You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
It would be very helpful for users of the Application Namespace Helm chart to
validate that the values configured for
CONJUR_ACCOUNT
CONJUR_AUTHN_URL
in the Conjur Connect ConfigMap are valid and can be trusted when applications mount
this ConfigMap and subsequently try to connect with Conjur.
This will allow for quick isolation of misconfigurations.
This issue builds on the framework created in Issue #289. For an overview of the Namespace prep
Helm chart Helm test framework, refer to Issue #289.
Validation can be done by comparing configured values with corresponding values
that can be read from the /info Conjur API endpoint. Since this endpoint is currently only available for
Conjur Enterprise, this feature will only work with Conjur Enterprise instances.
Describe the solution you would like
Addition of conjur.type (can be "oss" or "enterprise") to chart values
A conjur.type field should be added to the chart's values.yaml file.
The default setting for this value will be "oss".
Expecting /info access vs. "best effort"
When conjur.type is explicitly set to "enterprise", this will signify that the /info
endpoint is expected to work, and a lack of response is a failure.
When conjur.type is not explicitly set to "enterprise", then access to /info
endpoint will be "best effort". That is, an attempt will be made to to access the /info endpoint. Failure to access this endpoint will not be considered a
test failure.
Parsing /info endpoint data and validating
When access to the /info endpoint is successful, the returned data
will be parsed for:
Conjur account
Enabled authn-k8s authenticator IDs
If the actual Conjur account does not match the conjurAccount value in the Golden ConfigMap,
then a test failure is declared.
If the enabled authn-k8s authenticator IDs do not contain the authnK8sAuthenticatorID
value in the Golden ConfigMap, then a test failure is declared.
Test results
Test failures must appear in the command line output of the helm test ... command.
The output should be clear about which value has been misconfigured.
Test environments
Testing must be done both with Conjur OSS instance and a Conjur Enterprise instance.
DoD
-[ ] conjur.type added to chart values, defaulting to "oss"
-[ ] A JSON schema validation is added to values.schema.json for this new field
-[ ] Test cases added to Namespace prep Helm chart test
-[ ] Testing performed on both Conjur OSS and Conjur Enterprise setup
-[ ] Helm test passes for "happy path" valid values
-[ ] Helm test fails for incorrect CONJUR_ACCOUNT, and failure is clear on command line output
-[ ] Helm test fails for incorrect CONJUR_AUTHN_URL, and failure is clear on command line output
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
It would be very helpful for users of the Application Namespace Helm chart to
validate that the values configured for
in the Conjur Connect ConfigMap are valid and can be trusted when applications mount
this ConfigMap and subsequently try to connect with Conjur.
This will allow for quick isolation of misconfigurations.
This issue builds on the framework created in Issue #289. For an overview of the Namespace prep
Helm chart Helm test framework, refer to Issue #289.
Validation can be done by comparing configured values with corresponding values
that can be read from the
/info
Conjur API endpoint. Since this endpoint is currently only available forConjur Enterprise, this feature will only work with Conjur Enterprise instances.
Describe the solution you would like
Addition of
conjur.type
(can be "oss" or "enterprise") to chart valuesA
conjur.type
field should be added to the chart'svalues.yaml
file.The default setting for this value will be "oss".
Expecting
/info
access vs. "best effort"conjur.type
is explicitly set to "enterprise", this will signify that the/info
endpoint is expected to work, and a lack of response is a failure.
conjur.type
is not explicitly set to "enterprise", then access to/info
endpoint will be "best effort". That is, an attempt will be made to to access the
/info
endpoint. Failure to access this endpoint will not be considered atest failure.
Parsing
/info
endpoint data and validatingWhen access to the
/info
endpoint is successful, the returned datawill be parsed for:
If the actual Conjur account does not match the
conjurAccount
value in the Golden ConfigMap,then a test failure is declared.
If the enabled authn-k8s authenticator IDs do not contain the
authnK8sAuthenticatorID
value in the Golden ConfigMap, then a test failure is declared.
Test results
Test failures must appear in the command line output of the
helm test ...
command.The output should be clear about which value has been misconfigured.
Test environments
Testing must be done both with Conjur OSS instance and a Conjur Enterprise instance.
DoD
-[ ]
conjur.type
added to chart values, defaulting to "oss"-[ ] A JSON schema validation is added to
values.schema.json
for this new field-[ ] Test cases added to Namespace prep Helm chart test
-[ ] Testing performed on both Conjur OSS and Conjur Enterprise setup
-[ ] Helm test passes for "happy path" valid values
-[ ] Helm test fails for incorrect CONJUR_ACCOUNT, and failure is clear on command line output
-[ ] Helm test fails for incorrect CONJUR_AUTHN_URL, and failure is clear on command line output
The text was updated successfully, but these errors were encountered: