coulomb/ops-mason
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Plan Qonto Kubernetes credential lane

Browse source
This commit is contained in:
tegwick 2026-07-27 02:06:59 +02:00
parent 3125e94219
commit 8d89611b22
3 changed files with 223 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

58
tests/test_executor.py
View file

@ -7,8 +7,10 @@ from ops_mason.executor import (
AppRoleKVSpec,
BuildError,
BuildRefused,
KubernetesKVSpec,
_policy_hcl,
build_approle_kv_lane,
build_kubernetes_kv_lane,
)
@ -146,3 +148,59 @@ def test_bao_failure_raises_build_error(tmp_path) -> None:
with patch("ops_mason.executor.subprocess.run", return_value=fake_result):
with pytest.raises(BuildError, match="permission denied"):
build_approle_kv_lane(plan, spec)
def _kubernetes_spec(tmp_path) -> KubernetesKVSpec:
return KubernetesKVSpec(
policy_name="workload-kv-read-binky-qonto-api",
role_name="external-secrets-rapp-qonto",
service_account_names=("external-secrets",),
service_account_namespaces=("external-secrets",),
audit_log_path=tmp_path / "audit.jsonl",
)
def test_kubernetes_lane_refusal_never_calls_bao(tmp_path) -> None:
plan = _plan(tmp_path, status="reviewed", approved_by=None, approved_at=None)
with patch("ops_mason.executor.subprocess.run") as run:
with pytest.raises(BuildRefused):
build_kubernetes_kv_lane(plan, _kubernetes_spec(tmp_path))
run.assert_not_called()
def test_kubernetes_lane_builds_exact_service_account_binding(tmp_path) -> None:
plan = _plan(tmp_path)
spec = _kubernetes_spec(tmp_path)
result = MagicMock(returncode=0, stderr="", stdout="")
with (
patch("ops_mason.executor.subprocess.run", return_value=result) as run,
patch("ops_mason.executor.record_build") as audit,
):
objects = build_kubernetes_kv_lane(plan, spec)
command = run.call_args.args[0]
assert command == [
"bao",
"write",
"auth/kubernetes/role/external-secrets-rapp-qonto",
"bound_service_account_names=external-secrets",
"bound_service_account_namespaces=external-secrets",
"policies=workload-kv-read-binky-qonto-api",
"ttl=15m",
]
assert objects["kubernetes_role_name"] == "external-secrets-rapp-qonto"
audit.assert_called_once()
def test_kubernetes_lane_requires_nonempty_bindings(tmp_path) -> None:
plan = _plan(tmp_path)
spec = KubernetesKVSpec(
policy_name="policy",
role_name="role",
service_account_names=(),
service_account_namespaces=("external-secrets",),
)
with patch("ops_mason.executor.subprocess.run") as run:
with pytest.raises(BuildRefused, match="explicit service account"):
build_kubernetes_kv_lane(plan, spec)
run.assert_not_called()