Test producer-managed secret connections end to end - #12800
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
There was a problem hiding this comment.
Pull request overview
Adds an end-to-end functional test that validates “managed secret outputs via connections” for a Recipe-backed Redis producer and a connected Container consumer, ensuring secret values remain secret-backed (Kubernetes secretKeyRef) and are not leaked into producer state or pod specs.
Changes:
- Added a dedicated Bicep fixture that pins Recipes to
resource-types-contrib:edgeto exercise managed secret connection behavior. - Added a Go functional test that deploys Redis + Container, asserts the deterministic managed
Radius.Security/secretsresource + Kubernetes Secret exist, and verifies env var injection usessecretKeyRef(including init containers) without plaintext leakage.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| test/functional-portable/corerp/noncloud/resources/testdata/corerp-resources-container-managed-secret.bicep | New fixture wiring Redis producer + Container consumer via a dedicated recipe pack and connection. |
| test/functional-portable/corerp/noncloud/resources/container_managed_secret_test.go | New functional test that validates managed secret resource creation, Kubernetes Secret materialization, and secretKeyRef-based env var projection (no plaintext in pod spec). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #12800 +/- ##
==========================================
- Coverage 59.82% 59.82% -0.01%
==========================================
Files 779 779
Lines 46058 46058
==========================================
- Hits 27554 27553 -1
- Misses 18504 18505 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Functional Tests - corerp-noncloud192 tests +2 188 ✅ +2 59m 49s ⏱️ - 14m 22s For more details on these failures, see this check. Results for commit 07a666f. ± Comparison against base commit 2062d27. ♻️ This comment has been updated with latest results. |
9c43231 to
1f9ec2f
Compare
willdavsmith
changed the title
nithyatsu
left a comment
nithyatsu
left a comment
There was a problem hiding this comment.
Nice, focused test — the plaintext-leak assertions (producer secrets map has no url, and the pod spec doesn't contain the decoded value) are exactly the right checks, and the namespace/workspace wiring all holds up.
One substantive gap plus a few nits inline.
Missing the delete half of "end to end"
Materializer.Delete is part of the managed-secret contract, but nothing here asserts that the managed Radius.Security/secrets resource and its backing Kubernetes Secret are actually removed when the producer/application is deleted.
Note that listing the managed secret in RPResources does not cover this: validation.DeleteRPResource no-ops for radius.security/secrets (it falls through to the "cleaned up via cascade delete" branch), so the delete path is never directly exercised or verified.
A PostDeleteVerify that asserts both are gone would close the highest-value remaining gap:
PostDeleteVerify: func(ctx context.Context, t *testing.T, test rp.RPTest) {
_, err := test.Options.ManagementClient.GetResource(ctx, "Radius.Security/secrets", managedSecretName)
require.Error(t, err, "managed Radius.Security/secrets resource should be deleted with its owner")
_, err = test.Options.K8sClient.CoreV1().Secrets(name).Get(ctx, managedSecretName, metav1.GetOptions{})
require.True(t, apierrors.IsNotFound(err), "backing Kubernetes Secret should be deleted with its owner")
},(PostDeleteVerify is on RPTest, not TestStep, and it's skipped under RADIUS_TEST_FAST_CLEANUP=true — worth confirming the non-cloud workflow doesn't set that, otherwise the assertion silently never runs in CI.)
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
5a5cb45 to
47a3f94
Compare
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
Summary
outputs.secretsRadius.Security/secretsresource and backing Kubernetes SecretCONNECTION_REDIS_HOST/PORTvalues and secret-backedCONNECTION_REDIS_URLthroughsecretKeyReffor regular and init containersCompatibility
The required control-plane support from #12709 and Kubernetes Container Recipe support from radius-project/resource-types-contrib#300 are both merged. The dedicated Recipe Pack selects the published
ghcr.io/radius-project/kube-recipes/{containers,rediscaches,secrets}:edgeartifacts used by Radius edge/PR functional coverage, so the test exercises the coordinated Radius/contrib contract directly.The backing Kubernetes Secret is validated by its deterministic resource name because managed Secrets do not carry selector labels matching the managed Radius Secret resource name. Post-step verification also reads the Secret directly and validates its
urldata key.Validation
gofmt -w test/functional-portable/corerp/noncloud/resources/container_managed_secret_test.gogo test ./test/functional-portable/corerp/noncloud/resources -run '^$'go test ./test/validation~/.rad/bin/bicep format test/functional-portable/corerp/noncloud/resources/testdata/corerp-resources-container-managed-secret.bicep~/.rad/bin/bicep build test/functional-portable/corerp/noncloud/resources/testdata/corerp-resources-container-managed-secret.bicep --stdoutgit diff --checkcorerp-noncloud