(t *testing.T)
| 1280 | } |
| 1281 | |
| 1282 | func TestSecret(t *testing.T) { |
| 1283 | t.Parallel() |
| 1284 | |
| 1285 | ctx := context.Background() |
| 1286 | cluster := new(v1beta1.PostgresCluster) |
| 1287 | existing := new(corev1.Secret) |
| 1288 | intent := new(corev1.Secret) |
| 1289 | |
| 1290 | root, err := pki.NewRootCertificateAuthority() |
| 1291 | assert.NilError(t, err) |
| 1292 | |
| 1293 | t.Run("NoRepoHost", func(t *testing.T) { |
| 1294 | // We always add the pgbackrest server certs |
| 1295 | assert.NilError(t, Secret(ctx, cluster, nil, root, existing, intent)) |
| 1296 | assert.Assert(t, len(intent.Data["pgbackrest-client.crt"]) > 0) |
| 1297 | assert.Assert(t, len(intent.Data["pgbackrest-client.key"]) > 0) |
| 1298 | assert.Assert(t, len(intent.Data["pgbackrest.ca-roots"]) > 0) |
| 1299 | assert.Assert(t, len(intent.Data["pgbackrest-repo-host.crt"]) == 0) |
| 1300 | assert.Assert(t, len(intent.Data["pgbackrest-repo-host.key"]) == 0) |
| 1301 | }) |
| 1302 | |
| 1303 | host := new(appsv1.StatefulSet) |
| 1304 | host.Namespace = "ns1" |
| 1305 | host.Name = "some-repo" |
| 1306 | host.Spec.ServiceName = "some-domain" |
| 1307 | |
| 1308 | // The existing Secret does not change. |
| 1309 | constant := existing.DeepCopy() |
| 1310 | assert.NilError(t, Secret(ctx, cluster, host, root, existing, intent)) |
| 1311 | assert.DeepEqual(t, constant, existing) |
| 1312 | |
| 1313 | // There is a leaf certificate and private key for the repository host. |
| 1314 | leaf := &pki.LeafCertificate{} |
| 1315 | assert.NilError(t, leaf.Certificate.UnmarshalText(intent.Data["pgbackrest-repo-host.crt"])) |
| 1316 | assert.NilError(t, leaf.PrivateKey.UnmarshalText(intent.Data["pgbackrest-repo-host.key"])) |
| 1317 | |
| 1318 | assert.DeepEqual(t, leaf.Certificate.DNSNames(), []string{ |
| 1319 | leaf.Certificate.CommonName(), |
| 1320 | "some-repo-0.some-domain.ns1.svc", |
| 1321 | "some-repo-0.some-domain.ns1", |
| 1322 | "some-repo-0.some-domain", |
| 1323 | }) |
| 1324 | |
| 1325 | // Assuming the intent is written, no change when called again. |
| 1326 | existing.Data = intent.Data |
| 1327 | before := intent.DeepCopy() |
| 1328 | assert.NilError(t, Secret(ctx, cluster, host, root, existing, intent)) |
| 1329 | assert.DeepEqual(t, before, intent) |
| 1330 | |
| 1331 | t.Run("Rotation", func(t *testing.T) { |
| 1332 | // The leaf certificate is regenerated when the root authority changes. |
| 1333 | root2, err := pki.NewRootCertificateAuthority() |
| 1334 | assert.NilError(t, err) |
| 1335 | assert.NilError(t, Secret(ctx, cluster, host, root2, existing, intent)) |
| 1336 | |
| 1337 | leaf2 := &pki.LeafCertificate{} |
| 1338 | assert.NilError(t, leaf2.Certificate.UnmarshalText(intent.Data["pgbackrest-repo-host.crt"])) |
| 1339 | assert.NilError(t, leaf2.PrivateKey.UnmarshalText(intent.Data["pgbackrest-repo-host.key"])) |
nothing calls this directly
no test coverage detected