@@ -532,6 +532,157 @@ var _ = Describe("Secret validation", func() {
532532 }))))
533533 })
534534 })
535+ Context ("with region field" , func () {
536+ It ("should pass with valid AWS_REGION" , func () {
537+ secret .Data = map [string ][]byte {
538+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
539+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
540+ aws .DNSRegion : []byte ("us-east-1" ),
541+ }
542+
543+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
544+ Expect (errs ).To (BeEmpty ())
545+ })
546+
547+ It ("should pass with valid region using camelCase key" , func () {
548+ secret .Data = map [string ][]byte {
549+ aws .AccessKeyID : []byte (validAccessKeyID ),
550+ aws .SecretAccessKey : []byte (validSecretAccessKey ),
551+ aws .Region : []byte ("eu-west-2" ),
552+ }
553+
554+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
555+ Expect (errs ).To (BeEmpty ())
556+ })
557+
558+ It ("should pass with valid GovCloud region" , func () {
559+ secret .Data = map [string ][]byte {
560+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
561+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
562+ aws .DNSRegion : []byte ("us-gov-west-1" ),
563+ }
564+
565+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
566+ Expect (errs ).To (BeEmpty ())
567+ })
568+
569+ It ("should pass with valid multi-zone region" , func () {
570+ secret .Data = map [string ][]byte {
571+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
572+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
573+ aws .DNSRegion : []byte ("ap-southeast-3" ),
574+ }
575+
576+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
577+ Expect (errs ).To (BeEmpty ())
578+ })
579+
580+ It ("should pass when region field is empty" , func () {
581+ secret .Data = map [string ][]byte {
582+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
583+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
584+ aws .DNSRegion : []byte ("" ),
585+ }
586+
587+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
588+ Expect (errs ).To (BeEmpty ())
589+ })
590+
591+ It ("should pass when region field is missing" , func () {
592+ secret .Data = map [string ][]byte {
593+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
594+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
595+ }
596+
597+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
598+ Expect (errs ).To (BeEmpty ())
599+ })
600+
601+ It ("should fail when region format is invalid" , func () {
602+ secret .Data = map [string ][]byte {
603+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
604+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
605+ aws .DNSRegion : []byte ("invalid-region" ),
606+ }
607+
608+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
609+ Expect (errs ).To (ContainElement (PointTo (MatchFields (IgnoreExtras , Fields {
610+ "Type" : Equal (field .ErrorTypeInvalid ),
611+ "Field" : Equal ("secret.data[AWS_REGION]" ),
612+ }))))
613+ })
614+
615+ It ("should fail when region has uppercase characters" , func () {
616+ secret .Data = map [string ][]byte {
617+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
618+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
619+ aws .DNSRegion : []byte ("US-EAST-1" ),
620+ }
621+
622+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
623+ Expect (errs ).To (ContainElement (PointTo (MatchFields (IgnoreExtras , Fields {
624+ "Type" : Equal (field .ErrorTypeInvalid ),
625+ "Field" : Equal ("secret.data[AWS_REGION]" ),
626+ }))))
627+ })
628+
629+ It ("should fail when region is too long" , func () {
630+ secret .Data = map [string ][]byte {
631+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
632+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
633+ aws .DNSRegion : []byte ("us-extremely-long-region-name-that-exceeds-limit-1" ),
634+ }
635+
636+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
637+ Expect (errs ).To (ContainElement (PointTo (MatchFields (IgnoreExtras , Fields {
638+ "Type" : Equal (field .ErrorTypeInvalid ),
639+ "Field" : Equal ("secret.data[AWS_REGION]" ),
640+ }))))
641+ })
642+
643+ It ("should fail when region contains invalid characters" , func () {
644+ secret .Data = map [string ][]byte {
645+ aws .DNSAccessKeyID : []byte (validAccessKeyID ),
646+ aws .DNSSecretAccessKey : []byte (validSecretAccessKey ),
647+ aws .DNSRegion : []byte ("us_east_1" ),
648+ }
649+
650+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
651+ Expect (errs ).To (ContainElement (PointTo (MatchFields (IgnoreExtras , Fields {
652+ "Type" : Equal (field .ErrorTypeInvalid ),
653+ "Field" : Equal ("secret.data[AWS_REGION]" ),
654+ }))))
655+ })
656+
657+ It ("should fail when region using camelCase key is invalid" , func () {
658+ secret .Data = map [string ][]byte {
659+ aws .AccessKeyID : []byte (validAccessKeyID ),
660+ aws .SecretAccessKey : []byte (validSecretAccessKey ),
661+ aws .Region : []byte ("invalid_region" ),
662+ }
663+
664+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
665+ Expect (errs ).To (ContainElement (PointTo (MatchFields (IgnoreExtras , Fields {
666+ "Type" : Equal (field .ErrorTypeInvalid ),
667+ "Field" : Equal ("secret.data[region]" ),
668+ }))))
669+ })
670+
671+ It ("should fail when both region keys are present" , func () {
672+ secret .Data = map [string ][]byte {
673+ aws .AccessKeyID : []byte (validAccessKeyID ),
674+ aws .SecretAccessKey : []byte (validSecretAccessKey ),
675+ aws .Region : []byte ("us-east-1" ),
676+ aws .DNSRegion : []byte ("us-west-2" ),
677+ }
678+
679+ errs := ValidateCloudProviderSecret (secret , fldPath , SecretKindDns )
680+ Expect (errs ).To (ContainElement (PointTo (MatchFields (IgnoreExtras , Fields {
681+ "Type" : Equal (field .ErrorTypeForbidden ),
682+ "Field" : Equal ("secret.data[AWS_REGION]" ),
683+ }))))
684+ })
685+ })
535686 })
536687
537688 Context ("Invalid Secret Kind" , func () {
0 commit comments