@@ -1974,6 +1974,164 @@ var _ = Describe("Barbican controller", func() {
19741974 })
19751975 })
19761976
1977+ When ("ApplicationCredential consumer finalizer is managed" , func () {
1978+ var (
1979+ acSecretName string
1980+ servicePasswordSecret string
1981+ )
1982+
1983+ BeforeEach (func () {
1984+ servicePasswordSecret = "ac-test-osp-secret" //nolint:gosec // G101
1985+
1986+ DeferCleanup (k8sClient .Delete , ctx ,
1987+ CreateBarbicanMessageBusSecret (
1988+ barbicanTest .Instance .Namespace ,
1989+ barbicanTest .RabbitmqSecretName ,
1990+ ),
1991+ )
1992+ DeferCleanup (k8sClient .Delete , ctx ,
1993+ CreateBarbicanSecret (
1994+ barbicanTest .Instance .Namespace , servicePasswordSecret ))
1995+
1996+ acSecretName = "ac-barbican-a1b2c-secret" //nolint:gosec // G101
1997+ secret := & corev1.Secret {
1998+ ObjectMeta : metav1.ObjectMeta {
1999+ Namespace : barbicanTest .Instance .Namespace ,
2000+ Name : acSecretName ,
2001+ },
2002+ Data : map [string ][]byte {
2003+ keystonev1 .ACIDSecretKey : []byte ("a1b2ctest-ac-id" ),
2004+ keystonev1 .ACSecretSecretKey : []byte ("test-ac-secret" ),
2005+ },
2006+ }
2007+ DeferCleanup (k8sClient .Delete , ctx , secret )
2008+ Expect (k8sClient .Create (ctx , secret )).To (Succeed ())
2009+
2010+ spec := GetDefaultBarbicanSpec ()
2011+ spec ["secret" ] = servicePasswordSecret
2012+ spec ["simpleCryptoBackendSecret" ] = servicePasswordSecret
2013+ spec ["auth" ] = map [string ]any {
2014+ "applicationCredentialSecret" : acSecretName ,
2015+ }
2016+ DeferCleanup (th .DeleteInstance ,
2017+ CreateBarbican (barbicanTest .Instance , spec ))
2018+ DeferCleanup (
2019+ mariadb .DeleteDBService ,
2020+ mariadb .CreateDBService (
2021+ barbicanTest .Instance .Namespace ,
2022+ GetBarbican (barbicanTest .Instance ).Spec .DatabaseInstance ,
2023+ corev1.ServiceSpec {
2024+ Ports : []corev1.ServicePort {{Port : 3306 }}}))
2025+
2026+ DeferCleanup (keystone .DeleteKeystoneAPI ,
2027+ keystone .CreateKeystoneAPI (barbicanTest .Instance .Namespace ))
2028+
2029+ infra .SimulateTransportURLReady (barbicanTest .BarbicanTransportURL )
2030+ mariadb .SimulateMariaDBAccountCompleted (barbicanTest .BarbicanDatabaseAccount )
2031+ mariadb .SimulateMariaDBDatabaseCompleted (barbicanTest .BarbicanDatabaseName )
2032+ th .SimulateJobSuccess (barbicanTest .BarbicanDBSync )
2033+ keystone .SimulateKeystoneEndpointReady (barbicanTest .BarbicanKeystoneEndpoint )
2034+ })
2035+
2036+ It ("should add the consumer finalizer to the AC secret" , func () {
2037+ Eventually (func (g Gomega ) {
2038+ secret := th .GetSecret (types.NamespacedName {
2039+ Namespace : barbicanTest .Instance .Namespace ,
2040+ Name : acSecretName ,
2041+ })
2042+ g .Expect (secret .Finalizers ).To (
2043+ ContainElement (barbican .ACConsumerFinalizer ))
2044+ }, timeout , interval ).Should (Succeed ())
2045+ })
2046+
2047+ It ("should track the consumed AC secret in status" , func () {
2048+ Eventually (func (g Gomega ) {
2049+ b := GetBarbican (barbicanTest .Instance )
2050+ g .Expect (b .Status .ApplicationCredentialSecret ).To (Equal (acSecretName ))
2051+ }, timeout , interval ).Should (Succeed ())
2052+ })
2053+
2054+ It ("should move the finalizer from the old to the new secret on rotation" , func () {
2055+ // Wait for the initial finalizer to appear
2056+ Eventually (func (g Gomega ) {
2057+ secret := th .GetSecret (types.NamespacedName {
2058+ Namespace : barbicanTest .Instance .Namespace ,
2059+ Name : acSecretName ,
2060+ })
2061+ g .Expect (secret .Finalizers ).To (
2062+ ContainElement (barbican .ACConsumerFinalizer ))
2063+ }, timeout , interval ).Should (Succeed ())
2064+
2065+ // Create a new AC secret
2066+ newACSecretName := "ac-barbican-x9y8z-secret" //nolint:gosec // G101
2067+ newSecret := & corev1.Secret {
2068+ ObjectMeta : metav1.ObjectMeta {
2069+ Namespace : barbicanTest .Instance .Namespace ,
2070+ Name : newACSecretName ,
2071+ },
2072+ Data : map [string ][]byte {
2073+ keystonev1 .ACIDSecretKey : []byte ("x9y8zrotated-ac-id" ),
2074+ keystonev1 .ACSecretSecretKey : []byte ("rotated-ac-secret" ),
2075+ },
2076+ }
2077+ DeferCleanup (k8sClient .Delete , ctx , newSecret )
2078+ Expect (k8sClient .Create (ctx , newSecret )).To (Succeed ())
2079+
2080+ // Update the Barbican CR to reference the new AC secret
2081+ Eventually (func (g Gomega ) {
2082+ b := GetBarbican (barbicanTest .Instance )
2083+ b .Spec .Auth .ApplicationCredentialSecret = newACSecretName
2084+ g .Expect (k8sClient .Update (ctx , b )).Should (Succeed ())
2085+ }, timeout , interval ).Should (Succeed ())
2086+
2087+ // New secret should gain the consumer finalizer
2088+ Eventually (func (g Gomega ) {
2089+ secret := th .GetSecret (types.NamespacedName {
2090+ Namespace : barbicanTest .Instance .Namespace ,
2091+ Name : newACSecretName ,
2092+ })
2093+ g .Expect (secret .Finalizers ).To (
2094+ ContainElement (barbican .ACConsumerFinalizer ))
2095+ }, timeout , interval ).Should (Succeed ())
2096+
2097+ // Old secret should lose the consumer finalizer
2098+ Eventually (func (g Gomega ) {
2099+ secret := th .GetSecret (types.NamespacedName {
2100+ Namespace : barbicanTest .Instance .Namespace ,
2101+ Name : acSecretName ,
2102+ })
2103+ g .Expect (secret .Finalizers ).NotTo (
2104+ ContainElement (barbican .ACConsumerFinalizer ))
2105+ }, timeout , interval ).Should (Succeed ())
2106+
2107+ // Status should reflect the new secret
2108+ Eventually (func (g Gomega ) {
2109+ b := GetBarbican (barbicanTest .Instance )
2110+ g .Expect (b .Status .ApplicationCredentialSecret ).To (Equal (newACSecretName ))
2111+ }, timeout , interval ).Should (Succeed ())
2112+ })
2113+
2114+ It ("should remove the consumer finalizer from AC secret on CR deletion" , func () {
2115+ Eventually (func (g Gomega ) {
2116+ secret := th .GetSecret (types.NamespacedName {
2117+ Namespace : barbicanTest .Instance .Namespace ,
2118+ Name : acSecretName ,
2119+ })
2120+ g .Expect (secret .Finalizers ).To (
2121+ ContainElement (barbican .ACConsumerFinalizer ))
2122+ }, timeout , interval ).Should (Succeed ())
2123+
2124+ th .DeleteInstance (GetBarbican (barbicanTest .Instance ))
2125+
2126+ secret := th .GetSecret (types.NamespacedName {
2127+ Namespace : barbicanTest .Instance .Namespace ,
2128+ Name : acSecretName ,
2129+ })
2130+ Expect (secret .Finalizers ).NotTo (
2131+ ContainElement (barbican .ACConsumerFinalizer ))
2132+ })
2133+ })
2134+
19772135 // Run MariaDBAccount suite tests. these are pre-packaged ginkgo tests
19782136 // that exercise standard account create / update patterns that should be
19792137 // common to all controllers that ensure MariaDBAccount CRs.
0 commit comments