From 69c69177fa2ed243063bfe24b4eae3f705d5b591 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Bellon-Gervais?= Date: Mon, 7 Jul 2025 14:38:18 +0200 Subject: [PATCH 1/5] Fix for fernetkey and add test of its value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Grégoire Bellon-Gervais --- chart/templates/secrets/fernetkey-secret.yaml | 6 ++++-- .../security/test_fernetkey_secret.py | 20 +++++++++++++++++-- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/chart/templates/secrets/fernetkey-secret.yaml b/chart/templates/secrets/fernetkey-secret.yaml index a9a1f6016938b..0c1f2dc712373 100644 --- a/chart/templates/secrets/fernetkey-secret.yaml +++ b/chart/templates/secrets/fernetkey-secret.yaml @@ -21,10 +21,12 @@ ## Airflow Fernet Key Secret ################################# {{- if not .Values.fernetKeySecretName }} +# Fernet key value must be b64enc +{{- $generated_fernet_key := (randAlphaNum 32 | b64enc) }} apiVersion: v1 kind: Secret metadata: - name: {{ .Release.Name }}-fernet-key + name: {{ include "airflow.fullname" . }}-fernet-key labels: tier: airflow release: {{ .Release.Name }} @@ -42,5 +44,5 @@ metadata: {{- end }} type: Opaque data: - fernet-key: {{ (.Values.fernetKey) | default (randAlphaNum 32) | b64enc | quote }} + fernet-key: {{ (default $generated_fernet_key .Values.fernetKey) | b64enc | quote }} {{- end }} diff --git a/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py b/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py index a134273bba7b0..b3973fffaab3f 100644 --- a/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py +++ b/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py @@ -16,8 +16,11 @@ # under the License. from __future__ import annotations +import base64 + import jmespath from chart_utils.helm_template_generator import render_chart +from cryptography.fernet import Fernet class TestFernetKeySecret: @@ -26,11 +29,24 @@ class TestFernetKeySecret: def test_should_add_annotations_to_fernetkey_secret(self): docs = render_chart( values={ - "fernetKey": "test", + "fernetKey": "0IElBVJmqYRvIXEed4711qEHLkeNl8uJ1q1EmnrKDUg=", "fernetKeySecretAnnotations": {"test_annotation": "test_annotation_value"}, }, show_only=["templates/secrets/fernetkey-secret.yaml"], )[0] - assert "annotations" in jmespath.search("metadata", docs) assert jmespath.search("metadata.annotations", docs)["test_annotation"] == "test_annotation_value" + + def test_should_generate_valid_fernet_key(self): + """Test that a valid Fernet key is generated.""" + docs = render_chart( + values={}, # No fernetKey provided + show_only=["templates/secrets/fernetkey-secret.yaml"], + )[0] + + # Extract the base64 encoded fernet key from the secret + fernet_key_b64 = jmespath.search('data."fernet-key"', docs).strip('"') + fernet_key = base64.b64decode(fernet_key_b64).decode() + + # Verify the key is valid by creating a Fernet instance + Fernet(fernet_key.encode()) # Raise: Fernet key must be 32 url-safe base64-encoded bytes. From 9cd3cc737fd6d6cf56640748738533c7b4da08c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Bellon-Gervais?= Date: Mon, 7 Jul 2025 15:07:00 +0200 Subject: [PATCH 2/5] Fix for test airflow.fullname vs .Release.Name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Grégoire Bellon-Gervais --- .../tests/helm_tests/airflow_aux/test_basic_helm_chart.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py b/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py index 46f617943a884..610985fa8c870 100644 --- a/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py +++ b/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py @@ -37,7 +37,7 @@ ("ServiceAccount", "test-basic-airflow-worker"), ("Secret", "test-basic-airflow-metadata"), ("Secret", "test-basic-broker-url"), - ("Secret", "test-basic-fernet-key"), + ("Secret", "test-basic-airflow-fernet-key"), ("Secret", "test-basic-redis-password"), ("Secret", "test-basic-postgresql"), ("ConfigMap", "test-basic-airflow-config"), From fe38b96969a9a83e3aa55cd6ad864a229bae8bff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Bellon-Gervais?