Skip to content

Commit

Permalink
feat: crl kmp support
Browse files Browse the repository at this point in the history 
Signed-off-by: Juncheng Zhu <[email protected]>
  • Loading branch information
@junczhu
junczhu committed Dec 10, 2024
1 parent deafb4a commit dfd6adf
Show file tree
Hide file tree
Showing 10 changed files with 689 additions and 29 deletions.
14 changes: 7 additions & 7 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,8 @@ require (
github.com/golang/protobuf v1.5.4
github.com/google/go-containerregistry v0.20.2
github.com/gorilla/mux v1.8.1
github.com/notaryproject/notation-core-go v1.1.0
github.com/notaryproject/notation-go v1.2.1
github.com/notaryproject/notation-core-go v1.2.0-rc.1
github.com/notaryproject/notation-go v1.3.0-rc.1
github.com/notaryproject/notation-plugin-framework-go v1.0.0
github.com/open-policy-agent/cert-controller v0.8.0
github.com/open-policy-agent/frameworks/constraint v0.0.0-20230411224310-3f237e2710fa
Expand Down Expand Up @@ -234,14 +234,14 @@ require (
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
golang.org/x/crypto v0.26.0
golang.org/x/crypto v0.27.0
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
golang.org/x/mod v0.20.0 // indirect
golang.org/x/mod v0.21.0 // indirect
golang.org/x/net v0.28.0 // indirect
golang.org/x/oauth2 v0.22.0 // indirect
golang.org/x/sys v0.23.0 // indirect
golang.org/x/term v0.23.0 // indirect
golang.org/x/text v0.17.0 // indirect
golang.org/x/sys v0.25.0 // indirect
golang.org/x/term v0.24.0 // indirect
golang.org/x/text v0.18.0 // indirect
golang.org/x/time v0.6.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.3.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
28 changes: 14 additions & 14 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -516,10 +516,10 @@ github.com/mozillazg/docker-credential-acr-helper v0.3.0/go.mod h1:cZlu3tof523uj
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
github.com/notaryproject/notation-core-go v1.1.0 h1:xCybcONOKcCyPNihJUSa+jRNsyQFNkrk0eJVVs1kWeg=
github.com/notaryproject/notation-core-go v1.1.0/go.mod h1:+6AOh41JPrnVLbW/19SJqdhVHwKgIINBO/np0e7nXJA=
github.com/notaryproject/notation-go v1.2.1 h1:fbCMBcvg1xttrisd5CyM60QDectGYYF701Us0M3cKN8=
github.com/notaryproject/notation-go v1.2.1/go.mod h1:re9V+TfuNRaUq5e3NuNcCJN53++sL2KbnJrjGyOUpgE=
github.com/notaryproject/notation-core-go v1.2.0-rc.1 h1:VMFlG+9a1JoNAQ3M96g8iqCq0cDRtE7XBaiTD8Ouvqw=
github.com/notaryproject/notation-core-go v1.2.0-rc.1/go.mod h1:b/70rA4OgOHlg0A7pb8zTWKJadFO6781zS3a37KHEJQ=
github.com/notaryproject/notation-go v1.3.0-rc.1 h1:pm9tdUy2tWYqlwyRDZyKXgLwAscDATPUYv0ul2RK/Iw=
github.com/notaryproject/notation-go v1.3.0-rc.1/go.mod h1:W4o45yolX4Q+3PKlcpGleLLXEKWHa3BshEqw/JX5c6I=
github.com/notaryproject/notation-plugin-framework-go v1.0.0 h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4=
github.com/notaryproject/notation-plugin-framework-go v1.0.0/go.mod h1:RqWSrTOtEASCrGOEffq0n8pSg2KOgKYiWqFWczRSics=
github.com/notaryproject/tspclient-go v0.2.0 h1:g/KpQGmyk/h7j60irIRG1mfWnibNOzJ8WhLqAzuiQAQ=
Expand Down Expand Up @@ -780,8 +780,8 @@ golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
Expand All @@ -792,8 +792,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
Expand Down Expand Up @@ -871,8 +871,8 @@ golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
Expand All @@ -883,8 +883,8 @@ golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
golang.org/x/term v0.24.0 h1:Mh5cbb+Zk2hqqXNO7S1iTjEphVL+jb8ZWaqh/g+JWkM=
golang.org/x/term v0.24.0/go.mod h1:lOBK/LVxemqiMij05LGJ0tzNr8xlmwBRJ81PX6wVLH8=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
Expand All @@ -897,8 +897,8 @@ golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
Expand Down
12 changes: 12 additions & 0 deletions pkg/keymanagementprovider/refresh/kubeRefresh.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import (

