From 45cfc708bb8d26b81a5849889c665cfe32efd246 Mon Sep 17 00:00:00 2001 From: rzisholz Date: Thu, 27 Aug 2026 19:12:27 +0300 Subject: [PATCH 1/2] CP-21164: clear ARK_USERNAME/ARK_SECRET explicitly in cyberark validation tests CI sets both from real secrets at the job level (for the separate ARK_LIVE_TEST-gated live test), so three subtests asserting on an empty username/secret picked up real ambient values instead of the empty baseline they assumed locally. --- pkg/agent/config_test.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkg/agent/config_test.go b/pkg/agent/config_test.go index 923596b8..a8f8e324 100644 --- a/pkg/agent/config_test.go +++ b/pkg/agent/config_test.go @@ -1323,11 +1323,19 @@ func Test_ValidateAndCombineConfig_NGTS(t *testing.T) { func TestConfig_CyberArk_Validation(t *testing.T) { // Common env setup: ARK_SUBDOMAIN is the only required env var for MachineHub mode. + // ARK_USERNAME/ARK_SECRET are cleared unconditionally rather than left + // ambient — CI sets both from real secrets at the job level (for the + // separate ARK_LIVE_TEST-gated live test), so leaving them untouched here + // would let real credentials leak into subtests that assert on an empty + // username/secret. Subtests needing non-empty values set them explicitly + // after calling setEnv. setEnv := func(t *testing.T) { t.Helper() t.Setenv("POD_NAMESPACE", "venafi") t.Setenv("KUBECONFIG", withFile(t, fakeKubeconfig)) t.Setenv("ARK_SUBDOMAIN", "tlspk") + t.Setenv("ARK_USERNAME", "") + t.Setenv("ARK_SECRET", "") } // service_id is not required at config-validation time as long as the From 5a399d499535333c43c3187b0ece5690b8fc380a Mon Sep 17 00:00:00 2001 From: rzisholz Date: Thu, 27 Aug 2026 19:27:43 +0300 Subject: [PATCH 2/2] CP-21164: trigger CI re-run for test-e2e label Empty commit to retrigger the test suite now that the test-e2e label was added, per Mladen's request.