Replace associated credential sets when running bundle

When we run a bundle, like with porter install/upgrade, we should replace the names of any previously used parameter or credential sets with the ones specified in the most recent run. If none were specified, then reuse from the previous run.

Signed-off-by: Carolyn Van Slyck <[email protected]>

docs/content/credentials.md

@@ -44,6 +44,37 @@ where the values can be found.
 If you are creating credential sets manually, you can use the [Credential Set Schema]
 to validate that you have created it properly.
 
+### Remembering Credentials
+Porter remembers the last set of credentials used with an installation, and reuses them when the bundle is executed again.
+
+For example, if Carolyn installs a bundle using her credentials, Porter remembers that Carolyn's credentials are associated with the resulting installation.
+Now when Carolyn upgrades the bundle, if credentials are not specified, Porter will reuse the original credentials that the bundle was installed with.
+Later Yingrong upgrades the bundle, specifying the shared team credentials in the upgrade command, and now those credentials are associated with the installation instead of Carolyn's personal credentials.
+
+```console
+$ porter install tutorial -c carolyn-creds -r ghcr.io/getporter/examples/credentials-tutorial:v0.2.0
+# bundle is installed with Carolyn's credentials
+
+$ porter show tutorial
+Name: tutorial
+Namespace: quickstart
+Created: 3 minutes ago
+Modified: 7 seconds ago
+
+Bundle:
+  Repository: ghcr.io/getporter/examples/credentials-tutorial
+  Version: 0.2.0
+
+Credential Sets:
+  - carolyn-creds
+
+$ porter upgrade --version 0.3.0
+# Carolyn's credentials are used again, since none were specified
+
+$ porter upgrade -c blue-team-creds --version 0.3.1
+# Upgrade is run again but this time with the shared blue team credentials
+```
+
 [Credential Set Schema]: /src/pkg/schema/credential-set.schema.json
 
 ## Runtime

pkg/porter/helpers.go

@@ -134,7 +134,12 @@ func (p *TestPorter) SetupIntegrationTest() context.Context {
 	err = encoding.UnmarshalYaml(ciCredsB, &testCreds)
 	require.NoError(t, err, "could not unmarshal test credentials %s", ciCredsPath)
 	err = p.Credentials.UpsertCredentialSet(context.Background(), testCreds)
-	require.NoError(t, err, "could not save test credentials")
+	require.NoError(t, err, "could not save test credentials (ci)")
+
+	// Make a copy of the creds with a different name so that we can test out switching to different credential sets
+	testCreds.Name = "ci2"
+	err = p.Credentials.UpsertCredentialSet(context.Background(), testCreds)
+	require.NoError(t, err, "could not save test credentials (ci2)")
 
 	return ctx
 }

pkg/porter/install.go

@@ -111,29 +111,14 @@ func (p *Porter) applyActionOptionsToInstallation(ctx context.Context, i *storag
 		return err
 	}
 
-	// Record the names of the parameter sets used
-	i.ParameterSets = append(i.ParameterSets, Unique(i.ParameterSets, opts.ParameterSets...)...)
-
-	// Record the names of the credential sets used
-	i.CredentialSets = append(i.CredentialSets, Unique(i.CredentialSets, opts.CredentialIdentifiers...)...)
-
-	return nil
-}
-
-func Unique(existings []string, n ...string) []string {
-	var u []string
-	old := make(map[string]struct{})
-
-	for _, e := range existings {
-		old[e] = struct{}{}
+	// Record the names of the parameter and credential sets used if specified. Otherwise, reuse the previously specified sets.
+	// This should replace previously specified sets so that only what was just specified is used.
+	if len(opts.ParameterSets) > 0 {
+		i.ParameterSets = opts.ParameterSets
 	}
-
-	for _, cs := range n {
-		if _, ok := old[cs]; ok {
-			continue
-		}
-		u = append(u, cs)
+	if len(opts.CredentialIdentifiers) > 0 {
+		i.CredentialSets = opts.CredentialIdentifiers
 	}
 
-	return u
+	return nil
 }

pkg/porter/install_test.go

@@ -1,9 +1,15 @@
 package porter
 
 import (
+	"context"
 	"testing"
 
+	"get.porter.sh/porter/pkg/cnab"
 	"get.porter.sh/porter/pkg/portercontext"
+	"get.porter.sh/porter/pkg/secrets"
+	"get.porter.sh/porter/pkg/storage"
+	"github.com/cnabio/cnab-go/bundle"
+	"github.com/cnabio/cnab-go/bundle/definition"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -64,24 +70,90 @@ func TestInstallOptions_validateDriver(t *testing.T) {
 	}
 }
 
