@@ -173,6 +173,7 @@ func TestParseCleanupJobConfig_Defaults(t *testing.T) {
173173 "JobTimeout" : "job-timeout" ,
174174 "JobTTL" : "job-ttl" ,
175175 "JobBackoffLimit" : "job-backoff-limit" ,
176+ "JobEnvSecrets" : "job-env-secrets" ,
176177 }
177178
178179 config , err := ParseCleanupJobConfig (annotations , annotationKeys )
@@ -198,6 +199,65 @@ func TestParseCleanupJobConfig_Defaults(t *testing.T) {
198199 if config .BackoffLimit != DefaultJobBackoffLimit {
199200 t .Errorf ("Expected default BackoffLimit %d, got %d" , DefaultJobBackoffLimit , config .BackoffLimit )
200201 }
202+ if len (config .EnvFromSecrets ) != 0 {
203+ t .Errorf ("Expected empty EnvFromSecrets, got %v" , config .EnvFromSecrets )
204+ }
205+ }
206+
207+ func TestParseCleanupJobConfig_WithSecrets (t * testing.T ) {
208+ annotations := map [string ]string {
209+ "on-delete-job" : "scripts/cleanup.sh" ,
210+ "job-env-secrets" : "aws-creds,db-creds" ,
211+ }
212+ annotationKeys := map [string ]string {
213+ "OnDeleteJob" : "on-delete-job" ,
214+ "JobEnvSecrets" : "job-env-secrets" ,
215+ "JobServiceAccount" : "job-service-account" ,
216+ }
217+
218+ config , err := ParseCleanupJobConfig (annotations , annotationKeys )
219+ if err != nil {
220+ t .Fatalf ("Unexpected error: %v" , err )
221+ }
222+ if config == nil {
223+ t .Fatal ("Expected config, got nil" )
224+ }
225+
226+ if len (config .EnvFromSecrets ) != 2 {
227+ t .Fatalf ("Expected 2 secrets, got %d" , len (config .EnvFromSecrets ))
228+ }
229+ if config .EnvFromSecrets [0 ] != "aws-creds" {
230+ t .Errorf ("Expected first secret 'aws-creds', got %s" , config .EnvFromSecrets [0 ])
231+ }
232+ if config .EnvFromSecrets [1 ] != "db-creds" {
233+ t .Errorf ("Expected second secret 'db-creds', got %s" , config .EnvFromSecrets [1 ])
234+ }
235+ }
236+
237+ func TestParseCleanupJobConfig_WithSecretsWhitespace (t * testing.T ) {
238+ annotations := map [string ]string {
239+ "on-delete-job" : "scripts/cleanup.sh" ,
240+ "job-env-secrets" : "aws-creds , db-creds , third-secret" ,
241+ }
242+ annotationKeys := map [string ]string {
243+ "OnDeleteJob" : "on-delete-job" ,
244+ "JobEnvSecrets" : "job-env-secrets" ,
245+ "JobServiceAccount" : "job-service-account" ,
246+ }
247+
248+ config , err := ParseCleanupJobConfig (annotations , annotationKeys )
249+ if err != nil {
250+ t .Fatalf ("Unexpected error: %v" , err )
251+ }
252+ if len (config .EnvFromSecrets ) != 3 {
253+ t .Fatalf ("Expected 3 secrets, got %d" , len (config .EnvFromSecrets ))
254+ }
255+ // Verify whitespace is trimmed
256+ for i , expected := range []string {"aws-creds" , "db-creds" , "third-secret" } {
257+ if config .EnvFromSecrets [i ] != expected {
258+ t .Errorf ("Expected secret %d to be '%s', got '%s'" , i , expected , config .EnvFromSecrets [i ])
259+ }
260+ }
201261}
202262
203263func TestCreateCleanupJob (t * testing.T ) {
@@ -473,3 +533,105 @@ func TestWaitForJobCompletion_GetError(t *testing.T) {
473533 t .Fatalf ("expected error when Get fails, got nil" )
474534 }
475535}
536+
537+ func TestBuildEnvFrom_Empty (t * testing.T ) {
538+ result := buildEnvFrom ([]string {})
539+ if result != nil {
540+ t .Errorf ("Expected nil for empty input, got %v" , result )
541+ }
542+ }
543+
544+ func TestBuildEnvFrom_SingleSecret (t * testing.T ) {
545+ result := buildEnvFrom ([]string {"my-secret" })
546+ if len (result ) != 1 {
547+ t .Fatalf ("Expected 1 EnvFromSource, got %d" , len (result ))
