2023-11-10 10:42:44 +00:00
|
|
|
import ipaddress
|
2023-09-19 19:48:39 +00:00
|
|
|
from typing import TYPE_CHECKING
|
|
|
|
|
|
|
|
import pytest
|
|
|
|
from cli import Cli
|
2023-10-16 13:03:53 +00:00
|
|
|
from fixtures_flakes import FlakeForTest
|
2023-09-19 19:48:39 +00:00
|
|
|
|
|
|
|
from clan_cli.machines.facts import machine_get_fact
|
|
|
|
from clan_cli.secrets.folders import sops_secrets_folder
|
|
|
|
from clan_cli.secrets.secrets import has_secret
|
|
|
|
|
|
|
|
if TYPE_CHECKING:
|
|
|
|
from age_keys import KeyPair
|
|
|
|
|
|
|
|
|
|
|
|
@pytest.mark.impure
|
2023-09-29 16:30:11 +00:00
|
|
|
def test_generate_secret(
|
2023-09-19 19:48:39 +00:00
|
|
|
monkeypatch: pytest.MonkeyPatch,
|
2023-10-16 13:03:53 +00:00
|
|
|
test_flake_with_core: FlakeForTest,
|
2023-09-19 19:48:39 +00:00
|
|
|
age_keys: list["KeyPair"],
|
|
|
|
) -> None:
|
2023-10-14 12:57:36 +00:00
|
|
|
monkeypatch.chdir(test_flake_with_core.path)
|
2023-09-19 19:48:39 +00:00
|
|
|
monkeypatch.setenv("SOPS_AGE_KEY", age_keys[0].privkey)
|
|
|
|
cli = Cli()
|
2023-10-23 20:34:43 +00:00
|
|
|
cli.run(
|
|
|
|
[
|
|
|
|
"secrets",
|
|
|
|
"users",
|
|
|
|
"add",
|
2024-05-29 08:10:10 +00:00
|
|
|
"--flake",
|
|
|
|
str(test_flake_with_core.path),
|
2023-10-23 20:34:43 +00:00
|
|
|
"user1",
|
|
|
|
age_keys[0].pubkey,
|
|
|
|
]
|
|
|
|
)
|
2024-02-16 16:03:14 +00:00
|
|
|
cli.run(
|
|
|
|
[
|
|
|
|
"secrets",
|
|
|
|
"groups",
|
|
|
|
"add-user",
|
2024-05-29 08:10:10 +00:00
|
|
|
"--flake",
|
|
|
|
str(test_flake_with_core.path),
|
2024-02-16 16:03:14 +00:00
|
|
|
"admins",
|
|
|
|
"user1",
|
|
|
|
]
|
|
|
|
)
|
2024-05-29 08:10:10 +00:00
|
|
|
cmd = ["facts", "generate", "--flake", str(test_flake_with_core.path), "vm1"]
|
2024-01-11 20:48:39 +00:00
|
|
|
cli.run(cmd)
|
2023-11-03 11:51:17 +00:00
|
|
|
has_secret(test_flake_with_core.path, "vm1-age.key")
|
|
|
|
has_secret(test_flake_with_core.path, "vm1-zerotier-identity-secret")
|
2023-11-14 11:58:15 +00:00
|
|
|
has_secret(test_flake_with_core.path, "vm1-zerotier-subnet")
|
2023-10-14 12:57:36 +00:00
|
|
|
network_id = machine_get_fact(
|
2023-11-15 13:28:40 +00:00
|
|
|
test_flake_with_core.path, "vm1", "zerotier-network-id"
|
2023-10-14 12:57:36 +00:00
|
|
|
)
|
2023-09-26 15:31:45 +00:00
|
|
|
assert len(network_id) == 16
|
2023-11-10 10:42:44 +00:00
|
|
|
secrets_folder = sops_secrets_folder(test_flake_with_core.path)
|
|
|
|
age_key = secrets_folder / "vm1-age.key" / "secret"
|
|
|
|
identity_secret = secrets_folder / "vm1-zerotier-identity-secret" / "secret"
|
2023-09-19 19:48:39 +00:00
|
|
|
age_key_mtime = age_key.lstat().st_mtime_ns
|
2023-09-26 15:31:45 +00:00
|
|
|
secret1_mtime = identity_secret.lstat().st_mtime_ns
|
2023-09-19 19:48:39 +00:00
|
|
|
|
2024-04-15 19:06:03 +00:00
|
|
|
# test idempotency for vm1 and also generate for vm2
|
2024-05-29 08:10:10 +00:00
|
|
|
cli.run(["facts", "generate", "--flake", str(test_flake_with_core.path)])
|
2023-09-19 19:48:39 +00:00
|
|
|
assert age_key.lstat().st_mtime_ns == age_key_mtime
|
2023-09-26 15:31:45 +00:00
|
|
|
assert identity_secret.lstat().st_mtime_ns == secret1_mtime
|
2023-09-28 15:57:44 +00:00
|
|
|
|
2023-11-10 10:42:44 +00:00
|
|
|
assert (
|
|
|
|
secrets_folder / "vm1-zerotier-identity-secret" / "machines" / "vm1"
|
|
|
|
).exists()
|
|
|
|
|
|
|
|
assert has_secret(test_flake_with_core.path, "vm2-age.key")
|
|
|
|
assert has_secret(test_flake_with_core.path, "vm2-zerotier-identity-secret")
|
2023-11-15 13:28:40 +00:00
|
|
|
ip = machine_get_fact(test_flake_with_core.path, "vm1", "zerotier-ip")
|
2023-11-10 10:42:44 +00:00
|
|
|
assert ipaddress.IPv6Address(ip).is_private
|