hybrid_platforms_conductor 33.2.0 → 33.3.0

data/lib/hybrid_platforms_conductor/plugins.rb

@@ -1,3 +1,4 @@
+require 'forwardable'
 require 'hybrid_platforms_conductor/logger_helpers'
 
 module HybridPlatformsConductor

data/lib/hybrid_platforms_conductor/safe_merge.rb

@@ -0,0 +1,37 @@
+module HybridPlatformsConductor
+
+  # Provide an easy way to safe-merge hashes
+  module SafeMerge
+
+    # Safe-merge 2 hashes.
+    # Safe-merging is done by:
+    # * Merging values that are hashes.
+    # * Reporting errors when values conflict.
+    # When values are conflicting, the initial hash won't modify those conflicting values and will stop the merge.
+    #
+    # Parameters::
+    # * *hash* (Hash): Hash to be modified merging hash_to_merge
+    # * *hash_to_merge* (Hash): Hash to be merged into hash
+    # Result::
+    # * nil or Array<Object>: nil in case of success, or the keys path leading to a conflicting value in case of error
+    def safe_merge(hash, hash_to_merge)
+      conflicting_path = nil
+      hash_to_merge.each do |key, value_to_merge|
+        if hash.key?(key)
+          if hash[key].is_a?(Hash) && value_to_merge.is_a?(Hash)
+            sub_conflicting_path = safe_merge(hash[key], value_to_merge)
+            conflicting_path = [key] + sub_conflicting_path unless sub_conflicting_path.nil?
+          elsif hash[key] != value_to_merge
+            conflicting_path = [key]
+          end
+        else
+          hash[key] = value_to_merge
+        end
+        break unless conflicting_path.nil?
+      end
+      conflicting_path
+    end
+
+  end
+
+end

data/lib/hybrid_platforms_conductor/topographer/plugins/graphviz.rb

@@ -17,9 +17,11 @@ module HybridPlatformsConductor
           @topographer.force_cluster_strict_hierarchy
           # Write a Graphviz file
           File.open(file_name, 'w') do |f|
-            f.puts 'digraph unix {
-              size="6,6";
-              node [style=filled];'
+            f.puts <<~EO_GRAPHVIZ
+              digraph unix {
+                size="6,6";
+                node [style=filled];
+            EO_GRAPHVIZ
             # First write the definition of all nodes
             # Find all nodes belonging to no cluster
             orphan_nodes = @topographer.nodes_graph.keys

data/lib/hybrid_platforms_conductor/version.rb

@@ -1,5 +1,5 @@
 module HybridPlatformsConductor
 
-  VERSION = '33.2.0'
+  VERSION = '33.3.0'
 
 end

data/spec/hybrid_platforms_conductor_test.rb

@@ -101,6 +101,10 @@ module HybridPlatformsConductorTest
         ENV.delete 'hpc_user_for_thycotic'
         ENV.delete 'hpc_password_for_thycotic'
         ENV.delete 'hpc_domain_for_thycotic'
+        ENV.delete 'hpc_user_for_keepass'
+        ENV.delete 'hpc_password_for_keepass'
+        ENV.delete 'hpc_password_enc_for_keepass'
+        ENV.delete 'hpc_key_file_for_keepass'
         ENV.delete 'hpc_certificates'
         ENV.delete 'hpc_interactive'
         ENV.delete 'hpc_test_cookbooks_path'

data/spec/hybrid_platforms_conductor_test/api/actions_executor/connectors/ssh/config_dsl_spec.rb

@@ -13,10 +13,10 @@ describe HybridPlatformsConductor::ActionsExecutor do
       end
 
       it 'returns 1 defined gateway with its content' do
-        ssh_gateway = '
+        ssh_gateway = <<~EO_CONFIG
           Host gateway
             Hostname mygateway.com
-        '
+        EO_CONFIG
         with_repository do
           with_platforms "gateway :gateway_1, '#{ssh_gateway}'" do
             expect(test_config.ssh_for_gateway(:gateway_1)).to eq ssh_gateway
@@ -34,10 +34,12 @@ describe HybridPlatformsConductor::ActionsExecutor do
 
       it 'returns several defined gateways' do
         with_repository do
-          with_platforms '
-            gateway :gateway_1, \'\'
-            gateway :gateway_2, \'\'
-          ' do
+          with_platforms(
+            <<~EO_CONFIG
+              gateway :gateway_1, ''
+              gateway :gateway_2, ''
+            EO_CONFIG
+          ) do
             expect(test_config.known_gateways.sort).to eq %i[gateway_1 gateway_2].sort
           end
         end

data/spec/hybrid_platforms_conductor_test/api/cmd_runner_spec.rb

@@ -47,7 +47,21 @@ describe HybridPlatformsConductor::CmdRunner do
 
   it 'runs a command in an un-bundled environment' do
     with_repository do
-      expect(test_cmd_runner.run_cmd('echo "${BUNDLE_GEMFILE}"')).to eq [0, "\n", '']
+      %w[
+        BUNDLE_GEMFILE
+        GEM_HOME
+        RUBYOPT
+      ].each do |var_to_check|
+        expect(test_cmd_runner.run_cmd("echo \"${#{var_to_check}}\"")).to eq [0, "\n", '']
+      end
+    end
+  end
+
+  it 'keeps dynamically set environment' do
+    with_repository do
+      value = ('a'..'z').to_a.sample(8).join
+      ENV['hpc_test_new_variable'] = value
+      expect(test_cmd_runner.run_cmd('echo "${hpc_test_new_variable}"')).to eq [0, "#{value}\n", '']
     end
   end
 

data/spec/hybrid_platforms_conductor_test/api/config_spec.rb

@@ -19,10 +19,12 @@ describe HybridPlatformsConductor::Config do
   end
 
   it 'returns several defined OS images' do
-    with_platforms '
-      os_image :image_1, \'/path/to/image_1\'
-      os_image :image_2, \'/path/to/image_2\'
-    ' do
+    with_platforms(
+      <<~EO_CONFIG
+        os_image :image_1, '/path/to/image_1'
+        os_image :image_2, '/path/to/image_2'
+      EO_CONFIG
+    ) do
       expect(test_config.known_os_images.sort).to eq %i[image_1 image_2].sort
     end
   end
@@ -49,11 +51,13 @@ describe HybridPlatformsConductor::Config do
   end
 
   it 'includes several configuration files' do
-    with_platforms '
-      os_image :image_1, \'/path/to/image_1\'
-      include_config_from "#{__dir__}/my_conf_1.rb"
-      include_config_from "#{__dir__}/my_conf_2.rb"
-    ' do |hybrid_platforms_dir|
+    with_platforms(
+      <<~'EO_CONFIG'
+        os_image :image_1, '/path/to/image_1'
+        include_config_from "#{__dir__}/my_conf_1.rb"
+        include_config_from "#{__dir__}/my_conf_2.rb"
+      EO_CONFIG
+    ) do |hybrid_platforms_dir|
       File.write("#{hybrid_platforms_dir}/my_conf_1.rb", <<~'EO_CONFIG')
         os_image :image_4, '/path/to/image_4'
         include_config_from "#{__dir__}/my_conf_3.rb"
@@ -65,9 +69,7 @@ describe HybridPlatformsConductor::Config do
   end
 
   it 'applies nodes specific configuration to all nodes by default' do
-    with_platforms '
-      expect_tests_to_fail :my_test, \'Failure reason\'
-    ' do
+    with_platforms 'expect_tests_to_fail :my_test, \'Failure reason\'' do
       expect(test_config.expected_failures).to eq [
         {
           nodes_selectors_stack: [],
@@ -79,12 +81,14 @@ describe HybridPlatformsConductor::Config do
   end
 
   it 'filters nodes specific configuration to nodes sets in a scope' do
-    with_platforms '
-      for_nodes(%w[node1 node2 node3]) do
-        expect_tests_to_fail :my_test_1, \'Failure reason 1\'
-      end
-      expect_tests_to_fail :my_test_2, \'Failure reason 2\'
-    ' do
+    with_platforms(
+      <<~EO_CONFIG
+        for_nodes(%w[node1 node2 node3]) do
+          expect_tests_to_fail :my_test_1, 'Failure reason 1'
+        end
+        expect_tests_to_fail :my_test_2, 'Failure reason 2'
+      EO_CONFIG
+    ) do
       sort_proc = proc { |expected_failure_info| expected_failure_info[:reason] }
       expect(test_config.expected_failures.sort_by(&sort_proc)).to eq [
         {
@@ -102,14 +106,16 @@ describe HybridPlatformsConductor::Config do
   end
 
   it 'filters nodes specific configuration in a scoped stack' do
-    with_platforms '
-      for_nodes(%w[node1 node2 node3]) do
-        expect_tests_to_fail :my_test_1, \'Failure reason 1\'
-        for_nodes(%w[node2 node3 node4]) do
-          expect_tests_to_fail :my_test_2, \'Failure reason 2\'
+    with_platforms(
+      <<~EO_CONFIG
+        for_nodes(%w[node1 node2 node3]) do
+          expect_tests_to_fail :my_test_1, 'Failure reason 1'
+          for_nodes(%w[node2 node3 node4]) do
+            expect_tests_to_fail :my_test_2, 'Failure reason 2'
+          end
         end
-      end
-    ' do
+      EO_CONFIG
+    ) do
       sort_proc = proc { |expected_failure_info| expected_failure_info[:reason] }
       expect(test_config.expected_failures.sort_by(&sort_proc)).to eq [
         {
@@ -127,13 +133,15 @@ describe HybridPlatformsConductor::Config do
   end
 
   it 'returns the expected failures correctly' do
-    with_platforms '
-      expect_tests_to_fail :my_test_1, \'Failure reason 1\'
-      expect_tests_to_fail %i[my_test_2 my_test_3], \'Failure reason 23\'
-      for_nodes(%w[node1 node2 node3]) do
-        expect_tests_to_fail :my_test_4, \'Failure reason 4\'
-      end
-    ' do
+    with_platforms(
+      <<~EO_CONFIG
+        expect_tests_to_fail :my_test_1, 'Failure reason 1'
+        expect_tests_to_fail %i[my_test_2 my_test_3], 'Failure reason 23'
+        for_nodes(%w[node1 node2 node3]) do
+          expect_tests_to_fail :my_test_4, 'Failure reason 4'
+        end
+      EO_CONFIG
+    ) do
       sort_proc = proc { |expected_failure_info| expected_failure_info[:reason] }
       expect(test_config.expected_failures.sort_by(&sort_proc)).to eq [
         {
@@ -155,47 +163,15 @@ describe HybridPlatformsConductor::Config do
     end
   end
 
-  it 'returns the retriable errors correctly' do
-    with_platforms '
-      retry_deploy_for_errors_on_stdout \'Retry stdout global\'
-      retry_deploy_for_errors_on_stderr [
-        \'Retry stderr global\',
-        /.+Retry stderr regexp global/
-      ]
-      for_nodes(%w[node1 node2 node3]) do
-        retry_deploy_for_errors_on_stdout \'Retry stdout nodes\'
-        retry_deploy_for_errors_on_stderr \'Retry stderr nodes\'
-      end
-    ' do
-      sort_proc = proc { |retriable_error_info| ((retriable_error_info[:errors_on_stdout] || []) + (retriable_error_info[:errors_on_stderr] || [])).first.to_s }
-      expect(test_config.retriable_errors.sort_by(&sort_proc)).to eq [
-        {
-          nodes_selectors_stack: [],
-          errors_on_stdout: ['Retry stdout global']
-        },
-        {
-          nodes_selectors_stack: [],
-          errors_on_stderr: ['Retry stderr global', /.+Retry stderr regexp global/]
-        },
-        {
-          nodes_selectors_stack: [%w[node1 node2 node3]],
-          errors_on_stdout: ['Retry stdout nodes']
-        },
-        {
-          nodes_selectors_stack: [%w[node1 node2 node3]],
-          errors_on_stderr: ['Retry stderr nodes']
-        }
-      ].sort_by(&sort_proc)
-    end
-  end
-
   it 'returns the deployment schedules correctly' do
-    with_platforms '
-      deployment_schedule(IceCube::Schedule.new(Time.parse(\'2020-05-01 11:22:33 UTC\')))
-      for_nodes(%w[node1 node2 node3]) do
-        deployment_schedule(IceCube::Schedule.new(Time.parse(\'2020-05-02 22:33:44 UTC\')))
-      end
-    ' do
+    with_platforms(
+      <<~EO_CONFIG
+        deployment_schedule(IceCube::Schedule.new(Time.parse('2020-05-01 11:22:33 UTC')))
+        for_nodes(%w[node1 node2 node3]) do
+          deployment_schedule(IceCube::Schedule.new(Time.parse('2020-05-02 22:33:44 UTC')))
+        end
+      EO_CONFIG
+    ) do
       sort_proc = proc { |deployment_schedule_info| deployment_schedule_info[:schedule].to_ical }
       expect(test_config.deployment_schedules.sort_by(&sort_proc)).to eq [
         {

data/spec/hybrid_platforms_conductor_test/api/deployer/config_dsl_spec.rb

@@ -8,6 +8,42 @@ describe HybridPlatformsConductor::Deployer do
       end
     end
 
+    it 'returns the retriable errors correctly' do
+      with_platforms(
+        <<~EO_CONFIG
+          retry_deploy_for_errors_on_stdout 'Retry stdout global'
+          retry_deploy_for_errors_on_stderr [
+            'Retry stderr global',
+            /.+Retry stderr regexp global/
+          ]
+          for_nodes(%w[node1 node2 node3]) do
+            retry_deploy_for_errors_on_stdout 'Retry stdout nodes'
+            retry_deploy_for_errors_on_stderr 'Retry stderr nodes'
+          end
+        EO_CONFIG
+      ) do
+        sort_proc = proc { |retriable_error_info| ((retriable_error_info[:errors_on_stdout] || []) + (retriable_error_info[:errors_on_stderr] || [])).first.to_s }
+        expect(test_config.retriable_errors.sort_by(&sort_proc)).to eq [
+          {
+            nodes_selectors_stack: [],
+            errors_on_stdout: ['Retry stdout global']
+          },
+          {
+            nodes_selectors_stack: [],
+            errors_on_stderr: ['Retry stderr global', /.+Retry stderr regexp global/]
+          },
+          {
+            nodes_selectors_stack: [%w[node1 node2 node3]],
+            errors_on_stdout: ['Retry stdout nodes']
+          },
+          {
+            nodes_selectors_stack: [%w[node1 node2 node3]],
+            errors_on_stderr: ['Retry stderr nodes']
+          }
+        ].sort_by(&sort_proc)
+      end
+    end
+
     it 'declares log plugins to be used' do
       with_platforms(
         <<~EO_CONFIG

data/spec/hybrid_platforms_conductor_test/api/deployer/secrets_reader_plugins/keepass_spec.rb

@@ -0,0 +1,719 @@
+require 'open3'
+
+describe HybridPlatformsConductor::Deployer do
+
+  context 'when checking secrets_reader plugins' do
+
+    context 'with keepass' do
+
+      # Expect some calls to be done on KPScript
+      #
+      # Parameters::
+      # * *expected_calls* (Array<[String, String or Hash]>): The list of calls and their corresponding mocked response:
+      #   * String: Mocked stdout
+      #   * Hash<Symbol,Object>: More complete structure defining the mocked response:
+      #     * *exit_status* (Integer): The command exit status [default: 0]
+      #     * *stdout* (String): The command stdout
+      #     * *xml* (String or nil): XML document to generate as an export, or nil for none [default: nil]
+      def expect_calls_to_kpscript(expected_calls)
+        if expected_calls.empty?
+          expect(Open3).not_to receive(:popen3)
+        else
+          expect(Open3).to receive(:popen3).exactly(expected_calls.size).times do |cmd, &block|
+            expected_call, mocked_call = expected_calls.shift
+            if expected_call.is_a?(Regexp)
+              expect(cmd).to match expected_call
+            else
+              expect(cmd).to eq expected_call
+            end
+            mocked_call = { stdout: mocked_call } if mocked_call.is_a?(String)
+            mocked_call[:exit_status] = 0 unless mocked_call.key?(:exit_status)
+            wait_thr_double = instance_double(Process::Waiter)
+            allow(wait_thr_double).to receive(:value) do
+              wait_thr_value_double = instance_double(Process::Status)
+              allow(wait_thr_value_double).to receive(:exitstatus) do
+                mocked_call[:exit_status]
+              end
+              wait_thr_value_double
+            end
+            if mocked_call[:xml]
+              xml_file = cmd.match(/-OutFile:"([^"]+)"/)[1]
+              logger.debug "Mock KPScript XML file #{xml_file} with\n#{mocked_call[:xml]}"
+              File.write(xml_file, mocked_call[:xml])
+            end
+            block.call(
+              StringIO.new,
+              StringIO.new(mocked_call[:stdout]),
+              StringIO.new,
+              wait_thr_double
+            )
+          end
+        end
+      end
+
+      # Setup a platform for tests
+      #
+      # Parameters::
+      # * *additional_config* (String): Additional config
+      # * *platform_info* (Hash): Platform configuration [default: 1 node having 1 service]
+      # * *mock_keepass_password* (String): Password to be returned by credentials [default: 'test_keepass_password']
+      # * *mock_xml* (String): XML to be mocked [default: xml_single_entry]
+      # * *expect_key_file* (String or nil): Key file to be expected, or nil if none [default: nil]
+      # * *expect_password_enc* (String or nil): Encrypted password to be expected, or nil if none [default: nil]
+      # * *expect_kpscript_calls* (Boolean): Should we expect calls to KPScript? [default: true]
+      # * *expect_nbr_credentials_calls* (Integer): How many calls to the credentials are expected? [default: 1]
+      # * *block* (Proc): Code called when the platform is setup
+      def with_test_platform_for_keepass_test(
+        additional_config,
+        platform_info: {
+          nodes: { 'node' => { services: %w[service] } },
+          deployable_services: %w[service]
+        },
+        mock_keepass_password: 'test_keepass_password',
+        mock_xml: xml_single_entry,
+        expect_key_file: nil,
+        expect_password_enc: nil,
+        expect_kpscript_calls: true,
+        expect_nbr_credentials_calls: 1,
+        &block
+      )
+        expect(HybridPlatformsConductor::Credentials).to receive(:with_credentials_for).exactly(expect_nbr_credentials_calls).times do |id, _logger, _logger_stderr, url: nil, &client_code|
+          expect(id).to eq :keepass
+          client_code.call nil, mock_keepass_password
+        end
+        if expect_kpscript_calls
+          expect_calls_to_kpscript [
+            [
+              %r{/path/to/kpscript "/path/to/database.kdbx"#{mock_keepass_password.nil? ? '' : " -pw:\"#{Regexp.escape(mock_keepass_password)}\""}#{expect_password_enc.nil? ? '' : " -pw-enc:\"#{Regexp.escape(expect_password_enc)}\""}#{expect_key_file.nil? ? '' : " -keyfile:\"#{Regexp.escape(expect_key_file)}\""} -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: mock_xml
+              }
+            ]
+          ]
+        end
+        with_test_platform(
+          platform_info,
+          additional_config: "read_secrets_from :keepass\n#{additional_config}",
+          &block
+        )
+      end
+
+      # Expect secrets to be set to given values
+      #
+      # Parameters::
+      # * *expected_secrets* (Hash): Expected secrets
+      def expect_secrets_to_be(expected_secrets)
+        expect(test_services_handler).to receive(:package).with(
+          services: { 'node' => %w[service] },
+          secrets: expected_secrets,
+          local_environment: false
+        ) { raise 'Abort as testing secrets is enough' }
+        expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Abort as testing secrets is enough'
+      end
+
+      let(:xml_single_entry) do
+        <<~EO_XML
+          <KeePassFile>
+            <Root>
+              <Group>
+                <Entry>
+                  <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                  <String>
+                    <Key>Password</Key>
+                    <Value ProtectInMemory="True">TestPassword</Value>
+                  </String>
+                  <String>
+                    <Key>Title</Key>
+                    <Value>Test Secret</Value>
+                  </String>
+                  <String>
+                    <Key>UserName</Key>
+                    <Value>Test User Name</Value>
+                  </String>
+                </Entry>
+              </Group>
+            </Root>
+          </KeePassFile>
+        EO_XML
+      end
+
+      it 'gets secrets from a KeePass database with password' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+        ) do
+          expect_secrets_to_be('Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' })
+        end
+      end
+
+      it 'gets secrets from a KeePass database with password and key file' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          expect_key_file: '/path/to/database.key'
+        ) do
+          ENV['hpc_key_file_for_keepass'] = '/path/to/database.key'
+          expect_secrets_to_be('Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' })
+        end
+      end
+
+      it 'gets secrets from a KeePass database with encrypted password' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          mock_keepass_password: nil,
+          expect_password_enc: 'PASSWORD_ENC'
+        ) do
+          ENV['hpc_password_enc_for_keepass'] = 'PASSWORD_ENC'
+          expect_secrets_to_be('Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' })
+        end
+      end
+
+      it 'gets secrets from a KeePass database with encrypted password and key file' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          mock_keepass_password: nil,
+          expect_password_enc: 'PASSWORD_ENC',
+          expect_key_file: '/path/to/database.key'
+        ) do
+          ENV['hpc_password_enc_for_keepass'] = 'PASSWORD_ENC'
+          ENV['hpc_key_file_for_keepass'] = '/path/to/database.key'
+          expect_secrets_to_be('Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' })
+        end
+      end
+
+      it 'gets secrets from a KeePass database with key file' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          mock_keepass_password: nil,
+          expect_key_file: '/path/to/database.key'
+        ) do
+          ENV['hpc_key_file_for_keepass'] = '/path/to/database.key'
+          expect_secrets_to_be('Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' })
+        end
+      end
+
+      it 'fails to get secrets from a KeePass database when no authentication mechanisms are provided' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          mock_keepass_password: nil,
+          expect_kpscript_calls: false
+        ) do
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Please specify at least one of password, password_enc or key_file arguments'
+        end
+      end
+
+      it 'fails to get secrets if KPScript is not configured' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          expect_nbr_credentials_calls: 0,
+          expect_kpscript_calls: false
+        ) do
+          expect { test_deployer.deploy_on(%w[node]) }.to raise_error 'Missing KPScript configuration. Please use use_kpscript_from to set it.'
+        end
+      end
+
+      it 'gets secrets from KeePass groups' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          mock_xml: <<~EO_XML
+            <KeePassFile>
+              <Root>
+                <Group>
+                  <Entry>
+                    <String>
+                      <Key>Password</Key>
+                      <Value ProtectInMemory="True">TestPassword0</Value>
+                    </String>
+                    <String>
+                      <Key>Title</Key>
+                      <Value>Secret 0</Value>
+                    </String>
+                  </Entry>
+                  <Group>
+                    <Name>Group1</UUID>
+                    <Entry>
+                      <String>
+                        <Key>Password</Key>
+                        <Value ProtectInMemory="True">TestPassword1</Value>
+                      </String>
+                      <String>
+                        <Key>Title</Key>
+                        <Value>Secret 1</Value>
+                      </String>
+                    </Entry>
+                    <Group>
+                      <Name>Group2</UUID>
+                      <Entry>
+                        <String>
+                          <Key>Password</Key>
+                          <Value ProtectInMemory="True">TestPassword2</Value>
+                        </String>
+                        <String>
+                          <Key>Title</Key>
+                          <Value>Secret 2</Value>
+                        </String>
+                      </Entry>
+                    </Group>
+                    <Group>
+                      <Name>Group3</UUID>
+                      <Entry>
+                        <String>
+                          <Key>Password</Key>
+                          <Value ProtectInMemory="True">TestPassword3</Value>
+                        </String>
+                        <String>
+                          <Key>Title</Key>
+                          <Value>Secret 3</Value>
+                        </String>
+                      </Entry>
+                    </Group>
+                  </Group>
+                </Group>
+              </Root>
+            </KeePassFile>
+          EO_XML
+        ) do
+          expect_secrets_to_be(
+            'Secret 0' => { 'password' => 'TestPassword0' },
+            'Group1' => {
+              'Secret 1' => { 'password' => 'TestPassword1' },
+              'Group2' => {
+                'Secret 2' => { 'password' => 'TestPassword2' }
+              },
+              'Group3' => {
+                'Secret 3' => { 'password' => 'TestPassword3' }
+              }
+            }
+          )
+        end
+      end
+
+      it 'gets secrets with attachments' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          mock_xml: <<~EO_XML
+            <KeePassFile>
+              <Meta>
+                <Binaries>
+                  <Binary ID="0" Compressed="True">#{
+                    str = StringIO.new
+                    gz = Zlib::GzipWriter.new(str)
+                    gz.write('File 0 Content')
+                    gz.close
+                    Base64.encode64(str.string).strip
+                  }</Binary>
+                  <Binary ID="1">#{Base64.encode64('File 1 Content').strip}</Binary>
+                </Binaries>
+              </Meta>
+              <Root>
+                <Group>
+                  <Entry>
+                    <String>
+                      <Key>Password</Key>
+                      <Value ProtectInMemory="True">TestPassword0</Value>
+                    </String>
+                    <String>
+                      <Key>Title</Key>
+                      <Value>Secret 0</Value>
+                    </String>
+                    <Binary>
+                      <Key>file0.txt</Key>
+                      <Value Ref="0" />
+                    </Binary>
+                  </Entry>
+                  <Group>
+                    <Name>Group1</UUID>
+                    <Entry>
+                      <String>
+                        <Key>Password</Key>
+                        <Value ProtectInMemory="True">TestPassword1</Value>
+                      </String>
+                      <String>
+                        <Key>Title</Key>
+                        <Value>Secret 1</Value>
+                      </String>
+                      <Binary>
+                        <Key>file1.txt</Key>
+                        <Value Ref="1" />
+                      </Binary>
+                    </Entry>
+                  </Group>
+                </Group>
+              </Root>
+            </KeePassFile>
+          EO_XML
+        ) do
+          expect_secrets_to_be(
+            'Secret 0' => { 'file0.txt' => 'File 0 Content', 'password' => 'TestPassword0' },
+            'Group1' => {
+              'Secret 1' => { 'file1.txt' => 'File 1 Content', 'password' => 'TestPassword1' }
+            }
+          )
+        end
+      end
+
+      it 'gets secrets from a KeePass database for several nodes' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database.kdbx')
+          EO_CONFIG
+          platform_info: {
+            nodes: { 'node1' => { services: %w[service1] }, 'node2' => { services: %w[service2] } },
+            deployable_services: %w[service1 service2]
+          }
+        ) do
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node1' => %w[service1], 'node2' => %w[service2] },
+            secrets: { 'Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' } },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node1 node2]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'gets secrets from a KeePass database for several databases' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database1.kdbx')
+            for_nodes('node2') do
+              secrets_from_keepass(database: '/path/to/database2.kdbx')
+            end
+          EO_CONFIG
+          platform_info: {
+            nodes: { 'node1' => { services: %w[service1] }, 'node2' => { services: %w[service2] } },
+            deployable_services: %w[service1 service2]
+          },
+          expect_kpscript_calls: false,
+          expect_nbr_credentials_calls: 2
+        ) do
+          expect_calls_to_kpscript [
+            [
+              %r{/path/to/kpscript "/path/to/database1.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: xml_single_entry
+              }
+            ],
+            [
+              %r{/path/to/kpscript "/path/to/database2.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: <<~EO_XML
+                  <KeePassFile>
+                    <Root>
+                      <Group>
+                        <Entry>
+                          <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                          <String>
+                            <Key>Password</Key>
+                            <Value ProtectInMemory="True">TestPassword2</Value>
+                          </String>
+                          <String>
+                            <Key>Title</Key>
+                            <Value>Test Secret 2</Value>
+                          </String>
+                          <String>
+                            <Key>UserName</Key>
+                            <Value>Test User Name 2</Value>
+                          </String>
+                        </Entry>
+                      </Group>
+                    </Root>
+                  </KeePassFile>
+                EO_XML
+              }
+            ]
+          ]
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node1' => %w[service1], 'node2' => %w[service2] },
+            secrets: {
+              'Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' },
+              'Test Secret 2' => { 'password' => 'TestPassword2', 'user_name' => 'Test User Name 2' }
+            },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node1 node2]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'gets secrets from a group path in a KeePass database' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(
+              database: '/path/to/database.kdbx',
+              group_path: %w[Group1 Group2 Group3]
+            )
+          EO_CONFIG
+          expect_kpscript_calls: false
+        ) do
+          expect_calls_to_kpscript [
+            [
+              %r{/path/to/kpscript "/path/to/database.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+" -GroupPath:"Group1/Group2/Group3"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: xml_single_entry
+              }
+            ]
+          ]
+          expect_secrets_to_be('Test Secret' => { 'password' => 'TestPassword', 'user_name' => 'Test User Name' })
+        end
+      end
+
+      it 'merges secrets from several KeePass databases' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database1.kdbx')
+            for_nodes('node2') do
+              secrets_from_keepass(database: '/path/to/database2.kdbx')
+            end
+          EO_CONFIG
+          platform_info: {
+            nodes: { 'node1' => { services: %w[service1] }, 'node2' => { services: %w[service2] } },
+            deployable_services: %w[service1 service2]
+          },
+          expect_kpscript_calls: false,
+          expect_nbr_credentials_calls: 2
+        ) do
+          expect_calls_to_kpscript [
+            [
+              %r{/path/to/kpscript "/path/to/database1.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: <<~EO_XML
+                  <KeePassFile>
+                    <Root>
+                      <Group>
+                        <Entry>
+                          <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                          <String>
+                            <Key>Password</Key>
+                            <Value ProtectInMemory="True">TestPassword1</Value>
+                          </String>
+                          <String>
+                            <Key>Title</Key>
+                            <Value>Test Secret 1</Value>
+                          </String>
+                          <String>
+                            <Key>UserName</Key>
+                            <Value>Test User Name 1</Value>
+                          </String>
+                        </Entry>
+                        <Group>
+                          <UUID>RsonCc3VHk+k85z5zHhZzQ==</UUID>
+                          <Name>Group1</Name>
+                          <Entry>
+                            <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                            <String>
+                              <Key>Password</Key>
+                              <Value ProtectInMemory="True">TestPassword3</Value>
+                            </String>
+                            <String>
+                              <Key>Title</Key>
+                              <Value>Test Secret 3</Value>
+                            </String>
+                            <String>
+                              <Key>UserName</Key>
+                              <Value>Test User Name 3</Value>
+                            </String>
+                          </Entry>
+                        </Group>
+                      </Group>
+                    </Root>
+                  </KeePassFile>
+                EO_XML
+              }
+            ],
+            [
+              %r{/path/to/kpscript "/path/to/database2.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: <<~EO_XML
+                  <KeePassFile>
+                    <Root>
+                      <Group>
+                        <Entry>
+                          <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                          <String>
+                            <Key>Password</Key>
+                            <Value ProtectInMemory="True">TestPassword2</Value>
+                          </String>
+                          <String>
+                            <Key>Title</Key>
+                            <Value>Test Secret 2</Value>
+                          </String>
+                          <String>
+                            <Key>UserName</Key>
+                            <Value>Test User Name 2</Value>
+                          </String>
+                        </Entry>
+                        <Group>
+                          <UUID>RsonCc3VHk+k85z5zHhZzQ==</UUID>
+                          <Name>Group1</Name>
+                          <Entry>
+                            <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                            <String>
+                              <Key>Password</Key>
+                              <Value ProtectInMemory="True">TestPassword3</Value>
+                            </String>
+                            <String>
+                              <Key>Title</Key>
+                              <Value>Test Secret 3</Value>
+                            </String>
+                            <String>
+                              <Key>Notes</Key>
+                              <Value>Notes 3</Value>
+                            </String>
+                          </Entry>
+                          <Entry>
+                            <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                            <String>
+                              <Key>Password</Key>
+                              <Value ProtectInMemory="True">TestPassword4</Value>
+                            </String>
+                            <String>
+                              <Key>Title</Key>
+                              <Value>Test Secret 4</Value>
+                            </String>
+                            <String>
+                              <Key>UserName</Key>
+                              <Value>Test User Name 4</Value>
+                            </String>
+                          </Entry>
+                        </Group>
+                      </Group>
+                    </Root>
+                  </KeePassFile>
+                EO_XML
+              }
+            ]
+          ]
+          expect(test_services_handler).to receive(:package).with(
+            services: { 'node1' => %w[service1], 'node2' => %w[service2] },
+            secrets: {
+              'Test Secret 1' => { 'password' => 'TestPassword1', 'user_name' => 'Test User Name 1' },
+              'Test Secret 2' => { 'password' => 'TestPassword2', 'user_name' => 'Test User Name 2' },
+              'Group1' => {
+                'Test Secret 3' => { 'password' => 'TestPassword3', 'user_name' => 'Test User Name 3', 'notes' => 'Notes 3' },
+                'Test Secret 4' => { 'password' => 'TestPassword4', 'user_name' => 'Test User Name 4' }
+              }
+            },
+            local_environment: false
+          ) { raise 'Abort as testing secrets is enough' }
+          expect { test_deployer.deploy_on(%w[node1 node2]) }.to raise_error 'Abort as testing secrets is enough'
+        end
+      end
+
+      it 'fails in case of secrets conflicts between several KeePass databases' do
+        with_test_platform_for_keepass_test(
+          <<~EO_CONFIG,
+            use_kpscript_from '/path/to/kpscript'
+            secrets_from_keepass(database: '/path/to/database1.kdbx')
+            for_nodes('node2') do
+              secrets_from_keepass(database: '/path/to/database2.kdbx')
+            end
+          EO_CONFIG
+          platform_info: {
+            nodes: { 'node1' => { services: %w[service1] }, 'node2' => { services: %w[service2] } },
+            deployable_services: %w[service1 service2]
+          },
+          expect_kpscript_calls: false,
+          expect_nbr_credentials_calls: 2
+        ) do
+          expect_calls_to_kpscript [
+            [
+              %r{/path/to/kpscript "/path/to/database1.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: <<~EO_XML
+                  <KeePassFile>
+                    <Root>
+                      <Group>
+                        <Entry>
+                          <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                          <String>
+                            <Key>Password</Key>
+                            <Value ProtectInMemory="True">TestPassword1</Value>
+                          </String>
+                          <String>
+                            <Key>Title</Key>
+                            <Value>Test Secret 1</Value>
+                          </String>
+                          <String>
+                            <Key>UserName</Key>
+                            <Value>Test User Name 1</Value>
+                          </String>
+                        </Entry>
+                      </Group>
+                    </Root>
+                  </KeePassFile>
+                EO_XML
+              }
+            ],
+            [
+              %r{/path/to/kpscript "/path/to/database2.kdbx" -pw:"test_keepass_password" -c:Export -Format:"KeePass XML \(2.x\)" -OutFile:"/tmp/.+"},
+              {
+                stdout: 'OK: Operation completed successfully.',
+                xml: <<~EO_XML
+                  <KeePassFile>
+                    <Root>
+                      <Group>
+                        <Entry>
+                          <UUID>Iv3JjMzpPEaijOB+SFZpRw==</UUID>
+                          <String>
+                            <Key>Password</Key>
+                            <Value ProtectInMemory="True">OtherTestPassword1</Value>
+                          </String>
+                          <String>
+                            <Key>Title</Key>
+                            <Value>Test Secret 1</Value>
+                          </String>
+                          <String>
+                            <Key>UserName</Key>
+                            <Value>Test User Name 1</Value>
+                          </String>
+                        </Entry>
+                      </Group>
+                    </Root>
+                  </KeePassFile>
+                EO_XML
+              }
+            ]
+          ]
+          expect { test_deployer.deploy_on(%w[node1 node2]) }.to raise_error 'Secret set at path Test Secret 1->password by /path/to/database2.kdbx for service service2 on node node2 has conflicting values (set debug for value details).'
+        end
+      end
+
+    end
+
+  end
+
+end