re "github.com/ratify-project/ratify/errors"
kmp "github.com/ratify-project/ratify/pkg/keymanagementprovider"
nv "github.com/ratify-project/ratify/pkg/verifier/notation"
"github.com/sirupsen/logrus"
ctrl "sigs.k8s.io/controller-runtime"
)
Expand All @@ -35,6 +36,7 @@ type KubeRefresher struct {
Resource string
Result ctrl.Result
Status kmp.KeyManagementProviderStatus
CRLHandler nv.RevocationFactory
}

// Register registers the kubeRefresher factory
Expand All @@ -54,6 +56,15 @@ func (kr *KubeRefresher) Refresh(ctx context.Context) error {
return kmpErr
}

// fetch CRLs and cache them
crlFetcher, err := kr.CRLHandler.NewFetcher()
if err != nil {
// log error and continue
logger.Warnf("Unable to create CRL fetcher for key management provider %s of type %s with error: %v", kr.Resource, kr.ProviderType, err)
}
for _, cert := range certificates {
nv.CacheCRL(ctx, cert, crlFetcher)
}
// fetch keys and store in map
keys, keyAttributes, err := kr.Provider.GetKeys(ctx)
if err != nil {
Expand Down Expand Up @@ -109,5 +120,6 @@ func (kr *KubeRefresher) Create(config RefresherConfig) (Refresher, error) {
ProviderType: config.ProviderType,
ProviderRefreshInterval: config.ProviderRefreshInterval,
Resource: config.Resource,
CRLHandler: nv.NewCRLHandler(),
}, nil
}
49 changes: 46 additions & 3 deletions pkg/keymanagementprovider/refresh/kubeRefresh_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,14 +21,19 @@ import (
"crypto"
"crypto/x509"
"errors"
"net/http"
"reflect"
"testing"
"time"

"github.com/notaryproject/notation-core-go/revocation"
corecrl "github.com/notaryproject/notation-core-go/revocation/crl"
re "github.com/ratify-project/ratify/errors"
"github.com/ratify-project/ratify/pkg/keymanagementprovider"
"github.com/ratify-project/ratify/pkg/keymanagementprovider/config"
_ "github.com/ratify-project/ratify/pkg/keymanagementprovider/inline"
mock "github.com/ratify-project/ratify/pkg/keymanagementprovider/mocks"
nv "github.com/ratify-project/ratify/pkg/verifier/notation"
ctrl "sigs.k8s.io/controller-runtime"
)

Expand All @@ -41,6 +46,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
GetCertsFunc func(_ context.Context) (map[keymanagementprovider.KMPMapKey][]*x509.Certificate, keymanagementprovider.KeyManagementProviderStatus, error)
GetKeysFunc func(_ context.Context) (map[keymanagementprovider.KMPMapKey]crypto.PublicKey, keymanagementprovider.KeyManagementProviderStatus, error)
IsRefreshableFunc func() bool
NewCRLHandler nv.RevocationFactory
expectedResult ctrl.Result
expectedError bool
}{
Expand All @@ -49,6 +55,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
providerRawParameters: []byte(`{"contentType": "certificate", "value": "-----BEGIN CERTIFICATE-----\nMIID2jCCAsKgAwIBAgIQXy2VqtlhSkiZKAGhsnkjbDANBgkqhkiG9w0BAQsFADBvMRswGQYDVQQD\nExJyYXRpZnkuZXhhbXBsZS5jb20xDzANBgNVBAsTBk15IE9yZzETMBEGA1UEChMKTXkgQ29tcGFu\neTEQMA4GA1UEBxMHUmVkbW9uZDELMAkGA1UECBMCV0ExCzAJBgNVBAYTAlVTMB4XDTIzMDIwMTIy\nNDUwMFoXDTI0MDIwMTIyNTUwMFowbzEbMBkGA1UEAxMScmF0aWZ5LmV4YW1wbGUuY29tMQ8wDQYD\nVQQLEwZNeSBPcmcxEzARBgNVBAoTCk15IENvbXBhbnkxEDAOBgNVBAcTB1JlZG1vbmQxCzAJBgNV\nBAgTAldBMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL10bM81\npPAyuraORABsOGS8M76Bi7Guwa3JlM1g2D8CuzSfSTaaT6apy9GsccxUvXd5cmiP1ffna5z+EFmc\nizFQh2aq9kWKWXDvKFXzpQuhyqD1HeVlRlF+V0AfZPvGt3VwUUjNycoUU44ctCWmcUQP/KShZev3\n6SOsJ9q7KLjxxQLsUc4mg55eZUThu8mGB8jugtjsnLUYvIWfHhyjVpGrGVrdkDMoMn+u33scOmrt\nsBljvq9WVo4T/VrTDuiOYlAJFMUae2Ptvo0go8XTN3OjLblKeiK4C+jMn9Dk33oGIT9pmX0vrDJV\nX56w/2SejC1AxCPchHaMuhlwMpftBGkCAwEAAaNyMHAwDgYDVR0PAQH/BAQDAgeAMAkGA1UdEwQC\nMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU0eaKkZj+MS9jCp9Dg1zdv3v/aKww\nHQYDVR0OBBYEFNHmipGY/jEvYwqfQ4Nc3b97/2isMA0GCSqGSIb3DQEBCwUAA4IBAQBNDcmSBizF\nmpJlD8EgNcUCy5tz7W3+AAhEbA3vsHP4D/UyV3UgcESx+L+Nye5uDYtTVm3lQejs3erN2BjW+ds+\nXFnpU/pVimd0aYv6mJfOieRILBF4XFomjhrJOLI55oVwLN/AgX6kuC3CJY2NMyJKlTao9oZgpHhs\nLlxB/r0n9JnUoN0Gq93oc1+OLFjPI7gNuPXYOP1N46oKgEmAEmNkP1etFrEjFRgsdIFHksrmlOlD\nIed9RcQ087VLjmuymLgqMTFX34Q3j7XgN2ENwBSnkHotE9CcuGRW+NuiOeJalL8DBmFXXWwHTKLQ\nPp5g6m1yZXylLJaFLKz7tdMmO355\n-----END CERTIFICATE-----\n"}`),
providerType: "inline",
IsRefreshableFunc: func() bool { return false },
NewCRLHandler: nv.NewCRLHandler(),
expectedResult: ctrl.Result{},
expectedError: false,
},
Expand All @@ -57,6 +64,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
providerRawParameters: []byte(`{"vaultURI": "https://yourkeyvault.vault.azure.net/", "certificates": [{"name": "cert1", "version": "1"}], "tenantID": "yourtenantID", "clientID": "yourclientID"}`),
providerType: "test-kmp",
providerRefreshInterval: "",
NewCRLHandler: nv.NewCRLHandler(),
IsRefreshableFunc: func() bool { return true },
expectedResult: ctrl.Result{},
expectedError: false,
Expand All @@ -66,6 +74,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
providerRawParameters: []byte(`{"vaultURI": "https://yourkeyvault.vault.azure.net/", "certificates": [{"name": "cert1", "version": "1"}], "tenantID": "yourtenantID", "clientID": "yourclientID"}`),
providerType: "test-kmp",
providerRefreshInterval: "1m",
NewCRLHandler: nv.NewCRLHandler(),
IsRefreshableFunc: func() bool { return true },
expectedResult: ctrl.Result{RequeueAfter: time.Minute},
expectedError: false,
Expand All @@ -75,6 +84,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
providerRawParameters: []byte(`{"vaultURI": "https://yourkeyvault.vault.azure.net/", "certificates": [{"name": "cert1", "version": "1"}], "tenantID": "yourtenantID", "clientID": "yourclientID"}`),
providerType: "test-kmp",
providerRefreshInterval: "1mm",
NewCRLHandler: nv.NewCRLHandler(),
IsRefreshableFunc: func() bool { return true },
expectedResult: ctrl.Result{},
expectedError: true,
Expand All @@ -88,6 +98,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
providerRawParameters: []byte(`{"vaultURI": "https://yourkeyvault.vault.azure.net/", "certificates": [{"name": "cert1", "version": "1"}], "tenantID": "yourtenantID", "clientID": "yourclientID"}`),
providerType: "test-kmp-error",
IsRefreshableFunc: func() bool { return true },
NewCRLHandler: nv.NewCRLHandler(),
expectedError: true,
},
{
Expand All @@ -99,14 +110,29 @@ func TestKubeRefresher_Refresh(t *testing.T) {
providerRawParameters: []byte(`{"vaultURI": "https://yourkeyvault.vault.azure.net/", "certificates": [{"name": "cert1", "version": "1"}], "tenantID": "yourtenantID", "clientID": "yourclientID"}`),
providerType: "test-kmp-error",
IsRefreshableFunc: func() bool { return true },
NewCRLHandler: nv.NewCRLHandler(),
expectedError: true,
},
{
name: "Error Caching with CRL Fetcher (non-blocking)",
GetCertsFunc: func(_ context.Context) (map[keymanagementprovider.KMPMapKey][]*x509.Certificate, keymanagementprovider.KeyManagementProviderStatus, error) {
return map[keymanagementprovider.KMPMapKey][]*x509.Certificate{
{Name: "sample"}: {&x509.Certificate{}},
}, keymanagementprovider.KeyManagementProviderStatus{}, nil
},
providerRawParameters: []byte(`{"vaultURI": "https://yourkeyvault.vault.azure.net/", "certificates": [{"name": "cert1", "version": "1"}], "tenantID": "yourtenantID", "clientID": "yourclientID"}`),
providerType: "test-kmp",
providerRefreshInterval: "1m",
IsRefreshableFunc: func() bool { return true },
NewCRLHandler: &MockCRLHandler{CacheEnabled: true, httpClient: &http.Client{}},
expectedResult: ctrl.Result{RequeueAfter: time.Minute},
expectedError: false,
},
}

