decryptor: detect format of Secret data field

Signed-off-by: Hidde Beydals <hello@hidde.co>

controllers/kustomization_decryptor.go

@@ -92,6 +92,9 @@ var (
 		formats.Json:   []byte("\"mac\": \"ENC["),
 		formats.Yaml:   []byte("mac: ENC["),
 	}
+	// unsupportedFormat is used to signal no sopsFormatToMarkerBytes format was
+	// detected by detectFormatFromMarkerBytes.
+	unsupportedFormat = formats.Format(-1)
 )
 
 // KustomizeDecryptor performs decryption operations for a
@@ -334,9 +337,9 @@ func (d *KustomizeDecryptor) DecryptResource(res *resource.Resource) (*resource.
 					continue
 				}
 
-				if bytes.Contains(data, sopsFormatToMarkerBytes[formats.Yaml]) || bytes.Contains(data, sopsFormatToMarkerBytes[formats.Json]) {
+				if inF := detectFormatFromMarkerBytes(data); inF != unsupportedFormat {
 					outF := formatForPath(key)
-					out, err := d.SopsDecryptWithFormat(data, formats.Yaml, outF)
+					out, err := d.SopsDecryptWithFormat(data, inF, outF)
 					if err != nil {
 						return nil, fmt.Errorf("failed to decrypt and format '%s/%s' Secret field '%s': %w",
 							res.GetNamespace(), res.GetName(), key, err)
@@ -740,3 +743,12 @@ func formatForPath(path string) formats.Format {
 		return formats.FormatForPath(path)
 	}
 }
+
+func detectFormatFromMarkerBytes(b []byte) formats.Format {
+	for k, v := range sopsFormatToMarkerBytes {
+		if bytes.Contains(b, v) {
+			return k
+		}
+	}
+	return unsupportedFormat
+}

controllers/kustomization_decryptor_test.go

@@ -1725,3 +1725,29 @@ func Test_formatForPath(t *testing.T) {
 		})
 	}
 }
+
+func Test_detectFormatFromMarkerBytes(t *testing.T) {
+	tests := []struct {
+		name string
+		b    []byte
+		want formats.Format
+	}{
+		{
+			name: "detects format",
+			b:    bytes.Join([][]byte{[]byte("random other bytes"), sopsFormatToMarkerBytes[formats.Yaml], []byte("more random bytes")}, []byte(" ")),
+			want: formats.Yaml,
+		},
+		{
+			name: "returns unsupported format",
+			b:    []byte("no marker bytes present"),
+			want: unsupportedFormat,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := detectFormatFromMarkerBytes(tt.b); got != tt.want {
+				t.Errorf("detectFormatFromMarkerBytes() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}