Skip to content

Strengthen CA bundle injection update tests to also verify corrupted injected key is re-stomped #347

@coderabbitai

Description

@coderabbitai

Summary

The e2e helpers editConfigMapCABundleInjectionData and editSecretCABundleInjectionData in test/e2e/e2e.go currently test the injector's exclusive-ownership contract by adding a foreign "foo" key and asserting it is removed. This verifies that the injector "stomps" the object back to a single controlled entry, but does not verify that a corrupted value for the injected key (api.InjectionDataKey / service-ca.crt) is also restored.

Desired change

Both helpers should be strengthened symmetrically to additionally overwrite secretCopy.Data[api.InjectionDataKey] (or cmCopy.Data[api.InjectionDataKey]) with a known-bad value and poll until it is reverted to the correct CA bundle. This would cover the scenario where the injected entry itself is tampered with.

The change should be made to both helpers in the same PR to keep the two resource types in sync:

  • editConfigMapCABundleInjectionData in test/e2e/e2e.go
  • editSecretCABundleInjectionData in test/e2e/e2e.go

Background

Discussed in PR #265 (adding Secret CA bundle injection support) at:
#265 (comment)

Requested by @mnencia.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions