chef 12.0.3 → 12.1.0.rc.0

data/spec/unit/knife/bootstrap_spec.rb

@@ -23,7 +23,7 @@ require 'net/ssh'
 
 describe Chef::Knife::Bootstrap do
   before do
-    Chef::Platform.stub(:windows?) { false }
+    allow(Chef::Platform).to receive(:windows?) { false }
   end
   let(:knife) do
     Chef::Log.logger = Logger.new(StringIO.new)
@@ -32,7 +32,7 @@ describe Chef::Knife::Bootstrap do
     k = Chef::Knife::Bootstrap.new(bootstrap_cli_options)
     k.merge_configs
 
-    k.ui.stub(:stderr).and_return(stderr)
+    allow(k.ui).to receive(:stderr).and_return(stderr)
     allow(k).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(false)
     k
   end
@@ -44,8 +44,15 @@ describe Chef::Knife::Bootstrap do
   let(:bootstrap_cli_options) { [ ] }
 
   it "should use chef-full as default template" do
-    knife.bootstrap_template.should be_a_kind_of(String)
-    File.basename(knife.bootstrap_template).should eq("chef-full")
+    expect(knife.bootstrap_template).to be_a_kind_of(String)
+    expect(File.basename(knife.bootstrap_template)).to eq("chef-full")
+  end
+
+  context "with --bootstrap-vault-item" do
+    let(:bootstrap_cli_options) { [ "--bootstrap-vault-item", "vault1:item1", "--bootstrap-vault-item", "vault1:item2", "--bootstrap-vault-item", "vault2:item1" ] }
+    it "sets the knife config cli option correctly" do
+      expect(knife.config[:bootstrap_vault_item]).to eq({"vault1"=>["item1", "item2"], "vault2"=>["item1"]})
+    end
   end
 
   context "with :distro and :bootstrap_template cli options" do
@@ -78,7 +85,7 @@ describe Chef::Knife::Bootstrap do
         let(:bootstrap_template) { "/opt/blah/not/exists/template.erb" }
 
         it "raises an error" do
-          lambda { knife.find_template }.should raise_error
+          expect { knife.find_template }.to raise_error
         end
       end
 
@@ -86,8 +93,8 @@ describe Chef::Knife::Bootstrap do
         let(:bootstrap_template) { File.expand_path(File.join(CHEF_SPEC_DATA, "bootstrap", "test.erb")) }
 
         it "loads the given file as the template" do
-          Chef::Log.should_receive(:debug)
-          knife.find_template.should eq(File.expand_path(File.join(CHEF_SPEC_DATA, "bootstrap", "test.erb")))
+          expect(Chef::Log).to receive(:debug)
+          expect(knife.find_template).to eq(File.expand_path(File.join(CHEF_SPEC_DATA, "bootstrap", "test.erb")))
         end
       end
     end
@@ -95,7 +102,7 @@ describe Chef::Knife::Bootstrap do
     context "when :bootstrap_template config is set to a template name" do
       let(:bootstrap_template) { "example" }
 
-      let(:builtin_template_path) { File.expand_path(File.join(File.dirname(__FILE__), '../../../lib/chef/knife/bootstrap', "example.erb"))}
+      let(:builtin_template_path) { File.expand_path(File.join(File.dirname(__FILE__), '../../../lib/chef/knife/bootstrap/templates', "example.erb"))}
 
       let(:chef_config_dir_template_path) { "/knife/chef/config/bootstrap/example.erb" }
 
@@ -104,7 +111,7 @@ describe Chef::Knife::Bootstrap do
       let(:gem_files_template_path) { "/Users/schisamo/.rvm/gems/ruby-1.9.2-p180@chef-0.10/gems/knife-windows-0.5.4/lib/chef/knife/bootstrap/fake-bootstrap-template.erb" }
 
       def configure_chef_config_dir
-        Chef::Knife.stub(:chef_config_dir).and_return("/knife/chef/config")
+        allow(Chef::Knife).to receive(:chef_config_dir).and_return("/knife/chef/config")
       end
 
       def configure_env_home
@@ -112,13 +119,13 @@ describe Chef::Knife::Bootstrap do
       end
 
       def configure_gem_files
-        Gem.stub(:find_files).and_return([ gem_files_template_path ])
+        allow(Gem).to receive(:find_files).and_return([ gem_files_template_path ])
       end
 
       before(:each) do
         @original_home = ENV['HOME']
         ENV['HOME'] = nil
-        File.should_receive(:exists?).with(bootstrap_template).and_return(false)
+        expect(File).to receive(:exists?).with(bootstrap_template).and_return(false)
       end
 
       after(:each) do
@@ -131,11 +138,11 @@ describe Chef::Knife::Bootstrap do
           configure_env_home
           configure_gem_files
 
