Skip to content

Commit a455195

Browse files
authored
test: dedup kms_bucket fixture (#1129)
After adding back KMS permissions to the kokoro project, KMS integration tests now pass. However, upon investigation, I noticed that we have a duplicate set of kms pytest fixtures. This removes the duplicates and changes fixture scope to per-function. Fixes #1128
1 parent 28c02dd commit a455195

File tree

2 files changed

+56
-92
lines changed

2 files changed

+56
-92
lines changed

tests/system/conftest.py

Lines changed: 56 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717

1818
import pytest
1919

20+
from google.api_core import exceptions
21+
from google.cloud import kms
2022
from google.cloud.storage._helpers import _base64_md5hash
2123
from . import _helpers
2224

@@ -235,12 +237,12 @@ def file_data():
235237
return _file_data
236238

237239

238-
@pytest.fixture(scope="session")
240+
@pytest.fixture(scope="function")
239241
def kms_bucket_name():
240242
return _helpers.unique_name("gcp-systest-kms")
241243

242244

243-
@pytest.fixture(scope="session")
245+
@pytest.fixture(scope="function")
244246
def kms_bucket(storage_client, kms_bucket_name, no_mtls):
245247
bucket = _helpers.retry_429_503(storage_client.create_bucket)(kms_bucket_name)
246248

@@ -249,11 +251,61 @@ def kms_bucket(storage_client, kms_bucket_name, no_mtls):
249251
_helpers.delete_bucket(bucket)
250252

251253

252-
@pytest.fixture(scope="session")
254+
@pytest.fixture(scope="function")
253255
def kms_key_name(storage_client, kms_bucket):
254256
return _kms_key_name(storage_client, kms_bucket, default_key_name)
255257

256258

257-
@pytest.fixture(scope="session")
259+
@pytest.fixture(scope="function")
258260
def alt_kms_key_name(storage_client, kms_bucket):
259261
return _kms_key_name(storage_client, kms_bucket, alt_key_name)
262+
263+
264+
@pytest.fixture(scope="session")
265+
def kms_client():
266+
return kms.KeyManagementServiceClient()
267+
268+
269+
@pytest.fixture(scope="function")
270+
def keyring(storage_client, kms_bucket, kms_client):
271+
project = storage_client.project
272+
location = kms_bucket.location.lower()
273+
purpose = kms.enums.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT
274+
275+
# If the keyring doesn't exist create it.
276+
keyring_path = kms_client.key_ring_path(project, location, keyring_name)
277+
278+
try:
279+
kms_client.get_key_ring(keyring_path)
280+
except exceptions.NotFound:
281+
parent = kms_client.location_path(project, location)
282+
kms_client.create_key_ring(parent, keyring_name, {})
283+
284+
# Mark this service account as an owner of the new keyring
285+
service_account_email = storage_client.get_service_account_email()
286+
policy = {
287+
"bindings": [
288+
{
289+
"role": "roles/cloudkms.cryptoKeyEncrypterDecrypter",
290+
"members": ["serviceAccount:" + service_account_email],
291+
}
292+
]
293+
}
294+
kms_client.set_iam_policy(keyring_path, policy)
295+
296+
# Populate the keyring with the keys we use in the tests
297+
key_names = [
298+
"gcs-test",
299+
"gcs-test-alternate",
300+
"explicit-kms-key-name",
301+
"default-kms-key-name",
302+
"override-default-kms-key-name",
303+
"alt-default-kms-key-name",
304+
]
305+
for key_name in key_names:
306+
key_path = kms_client.crypto_key_path(project, location, keyring_name, key_name)
307+
try:
308+
kms_client.get_crypto_key(key_path)
309+
except exceptions.NotFound:
310+
key = {"purpose": purpose}
311+
kms_client.create_crypto_key(keyring_path, key_name, key)

tests/system/test_kms_integration.py

Lines changed: 0 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -14,99 +14,11 @@
1414

1515
import os
1616

17-
import pytest
18-
19-
from google.api_core import exceptions
20-
from google.cloud import kms
2117
from . import _helpers
2218

2319
keyring_name = "gcs-test"
2420
default_key_name = "gcs-test"
2521
alt_key_name = "gcs-test-alternate"
26-
_key_name_format = "projects/{}/locations/{}/keyRings/{}/cryptoKeys/{}"
27-
28-
29-
def _kms_key_name(client, bucket, key_name):
30-
return _key_name_format.format(
31-
client.project,
32-
bucket.location.lower(),
33-
keyring_name,
34-
key_name,
35-
)
36-
37-
38-
@pytest.fixture(scope="session")
39-
def kms_bucket_name():
40-
return _helpers.unique_name("gcp-systest-kms")
41-
42-
43-
@pytest.fixture(scope="session")
44-
def kms_bucket(storage_client, kms_bucket_name, no_mtls):
45-
bucket = _helpers.retry_429_503(storage_client.create_bucket)(kms_bucket_name)
46-
47-
yield bucket
48-
49-
_helpers.delete_bucket(bucket)
50-
51-
52-
@pytest.fixture(scope="session")
53-
def kms_client():
54-
return kms.KeyManagementServiceClient()
55-
56-
57-
@pytest.fixture(scope="function")
58-
def keyring(storage_client, kms_bucket, kms_client):
59-
project = storage_client.project
60-
location = kms_bucket.location.lower()
61-
purpose = kms.enums.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT
62-
63-
# If the keyring doesn't exist create it.
64-
keyring_path = kms_client.key_ring_path(project, location, keyring_name)
65-
66-
try:
67-
kms_client.get_key_ring(keyring_path)
68-
except exceptions.NotFound:
69-
parent = kms_client.location_path(project, location)
70-
kms_client.create_key_ring(parent, keyring_name, {})
71-
72-
# Mark this service account as an owner of the new keyring
73-
service_account_email = storage_client.get_service_account_email()
74-
policy = {
75-
"bindings": [
76-
{
77-
"role": "roles/cloudkms.cryptoKeyEncrypterDecrypter",
78-
"members": ["serviceAccount:" + service_account_email],
79-
}
80-
]
81-
}
82-
kms_client.set_iam_policy(keyring_path, policy)
83-
84-
# Populate the keyring with the keys we use in the tests
85-
key_names = [
86-
"gcs-test",
87-
"gcs-test-alternate",
88-
"explicit-kms-key-name",
89-
"default-kms-key-name",
90-
"override-default-kms-key-name",
91-
"alt-default-kms-key-name",
92-
]
93-
for key_name in key_names:
94-
key_path = kms_client.crypto_key_path(project, location, keyring_name, key_name)
95-
try:
96-
kms_client.get_crypto_key(key_path)
97-
except exceptions.NotFound:
98-
key = {"purpose": purpose}
99-
kms_client.create_crypto_key(keyring_path, key_name, key)
100-
101-
102-
@pytest.fixture(scope="session")
103-
def kms_key_name(storage_client, kms_bucket):
104-
return _kms_key_name(storage_client, kms_bucket, default_key_name)
105-
106-
107-
@pytest.fixture(scope="session")
108-
def alt_kms_key_name(storage_client, kms_bucket):
109-
return _kms_key_name(storage_client, kms_bucket, alt_key_name)
11022

11123

11224
def test_blob_w_explicit_kms_key_name(

0 commit comments

Comments
 (0)