Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: defer webhook refresh until Tekton exists

Browse source
This commit is contained in:
eding 2026-09-06 09:51:05 +02:00
parent 62540c69a2
commit 214b00720a
2 changed files with 27 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
internal/openbao/bootstrap.go
View file

@ -330,6 +330,13 @@ func refreshExternalSecrets(kubeconfig string) error {
if err != nil { if err != nil {
return fmt.Errorf("refresh OpenBao secret store after seed: %w", err) return fmt.Errorf("refresh OpenBao secret store after seed: %w", err)
} }
webhook, err := kubectlOutput(kubeconfig, "get", "externalsecret", "forgejo-webhook", "-n", "tekton-pipelines", "--ignore-not-found", "-o=name")
if err != nil {
return fmt.Errorf("check Forgejo webhook ExternalSecret after OpenBao seed: %w", err)
}
if strings.TrimSpace(string(webhook)) == "" {
return nil
}
_, err = kubectlOutput(kubeconfig, externalSecretRefreshArgs(timestamp)...) _, err = kubectlOutput(kubeconfig, externalSecretRefreshArgs(timestamp)...)
if err != nil { if err != nil {
return fmt.Errorf("refresh ExternalSecrets after OpenBao seed: %w", err) return fmt.Errorf("refresh ExternalSecrets after OpenBao seed: %w", err)

21
internal/openbao/bootstrap_test.go
View file

@ -84,13 +84,32 @@ func TestRefreshExternalSecretsIsReadyGatedAndScoped(t *testing.T) {
if len(calls) == 1 { if len(calls) == 1 {
return []byte("True"), nil return []byte("True"), nil
} }
if len(calls) == 3 {
return []byte("externalsecret.external-secrets.io/forgejo-webhook"), nil
}
return nil, nil return nil, nil
} }
if err := refreshExternalSecrets("kubeconfig"); err != nil || len(calls) != 3 || !strings.Contains(calls[0], "get deployment/external-secrets") || !strings.Contains(calls[1], "annotate clustersecretstore openbao") || !strings.Contains(calls[2], "annotate externalsecret forgejo-webhook") || strings.Contains(calls[1], "--all") || strings.Contains(calls[2], "--all") { if err := refreshExternalSecrets("kubeconfig"); err != nil || len(calls) != 4 || !strings.Contains(calls[0], "get deployment/external-secrets") || !strings.Contains(calls[1], "annotate clustersecretstore openbao") || !strings.Contains(calls[2], "get externalsecret forgejo-webhook") || !strings.Contains(calls[3], "annotate externalsecret forgejo-webhook") || strings.Contains(calls[1], "--all") || strings.Contains(calls[3], "--all") {
t.Fatalf("ExternalSecret refresh was not readiness-gated and scoped: %q, %v", calls, err) t.Fatalf("ExternalSecret refresh was not readiness-gated and scoped: %q, %v", calls, err)
} }
} }
func TestRefreshExternalSecretsSkipsWebhookBeforeTekton(t *testing.T) {
original := kubectlOutput
t.Cleanup(func() { kubectlOutput = original })
var calls []string
kubectlOutput = func(_ string, args ...string) ([]byte, error) {
calls = append(calls, strings.Join(args, " "))
if len(calls) == 1 {
return []byte("True"), nil
}
return nil, nil
}
if err := refreshExternalSecrets("kubeconfig"); err != nil || len(calls) != 3 || !strings.Contains(calls[2], "--ignore-not-found") {
t.Fatalf("missing webhook ExternalSecret was not safely skipped: %q, %v", calls, err)
}
}
func TestReadRecoveryMaterialDecryptsAndValidatesBundle(t *testing.T) { func TestReadRecoveryMaterialDecryptsAndValidatesBundle(t *testing.T) {
original := decryptRecovery original := decryptRecovery
t.Cleanup(func() { decryptRecovery = original }) t.Cleanup(func() { decryptRecovery = original })