SecretAsContainerResourceProvisioner { public void provision(E env, RuntimeIdentity runtimeIdentity, KubernetesNamespace namespace) throws InfrastructureException { LabelSelector selector = new LabelSelectorBuilder().withMatchLabels(secretLabels).build(); for (Secret secret : namespace.secrets().get(selector)) { if (secret.getMetadata().getAnnotations() == null) { throw new InfrastructureException( format( "Unable to mount secret '%s': it has missing required annotations. Please check documentation for secret format guide.", secret.getMetadata().getName())); } String mountType = secret.getMetadata().getAnnotations().get(ANNOTATION_MOUNT_AS); if ("env".equalsIgnoreCase(mountType)) { environmentVariableSecretApplier.applySecret(env, runtimeIdentity, secret); } else if ("file".equalsIgnoreCase(mountType)) { if (parseBoolean(secret.getMetadata().getAnnotations().get(ANNOTATION_GIT_CREDENTIALS))) { gitCredentialStorageFileSecretApplier.applySecret(env, runtimeIdentity, secret); } else { fileSecretApplier.applySecret(env, runtimeIdentity, secret); } } else { throw new InfrastructureException( format( "Unable to mount secret '%s': it has missing or unknown type of the mount. Please make sure that '%s' annotation has value either 'env' or 'file'.", secret.getMetadata().getName(), ANNOTATION_MOUNT_AS)); } } } @Inject  SecretAsContainerResourceProvisioner(
      FileSecretApplier fileSecretApplier,
      EnvironmentVariableSecretApplier environmentVariableSecretApplier,
      GitCredentialStorageFileSecretApplier gitCredentialStorageFileSecretApplier,
      @Named("che.workspace.provision.secret.labels") String[] labels); void provision(E env, RuntimeIdentity runtimeIdentity, KubernetesNamespace namespace);  }
@Test( expectedExceptions = InfrastructureException.class, expectedExceptionsMessageRegExp = "Unable to mount secret 'test_secret': it has missing or unknown type of the mount. Please make sure that 'che.eclipse.org/mount-as' annotation has value either 'env' or 'file'.") public void shouldThrowExceptionWhenNoMountTypeSpecified() throws Exception { Secret secret = new SecretBuilder() .withData(ImmutableMap.of("settings.xml", "random", "another.xml", "freedom")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations(emptyMap()) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); provisioner.provision(environment, runtimeIdentity, namespace); }
@Test public void shouldCallEnvironmentVariableSecretApplier() throws InfrastructureException { Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_ENV_NAME, "MY_FOO", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); provisioner.provision(environment, runtimeIdentity, namespace); verify(environmentVariableSecretApplier) .applySecret(eq(environment), eq(runtimeIdentity), eq(secret)); verifyZeroInteractions(fileSecretApplier); verifyZeroInteractions(gitCredentialStorageFileSecretApplier); }
@Test public void shouldCallFileSecretApplier() throws InfrastructureException { Secret secret = new SecretBuilder() .withData(ImmutableMap.of("settings.xml", "random", "another.xml", "freedom")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_MOUNT_AS, "file", ANNOTATION_MOUNT_PATH, "/home/user/.m2", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); provisioner.provision(environment, runtimeIdentity, namespace); verify(fileSecretApplier).applySecret(eq(environment), eq(runtimeIdentity), eq(secret)); verifyZeroInteractions(environmentVariableSecretApplier); verifyZeroInteractions(gitCredentialStorageFileSecretApplier); }
@Test public void shouldCallGitCredentialStorageFileSecretApplier() throws InfrastructureException { Secret secret = new SecretBuilder() .withData(ImmutableMap.of("credentials", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_MOUNT_AS, "file", ANNOTATION_MOUNT_PATH, "/home/user/.git", GitCredentialStorageFileSecretApplier.ANNOTATION_GIT_CREDENTIALS, "true", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); provisioner.provision(environment, runtimeIdentity, namespace); verify(gitCredentialStorageFileSecretApplier) .applySecret(eq(environment), eq(runtimeIdentity), eq(secret)); verifyZeroInteractions(environmentVariableSecretApplier); verifyZeroInteractions(fileSecretApplier); }