From 09ee0b525ca3bc43dbc4e89e82e6f7a53aa96197 Mon Sep 17 00:00:00 2001 From: Stavros kois Date: Wed, 8 Feb 2023 16:49:20 +0200 Subject: [PATCH] add secret vol --- .../tests/pod/volume_secret_test.yaml | 194 ++++++++++++++++++ library/common/1.0.0/docs/persistence.md | 12 ++ .../1.0.0/templates/lib/pod/_volumes.tpl | 1 + .../templates/lib/pod/volumes/_secret.tpl | 57 +++++ 4 files changed, 264 insertions(+) create mode 100644 library/common-test/tests/pod/volume_secret_test.yaml create mode 100644 library/common/1.0.0/templates/lib/pod/volumes/_secret.tpl diff --git a/library/common-test/tests/pod/volume_secret_test.yaml b/library/common-test/tests/pod/volume_secret_test.yaml new file mode 100644 index 0000000000..03541ac4f1 --- /dev/null +++ b/library/common-test/tests/pod/volume_secret_test.yaml @@ -0,0 +1,194 @@ +suite: pod secret volume test +templates: + - common.yaml +tests: + - it: should pass with secret volume + set: + some_object: some-object-name + some_mode: "0777" + workload: + workload-name1: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + secret-vol: + enabled: true + type: secret + objectName: "{{ .Values.some_object }}" + defaultMode: "{{ .Values.some_mode }}" + asserts: + - documentIndex: &deploymentDoc 0 + isKind: + of: Deployment + - documentIndex: *deploymentDoc + contains: + path: spec.template.spec.volumes + content: + name: secret-vol + secret: + secretName: release-name-common-test-some-object-name + defaultMode: 0777 + + - it: should pass with secret volume with items + set: + some_object: some-object-name + some_mode: "0777" + some_key: some-key + some_path: some-path + workload: + workload-name1: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + secret-vol: + enabled: true + type: secret + objectName: "{{ .Values.some_object }}" + defaultMode: "{{ .Values.some_mode }}" + items: + - key: "{{ .Values.some_key }}" + path: "{{ .Values.some_path }}" + - key: some-other-key + path: some-other-path + asserts: + - documentIndex: *deploymentDoc + isKind: + of: Deployment + - documentIndex: *deploymentDoc + contains: + path: spec.template.spec.volumes + content: + name: secret-vol + secret: + secretName: release-name-common-test-some-object-name + defaultMode: 0777 + items: + - key: some-key + path: some-path + - key: some-other-key + path: some-other-path + + - it: should pass with secret volume without expanding object name + set: + some_object: some-object-name + workload: + workload-name1: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + secret-vol: + enabled: true + type: secret + objectName: "{{ .Values.some_object }}" + expandObjectName: false + asserts: + - documentIndex: *deploymentDoc + isKind: + of: Deployment + - documentIndex: *deploymentDoc + contains: + path: spec.template.spec.volumes + content: + name: secret-vol + secret: + secretName: some-object-name + +# Failures + - it: should fail without objectName in secret + set: + workload: + some-workload: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + volume1: + enabled: true + type: secret + objectName: "" + asserts: + - failedTemplate: + errorMessage: Persistence - Expected non-empty on type + + - it: should fail with defaultMode not a string in secret + set: + workload: + some-workload: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + volume1: + enabled: true + type: secret + objectName: some-object-name + defaultMode: 1234 + asserts: + - failedTemplate: + errorMessage: Persistence - Expected to be [string], but got [float64] + + - it: should fail with defaultMode not in format of "0000"-"0777" in secret + set: + workload: + some-workload: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + volume1: + enabled: true + type: secret + objectName: some-object-name + defaultMode: "123" + asserts: + - failedTemplate: + errorMessage: Persistence - Expected to have be in format of ["0777"], but got ["123"] + + - it: should fail without key in items in secret + set: + workload: + some-workload: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + volume1: + enabled: true + type: secret + objectName: some-object-name + items: + - key: "" + path: some-path + asserts: + - failedTemplate: + errorMessage: Persistence - Expected non-empty + + - it: should fail without path in items in secret + set: + workload: + some-workload: + enabled: true + primary: true + type: Deployment + podSpec: {} + persistence: + volume1: + enabled: true + type: secret + objectName: some-object-name + items: + - key: some-key + path: "" + asserts: + - failedTemplate: + errorMessage: Persistence - Expected non-empty diff --git a/library/common/1.0.0/docs/persistence.md b/library/common/1.0.0/docs/persistence.md index 4af8b58455..55ea325db3 100644 --- a/library/common/1.0.0/docs/persistence.md +++ b/library/common/1.0.0/docs/persistence.md @@ -93,4 +93,16 @@ persistence: path: path1 - key: key2 path: path2 + + secret-vol: + enabled: true + type: secret + objectName: secret-name + expandObjecName: false + defaultMode: "0777" + items: + - key: key1 + path: path1 + - key: key2 + path: path2 ``` diff --git a/library/common/1.0.0/templates/lib/pod/_volumes.tpl b/library/common/1.0.0/templates/lib/pod/_volumes.tpl index f13d667c61..b1c6fdcb63 100644 --- a/library/common/1.0.0/templates/lib/pod/_volumes.tpl +++ b/library/common/1.0.0/templates/lib/pod/_volumes.tpl @@ -41,6 +41,7 @@ objectData: The object data to be used to render the Pod. {{- else if eq "ixVolume" $type -}} {{- else if eq "hostPath" $type -}} {{- else if eq "secret" $type -}} + {{- include "ix.v1.common.lib.pod.volume.secret" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} {{- else if eq "configmap" $type -}} {{- include "ix.v1.common.lib.pod.volume.configmap" (dict "rootCtx" $rootCtx "objectData" $persistence) | trim | nindent 0 -}} {{- else if eq "emptyDir" $type -}} diff --git a/library/common/1.0.0/templates/lib/pod/volumes/_secret.tpl b/library/common/1.0.0/templates/lib/pod/volumes/_secret.tpl new file mode 100644 index 0000000000..91386b1284 --- /dev/null +++ b/library/common/1.0.0/templates/lib/pod/volumes/_secret.tpl @@ -0,0 +1,57 @@ +{{/* Returns Secret Volume */}} +{{/* Call this template: +{{ include "ix.v1.common.lib.pod.volume.secret" (dict "rootCtx" $ "objectData" $objectData) }} +rootCtx: The root context of the template. It is used to access the global context. +objectData: The object data to be used to render the volume. +*/}} +{{- define "ix.v1.common.lib.pod.volume.secret" -}} + {{- $rootCtx := .rootCtx -}} + {{- $objectData := .objectData -}} + + {{- $objectName := tpl $objectData.objectName $rootCtx -}} + {{- $expandName := true -}} + {{- if kindIs "bool" $objectData.expandObjectName -}} + {{- $expandName = $objectData.expandObjectName -}} + {{- end -}} + + {{- if $expandName -}} + {{- $objectName = (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $rootCtx) $objectName) -}} + {{- end -}} + + {{- $defMode := "" -}} + + {{- if not $objectData.objectName -}} + {{- fail "Persistence - Expected non-empty on type" -}} + {{- end -}} + + {{- if (and $objectData.defaultMode (not (kindIs "string" $objectData.defaultMode))) -}} + {{- fail (printf "Persistence - Expected to be [string], but got [%s]" (kindOf $objectData.defaultMode)) -}} + {{- end -}} + + {{- with $objectData.defaultMode -}} + {{- $defMode = tpl $objectData.defaultMode $rootCtx -}} + {{- end -}} + + {{- if and $defMode (not (mustRegexMatch "^[0-9]{4}$" $defMode)) -}} + {{- fail (printf "Persistence - Expected to have be in format of [\"0777\"], but got [%q]" $defMode) -}} + {{- end }} +- name: {{ $objectData.shortName }} + secret: + secretName: {{ $objectName }} + {{- with $defMode }} + defaultMode: {{ . }} + {{- end -}} + {{- with $objectData.items }} + items: + {{- range . -}} + {{- if not .key -}} + {{- fail "Persistence - Expected non-empty " -}} + {{- end -}} + {{- if not .path -}} + {{- fail "Persistence - Expected non-empty " -}} + {{- end }} + - key: {{ tpl .key $rootCtx }} + path: {{ tpl .path $rootCtx }} + {{- end -}} + {{- end -}} +{{- end -}}