Skip to content

Commit 035d5bf

Browse files
ThoSapThoSap
committed
add a test to check if the password changes if the Role secretRef changes
1 parent e5df81f commit 035d5bf

5 files changed

Lines changed: 87 additions & 25 deletions

File tree

‎src/main/java/it/aboutbits/postgresql/MinioInstanceReadinessCheck.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
import lombok.RequiredArgsConstructor;
77
import org.eclipse.microprofile.health.HealthCheck;
88
import org.eclipse.microprofile.health.HealthCheckResponse;
9-
import org.eclipse.microprofile.health.HealthCheckResponseBuilder;
109
import org.eclipse.microprofile.health.Readiness;
1110
import org.jspecify.annotations.NullMarked;
1211

‎src/main/java/it/aboutbits/postgresql/core/BaseReconciler.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
package it.aboutbits.postgresql.core;
22

3-
import io.fabric8.kubernetes.api.model.HasMetadata;
43
import io.fabric8.kubernetes.client.CustomResource;
54
import io.fabric8.kubernetes.client.KubernetesClient;
65
import io.javaoperatorsdk.operator.api.reconciler.UpdateControl;

‎src/main/java/it/aboutbits/postgresql/crd/connection/ClusterConnectionSpec.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@
55
import lombok.Getter;
66
import lombok.Setter;
77
import org.jspecify.annotations.NullMarked;
8-
import org.jspecify.annotations.Nullable;
98

109
import java.util.HashMap;
1110
import java.util.Map;

‎src/test/java/it/aboutbits/postgresql/_support/testdata/persisted/creator/SecretRefCreate.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
import io.fabric8.kubernetes.api.model.SecretBuilder;
44
import io.fabric8.kubernetes.client.KubernetesClient;
55
import it.aboutbits.postgresql._support.testdata.base.TestDataCreator;
6-
import it.aboutbits.postgresql._support.testdata.persisted.Given;
76
import it.aboutbits.postgresql.core.SecretRef;
87
import org.jspecify.annotations.NullMarked;
98
import org.jspecify.annotations.Nullable;

‎src/test/java/it/aboutbits/postgresql/crd/role/RoleReconcilerTest.java‎

Lines changed: 87 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,11 @@ void createRole_withLogin_andStatusReady() {
5353

5454
var spec = role.getSpec();
5555

56-
spec.getClusterRef().setNamespace(kubernetesClient.getNamespace());
57-
5856
// when: create Role referencing the ClusterConnection and expecting LOGIN (passwordSecretRef non-null)
59-
role.getSpec().setPasswordSecretRef(clusterConnection.getSpec().getAdminSecretRef());
60-
role = applyRole(role);
57+
spec.setPasswordSecretRef(clusterConnection.getSpec().getAdminSecretRef());
6158

6259
// then: wait for status and assert READY
63-
var reconciled = waitForRoleStatus(role.getMetadata().getName());
60+
var reconciled = applyRole(role);
6461

6562
var expectedStatus = new CRStatus()
6663
.setName(roleName)
@@ -93,18 +90,17 @@ void createRole_withoutLogin_andStatusReady() {
9390
.withName("test-connection-role-nologin")
9491
.returnFirst();
9592

96-
// when
9793
var now = OffsetDateTime.now(ZoneOffset.UTC);
9894
var roleName = "test-role-nologin";
95+
9996
var role = buildRole(
10097
roleName,
10198
clusterConnection.getMetadata().getName(),
10299
/*login*/ false
103100
);
104-
role.getSpec().getClusterRef().setNamespace(kubernetesClient.getNamespace());
105-
role = applyRole(role);
106101

107-
var reconciled = waitForRoleStatus(role.getMetadata().getName());
102+
// when
103+
var reconciled = applyRole(role);
108104

109105
var expectedStatus = new CRStatus()
110106
.setName(roleName)
@@ -142,10 +138,9 @@ void createRole_withMissingClusterConnection_setsPending() {
142138
/*login*/ true
143139
);
144140
role.getSpec().getClusterRef().setNamespace(kubernetesClient.getNamespace());
145-
role = applyRole(role);
146141

147142
// when
148-
var reconciled = waitForRoleStatus(role.getMetadata().getName());
143+
var reconciled = applyRole(role);
149144

150145
// then
151146
assertThat(reconciled).isNotNull();
@@ -197,21 +192,19 @@ void secretChange_triggersReconciliation() throws Exception {
197192
role.getSpec().setPasswordSecretRef(secretRef);
198193

199194
// when: create Role
200-
role = applyRole(role);
201-
waitForRoleStatus(role.getMetadata().getName());
195+
var reconciled = applyRole(role);
202196

203197
var dsl = postgreSQLContextFactory.getDSLContext(clusterConnection);
204198

205199
// then: password should match the initial one
206200
// Wait for password to match because reconciliation might take a bit
207-
var initialRole = role;
208201
await().atMost(10, TimeUnit.SECONDS)
209202
.pollInterval(500, TimeUnit.MILLISECONDS)
210203
.until(() -> {
211204
try {
212205
return PostgreSQLAuthenticationUtil.passwordMatches(
213206
dsl,
214-
initialRole.getSpec(),
207+
reconciled.getSpec(),
215208
initialPassword
216209
);
217210
} catch (Exception e) {
@@ -231,7 +224,83 @@ void secretChange_triggersReconciliation() throws Exception {
231224
.serverSideApply();
232225

233226
// then: password should eventually match the new one
234-
var updatedRole = role;
227+
await().atMost(10, TimeUnit.SECONDS)
228+
.pollInterval(500, TimeUnit.MILLISECONDS)
229+
.until(() -> {
230+
try {
231+
return PostgreSQLAuthenticationUtil.passwordMatches(
232+
dsl,
233+
reconciled.getSpec(),
234+
newPassword
235+
);
236+
} catch (Exception e) {
237+
return false;
238+
}
239+
});
240+
}
241+
242+
@Test
243+
@DisplayName(
244+
"When a Role (LOGIN) changes its secret reference, it should trigger a re-reconciliation"
245+
)
246+
void secretRefChange_triggersReconciliation() throws Exception {
247+
// given
248+
var clusterConnection = given.one()
249+
.clusterConnection()
250+
.withName("test-connection-role-secret-ref-change")
251+
.returnFirst();
252+
253+
var roleName = "test-role-secret-ref-change";
254+
255+
var initialPassword = "initial-password";
256+
var newPassword = "new-password";
257+
258+
var initialSecretRef = given.one()
259+
.secretRef()
260+
.withPassword(initialPassword)
261+
.returnFirst();
262+
263+
var newSecretRef = given.one()
264+
.secretRef()
265+
.withPassword(newPassword)
266+
.returnFirst();
267+
268+
var role = buildRole(
269+
roleName,
270+
clusterConnection.getMetadata().getName(),
271+
/*login*/ true
272+
);
273+
274+
role.getSpec().setPasswordSecretRef(initialSecretRef);
275+
276+
// when: create Role
277+
var reconciled = applyRole(role);
278+
279+
var dsl = postgreSQLContextFactory.getDSLContext(clusterConnection);
280+
281+
// then: password should match the initial one
282+
var finalRole = reconciled;
283+
await().atMost(10, TimeUnit.SECONDS)
284+
.pollInterval(500, TimeUnit.MILLISECONDS)
285+
.until(() -> {
286+
try {
287+
return PostgreSQLAuthenticationUtil.passwordMatches(
288+
dsl,
289+
finalRole.getSpec(),
290+
initialPassword
291+
);
292+
} catch (Exception e) {
293+
return false;
294+
}
295+
});
296+
297+
// when: update secret reference in the Role
298+
role.getSpec().setPasswordSecretRef(newSecretRef);
299+
300+
reconciled = applyRole(role);
301+
302+
// then: password should eventually match the new one
303+
var updatedRole = reconciled;
235304
await().atMost(10, TimeUnit.SECONDS)
236305
.pollInterval(500, TimeUnit.MILLISECONDS)
237306
.until(() -> {
@@ -250,17 +319,14 @@ void secretChange_triggersReconciliation() throws Exception {
250319
private Role applyRole(Role role) {
251320
var namespace = kubernetesClient.getNamespace();
252321

253-
return kubernetesClient.resources(Role.class)
322+
kubernetesClient.resources(Role.class)
254323
.inNamespace(namespace)
255324
.resource(role)
256325
.serverSideApply();
257-
}
258326

259-
private Role waitForRoleStatus(String roleName) {
260-
var namespace = kubernetesClient.getNamespace();
261327
return kubernetesClient.resources(Role.class)
262328
.inNamespace(namespace)
263-
.withName(roleName)
329+
.withName(role.getName())
264330
.waitUntilCondition(
265331
r -> r.getStatus() != null,
266332
10,

0 commit comments

Comments
 (0)