Function TestVaultSource

cert/source_test.go:432–488

(t *testing.T)

}

func TestVaultSource(t *testing.T) {
	const (
		addr      = "127.0.0.1:58421"
		rootToken = "token"
		certPath  = "secret/fabio/cert"
	)

	// start a vault server
	vault, client := vaultServer(t, addr, rootToken)
	defer vault.Process.Kill()

	// create a cert and store it in vault
	certPEM, keyPEM := makePEM("localhost", time.Minute)
	data := map[string]any{"cert": string(certPEM), "key": string(keyPEM)}

	var nilSource *VaultSource // for calling helper methods

	mountPath, v2, err := nilSource.isKVv2(certPath, client)
	if err != nil {
		t.Fatal(err)
	}

	p := certPath + "/localhost"
	if v2 {
		t.Log("Vault: KV backend: V2")
		data = map[string]any{
			"data":    data,
			"options": map[string]any{},
		}
		p = nilSource.addPrefixToVKVPath(p, mountPath, "data")
	} else {
		t.Log("Vault: KV backend: V1")
	}
	if _, err := client.Logical().Write(p, data); err != nil {
		t.Fatalf("logical.Write failed: %s", err)
	}

	pool := makeCertPool(certPEM)
	timeout := 500 * time.Millisecond
	for _, tt := range vaultTestCases {
		t.Run(tt.desc, func(t *testing.T) {
			src := &VaultSource{
				Client: &vaultClient{
					addr:  "http://" + addr,
					token: makeToken(t, client, tt.wrapTTL, tt.req),
				},
				CertPath: certPath,
			}

			// suppress the log warning about a non-renewable token
			// since this is the expected behavior.
			dropNotRenewableWarning = tt.dropWarn
			testSource(t, src, pool, timeout)
			dropNotRenewableWarning = false
		})
	}
}