-          File.should_receive(:exists?).with(builtin_template_path).and_return(true)
+          expect(File).to receive(:exists?).with(builtin_template_path).and_return(true)
         end
 
         it "should load the template from built-in templates" do
-          knife.find_template.should eq(builtin_template_path)
+          expect(knife.find_template).to eq(builtin_template_path)
         end
       end
 
@@ -145,8 +152,8 @@ describe Chef::Knife::Bootstrap do
           configure_env_home
           configure_gem_files
 
-          File.should_receive(:exists?).with(builtin_template_path).and_return(false)
-          File.should_receive(:exists?).with(chef_config_dir_template_path).and_return(true)
+          expect(File).to receive(:exists?).with(builtin_template_path).and_return(false)
+          expect(File).to receive(:exists?).with(chef_config_dir_template_path).and_return(true)
 
           it "should load the template from chef_config_dir" do
             knife.find_template.should eq(chef_config_dir_template_path)
@@ -160,13 +167,13 @@ describe Chef::Knife::Bootstrap do
           configure_env_home
           configure_gem_files
 
-          File.should_receive(:exists?).with(builtin_template_path).and_return(false)
-          File.should_receive(:exists?).with(chef_config_dir_template_path).and_return(false)
-          File.should_receive(:exists?).with(env_home_template_path).and_return(true)
+          expect(File).to receive(:exists?).with(builtin_template_path).and_return(false)
+          expect(File).to receive(:exists?).with(chef_config_dir_template_path).and_return(false)
+          expect(File).to receive(:exists?).with(env_home_template_path).and_return(true)
         end
 
         it "should load the template from chef_config_dir" do
-          knife.find_template.should eq(env_home_template_path)
+          expect(knife.find_template).to eq(env_home_template_path)
         end
       end
 
@@ -175,13 +182,13 @@ describe Chef::Knife::Bootstrap do
           configure_chef_config_dir
           configure_gem_files
 
-          File.should_receive(:exists?).with(builtin_template_path).and_return(false)
-          File.should_receive(:exists?).with(chef_config_dir_template_path).and_return(false)
-          File.should_receive(:exists?).with(gem_files_template_path).and_return(true)
+          expect(File).to receive(:exists?).with(builtin_template_path).and_return(false)
+          expect(File).to receive(:exists?).with(chef_config_dir_template_path).and_return(false)
+          expect(File).to receive(:exists?).with(gem_files_template_path).and_return(true)
         end
 
         it "should load the template from Gem files" do
-          knife.find_template.should eq(gem_files_template_path)
+          expect(knife.find_template).to eq(gem_files_template_path)
         end
       end
     end
@@ -192,7 +199,7 @@ describe Chef::Knife::Bootstrap do
       it "sets the knife :bootstrap_template config" do
         knife.parse_options([t,"blahblah"])
         knife.merge_configs
-        knife.bootstrap_template.should eq("blahblah")
+        expect(knife.bootstrap_template).to eq("blahblah")
       end
     end
   end
@@ -201,19 +208,19 @@ describe Chef::Knife::Bootstrap do
     let(:bootstrap_template) { File.expand_path(File.join(CHEF_SPEC_DATA, "bootstrap", "test.erb")) }
 
     it "should return an empty run_list" do
-      knife.render_template.should == '{"run_list":[]}'
+      expect(knife.render_template).to eq('{"run_list":[]}')
     end
 
     it "should have role[base] in the run_list" do
       knife.parse_options(["-r","role[base]"])
       knife.merge_configs
-      knife.render_template.should == '{"run_list":["role[base]"]}'
+      expect(knife.render_template).to eq('{"run_list":["role[base]"]}')
     end
 
     it "should have role[base] and recipe[cupcakes] in the run_list" do
       knife.parse_options(["-r", "role[base],recipe[cupcakes]"])
       knife.merge_configs
-      knife.render_template.should == '{"run_list":["role[base]","recipe[cupcakes]"]}'
+      expect(knife.render_template).to eq('{"run_list":["role[base]","recipe[cupcakes]"]}')
     end
 
     it "should have foo => {bar => baz} in the first_boot" do
@@ -221,7 +228,7 @@ describe Chef::Knife::Bootstrap do
       knife.merge_configs
       expected_hash = FFI_Yajl::Parser.new.parse('{"foo":{"bar":"baz"},"run_list":[]}')
       actual_hash = FFI_Yajl::Parser.new.parse(knife.render_template)
-      actual_hash.should == expected_hash
+      expect(actual_hash).to eq(expected_hash)
     end
   end
 
