From: John Mulligan <jmulligan@redhat.com>
Date: Sun, 5 Jul 2026 17:30:12 +0000 (-0400)
Subject: qa/workunits/smb: add a test for invalid kmip key behavior
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=e05970a6944d85f211d6fd65bf079e8fb1b87c39;p=ceph.git

qa/workunits/smb: add a test for invalid kmip key behavior

Add a workunit test that uses and invalid fscrypt/kmip key to validate
that the share fails closed. This also helps validate that fscrypt
is even being enabled.

Signed-off-by: John Mulligan <jmulligan@redhat.com>
---

diff --git a/qa/workunits/smb/tests/test_kb_fscrypt.py b/qa/workunits/smb/tests/test_kb_fscrypt.py
new file mode 100644
index 00000000000..02aa56e7967
--- /dev/null
+++ b/qa/workunits/smb/tests/test_kb_fscrypt.py
@@ -0,0 +1,49 @@
+import pytest
+import smbprotocol
+
+import smbutil
+
+
+@pytest.mark.kb_fscrypt
+def test_invalid_key_uid_share(smb_cfg):
+    """Configure a share for fscrypt but with an invalid KMIP ID.
+    This tests basic error handling in keybridge and validates
+    that when a key can not be fetched that the share is not
+    accessible.
+    """
+    kb_fscrypt = smb_cfg.params["kb_fscrypt"]
+    cluster_id = kb_fscrypt["cluster_id"]
+    unused_subvolume = kb_fscrypt["unused_subvolume"]
+    share_id = kb_fscrypt.get("share_id", "invalidkey1")
+    invalid_key_id = kb_fscrypt.get("invalid_key_id", "9999")
+    filename = "foo.txt"
+
+    new_share = {
+        "resource_type": "ceph.smb.share",
+        "cluster_id": cluster_id,
+        "share_id": share_id,
+        "cephfs": {
+            "volume": "cephfs",
+            "subvolume": unused_subvolume,
+            "path": "/",
+            "fscrypt_key": {
+                "scope": "kmip",
+                "name": invalid_key_id,
+            },
+        },
+    }
+    smbutil.apply_share_config(smb_cfg, new_share)
+
+    try:
+        with pytest.raises(smbprotocol.exceptions.Unsuccessful):
+            with smbutil.connection(smb_cfg, share_id) as sharep:
+                fname = sharep / filename
+                fname.write_text("value: NOPE\n")
+    finally:
+        del_share = {
+            "resource_type": "ceph.smb.share",
+            "cluster_id": cluster_id,
+            "share_id": share_id,
+            "intent": "removed",
+        }
+        smbutil.apply_share_config(smb_cfg, del_share)