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
var factory mock.TestKeyManagementProviderFactory

if tt.GetCertsFunc != nil {
factory = mock.TestKeyManagementProviderFactory{
GetCertsFunc: tt.GetCertsFunc,
Expand All @@ -130,6 +156,7 @@ func TestKubeRefresher_Refresh(t *testing.T) {
ProviderType: tt.providerType,
ProviderRefreshInterval: tt.providerRefreshInterval,
Resource: "kmpname",
CRLHandler: tt.NewCRLHandler,
}

err := kr.Refresh(context.Background())
Expand All @@ -144,9 +171,24 @@ func TestKubeRefresher_Refresh(t *testing.T) {
}
}

type MockCRLHandler struct {
CacheEnabled bool
Fetcher corecrl.Fetcher
httpClient *http.Client
}

func (h *MockCRLHandler) NewFetcher() (corecrl.Fetcher, error) {
return nil, re.ErrorCodeConfigInvalid.WithDetail("failed to create CRL fetcher")
}

func (h *MockCRLHandler) NewValidator(_ revocation.Options) (revocation.Validator, error) {
return nil, nil
}

func TestKubeRefresher_GetResult(t *testing.T) {
kr := &KubeRefresher{
Result: ctrl.Result{RequeueAfter: time.Minute},
Result: ctrl.Result{RequeueAfter: time.Minute},
CRLHandler: nv.NewCRLHandler(),
}

result := kr.GetResult()
Expand All @@ -162,6 +204,7 @@ func TestKubeRefresher_GetStatus(t *testing.T) {
"attribute1": "value1",
"attribute2": "value2",
},
CRLHandler: nv.NewCRLHandler(),
}

status := kr.GetStatus()
Expand Down Expand Up @@ -210,7 +253,7 @@ func TestKubeRefresher_Create(t *testing.T) {

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
kr := &KubeRefresher{}
kr := &KubeRefresher{CRLHandler: nv.NewCRLHandler()}
refresher, err := kr.Create(tt.config)
if err != nil {
t.Fatalf("Expected no error, but got %v", err)
Expand Down
Loading

0 comments on commit dfd6adf

Please sign in to comment.