= Date: Mon, 7 Jul 2025 23:28:57 +0200 Subject: [PATCH 3/5] Rollback to .Release.Name for moment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Grégoire Bellon-Gervais --- chart/templates/secrets/fernetkey-secret.yaml | 2 +- .../tests/helm_tests/airflow_aux/test_basic_helm_chart.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/chart/templates/secrets/fernetkey-secret.yaml b/chart/templates/secrets/fernetkey-secret.yaml index 0c1f2dc712373..0127fb097b06f 100644 --- a/chart/templates/secrets/fernetkey-secret.yaml +++ b/chart/templates/secrets/fernetkey-secret.yaml @@ -26,7 +26,7 @@ apiVersion: v1 kind: Secret metadata: - name: {{ include "airflow.fullname" . }}-fernet-key + name: {{ .Release.Name }}-fernet-key labels: tier: airflow release: {{ .Release.Name }} diff --git a/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py b/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py index 610985fa8c870..46f617943a884 100644 --- a/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py +++ b/helm-tests/tests/helm_tests/airflow_aux/test_basic_helm_chart.py @@ -37,7 +37,7 @@ ("ServiceAccount", "test-basic-airflow-worker"), ("Secret", "test-basic-airflow-metadata"), ("Secret", "test-basic-broker-url"), - ("Secret", "test-basic-airflow-fernet-key"), + ("Secret", "test-basic-fernet-key"), ("Secret", "test-basic-redis-password"), ("Secret", "test-basic-postgresql"), ("ConfigMap", "test-basic-airflow-config"), From a79478711f0aa71904ba10800257969d12bfb5c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Bellon-Gervais?= Date: Tue, 8 Jul 2025 07:13:01 +0200 Subject: [PATCH 4/5] Test correctly fernetkey when provided MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Grégoire Bellon-Gervais --- .../helm_tests/security/test_fernetkey_secret.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py b/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py index b3973fffaab3f..1027a46cc1e1a 100644 --- a/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py +++ b/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py @@ -27,9 +27,11 @@ class TestFernetKeySecret: """Tests fernet key secret.""" def test_should_add_annotations_to_fernetkey_secret(self): + # Create a Fernet key + fernet_key_provided = Fernet.generate_key().decode() docs = render_chart( values={ - "fernetKey": "0IElBVJmqYRvIXEed4711qEHLkeNl8uJ1q1EmnrKDUg=", + "fernetKey": fernet_key_provided, "fernetKeySecretAnnotations": {"test_annotation": "test_annotation_value"}, }, show_only=["templates/secrets/fernetkey-secret.yaml"], @@ -37,6 +39,13 @@ def test_should_add_annotations_to_fernetkey_secret(self): assert "annotations" in jmespath.search("metadata", docs) assert jmespath.search("metadata.annotations", docs)["test_annotation"] == "test_annotation_value" + # Extract the base64 encoded fernet key from the secret + fernet_key_b64 = jmespath.search('data."fernet-key"', docs).strip('"') + fernet_key = base64.b64decode(fernet_key_b64).decode() + + # Verify the key is valid by creating a Fernet instance + Fernet(fernet_key.encode()) # Raise: Fernet key must be 32 url-safe base64-encoded bytes. + def test_should_generate_valid_fernet_key(self): """Test that a valid Fernet key is generated.""" docs = render_chart( From fdd7575fb807687b49488abdc444b511d8907939 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Bellon-Gervais?= Date: Tue, 8 Jul 2025 07:15:52 +0200 Subject: [PATCH 5/5] Better def name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Grégoire Bellon-Gervais --- helm-tests/tests/helm_tests/security/test_fernetkey_secret.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py b/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py index 1027a46cc1e1a..e558eb7e4fd08 100644 --- a/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py +++ b/helm-tests/tests/helm_tests/security/test_fernetkey_secret.py @@ -46,7 +46,7 @@ def test_should_add_annotations_to_fernetkey_secret(self): # Verify the key is valid by creating a Fernet instance Fernet(fernet_key.encode()) # Raise: Fernet key must be 32 url-safe base64-encoded bytes. - def test_should_generate_valid_fernet_key(self): + def test_should_generate_valid_fernetkey_secret(self): """Test that a valid Fernet key is generated.""" docs = render_chart( values={}, # No fernetKey provided