|
642 | 642 | end |
643 | 643 | end |
644 | 644 | end |
| 645 | + |
| 646 | + describe '#check_secrets' do |
| 647 | + let(:dry_run) { true } |
| 648 | + |
| 649 | + context 'with Parameter Store values' do |
| 650 | + let(:app) { Hako::Application.new(fixture_root.join('jsonnet', 'parameter_store.jsonnet')) } |
| 651 | + let(:ssm_client) { Aws::SSM::Client.new(stub_responses: true) } |
| 652 | + |
| 653 | + before do |
| 654 | + allow(scheduler).to receive(:ssm_client).and_return(ssm_client) |
| 655 | + allow(scheduler).to receive(:puts) # Suppress dry-run output |
| 656 | + end |
| 657 | + |
| 658 | + it 'checks Parameter Store values' do |
| 659 | + scheduler.deploy(containers) |
| 660 | + expect(ssm_client.api_requests.size).to eq(2) |
| 661 | + expect(ssm_client.api_requests).to match_array( |
| 662 | + [ |
| 663 | + hash_including( |
| 664 | + operation_name: :get_parameters, |
| 665 | + params: { |
| 666 | + names: match_array( |
| 667 | + [ |
| 668 | + 'arn:aws:ssm:ap-northeast-1:012345678901:parameter/hoge/fuga/SECRET_MESSAGE1', |
| 669 | + 'arn:aws:ssm:ap-northeast-1:012345678901:parameter/hoge/fuga/SECRET_MESSAGE2', |
| 670 | + ], |
| 671 | + ), |
| 672 | + }, |
| 673 | + ), |
| 674 | + hash_including( |
| 675 | + operation_name: :get_parameters, |
| 676 | + params: { |
| 677 | + names: ['arn:aws:ssm:us-east-1:012345678901:parameter/hoge/fuga/SECRET_MESSAGE3'], |
| 678 | + }, |
| 679 | + ), |
| 680 | + ], |
| 681 | + ) |
| 682 | + end |
| 683 | + |
| 684 | + context 'with invalid parameters' do |
| 685 | + before do |
| 686 | + ssm_client.stub_responses(:get_parameters, lambda { |context| |
| 687 | + if context.params[:names].include?('arn:aws:ssm:ap-northeast-1:012345678901:parameter/hoge/fuga/SECRET_MESSAGE2') |
| 688 | + Aws::SSM::Types::GetParametersResult.new( |
| 689 | + invalid_parameters: ['arn:aws:ssm:ap-northeast-1:012345678901:parameter/hoge/fuga/SECRET_MESSAGE2'], |
| 690 | + ) |
| 691 | + else |
| 692 | + Aws::SSM::Types::GetParametersResult.new(invalid_parameters: []) |
| 693 | + end |
| 694 | + }) |
| 695 | + end |
| 696 | + |
| 697 | + it 'raises an error' do |
| 698 | + expect { scheduler.deploy(containers) }.to raise_error(Hako::Error) { |e| |
| 699 | + expect(e.message).to_not include('SECRET_MESSAGE1') |
| 700 | + expect(e.message).to include('SECRET_MESSAGE2') |
| 701 | + expect(e.message).to_not include('SECRET_MESSAGE3') |
| 702 | + } |
| 703 | + end |
| 704 | + end |
| 705 | + end |
| 706 | + |
| 707 | + context 'with SecretsManager values' do |
| 708 | + let(:app) { Hako::Application.new(fixture_root.join('jsonnet', 'secretsmanager.jsonnet')) } |
| 709 | + let(:secretsmanager_client) { Aws::SecretsManager::Client.new(stub_responses: true) } |
| 710 | + let(:secrets) do |
| 711 | + { |
| 712 | + 'arn:aws:secretsmanager:ap-northeast-1:012345678901:secret:hoge/fuga1-abcdef' => 'SECRET_VALUE0', |
| 713 | + 'arn:aws:secretsmanager:ap-northeast-1:012345678901:secret:hoge/fuga2-abcdef' => '{"SECRET_MESSAGE1":"SECRET_VALUE1","SECRET_MESSAGE2":"SECRET_VALUE2"}', |
| 714 | + 'arn:aws:secretsmanager:us-east-1:012345678901:secret:hoge/fuga3-abcdef' => '{"SECRET_MESSAGE3":"SECRET_VALUE3"}', |
