| 19 | |
| 20 | |
| 21 | def test_secrets(mz: MaterializeApplication) -> None: |
| 22 | mz.testdrive.run(input=dedent(""" |
| 23 | > CREATE SECRET username AS '123'; |
| 24 | > CREATE SECRET password AS '234'; |
| 25 | |
| 26 | # Our Redpanda instance is not configured for SASL, so we can not |
| 27 | # really establish a successful connection. |
| 28 | ! CREATE CONNECTION secrets_conn TO KAFKA ( |
| 29 | BROKER '${testdrive.kafka-addr}', |
| 30 | SASL MECHANISMS 'PLAIN', |
| 31 | SASL USERNAME = SECRET username, |
| 32 | SASL PASSWORD = SECRET password |
| 33 | ); |
| 34 | contains:Broker does not support SSL connections |
| 35 | """)) |
| 36 | |
| 37 | id = mz.environmentd.sql_query("SELECT id FROM mz_secrets WHERE name = 'username'")[ |
| 38 | 0 |
| 39 | ][0] |
| 40 | assert id is not None |
| 41 | |
| 42 | secret = f"user-managed-{id}" |
| 43 | |
| 44 | # wait(condition="condition=Ready", resource=f"secret/{secret}") |
| 45 | |
| 46 | describe = mz.kubectl("describe", "secret", secret) |
| 47 | assert "contents: 3 bytes" in describe |
| 48 | |
| 49 | mz.environmentd.sql("ALTER SECRET username AS '1234567890'") |
| 50 | |
| 51 | describe = mz.kubectl("describe", "secret", secret) |
| 52 | assert "contents: 10 bytes" in describe |
| 53 | |
| 54 | mz.environmentd.sql("DROP SECRET username CASCADE") |
| 55 | |
| 56 | wait(condition="delete", resource=f"secret/{secret}") |
| 57 | |
| 58 | |
| 59 | # Tests that secrets deleted from the catalog but not from k8s are cleaned up on |