@@ -231,14 +238,14 @@ describe Chef::Knife::Bootstrap do
     it "should create a hint file when told to" do
       knife.parse_options(["--hint", "openstack"])
       knife.merge_configs
-      knife.render_template.should match /\/etc\/chef\/ohai\/hints\/openstack.json/
+      expect(knife.render_template).to match /\/etc\/chef\/ohai\/hints\/openstack.json/
     end
 
     it "should populate a hint file with JSON when given a file to read" do
-      ::File.stub(:read).and_return('{ "foo" : "bar" }')
+      allow(::File).to receive(:read).and_return('{ "foo" : "bar" }')
       knife.parse_options(["--hint", "openstack=hints/openstack.json"])
       knife.merge_configs
-      knife.render_template.should match /\{\"foo\":\"bar\"\}/
+      expect(knife.render_template).to match /\{\"foo\":\"bar\"\}/
     end
   end
 
@@ -261,7 +268,7 @@ describe Chef::Knife::Bootstrap do
       let(:setting) { "api.opscode.com" }
 
       it "renders the client.rb with a single FQDN no_proxy entry" do
-        rendered_template.should match(%r{.*no_proxy\s*"api.opscode.com".*})
+        expect(rendered_template).to match(%r{.*no_proxy\s*"api.opscode.com".*})
       end
     end
 
@@ -269,7 +276,7 @@ describe Chef::Knife::Bootstrap do
       let(:setting) { "api.opscode.com,172.16.10.*" }
 
       it "renders the client.rb with comma-separated FQDN and wildcard IP address no_proxy entries" do
-        rendered_template.should match(%r{.*no_proxy\s*"api.opscode.com,172.16.10.\*".*})
+        expect(rendered_template).to match(%r{.*no_proxy\s*"api.opscode.com,172.16.10.\*".*})
       end
     end
 
@@ -277,7 +284,7 @@ describe Chef::Knife::Bootstrap do
       let(:options) { ["--node-ssl-verify-mode", "none"] }
 
       it "renders the client.rb with ssl_verify_mode set to :verify_none" do
-        rendered_template.should match(/ssl_verify_mode :verify_none/)
+        expect(rendered_template).to match(/ssl_verify_mode :verify_none/)
       end
     end
 
@@ -285,7 +292,7 @@ describe Chef::Knife::Bootstrap do
       let(:options) { ["--node-ssl-verify-mode", "peer"] }
 
       it "renders the client.rb with ssl_verify_mode set to :verify_peer" do
-        rendered_template.should match(/ssl_verify_mode :verify_peer/)
+        expect(rendered_template).to match(/ssl_verify_mode :verify_peer/)
       end
     end
 
@@ -293,7 +300,7 @@ describe Chef::Knife::Bootstrap do
       let(:options) { ["--node-ssl-verify-mode", "all"] }
 
       it "raises error" do
-        lambda{ rendered_template }.should raise_error
+        expect{ rendered_template }.to raise_error
       end
     end
 
@@ -301,7 +308,7 @@ describe Chef::Knife::Bootstrap do
       let(:options) { ["--node-verify-api-cert"] }
 
       it "renders the client.rb with verify_api_cert set to true" do
-        rendered_template.should match(/verify_api_cert true/)
+        expect(rendered_template).to match(/verify_api_cert true/)
       end
     end
 
@@ -309,7 +316,7 @@ describe Chef::Knife::Bootstrap do
       let(:options) { ["--no-node-verify-api-cert"] }
 
       it "renders the client.rb with verify_api_cert set to false" do
-        rendered_template.should match(/verify_api_cert false/)
+        expect(rendered_template).to match(/verify_api_cert false/)
       end
     end
   end
@@ -327,13 +334,13 @@ describe Chef::Knife::Bootstrap do
     it "creates a secret file" do
       expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(true)
       expect(knife).to receive(:read_secret).and_return(secret)
-      rendered_template.should match(%r{#{secret}})
+      expect(rendered_template).to match(%r{#{secret}})
     end
 
