolicy: Always
      secretsProvider.name: my-container-name

    asserts:
      # Confirm that explicit image settings have been used
      - hasDocuments:
          count: 1
      - equal:
          path: spec.template.spec.containers[0].image
          value: my-docker-org/my-docker-image:latest
      - equal:
          path: spec.template.spec.containers[0].imagePullPolicy
          value: Always
      - equal:
          path: spec.template.spec.containers[0].name
          value: my-container-name

  #=======================================================================
  - it: uses the Helm Release name as a Secrets Provider Job name by default
  #=======================================================================
    set:
      # Set required values
      <<: *defaultRequired

    asserts:
      # Confirm that the Secrets Provider Job name is set to Release name
      - hasDocuments:
          count: 1
      - equal:
          path: metadata.name
          value: RELEASE-NAME

  #=======================================================================
  - it: uses the Secrets Provider Job name chart value if explicitly set
  #=======================================================================
    set:
      # Set required values
      <<: *defaultRequired

      # Explicitly Set the Secrets Provider Job name
      secretsProvider.jobName: my-secrets-provider-job-name

    asserts:
      # Confirm that the Secrets Provider Job name is set to the configured
      # chart value
      - hasDocuments:
          count: 1
      - equal:
          path: metadata.name
          value: my-secrets-provider-job-name

  #=======================================================================
  - it: configures JWT token volume and volume mount if authn-jwt is enabled
  #=======================================================================
    set:
      # Set required values
      <<: *defaultRequired

      # Enable authn-jwt authentication and set projected Filename
      environment.conjur.authnJWT.projectToken: true
      environment.conjur.authnJWT.projectedFilename: my-jwt-token-file

    asserts:
      # Confirm that the JWT token volume and volume mounts have been created
      - hasDocuments:
          count: 1
      - equal:
          path: spec.template.spec.containers[0].env[0].name
          value: JWT_TOKEN_PATH
      - equal:
          path: spec.template.spec.containers[0].env[0].value
          value: /var/run/secrets/tokens/my-jwt-token-file
      - equal:
          path: spec.template.spec.volumes[0].name
          value: jwt-token
      - equal:
          path: spec.template.spec.volumes[0].projected.sources[0].serviceAccountToken.path
          value: my-jwt-token-file
      - equal:
          path: spec.template.spec.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds
          value: 86400
      - equal:
          path: spec.template.spec.volumes[0].projected.sources[0].serviceAccountToken.audience
          value: conjur