-func TestUnique(t *testing.T) {
-	testcases := []struct {
-		name     string
-		existing []string
-		newData  []string
-		expected []string
-	}{
-		{"empty existing data", []string{}, []string{"foo", "bar"}, []string{"foo", "bar"}},
-		{"empty new data", []string{"foo", "bar"}, []string{}, nil},
-		{"has new data", []string{"foo", "bar"}, []string{"alice"}, []string{"alice"}},
-		{"has duplicate new data", []string{"foo", "bar"}, []string{"alice", "foo"}, []string{"alice"}},
-	}
+func TestPorter_applyActionOptionsToInstallation(t *testing.T) {
+	setup := func() (context.Context, *TestPorter, *storage.Installation) {
+		ctx := context.Background()
+		p := NewTestPorter(t)
 
-	for _, tc := range testcases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			result := Unique(tc.existing, tc.newData...)
-			require.Equal(t, tc.expected, result)
+		p.TestParameters.InsertParameterSet(ctx, storage.ParameterSet{
+			ParameterSetSpec: storage.ParameterSetSpec{
+				Name: "newps1",
+				Parameters: []secrets.Strategy{
+					{Name: "logLevel", Source: secrets.Source{Key: "value", Value: "11"}},
+				},
+			},
 		})
+
+		return ctx, p, &storage.Installation{
+			Bundle: storage.OCIReferenceParts{
+				Repository: "example.com/mybuns",
+				Version:    "1.0.0",
+			},
+			ParameterSets:  []string{"oldps1"},
+			CredentialSets: []string{"oldcs1", "oldcs2"},
+		}
 	}
+
+	t.Run("replace previous sets", func(t *testing.T) {
+		ctx, p, inst := setup()
+
+		// We should replace the previously used sets since we specified different ones
+		opts := NewBundleExecutionOptions()
+		opts.Reference = kahnlatest.String()
+		opts.bundleRef = &cnab.BundleReference{
+			Reference: kahnlatest,
+			Definition: cnab.NewBundle(bundle.Bundle{
+				Credentials: map[string]bundle.Credential{
+					"userid": {},
+				},
+				Parameters: map[string]bundle.Parameter{
+					"logLevel": {Definition: "logLevel"},
+				},
+				Definitions: map[string]*definition.Schema{
+					"logLevel": {Type: "string"},
+				},
+			}),
+		}
+
+		opts.ParameterSets = []string{"newps1"}
+		opts.CredentialIdentifiers = []string{"newcs1"}
+
+		require.NoError(t, opts.Validate(ctx, nil, p.Porter))
+		err := p.applyActionOptionsToInstallation(ctx, inst, opts)
+		require.NoError(t, err, "applyActionOptionsToInstallation failed")
+
+		require.Equal(t, opts.ParameterSets, inst.ParameterSets, "expected the installation to replace the credential sets with those specified")
+		require.Equal(t, opts.CredentialIdentifiers, inst.CredentialSets, "expected the installation to replace the credential sets with those specified")
+	})
+
+	t.Run("reuse previous sets", func(t *testing.T) {
+		ctx, p, inst := setup()
+
+		// We should reuse the previously used sets since we specified different ones
+		opts := NewBundleExecutionOptions()
+		opts.Reference = kahnlatest.String()
+		opts.bundleRef = &cnab.BundleReference{
+			Reference: kahnlatest,
+			Definition: cnab.NewBundle(bundle.Bundle{
+				Credentials: map[string]bundle.Credential{
+					"userid": {},
+				},
+				Parameters: map[string]bundle.Parameter{
+					"logLevel": {Definition: "logLevel"},
+				},
+				Definitions: map[string]*definition.Schema{
+					"logLevel": {Type: "string"},
+				},
+			}),
+		}
+		opts.ParameterSets = []string{}
+		opts.CredentialIdentifiers = []string{}
+
+		require.NoError(t, opts.Validate(ctx, nil, p.Porter))
+		err := p.applyActionOptionsToInstallation(ctx, inst, opts)
+		require.NoError(t, err, "applyActionOptionsToInstallation failed")
+
+		require.Equal(t, []string{"oldps1"}, inst.ParameterSets, "expected the installation to reuse the previous credential sets")
+		require.Equal(t, []string{"oldcs1", "oldcs2"}, inst.CredentialSets, "expected the installation to reuse the previous credential sets")
+	})
 }

