feat: add e2e test for docker auth with _json_key

[quixoten]

Overview

@csatib02, i've add the e2e tests from bank-vaults/vault-secrets-webhook#494. however, they're currently failing:

expected: "X2pzb25fa2V5OiB7CiAgInR5cGUiOiAic2VydmljZV9hY2NvdW50IiwKICAicHJvamVjdF9pZCI6ICJ0ZXN0Igp9Cg=="
actual  : "dmF1bHQ6c2VjcmV0L2RhdGEvZG9ja2VycmVwbyNET0NLRVJfUkVQT19KU09OX0tFWQ=="

or

expected: "_json_key: {\n  "type": "service_account",\n  "project_id": "test"\n}"
actual  : "vault:secret/data/dockerrepo#DOCKER_REPO_JSON_KEY"

So it's not currently unwrapping the value. I can look into this more later, but figured you might know immediately what the issue is.

[csatib02]

Thanks for adding this, the reason why the test fails, is because you have to add: secrets-webhook.security.bank-vaults.io/provider: vault to the annotations.

[quixoten]

@csatib02, test is still failing because the unwrapped value from vault is not being base64 encoded:

--- Expected
+++ Actual
@@ -1 +1,5 @@
-X2pzb25fa2V5OiB7CiAgInR5cGUiOiAic2VydmljZV9hY2NvdW50IiwKICAicHJvamVjdF9pZCI6ICJ0ZXN0Igp9Cg==
+_json_key: {
+  "type": "service_account",
+  "project_id": "test"
+}
+

i was looking in the docker source code to try to confirm that they're always treating the value of auth as a base64 encoded string, but didn't find anything definitive.

[csatib02]

Visiting the code I noticed a mistake in the AssembleDockerAuthConfig() function. Encoding of the auth field was always overwritten with the retrieved data, when the authType was a JSON or a single Vault path.

If you change the two functions to the following, then the tests will pass.
(The function signature was also changed in case of the last one here!)

// assembleCredentialData assembles the credential data that will be retrieved from Vault
func AssembleCredentialData(authCreds map[string]string) (map[string]string, error) {
	if username, ok := authCreds["username"]; ok {
		if password, ok := authCreds["password"]; ok {
			return map[string]string{
				"username": username,
				"password": password,
			}, nil
		}
	}

	if auth, ok := authCreds["auth"]; ok {
		return map[string]string{
			"auth": auth,
		}, nil
	}

	return nil, fmt.Errorf("no valid credentials found")
}

// assembleDockerAuthConfig assembles the DockerAuthConfig from the retrieved data from Vault
func AssembleDockerAuthConfig(dcCreds map[string]string) DockerAuthConfig {
	if username, ok := dcCreds["username"]; ok {
		if password, ok := dcCreds["password"]; ok {
			return DockerAuthConfig{
				Username: username,
				Password: password,
				Auth:     base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", username, password))),
			}
		}
	}

	if auth, ok := dcCreds["auth"]; ok {
		return DockerAuthConfig{
			Auth: base64.StdEncoding.EncodeToString([]byte(auth)),
		}
	}

	return DockerAuthConfig{}
}

[csatib02]

LGTM, thank you for working on this! 🚀