blob: 2b9425999c87142cc9f8fddc7a5ba400d8cd855b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
#
# Author:: Tyler Ball (<tball@chef.io>)
# Copyright:: Copyright (c) Chef Software Inc.
# License:: Apache License, Version 2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
require "spec_helper"
require "chef/knife"
require "chef/config"
require "tempfile"
class ExampleDataBagCommand < Chef::Knife
include Chef::Knife::DataBagSecretOptions
end
describe Chef::Knife::DataBagSecretOptions do
let(:example_db) do
k = ExampleDataBagCommand.new
allow(k.ui).to receive(:stdout).and_return(stdout)
k
end
let(:stdout) { StringIO.new }
let(:secret) { "abc123SECRET" }
let(:secret_file) do
sfile = Tempfile.new("encrypted_data_bag_secret")
sfile.puts(secret)
sfile.flush
sfile
end
after do
secret_file.close
secret_file.unlink
end
describe "#validate_secrets" do
it "throws an error when provided with both --secret and --secret-file on the CL" do
Chef::Config[:knife][:cl_secret_file] = secret_file.path
Chef::Config[:knife][:cl_secret] = secret
expect(example_db).to receive(:exit).with(1)
expect(example_db.ui).to receive(:fatal).with("Please specify only one of --secret, --secret-file")
example_db.validate_secrets
end
it "throws an error when provided with `secret` and `secret_file` in knife.rb" do
Chef::Config[:knife][:secret_file] = secret_file.path
Chef::Config[:knife][:secret] = secret
expect(example_db).to receive(:exit).with(1)
expect(example_db.ui).to receive(:fatal).with("Please specify only one of 'secret' or 'secret_file' in your config file")
example_db.validate_secrets
end
end
describe "#read_secret" do
it "returns the secret first" do
Chef::Config[:knife][:cl_secret] = secret
expect(example_db).to receive(:config).and_return({ secret: secret })
expect(example_db.read_secret).to eq(secret)
end
it "returns the secret_file only if secret does not exist" do
Chef::Config[:knife][:cl_secret_file] = secret_file.path
expect(example_db).to receive(:config).and_return({ secret_file: secret_file.path })
expect(Chef::EncryptedDataBagItem).to receive(:load_secret).with(secret_file.path).and_return("secret file contents")
expect(example_db.read_secret).to eq("secret file contents")
end
it "returns the secret from the knife.rb config" do
Chef::Config[:knife][:secret_file] = secret_file.path
Chef::Config[:knife][:secret] = secret
expect(example_db.read_secret).to eq(secret)
end
it "returns the secret_file from the knife.rb config only if the secret does not exist" do
Chef::Config[:knife][:secret_file] = secret_file.path
expect(Chef::EncryptedDataBagItem).to receive(:load_secret).with(secret_file.path).and_return("secret file contents")
expect(example_db.read_secret).to eq("secret file contents")
end
end
describe "#encryption_secret_provided?" do
it "returns true if the secret is passed on the CL" do
Chef::Config[:knife][:cl_secret] = secret
expect(example_db.encryption_secret_provided?).to eq(true)
end
it "returns true if the secret_file is passed on the CL" do
Chef::Config[:knife][:cl_secret_file] = secret_file.path
expect(example_db.encryption_secret_provided?).to eq(true)
end
it "returns true if --encrypt is passed on the CL and :secret is in config" do
expect(example_db).to receive(:config).and_return({ encrypt: true })
Chef::Config[:knife][:secret] = secret
expect(example_db.encryption_secret_provided?).to eq(true)
end
it "returns true if --encrypt is passed on the CL and :secret_file is in config" do
expect(example_db).to receive(:config).and_return({ encrypt: true })
Chef::Config[:knife][:secret_file] = secret_file.path
expect(example_db.encryption_secret_provided?).to eq(true)
end
it "throws an error if --encrypt is passed and there is not :secret or :secret_file in the config" do
expect(example_db).to receive(:config).and_return({ encrypt: true })
expect(example_db).to receive(:exit).with(1)
expect(example_db.ui).to receive(:fatal).with("No secret or secret_file specified in config, unable to encrypt item.")
example_db.encryption_secret_provided?
end
it "returns false if no secret is passed" do
expect(example_db).to receive(:config).and_return({})
expect(example_db.encryption_secret_provided?).to eq(false)
end
it "returns false if --encrypt is not provided and :secret is in the config" do
expect(example_db).to receive(:config).and_return({})
Chef::Config[:knife][:secret] = secret
expect(example_db.encryption_secret_provided?).to eq(false)
end
it "returns false if --encrypt is not provided and :secret_file is in the config" do
expect(example_db).to receive(:config).and_return({})
Chef::Config[:knife][:secret_file] = secret_file.path
expect(example_db.encryption_secret_provided?).to eq(false)
end
it "returns true if --encrypt is not provided, :secret is in the config and need_encrypt_flag is false" do
Chef::Config[:knife][:secret] = secret
expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(true)
end
it "returns true if --encrypt is not provided, :secret_file is in the config and need_encrypt_flag is false" do
Chef::Config[:knife][:secret_file] = secret_file.path
expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(true)
end
it "returns false if --encrypt is not provided and need_encrypt_flag is false" do
expect(example_db.encryption_secret_provided_ignore_encrypt_flag?).to eq(false)
end
end
end
|