| 715 | + } |
| 716 | + end |
| 717 | + |
| 718 | + before do |
| 719 | + allow(scheduler).to receive(:secretsmanager_client).and_return(secretsmanager_client) |
| 720 | + allow(scheduler).to receive(:puts) # Suppress dry-run output |
| 721 | + secretsmanager_client.stub_responses(:get_secret_value, lambda { |context| |
| 722 | + secret_string = secrets[context.params[:secret_id]] |
| 723 | + if secret_string |
| 724 | + Aws::SecretsManager::Types::GetSecretValueResponse.new(secret_string: secret_string) |
| 725 | + else |
| 726 | + 'ResourceNotFoundException' |
| 727 | + end |
| 728 | + }) |
| 729 | + end |
| 730 | + |
| 731 | + it 'checks SecretsManager values' do |
| 732 | + scheduler.deploy(containers) |
| 733 | + expect(secretsmanager_client.api_requests.size).to eq(3) |
| 734 | + expect(secretsmanager_client.api_requests).to match_array( |
| 735 | + [ |
| 736 | + hash_including( |
| 737 | + operation_name: :get_secret_value, |
| 738 | + params: { secret_id: 'arn:aws:secretsmanager:ap-northeast-1:012345678901:secret:hoge/fuga1-abcdef', version_stage: nil, version_id: nil, }, |
| 739 | + ), |
| 740 | + hash_including( |
| 741 | + operation_name: :get_secret_value, |
| 742 | + params: { |
| 743 | + secret_id: 'arn:aws:secretsmanager:ap-northeast-1:012345678901:secret:hoge/fuga2-abcdef', |
| 744 | + version_stage: nil, |
| 745 | + version_id: nil, |
| 746 | + }, |
| 747 | + ), |
| 748 | + hash_including( |
| 749 | + operation_name: :get_secret_value, |
| 750 | + params: { |
| 751 | + secret_id: 'arn:aws:secretsmanager:us-east-1:012345678901:secret:hoge/fuga3-abcdef', |
| 752 | + version_stage: nil, |
| 753 | + version_id: nil, |
| 754 | + }, |
| 755 | + ), |
| 756 | + ], |
| 757 | + ) |
| 758 | + end |
| 759 | + |
| 760 | + context 'when json-key is missing' do |
| 761 | + before do |
| 762 | + secrets['arn:aws:secretsmanager:ap-northeast-1:012345678901:secret:hoge/fuga2-abcdef'] = '{"SECRET_MESSAGE1":"SECRET_VALUE1"}' |
| 763 | + end |
| 764 | + |
| 765 | + it 'raises an error' do |
| 766 | + expect { scheduler.deploy(containers) }.to raise_error(Hako::Error) { |e| |
| 767 | + expect(e.message).to_not include('SECRET_VALUE') |
| 768 | + expect(e.message).to_not include('SECRET_MESSAGE1') |
| 769 | + expect(e.message).to include('SECRET_MESSAGE2') |
| 770 | + expect(e.message).to_not include('SECRET_MESSAGE3') |
| 771 | + } |
| 772 | + end |
| 773 | + end |
| 774 | + |
| 775 | + context 'when secret value is missing' do |
| 776 | + before do |
| 777 | + secrets.delete('arn:aws:secretsmanager:ap-northeast-1:012345678901:secret:hoge/fuga2-abcdef') |
| 778 | + end |
| 779 | + |
| 780 | + it 'raises an error' do |
| 781 | + expect { scheduler.deploy(containers) }.to raise_error(Hako::Error) { |e| |
| 782 | + expect(e.message).to_not include('SECRET_VALUE') |
| 783 | + expect(e.message).to include('SECRET_MESSAGE1') |
| 784 | + expect(e.message).to include('SECRET_MESSAGE2') |
| 785 | + expect(e.message).to_not include('SECRET_MESSAGE3') |
| 786 | + } |
| 787 | + end |
| 788 | + end |
| 789 | + end |
| 790 | + end |
645 | 791 | end |
0 commit comments