     it "renders the client.rb with an encrypted_data_bag_secret entry" do
       expect(knife).to receive(:encryption_secret_provided_ignore_encrypt_flag?).and_return(true)
       expect(knife).to receive(:read_secret).and_return(secret)
-      rendered_template.should match(%r{encrypted_data_bag_secret\s*"/etc/chef/encrypted_data_bag_secret"})
+      expect(rendered_template).to match(%r{encrypted_data_bag_secret\s*"/etc/chef/encrypted_data_bag_secret"})
     end
 
   end
@@ -348,8 +355,8 @@ describe Chef::Knife::Bootstrap do
 
     before do
       Chef::Config[:trusted_certs_dir] = trusted_certs_dir
-      IO.stub(:read).and_call_original
-      IO.stub(:read).with(File.expand_path(Chef::Config[:validation_key])).and_return("")
+      allow(IO).to receive(:read).and_call_original
+      allow(IO).to receive(:read).with(File.expand_path(Chef::Config[:validation_key])).and_return("")
     end
 
     def certificates
@@ -357,22 +364,22 @@ describe Chef::Knife::Bootstrap do
     end
 
     it "creates /etc/chef/trusted_certs" do
-      rendered_template.should match(%r{mkdir -p /etc/chef/trusted_certs})
+      expect(rendered_template).to match(%r{mkdir -p /etc/chef/trusted_certs})
     end
 
     it "copies the certificates in the directory" do
       certificates.each do |cert|
-        IO.should_receive(:read).with(File.expand_path(cert))
+        expect(IO).to receive(:read).with(File.expand_path(cert))
       end
 
       certificates.each do |cert|
-        rendered_template.should match(%r{cat > /etc/chef/trusted_certs/#{File.basename(cert)} <<'EOP'})
+        expect(rendered_template).to match(%r{cat > /etc/chef/trusted_certs/#{File.basename(cert)} <<'EOP'})
       end
     end
 
     it "doesn't create /etc/chef/trusted_certs if :trusted_certs_dir is empty" do
-      Dir.should_receive(:glob).with(File.join(trusted_certs_dir, "*.{crt,pem}")).and_return([])
-      rendered_template.should_not match(%r{mkdir -p /etc/chef/trusted_certs})
+      expect(Dir).to receive(:glob).with(File.join(trusted_certs_dir, "*.{crt,pem}")).and_return([])
+      expect(rendered_template).not_to match(%r{mkdir -p /etc/chef/trusted_certs})
     end
   end
 
@@ -387,57 +394,57 @@ describe Chef::Knife::Bootstrap do
         Chef::Config[:knife][:ssh_port] = nil
         knife.config[:forward_agent] = true
         knife.config[:identity_file] = "~/.ssh/me.rsa"
-        knife.stub(:render_template).and_return("")
+        allow(knife).to receive(:render_template).and_return("")
         knife.knife_ssh
       end
 
       it "configures the hostname" do
-        knife_ssh.name_args.first.should == "foo.example.com"
+        expect(knife_ssh.name_args.first).to eq("foo.example.com")
       end
 
       it "configures the ssh user" do
-        knife_ssh.config[:ssh_user].should == 'rooty'
+        expect(knife_ssh.config[:ssh_user]).to eq('rooty')
       end
 
       it "configures the ssh password" do
-        knife_ssh.config[:ssh_password].should == 'open_sesame'
+        expect(knife_ssh.config[:ssh_password]).to eq('open_sesame')
       end
 
       it "configures the ssh port" do
-        knife_ssh.config[:ssh_port].should == '4001'
+        expect(knife_ssh.config[:ssh_port]).to eq('4001')
       end
 
       it "configures the ssh agent forwarding" do
-        knife_ssh.config[:forward_agent].should == true
+        expect(knife_ssh.config[:forward_agent]).to eq(true)
       end
 
       it "configures the ssh identity file" do
-        knife_ssh.config[:identity_file].should == '~/.ssh/me.rsa'
+        expect(knife_ssh.config[:identity_file]).to eq('~/.ssh/me.rsa')
       end
     end
 
     context "validating use_sudo_password" do
       before do
         knife.config[:ssh_password] = "password"
-        knife.stub(:render_template).and_return("")
+        allow(knife).to receive(:render_template).and_return("")
       end
 
       it "use_sudo_password contains description and long params for help" do
-        knife.options.should have_key(:use_sudo_password) \
-          and knife.options[:use_sudo_password][:description].to_s.should_not == ''\
-          and knife.options[:use_sudo_password][:long].to_s.should_not == ''
+        expect(knife.options).to have_key(:use_sudo_password) \
+          and expect(knife.options[:use_sudo_password][:description].to_s).not_to eq('')\
+          and expect(knife.options[:use_sudo_password][:long].to_s).not_to eq('')
       end
 
       it "uses the password from --ssh-password for sudo when --use-sudo-password is set" do
         knife.config[:use_sudo] = true
         knife.config[:use_sudo_password] = true
-        knife.ssh_command.should include("echo \'#{knife.config[:ssh_password]}\' | sudo -S")
+        expect(knife.ssh_command).to include("echo \'#{knife.config[:ssh_password]}\' | sudo -S")
       end
 
       it "should not honor --use-sudo-password when --use-sudo is not set" do
         knife.config[:use_sudo] = false
         knife.config[:use_sudo_password] = true
-        knife.ssh_command.should_not include("echo #{knife.config[:ssh_password]} | sudo -S")
+        expect(knife.ssh_command).not_to include("echo #{knife.config[:ssh_password]} | sudo -S")
       end
     end
 
@@ -450,34 +457,34 @@ describe Chef::Knife::Bootstrap do
         Chef::Config[:knife][:identity_file] = "~/.ssh/you.rsa"
         Chef::Config[:knife][:ssh_gateway] = "towel.blinkenlights.nl"
         Chef::Config[:knife][:host_key_verify] = true
-        knife.stub(:render_template).and_return("")
+        allow(knife).to receive(:render_template).and_return("")
         knife.config = {}
         knife.merge_configs
         knife.knife_ssh
       end
 
       it "configures the ssh user" do
-        knife_ssh.config[:ssh_user].should == 'curiosity'
+        expect(knife_ssh.config[:ssh_user]).to eq('curiosity')
       end
 
       it "configures the ssh port" do
-        knife_ssh.config[:ssh_port].should == '2430'
+        expect(knife_ssh.config[:ssh_port]).to eq('2430')
       end
 
       it "configures the ssh agent forwarding" do
-        knife_ssh.config[:forward_agent].should == true
+        expect(knife_ssh.config[:forward_agent]).to eq(true)
       end
 
       it "configures the ssh identity file" do
-        knife_ssh.config[:identity_file].should == '~/.ssh/you.rsa'
+        expect(knife_ssh.config[:identity_file]).to eq('~/.ssh/you.rsa')
       end
 
       it "configures the ssh gateway" do
-        knife_ssh.config[:ssh_gateway].should == 'towel.blinkenlights.nl'
+        expect(knife_ssh.config[:ssh_gateway]).to eq('towel.blinkenlights.nl')
       end
 
       it "configures the host key verify mode" do
-        knife_ssh.config[:host_key_verify].should == true
+        expect(knife_ssh.config[:host_key_verify]).to eq(true)
       end
     end
 
@@ -486,27 +493,27 @@ describe Chef::Knife::Bootstrap do
         knife.name_args = ["foo.example.com"]
         knife.config[:ssh_user]      = "rooty"
         knife.config[:identity_file] = "~/.ssh/me.rsa"
-        knife.stub(:render_template).and_return("")
+        allow(knife).to receive(:render_template).and_return("")
         k = knife.knife_ssh
-        k.stub(:get_password).and_return('typed_in_password')
-        knife.stub(:knife_ssh).and_return(k)
+        allow(k).to receive(:get_password).and_return('typed_in_password')
+        allow(knife).to receive(:knife_ssh).and_return(k)
         knife.knife_ssh_with_password_auth
       end
 
       it "prompts the user for a password " do
-        knife_ssh_with_password_auth.config[:ssh_password].should == 'typed_in_password'
+        expect(knife_ssh_with_password_auth.config[:ssh_password]).to eq('typed_in_password')
       end
 
       it "configures knife not to use the identity file that didn't work previously" do
-        knife_ssh_with_password_auth.config[:identity_file].should be_nil
+        expect(knife_ssh_with_password_auth.config[:identity_file]).to be_nil
       end
     end
   end
 
   it "verifies that a server to bootstrap was given as a command line arg" do
     knife.name_args = nil
-    lambda { knife.run }.should raise_error(SystemExit)
-    stderr.string.should match /ERROR:.+FQDN or ip/
+    expect { knife.run }.to raise_error(SystemExit)
+    expect(stderr.string).to match /ERROR:.+FQDN or ip/
   end
 
   describe "when running the bootstrap" do
@@ -514,31 +521,77 @@ describe Chef::Knife::Bootstrap do
       knife.name_args = ["foo.example.com"]
       knife.config[:ssh_user]      = "rooty"
       knife.config[:identity_file] = "~/.ssh/me.rsa"
-      knife.stub(:render_template).and_return("")
+      allow(knife).to receive(:render_template).and_return("")
       knife_ssh = knife.knife_ssh
-      knife.stub(:knife_ssh).and_return(knife_ssh)
+      allow(knife).to receive(:knife_ssh).and_return(knife_ssh)
       knife_ssh
     end
 
