Allow P2F custom templates via ConfigMap #393
Conversation
![codeclimate[bot]](https://avatars.githubusercontent.com/in/9403?s=60&v=4){kind=small}
john-odonnell
force-pushed
the
ONYX-14093
branch
from
8bb9ec0 to
cf9572a
Compare
john-odonnell
force-pushed
the
ONYX-14093
branch
2 times, most recently
from
19a36d8 to
727bc0d
Compare
| @@ -297,16 +323,25 @@ func NewSecretGroups(secretsBasePath string, annotations map[string]string) ([]* | |||
| return sgs, nil | |||
| } | |||
|
|
|||
| func newSecretGroup(groupName string, secretsBasePath string, annotations map[string]string) (*SecretGroup, []error) { | |||
| func newSecretGroup(groupName string, annotations map[string]string, c Config) (*SecretGroup, []error) { | |||
There was a problem hiding this comment.
Function newSecretGroup has 5 return statements (exceeds 4 allowed).
| if err != nil { | ||
| return nil, []error{err} | ||
| } | ||
|
|
||
| return sg, nil | ||
| } | ||
|
|
||
| func collectTemplate(groupName string, annotations map[string]string, c Config) (string, error) { |
There was a problem hiding this comment.
Function collectTemplate has 5 return statements (exceeds 4 allowed).
john-odonnell
force-pushed
the
ONYX-14093
branch
from
727bc0d to
be5cf8f
Compare
john-odonnell
changed the title
john-odonnell
force-pushed
the
ONYX-14093
branch
from
be5cf8f to
6004b58
Compare
| }) | ||
| }) | ||
|
|
||
| t.Run("custom template file - annotation and configmap template provided", func(t *testing.T) { |
There was a problem hiding this comment.
I see this UT test case for custom template being provided by both annotation and configmap.
Is there a corresponding UT test case for secret file format being template, but no custom template defined by either annotation or configmap?
There was a problem hiding this comment.
Just added a test case for the above context.
john-odonnell
force-pushed
the
ONYX-14093
branch
from
cd98d60 to
4d0dcf8
Compare
|
Code Climate has analyzed commit 4d0dcf8 and detected 2 issues on this pull request. Here's the issue category breakdown:
The test coverage on the diff in this pull request is 94.2% (50% is the threshold). This pull request will bring the total coverage in the repository to 92.9% (0.1% change). View more on Code Climate. |
Desired Outcome
From ONYX-14093:
Implemented Changes
Behavioral Changes
If a secret group's output file format, specified with the annotation
conjur.org/secret-file-format.{secret-group}, is set totemplate, then the functionnewSecretGroupwill look for either an annotation- or ConfigMap-based template string.The ConfigMap defining templates must be mounted to
/conjur/templates, and the key for a given template value must be{secret-group}.tpl. At secret group creation, Secrets Provider will only attempt to read from this file. If the file does not exist, it is assumed that a template was not provided via ConfigMap.If the annotation
conjur.org/secret-file-format.{secret-group}is set totemplate, and templates are provided through BOTH the group's annotation and volume-mounted ConfigMap, secret group creation will receive a failing error.If the annotation
conjur.org/secret-file-format.{secret-group}is not set totemplate, Secrets Provider will never look for a template in either form. If a template is provided by either/both method(s), it will be ignored.Explicit Changes
templatetoconjur.org/secret-file-format.{secret-group}accepted valuespkg/secrets/pushtofile/pull_from_reader.go, a counterpart topush_to_writer.go, to mock and dependency-inject reading content from the filesystem.secret_group.go:func NewSecretGroupsinto itself andfunc newSecretGroupsWithDepsto dep-inject file reading operationscollectTemplateandreadTemplateFromFilePUSH_TO_FILE.mdupdatesConnected Issue/Story
Resolves #[relevant GitHub issue(s), e.g. 76]
CyberArk internal issue link: ONYX-14903
Definition of Done
At least 1 todo must be completed in the sections below for the PR to be
merged.
Changelog
CHANGELOG update
Test coverage
changes, or
Documentation
READMEs) were updated in this PRBehavior
Security