tests/integration/dependencies_test.go

@@ -1,5 +1,4 @@
 //go:build integration
-// +build integration
 
 package integration
 
@@ -66,7 +65,7 @@ func installWordpressBundle(ctx context.Context, p *porter.TestPorter) (namespac
 	namespace = p.RandomString(10)
 	installOpts := porter.NewInstallOptions()
 	installOpts.Namespace = namespace
-	installOpts.CredentialIdentifiers = []string{"ci"}
+	installOpts.CredentialIdentifiers = []string{"ci"} // Use the ci credential set, porter should remember this for later
 	installOpts.Params = []string{
 		"wordpress-password=mypassword",
 		"namespace=" + namespace,
@@ -137,7 +136,7 @@ func cleanupWordpressBundle(ctx context.Context, p *porter.TestPorter, namespace
 func upgradeWordpressBundle(ctx context.Context, p *porter.TestPorter, namespace string) {
 	upgradeOpts := porter.NewUpgradeOptions()
 	upgradeOpts.Namespace = namespace
-	upgradeOpts.CredentialIdentifiers = []string{"ci"}
+	// do not specify credential sets, porter should reuse what was specified from install
 	upgradeOpts.Params = []string{
 		"wordpress-password=mypassword",
 		"namespace=" + namespace,
@@ -164,13 +163,18 @@ func upgradeWordpressBundle(ctx context.Context, p *porter.TestPorter, namespace
 	require.NoError(p.T(), err, "GetLastClaim failed")
 	assert.Equal(p.T(), cnab.ActionUpgrade, c.Action, "the root bundle wasn't recorded as being upgraded")
 	assert.Equal(p.T(), cnab.StatusSucceeded, i.Status.ResultStatus, "the root bundle wasn't recorded as being upgraded successfully")
+
+	// Check that we are using the original credential set specified during install
+	require.Len(p.T(), i.CredentialSets, 1, "expected only one credential set associated to the installation")
+	assert.Equal(p.T(), "ci", i.CredentialSets[0], "expected to use the alternate credential set")
 }
 
 func invokeWordpressBundle(ctx context.Context, p *porter.TestPorter, namespace string) {
 	invokeOpts := porter.NewInvokeOptions()
 	invokeOpts.Namespace = namespace
 	invokeOpts.Action = "ping"
-	invokeOpts.CredentialIdentifiers = []string{"ci"}
+	// Use a different set of creds to run this rando command
+	invokeOpts.CredentialIdentifiers = []string{"ci2"}
 	invokeOpts.Params = []string{
 		"wordpress-password=mypassword",
 		"namespace=" + namespace,
@@ -196,11 +200,16 @@ func invokeWordpressBundle(ctx context.Context, p *porter.TestPorter, namespace
 	require.NoError(p.T(), err, "GetLastClaim failed")
 	assert.Equal(p.T(), "ping", c.Action, "the root bundle wasn't recorded as being invoked")
 	assert.Equal(p.T(), cnab.StatusSucceeded, i.Status.ResultStatus, "the root bundle wasn't recorded as being invoked successfully")
+
+	// Check that we are now using the alternate credentials with the bundle
+	require.Len(p.T(), i.CredentialSets, 1, "expected only one credential set associated to the installation")
+	assert.Equal(p.T(), "ci2", i.CredentialSets[0], "expected to use the alternate credential set")
 }
 
 func uninstallWordpressBundle(ctx context.Context, p *porter.TestPorter, namespace string) {
 	uninstallOptions := porter.NewUninstallOptions()
 	uninstallOptions.Namespace = namespace
+	// Now go back to using the original set of credentials
 	uninstallOptions.CredentialIdentifiers = []string{"ci"}
 	uninstallOptions.Params = []string{
 		"namespace=" + namespace,
@@ -227,4 +236,9 @@ func uninstallWordpressBundle(ctx context.Context, p *porter.TestPorter, namespa
 	require.NoError(p.T(), err, "GetLastClaim failed")
 	assert.Equal(p.T(), cnab.ActionUninstall, c.Action, "the root bundle wasn't recorded as being uninstalled")
 	assert.Equal(p.T(), cnab.StatusSucceeded, i.Status.ResultStatus, "the root bundle wasn't recorded as being uninstalled successfully")
+
+	// Check that we are now using the original credentials with the bundle
+	require.Len(p.T(), i.CredentialSets, 1, "expected only one credential set associated to the installation")
+	assert.Equal(p.T(), "ci", i.CredentialSets[0], "expected to use the alternate credential set")
+
 }