EnvironmentVariableSecretApplier extends KubernetesSecretApplier<KubernetesEnvironment> { @Override public void applySecret(KubernetesEnvironment env, RuntimeIdentity runtimeIdentity, Secret secret) throws InfrastructureException { boolean secretAutomount = Boolean.parseBoolean(secret.getMetadata().getAnnotations().get(ANNOTATION_AUTOMOUNT)); for (PodData podData : env.getPodsData().values()) { if (!podData.getRole().equals(PodRole.DEPLOYMENT)) { continue; } for (Container container : podData.getSpec().getContainers()) { Optional<ComponentImpl> component = getComponent(env, container.getName()); if (component.isPresent() && isComponentAutomountFalse(component.get())) { continue; } if (!secretAutomount && (!component.isPresent() || !isComponentAutomountTrue(component.get()))) { continue; } for (Entry<String, String> secretDataEntry : secret.getData().entrySet()) { final String mountEnvName = envName(secret, secretDataEntry.getKey(), runtimeIdentity); container .getEnv() .add( new EnvVarBuilder() .withName(mountEnvName) .withValueFrom( new EnvVarSourceBuilder() .withSecretKeyRef( new SecretKeySelectorBuilder() .withName(secret.getMetadata().getName()) .withKey(secretDataEntry.getKey()) .build()) .build()) .build()); } } } }  @Override void applySecret(KubernetesEnvironment env, RuntimeIdentity runtimeIdentity, Secret secret);  }
@Test public void shouldProvisionSingleEnvVariable() throws Exception { Container container_match = new ContainerBuilder().withName("maven").build(); Container container_unmatch = spy(new ContainerBuilder().withName("other").build()); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match, container_unmatch)); Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_ENV_NAME, "MY_FOO", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); secretApplier.applySecret(environment, runtimeIdentity, secret); assertEquals(container_match.getEnv().size(), 1); EnvVar var = container_match.getEnv().get(0); assertEquals(var.getName(), "MY_FOO"); assertEquals(var.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var.getValueFrom().getSecretKeyRef().getKey(), "foo"); }
@Test public void shouldProvisionMultiEnvVariable() throws Exception { Container container_match = new ContainerBuilder().withName("maven").build(); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match)); Secret secret = new SecretBuilder() .withData(ImmutableMap.of("foo", "random", "bar", "freedom")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( String.format(ANNOTATION_ENV_NAME_TEMPLATE, "foo"), "MY_FOO", String.format(ANNOTATION_ENV_NAME_TEMPLATE, "bar"), "MY_BAR", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); secretApplier.applySecret(environment, runtimeIdentity, secret); assertEquals(container_match.getEnv().size(), 2); EnvVar var = container_match.getEnv().get(0); assertEquals(var.getName(), "MY_FOO"); assertEquals(var.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var.getValueFrom().getSecretKeyRef().getKey(), "foo"); EnvVar var2 = container_match.getEnv().get(1); assertEquals(var2.getName(), "MY_BAR"); assertEquals(var2.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var2.getValueFrom().getSecretKeyRef().getKey(), "bar"); }
@Test public void shouldProvisionAllContainersIfAutomountEnabled() throws Exception { Container container_match1 = new ContainerBuilder().withName("maven").build(); Container container_match2 = new ContainerBuilder().withName("other").build(); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match1, container_match2)); Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_ENV_NAME, "MY_FOO", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); secretApplier.applySecret(environment, runtimeIdentity, secret); assertEquals(container_match1.getEnv().size(), 1); EnvVar var = container_match1.getEnv().get(0); assertEquals(var.getName(), "MY_FOO"); assertEquals(var.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var.getValueFrom().getSecretKeyRef().getKey(), "foo"); assertEquals(container_match2.getEnv().size(), 1); EnvVar var2 = container_match2.getEnv().get(0); assertEquals(var2.getName(), "MY_FOO"); assertEquals(var2.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var2.getValueFrom().getSecretKeyRef().getKey(), "foo"); }
@Test public void shouldProvisionContainersWithAutomountOverrideTrue() throws Exception { Container container_match1 = new ContainerBuilder().withName("maven").build(); Container container_match2 = new ContainerBuilder().withName("other").build(); DevfileImpl mock_defvile = mock(DevfileImpl.class); ComponentImpl component = new ComponentImpl(); component.setAlias("maven"); component.setAutomountWorkspaceSecrets(true); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match1, container_match2)); InternalMachineConfig internalMachineConfig = new InternalMachineConfig(); internalMachineConfig.getAttributes().put(DEVFILE_COMPONENT_ALIAS_ATTRIBUTE, "maven"); when(environment.getMachines()).thenReturn(ImmutableMap.of("maven", internalMachineConfig)); when(environment.getDevfile()).thenReturn(mock_defvile); when(mock_defvile.getComponents()).thenReturn(singletonList(component)); Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_ENV_NAME, "MY_FOO", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "false")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); secretApplier.applySecret(environment, runtimeIdentity, secret); assertEquals(container_match1.getEnv().size(), 1); EnvVar var = container_match1.getEnv().get(0); assertEquals(var.getName(), "MY_FOO"); assertEquals(var.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var.getValueFrom().getSecretKeyRef().getKey(), "foo"); assertEquals(container_match2.getEnv().size(), 0); }
@Test public void shouldNotProvisionContainersWithAutomountOverrideFalse() throws Exception { Container container_match1 = new ContainerBuilder().withName("maven").build(); Container container_match2 = new ContainerBuilder().withName("other").build(); DevfileImpl mock_defvile = mock(DevfileImpl.class); ComponentImpl component = new ComponentImpl(); component.setAlias("maven"); component.setAutomountWorkspaceSecrets(false); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match1, container_match2)); InternalMachineConfig internalMachineConfig = new InternalMachineConfig(); internalMachineConfig.getAttributes().put(DEVFILE_COMPONENT_ALIAS_ATTRIBUTE, "maven"); when(environment.getMachines()).thenReturn(ImmutableMap.of("maven", internalMachineConfig)); when(environment.getDevfile()).thenReturn(mock_defvile); when(mock_defvile.getComponents()).thenReturn(singletonList(component)); Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_ENV_NAME, "MY_FOO", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); secretApplier.applySecret(environment, runtimeIdentity, secret); assertEquals(container_match1.getEnv().size(), 0); assertEquals(container_match2.getEnv().size(), 1); EnvVar var2 = container_match2.getEnv().get(0); assertEquals(var2.getName(), "MY_FOO"); assertEquals(var2.getValueFrom().getSecretKeyRef().getName(), "test_secret"); assertEquals(var2.getValueFrom().getSecretKeyRef().getKey(), "foo"); }
@Test public void shouldNotProvisionAllContainersifAutomountDisabled() throws Exception { Container container_match1 = spy(new ContainerBuilder().withName("maven").build()); Container container_match2 = spy(new ContainerBuilder().withName("other").build()); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match1, container_match2)); Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of( ANNOTATION_ENV_NAME, "MY_FOO", ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "false")) .withLabels(emptyMap()) .build()) .build(); secretApplier.applySecret(environment, runtimeIdentity, secret); verify(container_match1).getName(); verify(container_match2).getName(); verifyNoMoreInteractions(container_match1, container_match2); }
@Test( expectedExceptions = InfrastructureException.class, expectedExceptionsMessageRegExp = "Unable to mount secret 'test_secret': It is configured to be mount as a environment variable, but its name was not specified. Please define the 'che.eclipse.org/env-name' annotation on the secret to specify it.") public void shouldThrowExceptionWhenNoEnvNameSpecifiedSingleValue() throws Exception { Container container_match = new ContainerBuilder().withName("maven").build(); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match)); Secret secret = new SecretBuilder() .withData(singletonMap("foo", "random")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of(ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); secretApplier.applySecret(environment, runtimeIdentity, secret); }
@Test( expectedExceptions = InfrastructureException.class, expectedExceptionsMessageRegExp = "Unable to mount key 'foo' of secret 'test_secret': It is configured to be mount as a environment variable, but its name was not specified. Please define the 'che.eclipse.org/foo_env-name' annotation on the secret to specify it.") public void shouldThrowExceptionWhenNoEnvNameSpecifiedMultiValue() throws Exception { Container container_match = new ContainerBuilder().withName("maven").build(); when(podSpec.getContainers()).thenReturn(ImmutableList.of(container_match)); Secret secret = new SecretBuilder() .withData(ImmutableMap.of("foo", "random", "bar", "test")) .withMetadata( new ObjectMetaBuilder() .withName("test_secret") .withAnnotations( ImmutableMap.of(ANNOTATION_MOUNT_AS, "env", ANNOTATION_AUTOMOUNT, "true")) .withLabels(emptyMap()) .build()) .build(); when(secrets.get(any(LabelSelector.class))).thenReturn(singletonList(secret)); secretApplier.applySecret(environment, runtimeIdentity, secret); }