github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-27 13:37:30 +00:00
Code Issues Projects Releases Wiki Activity

[KMS]: update envelope caching unit tests

Browse Source 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
This commit is contained in:
Anish Ramasekar 2022-09-15 18:01:48 +00:00
parent 661899f1a1
commit 92dce5de71
No known key found for this signature in database
GPG Key ID: F1F7F3518F1ECB0C
2 changed files with 48 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/envelope_test.go
View File

@ -83,6 +83,7 @@ func TestEnvelopeCaching(t *testing.T) {
desc string desc string
cacheSize int cacheSize int
simulateKMSPluginFailure bool simulateKMSPluginFailure bool
expectedError string
}{ }{
{ {
desc: "positive cache size should withstand plugin failure", desc: "positive cache size should withstand plugin failure",
@ -92,6 +93,13 @@ func TestEnvelopeCaching(t *testing.T) {
{ {
desc: "cache disabled size should not withstand plugin failure", desc: "cache disabled size should not withstand plugin failure",
cacheSize: 0, cacheSize: 0,
simulateKMSPluginFailure: true,
expectedError: "Envelope service was disabled",
},
{
desc: "cache disabled, no plugin failure should succeed",
cacheSize: 0,
simulateKMSPluginFailure: false,
}, },
} }
@ -119,13 +127,21 @@ func TestEnvelopeCaching(t *testing.T) {
} }
envelopeService.SetDisabledStatus(tt.simulateKMSPluginFailure) envelopeService.SetDisabledStatus(tt.simulateKMSPluginFailure)
// Subsequent read for the same data should work fine due to caching.
untransformedData, _, err = envelopeTransformer.TransformFromStorage(ctx, transformedData, dataCtx) untransformedData, _, err = envelopeTransformer.TransformFromStorage(ctx, transformedData, dataCtx)
if tt.expectedError != "" {
if err == nil {
t.Fatalf("expected error: %v, got nil", tt.expectedError)
}
if err.Error() != tt.expectedError {
t.Fatalf("expected error: %v, got: %v", tt.expectedError, err)
}
} else {
if err != nil { if err != nil {
t.Fatalf("could not decrypt Envelope transformer's encrypted data using just cache: %v", err) t.Fatalf("unexpected error: %v", err)
} }
if !bytes.Equal(untransformedData, originalText) { if !bytes.Equal(untransformedData, originalText) {
t.Fatalf("envelopeTransformer transformed data incorrectly using cache. Got: %v, want %v", untransformedData, originalText) t.Fatalf("envelopeTransformer transformed data incorrectly. Expected: %v, got %v", originalText, untransformedData)
}
} }
}) })
} }

22
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/envelope_test.go
View File

@ -95,6 +95,7 @@ func TestEnvelopeCaching(t *testing.T) {
desc string desc string
cacheSize int cacheSize int
simulateKMSPluginFailure bool simulateKMSPluginFailure bool
expectedError string
}{ }{
{ {
desc: "positive cache size should withstand plugin failure", desc: "positive cache size should withstand plugin failure",
@ -104,6 +105,13 @@ func TestEnvelopeCaching(t *testing.T) {
{ {
desc: "cache disabled size should not withstand plugin failure", desc: "cache disabled size should not withstand plugin failure",
cacheSize: 0, cacheSize: 0,
simulateKMSPluginFailure: true,
expectedError: "failed to decrypt DEK, error: Envelope service was disabled",
},
{
desc: "cache disabled, no plugin failure should succeed",
cacheSize: 0,
simulateKMSPluginFailure: false,
}, },
} }
@ -131,13 +139,21 @@ func TestEnvelopeCaching(t *testing.T) {
} }
envelopeService.SetDisabledStatus(tt.simulateKMSPluginFailure) envelopeService.SetDisabledStatus(tt.simulateKMSPluginFailure)
// Subsequent read for the same data should work fine due to caching.
untransformedData, _, err = envelopeTransformer.TransformFromStorage(ctx, transformedData, dataCtx) untransformedData, _, err = envelopeTransformer.TransformFromStorage(ctx, transformedData, dataCtx)
if tt.expectedError != "" {
if err == nil {
t.Fatalf("expected error: %v, got nil", tt.expectedError)
}
if err.Error() != tt.expectedError {
t.Fatalf("expected error: %v, got: %v", tt.expectedError, err)
}
} else {
if err != nil { if err != nil {
t.Fatalf("could not decrypt Envelope transformer's encrypted data using just cache: %v", err) t.Fatalf("unexpected error: %v", err)
} }
if !bytes.Equal(untransformedData, originalText) { if !bytes.Equal(untransformedData, originalText) {
t.Fatalf("envelopeTransformer transformed data incorrectly using cache. Got: %v, want %v", untransformedData, originalText) t.Fatalf("envelopeTransformer transformed data incorrectly. Expected: %v, got %v", originalText, untransformedData)
}
} }
}) })
} }