Open LongLiveCHIEF opened 6 years ago
Able to reproduce: https://github.com/LongLiveCHIEF/eyaml-rspec-example-failure/blob/add-eyaml-data-source/data/sector/alpha.yaml#L5
Looks like you don't wind up with any of the bad decrypt
errors, until you try to use lookup
from within a data source.
To reproduce, I made it convenient by wrapping everything with docker and make:
git clone -b add-eyaml-data-source https://github.com/LongLiveCHIEF/eyaml-rspec-example-failure.git
cd eyaml-rspec-example-failure
make build
make test
I've been struggling for days trying to test a new puppet 5 module that contains a hiera-eyaml data source. It seems that due to the nature of how hiera's layer hierarchy works, it's nearly impossible to prevent eyaml from decrypting a value during unit testing.
I'm using pdk, (which uses rspec-puppet) and here's what i've tried and the failures i've encountered along the way:
No .pem key files
My first error when running unit tests was a
error @rb_open file does not exists /etc/puppetlabs/secure/keys/key.pem
.To resolve this, I tried:
EYAML_CONFIG
location, with config file defining different locations for key files (and creating fake keys)hiera_config
value to an alternative hiera.yaml in fixutres, that didn't contain any eyaml data sourcesboth of these still resulted in the error above. It seems that since the key locations specified in the module's hiera.yaml file are now as of puppet 4.8/5 part of hiera layer 3, they override any value/location passed using a config file defined using the
EYAML_CONFIG
environment variable, or evenNext, I tried:
-testing
to any eyaml source file to use the test keys and values in stead of the encrypted values that require the private key stored on the puppetserver to decrypt.Even though the hierarchy was no longer using the real encrypted data sources in APL, I now get errors for a
bad decrypt
:I've tried just about everything, but it seems that due to the nature of specificity for layer 3 data-sources, the old ways of tricking the unit test suite to use test values no longer work.
Is there a known way/documenation/examples to unit test puppet 5 modules with eyaml data sources? A way to mock the eyaml lookup, or override the config provided by the layer 3
hiera.yaml
file?This relates to #252, since I believe if I could use variable interpolation in my layer 3
hiera.yaml
file, I could easily use testing keys for testing to get rid of thebad decrypt
errors in my unit testing suite.