@@ -1803,6 +1803,164 @@ var _ = Describe("Barbican controller", func() {
18031803 })
18041804 })
18051805
1806+ When ("ApplicationCredential consumer finalizer is managed" , func () {
1807+ var (
1808+ acSecretName string
1809+ servicePasswordSecret string
1810+ )
1811+
1812+ BeforeEach (func () {
1813+ servicePasswordSecret = "ac-test-osp-secret" //nolint:gosec // G101
1814+
1815+ DeferCleanup (k8sClient .Delete , ctx ,
1816+ CreateBarbicanMessageBusSecret (
1817+ barbicanTest .Instance .Namespace ,
1818+ barbicanTest .RabbitmqSecretName ,
1819+ ),
1820+ )
1821+ DeferCleanup (k8sClient .Delete , ctx ,
1822+ CreateBarbicanSecret (
1823+ barbicanTest .Instance .Namespace , servicePasswordSecret ))
1824+
1825+ acSecretName = "ac-barbican-a1b2c-secret" //nolint:gosec // G101
1826+ secret := & corev1.Secret {
1827+ ObjectMeta : metav1.ObjectMeta {
1828+ Namespace : barbicanTest .Instance .Namespace ,
1829+ Name : acSecretName ,
1830+ },
1831+ Data : map [string ][]byte {
1832+ keystonev1 .ACIDSecretKey : []byte ("a1b2ctest-ac-id" ),
1833+ keystonev1 .ACSecretSecretKey : []byte ("test-ac-secret" ),
1834+ },
1835+ }
1836+ DeferCleanup (k8sClient .Delete , ctx , secret )
1837+ Expect (k8sClient .Create (ctx , secret )).To (Succeed ())
1838+
1839+ spec := GetDefaultBarbicanSpec ()
1840+ spec ["secret" ] = servicePasswordSecret
1841+ spec ["simpleCryptoBackendSecret" ] = servicePasswordSecret
1842+ spec ["auth" ] = map [string ]any {
1843+ "applicationCredentialSecret" : acSecretName ,
1844+ }
1845+ DeferCleanup (th .DeleteInstance ,
1846+ CreateBarbican (barbicanTest .Instance , spec ))
1847+ DeferCleanup (
1848+ mariadb .DeleteDBService ,
1849+ mariadb .CreateDBService (
1850+ barbicanTest .Instance .Namespace ,
1851+ GetBarbican (barbicanTest .Instance ).Spec .DatabaseInstance ,
1852+ corev1.ServiceSpec {
1853+ Ports : []corev1.ServicePort {{Port : 3306 }}}))
1854+
1855+ DeferCleanup (keystone .DeleteKeystoneAPI ,
1856+ keystone .CreateKeystoneAPI (barbicanTest .Instance .Namespace ))
1857+
1858+ infra .SimulateTransportURLReady (barbicanTest .BarbicanTransportURL )
1859+ mariadb .SimulateMariaDBAccountCompleted (barbicanTest .BarbicanDatabaseAccount )
1860+ mariadb .SimulateMariaDBDatabaseCompleted (barbicanTest .BarbicanDatabaseName )
1861+ th .SimulateJobSuccess (barbicanTest .BarbicanDBSync )
1862+ keystone .SimulateKeystoneEndpointReady (barbicanTest .BarbicanKeystoneEndpoint )
1863+ })
1864+
1865+ It ("should add the consumer finalizer to the AC secret" , func () {
1866+ Eventually (func (g Gomega ) {
1867+ secret := th .GetSecret (types.NamespacedName {
1868+ Namespace : barbicanTest .Instance .Namespace ,
1869+ Name : acSecretName ,
1870+ })
1871+ g .Expect (secret .Finalizers ).To (
1872+ ContainElement (barbican .ACConsumerFinalizer ))
1873+ }, timeout , interval ).Should (Succeed ())
1874+ })
1875+
1876+ It ("should track the consumed AC secret in status" , func () {
1877+ Eventually (func (g Gomega ) {
1878+ b := GetBarbican (barbicanTest .Instance )
1879+ g .Expect (b .Status .ApplicationCredentialSecret ).To (Equal (acSecretName ))
1880+ }, timeout , interval ).Should (Succeed ())
1881+ })
1882+
1883+ It ("should move the finalizer from the old to the new secret on rotation" , func () {
1884+ // Wait for the initial finalizer to appear
1885+ Eventually (func (g Gomega ) {
1886+ secret := th .GetSecret (types.NamespacedName {
1887+ Namespace : barbicanTest .Instance .Namespace ,
1888+ Name : acSecretName ,
1889+ })
1890+ g .Expect (secret .Finalizers ).To (
1891+ ContainElement (barbican .ACConsumerFinalizer ))
1892+ }, timeout , interval ).Should (Succeed ())
1893+
1894+ // Create a new AC secret
1895+ newACSecretName := "ac-barbican-x9y8z-secret" //nolint:gosec // G101
1896+ newSecret := & corev1.Secret {
1897+ ObjectMeta : metav1.ObjectMeta {
1898+ Namespace : barbicanTest .Instance .Namespace ,
1899+ Name : newACSecretName ,
1900+ },
1901+ Data : map [string ][]byte {
1902+ keystonev1 .ACIDSecretKey : []byte ("x9y8zrotated-ac-id" ),
1903+ keystonev1 .ACSecretSecretKey : []byte ("rotated-ac-secret" ),
1904+ },
1905+ }
1906+ DeferCleanup (k8sClient .Delete , ctx , newSecret )
1907+ Expect (k8sClient .Create (ctx , newSecret )).To (Succeed ())
1908+
1909+ // Update the Barbican CR to reference the new AC secret
1910+ Eventually (func (g Gomega ) {
1911+ b := GetBarbican (barbicanTest .Instance )
1912+ b .Spec .Auth .ApplicationCredentialSecret = newACSecretName
1913+ g .Expect (k8sClient .Update (ctx , b )).Should (Succeed ())
1914+ }, timeout , interval ).Should (Succeed ())
1915+
1916+ // New secret should gain the consumer finalizer
1917+ Eventually (func (g Gomega ) {
1918+ secret := th .GetSecret (types.NamespacedName {
1919+ Namespace : barbicanTest .Instance .Namespace ,
1920+ Name : newACSecretName ,
1921+ })
1922+ g .Expect (secret .Finalizers ).To (
1923+ ContainElement (barbican .ACConsumerFinalizer ))
1924+ }, timeout , interval ).Should (Succeed ())
1925+
1926+ // Old secret should lose the consumer finalizer
1927+ Eventually (func (g Gomega ) {
1928+ secret := th .GetSecret (types.NamespacedName {
1929+ Namespace : barbicanTest .Instance .Namespace ,
1930+ Name : acSecretName ,
1931+ })
1932+ g .Expect (secret .Finalizers ).NotTo (
1933+ ContainElement (barbican .ACConsumerFinalizer ))
1934+ }, timeout , interval ).Should (Succeed ())
1935+
1936+ // Status should reflect the new secret
1937+ Eventually (func (g Gomega ) {
1938+ b := GetBarbican (barbicanTest .Instance )
1939+ g .Expect (b .Status .ApplicationCredentialSecret ).To (Equal (newACSecretName ))
1940+ }, timeout , interval ).Should (Succeed ())
1941+ })
1942+
1943+ It ("should remove the consumer finalizer from AC secret on CR deletion" , func () {
1944+ Eventually (func (g Gomega ) {
1945+ secret := th .GetSecret (types.NamespacedName {
1946+ Namespace : barbicanTest .Instance .Namespace ,
1947+ Name : acSecretName ,
1948+ })
1949+ g .Expect (secret .Finalizers ).To (
1950+ ContainElement (barbican .ACConsumerFinalizer ))
1951+ }, timeout , interval ).Should (Succeed ())
1952+
1953+ th .DeleteInstance (GetBarbican (barbicanTest .Instance ))
1954+
1955+ secret := th .GetSecret (types.NamespacedName {
1956+ Namespace : barbicanTest .Instance .Namespace ,
1957+ Name : acSecretName ,
1958+ })
1959+ Expect (secret .Finalizers ).NotTo (
1960+ ContainElement (barbican .ACConsumerFinalizer ))
1961+ })
1962+ })
1963+
18061964 // Run MariaDBAccount suite tests. these are pre-packaged ginkgo tests
18071965 // that exercise standard account create / update patterns that should be
18081966 // common to all controllers that ensure MariaDBAccount CRs.
0 commit comments