fix: use correct ExternalSecret CRD name for force-sync annotation

The force-sync pre-filled the ExternalSecret object name with the
Kubernetes secret name (e.g. job-apply-common-secrets), but the
kubectl annotate command must target the ExternalSecret CRD object
(e.g. job-apply). Added external_secret_name_template config option
with fallback to k8s_secret_name_template.
This commit is contained in:
2026-09-16 11:49:35 +02:00
parent 205f8906df
commit 720064454b
4 changed files with 64 additions and 3 deletions
+27
View File
@@ -112,6 +112,33 @@ func TestResolveK8sSecretName_FallsBackToSecretNameTemplate(t *testing.T) {
}
}
func TestResolveExternalSecretName_ExplicitTemplate(t *testing.T) {
cfg := Config{ExternalSecretNameTemplate: "{namespace}"}
got := cfg.ResolveExternalSecretName("job-apply")
want := "job-apply"
if got != want {
t.Fatalf("got %q, want %q", got, want)
}
}
func TestResolveExternalSecretName_FallsBackToK8sSecretNameTemplate(t *testing.T) {
cfg := Config{K8sSecretNameTemplate: "{namespace}-common-secrets"}
got := cfg.ResolveExternalSecretName("job-apply")
want := "job-apply-common-secrets"
if got != want {
t.Fatalf("got %q, want %q", got, want)
}
}
func TestResolveExternalSecretName_FallsBackToSecretNameTemplate(t *testing.T) {
cfg := Config{SecretNameTemplate: "tf-{namespace}-{env}-secrets"}
got := cfg.ResolveExternalSecretName("job-apply")
want := "tf-job-apply-{env}-secrets" // {env} intentionally left unresolved
if got != want {
t.Fatalf("got %q, want %q", got, want)
}
}
func TestLoginCommand_DefaultsWhenUnset(t *testing.T) {
cfg := Config{}
if got := cfg.LoginCommand(); got != DefaultAWSSSOLoginCommand {