zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Migrate secret-manager tests

This commit is contained in:
Julio Castillo 2023-04-14 17:08:01 +02:00
parent a2bffc7302
commit 1927b138d6
6 changed files with 64 additions and 101 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/secret-manager/README.md
View File

@ -45,7 +45,7 @@ module "secret-manager" {
}
}
}
# tftest modules=1 resources=4
# tftest modules=1 resources=4 inventory=iam.yaml
```
### Secret versions
@ -70,7 +70,7 @@ module "secret-manager" {
}
}
}
# tftest modules=1 resources=5
# tftest modules=1 resources=5 inventory=versions.yaml
```
<!-- BEGIN TFDOC -->

46
tests/modules/secret_manager/examples/iam.yaml Normal file
View File

@ -0,0 +1,46 @@
# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
values:
module.secret-manager.google_secret_manager_secret.default["test-auto"]:
project: my-project
replication:
- automatic: true
user_managed: []
secret_id: test-auto
module.secret-manager.google_secret_manager_secret.default["test-manual"]:
project: my-project
replication:
- automatic: null
user_managed:
- replicas:
- customer_managed_encryption: []
location: europe-west1
- customer_managed_encryption: []
location: europe-west4
secret_id: test-manual
module.secret-manager.google_secret_manager_secret_iam_binding.default["test-auto.roles/secretmanager.secretAccessor"]:
condition: []
members:
- group:auto-readers@example.com
role: roles/secretmanager.secretAccessor
module.secret-manager.google_secret_manager_secret_iam_binding.default["test-manual.roles/secretmanager.secretAccessor"]:
condition: []
members:
- group:manual-readers@example.com
role: roles/secretmanager.secretAccessor
counts:
google_secret_manager_secret: 2
google_secret_manager_secret_iam_binding: 2

17
tests/modules/secret_manager/__init__.py → tests/modules/secret_manager/examples/versions.yaml
View File

@ -1,4 +1,4 @@
# Copyright 2022 Google LLC
# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@ -11,3 +11,18 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
values:
module.secret-manager.google_secret_manager_secret_version.default["test-auto:v1"]:
enabled: false
secret_data: auto foo bar baz
module.secret-manager.google_secret_manager_secret_version.default["test-auto:v2"]:
enabled: true
secret_data: auto foo bar spam
module.secret-manager.google_secret_manager_secret_version.default["test-manual:v1"]:
enabled: true
secret_data: manual foo bar spam
counts:
google_secret_manager_secret: 2
google_secret_manager_secret_version: 3

42
tests/modules/secret_manager/fixture/main.tf
View File

@ -1,42 +0,0 @@
/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
module "test" {
source = "../../../../modules/secret-manager"
project_id = "my-project"
iam = {
secret-1 = {
"roles/secretmanager.secretAccessor" = [
"serviceAccount:service-account.example.com"
]
}
secret-2 = {
"roles/secretmanager.viewer" = [
"serviceAccount:service-account.example.com"
]
}
}
secrets = {
secret-1 = ["europe-west1"],
secret-2 = null
}
versions = {
secret-1 = {
foobar = { enabled = true, data = "foobar" }
}
}
labels = var.labels
}

20
tests/modules/secret_manager/fixture/variables.tf
View File

@ -1,20 +0,0 @@
/**
* Copyright 2022 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "labels" {
type = map(map(string))
default = {}
}

36
tests/modules/secret_manager/test_plan.py
View File

@ -1,36 +0,0 @@
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
import pytest
@pytest.fixture
def resources(plan_runner):
_, resources = plan_runner()
return resources
def test_resource_count(resources):
"Test number of resources created."
assert len(resources) == 5
def test_secret_iam(resources):
"Test secret IAM binding resources."
bindings = [r['values'] for r in resources if r['type']
== 'google_secret_manager_secret_iam_binding']
assert len(bindings) == 2
assert set(b['role'] for b in bindings) == set([
'roles/secretmanager.secretAccessor', 'roles/secretmanager.viewer'
])