novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Several secrets expand where the consumer is known, not on the first module to mention the provision

Browse Source 
The lab's two-secrets consumer was given one credential and no file: the expansion
ran on the resolver's walk over names, on whichever module mentioned the provision
first, and the per-consumer pass copied that. It expands in that pass now, and a
test has two consumers of one provision, one keeping one file and one keeping two.
This commit is contained in:
jschoubben
2026-09-21 20:36:19 +02:00
parent 973cda5d76
commit 76773dfbf5
2 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/catalogue/several_secrets_test.go
+14 -3
View File
@@ -68,23 +68,34 @@ func vaultAndCA() map[string]Manifest {
vault := Manifest{Module: "mesh-vault", Version: "1", Provides: FromAnywhere("secret"),
Grants: map[string]string{"secret": "/var/lib/vault/grants"},
Receives: map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}}
return shelf(vault, ca)
// A second consumer of the same provision that keeps ONE file, mentioned before the one that
// keeps two: the lab found the expansion done on the first module to mention the provision,
// and the second consumer given one credential and no file.
cache := Manifest{Module: "cache", Version: "1", Requires: []string{"secret"},
Secrets: map[string]string{"secret": "/var/lib/cache/secret"}}
return shelf(vault, cache, ca)
}
func TestEachLocalNameIsANeedAFileAndAHolderOfItsOwn(t *testing.T) {
got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "ca"}, workstation(), World{})
got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "cache", "ca"}, workstation(), World{})
if err != nil {
t.Fatal(err)
}
var locals []string
var locals, cacheLocals []string
for _, n := range got.Needs {
if n.Name == "secret" && n.For == "ca" {
locals = append(locals, n.Local)
}
if n.Name == "secret" && n.For == "cache" {
cacheLocals = append(cacheLocals, n.Local)
}
}
if strings.Join(locals, ",") != "root-key,root-pass" {
t.Fatalf("two secrets from one provider are two needs: %v", got.Needs)
}
if len(cacheLocals) != 1 || cacheLocals[0] != "" {
t.Fatalf("the one-file consumer keeps one need with no local name: %v", got.Needs)
}
for i := range got.Needs {
got.Needs[i].Sealed = "sealed-" + got.Needs[i].Local
}