-    it "configures the underlying ssh command and then runs it" do
-      knife_ssh.should_receive(:run)
-      knife.run
-    end
+    context "when running with a configured and present validation key" do
+      before do
+        # this tests runs the old code path where we have a validation key, so we need to pass that check
+        allow(File).to receive(:exist?).with(File.expand_path(Chef::Config[:validation_key])).and_return(true)
+      end
 
-    it "falls back to password based auth when auth fails the first time" do
-      knife.stub(:puts)
 
-      fallback_knife_ssh = knife_ssh.dup
-      knife_ssh.should_receive(:run).and_raise(Net::SSH::AuthenticationFailed.new("no ssh for you"))
-      knife.stub(:knife_ssh_with_password_auth).and_return(fallback_knife_ssh)
-      fallback_knife_ssh.should_receive(:run)
-      knife.run
+      it "configures the underlying ssh command and then runs it" do
+        expect(knife_ssh).to receive(:run)
+        knife.run
+      end
+
+      it "falls back to password based auth when auth fails the first time" do
+        allow(knife).to receive(:puts)
+
+        fallback_knife_ssh = knife_ssh.dup
+        expect(knife_ssh).to receive(:run).and_raise(Net::SSH::AuthenticationFailed.new("no ssh for you"))
+        allow(knife).to receive(:knife_ssh_with_password_auth).and_return(fallback_knife_ssh)
+        expect(fallback_knife_ssh).to receive(:run)
+        knife.run
+      end
+
+      it "raises the exception if config[:ssh_password] is set and an authentication exception is raised" do
+        knife.config[:ssh_password] = "password"
+        expect(knife_ssh).to receive(:run).and_raise(Net::SSH::AuthenticationFailed)
+        expect { knife.run }.to raise_error(Net::SSH::AuthenticationFailed)
+      end
+
+      it "creates the client and adds chef-vault items if vault_list is set" do
+        knife.config[:bootstrap_vault_file] = "/not/our/responsibility/to/check/if/this/exists"
+        expect(knife_ssh).to receive(:run)
+        expect(knife.client_builder).to receive(:run)
+        expect(knife.chef_vault_handler).to receive(:run).with(node_name: knife.config[:chef_node_name])
+        knife.run
+      end
+
+      it "creates the client and adds chef-vault items if vault_items is set" do
+        knife.config[:bootstrap_vault_json] = '{ "vault" => "item" }'
+        expect(knife_ssh).to receive(:run)
+        expect(knife.client_builder).to receive(:run)
+        expect(knife.chef_vault_handler).to receive(:run).with(node_name: knife.config[:chef_node_name])
+        knife.run
+      end
+
+      it "does old-style validation without creating a client key if vault_list+vault_items is not set" do
+        expect(File).to receive(:exist?).with(File.expand_path(Chef::Config[:validation_key])).and_return(true)
+        expect(knife_ssh).to receive(:run)
+        expect(knife.client_builder).not_to receive(:run)
+        expect(knife.chef_vault_handler).not_to receive(:run).with(node_name: knife.config[:chef_node_name])
+        knife.run
+      end
     end
 
-    it "raises the exception if config[:ssh_password] is set and an authentication exception is raised" do
-      knife.config[:ssh_password] = "password"
-      knife_ssh.should_receive(:run).and_raise(Net::SSH::AuthenticationFailed)
-      lambda { knife.run }.should raise_error(Net::SSH::AuthenticationFailed)
+    context "when the validation key is not present" do
+      before do
+        # this tests runs the old code path where we have a validation key, so we need to pass that check
+        allow(File).to receive(:exist?).with(File.expand_path(Chef::Config[:validation_key])).and_return(false)
+      end
+
+      it "creates the client (and possibly adds chef-vault items)" do
+        expect(knife_ssh).to receive(:run)
+        expect(knife.client_builder).to receive(:run)
+        expect(knife.chef_vault_handler).to receive(:run).with(node_name: knife.config[:chef_node_name])
+        knife.run
+      end
     end
   end