548+ }
549+ if result [0 ].SecretRef == nil {
550+ t .Fatal ("Expected SecretRef to be set" )
551+ }
552+ if result [0 ].SecretRef .Name != "my-secret" {
553+ t .Errorf ("Expected secret name 'my-secret', got %s" , result [0 ].SecretRef .Name )
554+ }
555+ }
556+
557+ func TestBuildEnvFrom_MultipleSecrets (t * testing.T ) {
558+ result := buildEnvFrom ([]string {"secret1" , "secret2" , "secret3" })
559+ if len (result ) != 3 {
560+ t .Fatalf ("Expected 3 EnvFromSource, got %d" , len (result ))
561+ }
562+ for i , expected := range []string {"secret1" , "secret2" , "secret3" } {
563+ if result [i ].SecretRef == nil {
564+ t .Fatalf ("Expected SecretRef at index %d to be set" , i )
565+ }
566+ if result [i ].SecretRef .Name != expected {
567+ t .Errorf ("Expected secret %d to be '%s', got %s" , i , expected , result [i ].SecretRef .Name )
568+ }
569+ }
570+ }
571+
572+ func TestBuildEnvFrom_EmptyStringInList (t * testing.T ) {
573+ result := buildEnvFrom ([]string {"secret1" , "" , "secret2" })
574+ if len (result ) != 2 {
575+ t .Fatalf ("Expected 2 EnvFromSource (empty string should be skipped), got %d" , len (result ))
576+ }
577+ if result [0 ].SecretRef .Name != "secret1" {
578+ t .Errorf ("Expected first secret 'secret1', got %s" , result [0 ].SecretRef .Name )
579+ }
580+ if result [1 ].SecretRef .Name != "secret2" {
581+ t .Errorf ("Expected second secret 'secret2', got %s" , result [1 ].SecretRef .Name )
582+ }
583+ }
584+
585+ func TestCreateCleanupJob_WithSecrets (t * testing.T ) {
586+ scheme := runtime .NewScheme ()
587+ _ = batchv1 .AddToScheme (scheme )
588+ _ = corev1 .AddToScheme (scheme )
589+
590+ cl := fake .NewClientBuilder ().WithScheme (scheme ).Build ()
591+
592+ obj := & unstructured.Unstructured {}
593+ obj .SetName ("test-obj" )
594+ obj .SetNamespace ("test-ns" )
595+ obj .SetUID ("test-uid" )
596+ obj .SetResourceVersion ("123" )
597+
598+ gvk := schema.GroupVersionKind {
599+ Group : "example.com" ,
600+ Version : "v1" ,
601+ Kind : "TestKind" ,
602+ }
603+
604+ config := & CleanupJobConfig {
605+ ConfigMapName : "my-scripts" ,
606+ ScriptKey : "cleanup.sh" ,
607+ ServiceAccount : "test-sa" ,
608+ Image : "test/image:v1" ,
609+ Wait : false ,
610+ Timeout : 5 * time .Minute ,
611+ TTLSecondsAfterFinished : 300 ,
612+ BackoffLimit : 3 ,
613+ EnvFromSecrets : []string {"aws-creds" , "db-password" },
614+ }
615+
616+ job , err := CreateCleanupJob (context .Background (), cl , obj , gvk , config , time .Now (), time .Now ())
617+ if err != nil {
618+ t .Fatalf ("Failed to create cleanup job: %v" , err )
619+ }
620+
621+ if len (job .Spec .Template .Spec .Containers ) != 1 {
622+ t .Fatalf ("Expected 1 container, got %d" , len (job .Spec .Template .Spec .Containers ))
623+ }
624+
625+ container := job .Spec .Template .Spec .Containers [0 ]
626+ if len (container .EnvFrom ) != 2 {
627+ t .Fatalf ("Expected 2 EnvFromSource, got %d" , len (container .EnvFrom ))
628+ }
629+
630+ // Check that secrets are correctly mounted
631+ if container .EnvFrom [0 ].SecretRef .Name != "aws-creds" {
632+ t .Errorf ("Expected first secret 'aws-creds', got %s" , container .EnvFrom [0 ].SecretRef .Name )
633+ }
634+ if container .EnvFrom [1 ].SecretRef .Name != "db-password" {
635+ t .Errorf ("Expected second secret 'db-password', got %s" , container .EnvFrom [1 ].SecretRef .Name )
636+ }
637+ }
0 commit comments