-
Notifications
You must be signed in to change notification settings - Fork 210
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[super-agent-deployment]: add authSecret configuration and validation (…
…#1393) <!-- Thank you for contributing to New Relic's Helm charts. Before you submit this PR we'd like to make sure you are aware of our technical requirements: * https://github.com/newrelic-experimental/helm-charts/blob/master/CONTRIBUTING.md#technical-requirements For a quick overview across what we will look at reviewing your PR, please read our review guidelines: * https://github.com/newrelic-experimental/helm-charts/blob/master/REVIEW_GUIDELINES.md Following our best practices right from the start will accelerate the review process and help get your PR merged quicker. When updates to your PR are requested, please add new commits and do not squash the history. This will make it easier to identify new changes. The PR will be squashed anyways when it is merged. Thanks. For fast feedback, please @-mention maintainers that are listed in the Chart.yaml file. Please make sure you test your changes before you push them. Once pushed, a Github Action will run across your changes and do some initial checks and linting. These checks run very quickly. Please check the results. We would like these checks to pass before we even continue reviewing your changes. --> #### Is this a new chart no #### What this PR does / why we need it: This PR introduces a new configuration option for managing authentication secrets within the Helm chart: 1. **authSecret Configuration**: Added to the values.yaml, allowing users to specify and create an authentication secret. 2. **Helper Function**: Ensures auth_key is provided when authSecret.create is true, preventing misconfigurations. 3. **Deployment Template Updates**: Includes the new authSecret in the deployment, ensuring it is correctly mounted. 4. **Helm Unittest**: Added test cases to validate the correct creation, mounting, and error handling of authSecret. Please review the changes and let me know if any adjustments are needed #### Which issue this PR fixes *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)* - fixes # #### Special notes for your reviewer: #### Checklist [Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.] - [x] Chart Version bumped - [x] Variables are documented in the README.md - [x] Title of the PR starts with chart name (e.g. `[mychartname]`)
- Loading branch information
Showing
8 changed files
with
200 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| {{- if eq (include "newrelic-super-agent.shouldCreateAuthSecret" .) "true" }} | ||
| {{- include "newrelic-super-agent.authSecret.validateData" . }} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: {{ .Values.authSecret.name | default (include "newrelic.common.naming.fullname" .) }} | ||
| type: Opaque | ||
| data: | ||
| auth_key: {{ .Values.authSecret.data.auth_key | b64enc }} | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
128 changes: 128 additions & 0 deletions
128
charts/super-agent-deployment/tests/auth_secret_test.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| suite: test super agent deployment's authSecret configurations | ||
| templates: | ||
| - templates/auth-secret.yaml | ||
| - templates/configmap-superagent-config.yaml | ||
| - templates/configmap-subagent-configs.yaml | ||
| - templates/deployment-superagent.yaml | ||
| release: | ||
| name: my-release | ||
| namespace: my-namespace | ||
|
|
||
| tests: | ||
| - it: authSecret is created and mounted correctly | ||
| set: | ||
| cluster: test | ||
| authSecret: | ||
| create: true | ||
| name: auth-credentials | ||
| data: | ||
| auth_key: test-key | ||
| asserts: | ||
| - template: templates/deployment-superagent.yaml | ||
| equal: | ||
| path: spec.template.spec.containers[0].volumeMounts | ||
| value: | ||
| - name: super-agent-config | ||
| mountPath: /etc/newrelic-super-agent | ||
| readOnly: true | ||
| - mountPath: /var/lib/newrelic-super-agent | ||
| name: var-lib-newrelic-super-agent | ||
| readOnly: false | ||
| - name: auth-secret-volume | ||
| mountPath: /etc/newrelic-super-agent | ||
| readOnly: true | ||
| - template: templates/deployment-superagent.yaml | ||
| equal: | ||
| path: spec.template.spec.volumes | ||
| value: | ||
| - name: super-agent-config | ||
| configMap: | ||
| name: local-data-super-agent | ||
| items: | ||
| - key: local_config | ||
| path: config.yaml | ||
| - name: var-lib-newrelic-super-agent | ||
| emptyDir: {} | ||
| - name: auth-secret-volume | ||
| secret: | ||
| secretName: auth-credentials | ||
| - template: templates/auth-secret.yaml | ||
| equal: | ||
| path: metadata.name | ||
| value: auth-credentials | ||
| - template: templates/auth-secret.yaml | ||
| equal: | ||
| path: data.auth_key | ||
| value: dGVzdC1rZXk= # base64 for "test-key" | ||
|
|
||
| - it: no mount and secret is created when authSecret.create is false | ||
| set: | ||
| cluster: test | ||
| authSecret: | ||
| create: false | ||
| asserts: | ||
| - template: templates/deployment-superagent.yaml | ||
| notContains: | ||
| path: spec.template.spec.containers[0].volumeMounts | ||
| value: | ||
| name: auth-secret-volume | ||
| - template: templates/deployment-superagent.yaml | ||
| notContains: | ||
| path: spec.template.spec.volumes | ||
| value: | ||
| name: auth-secret-volume | ||
|
|
||
| - it: authSecret is empty and defaults to authSecret.create=false | ||
| set: | ||
| cluster: test | ||
| authSecret: | ||
| asserts: | ||
| - template: templates/deployment-superagent.yaml | ||
| notContains: | ||
| path: spec.template.spec.containers[0].volumeMounts | ||
| value: | ||
| name: auth-secret-volume | ||
| - template: templates/deployment-superagent.yaml | ||
| notContains: | ||
| path: spec.template.spec.volumes | ||
| value: | ||
| name: auth-secret-volume | ||
|
|
||
| - it: authSecret create is empty with other fields set and defaults to authSecret.create=false | ||
| set: | ||
| cluster: test | ||
| authSecret: | ||
| name: test | ||
| asserts: | ||
| - template: templates/deployment-superagent.yaml | ||
| notContains: | ||
| path: spec.template.spec.containers[0].volumeMounts | ||
| value: | ||
| name: auth-secret-volume | ||
| - template: templates/deployment-superagent.yaml | ||
| notContains: | ||
| path: spec.template.spec.volumes | ||
| value: | ||
| name: auth-secret-volume | ||
|
|
||
| - it: authSecret creation fails when data is not provided | ||
| set: | ||
| cluster: test | ||
| authSecret: | ||
| create: true | ||
| asserts: | ||
| - template: templates/auth-secret.yaml | ||
| failedTemplate: | ||
| errorMessage: authSecret.data must be provided when authSecret.create is true | ||
|
|
||
| - it: authSecret creation fails when no auth_key is provided | ||
| set: | ||
| cluster: test | ||
| authSecret: | ||
| create: true | ||
| data: | ||
| auth_key: | ||
| asserts: | ||
| - template: templates/auth-secret.yaml | ||
| failedTemplate: | ||
| errorMessage: auth_key must be provided when authSecret.create is true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters