From c70f83b375caeaf609884420ecc0ca769184bd74 Mon Sep 17 00:00:00 2001 From: Mattia Eleuteri Date: Mon, 26 Oct 2026 22:11:09 +0100 Subject: [PATCH] fix(mariadb-operator): derive the cluster name from the platform domain The package pinned clusterName to cozy.local, so on a cluster installed with any other networking.clusterDomain the operator resolved its own MariaDB pods as ..svc.cozy.local and got NXDOMAIN. Replication between replicas was never configured, and User, Database and Grant resources failed to reconcile, with the operator only retrying at a verbose log level. clusterName is a vendored subchart value, out of reach of the _cluster lookup that package templates use, so the platform now carries it under the subchart key in the shared values Secret, the same route KEDA and the OpenSearch operator already take. The literal in the package stays as the default for a render without that Secret. Assisted-by: LLM Signed-off-by: Mattia Eleuteri --- packages/core/platform/templates/apps.yaml | 8 ++++ ...ps_mariadb_operator_cluster_name_test.yaml | 33 ++++++++++++++ .../tests/cluster_name_test.yaml | 43 +++++++++++++++++++ packages/system/mariadb-operator/values.yaml | 2 + 4 files changed, 86 insertions(+) create mode 100644 packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml create mode 100644 packages/system/mariadb-operator/tests/cluster_name_test.yaml diff --git a/packages/core/platform/templates/apps.yaml b/packages/core/platform/templates/apps.yaml index 030cfe8b2..4a0f0ae89 100644 --- a/packages/core/platform/templates/apps.yaml +++ b/packages/core/platform/templates/apps.yaml @@ -33,6 +33,14 @@ stringData: opensearch-operator: manager: dnsBase: {{ .Values.networking.clusterDomain | quote }} + {{- /* + The operator resolves its own MariaDB pods, and the webhook certificate + gets its SAN, from CLUSTER_NAME, which the vendored subchart reads from + clusterName. Same subchart-key route as above; a package rendered + without this Secret falls back to the literal in its values.yaml. + */}} + mariadb-operator: + clusterName: {{ .Values.networking.clusterDomain | quote }} _cluster: root-host: {{ $rootHost | quote }} bundle-name: {{ .Values.bundles.system.variant | quote }} diff --git a/packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml b/packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml new file mode 100644 index 000000000..6cd9426ba --- /dev/null +++ b/packages/core/platform/tests/apps_mariadb_operator_cluster_name_test.yaml @@ -0,0 +1,33 @@ +suite: apps.yaml networking.clusterDomain reaches the mariadb-operator cluster name + +templates: + - templates/apps.yaml + +release: + name: cozy-platform + namespace: cozy-system + +# The operator dials ..svc. to set up replication and +# to reconcile User, Database and Grant, and the vendored subchart fills +# CLUSTER_NAME from clusterName. A cluster whose domain is not cozy.local got +# NXDOMAIN on every such lookup while the literal was pinned in the package. +# Every pattern anchors clusterName to its mariadb-operator parent, so a sibling +# block carrying the same domain cannot satisfy the assertion on its own. + +tests: + - it: carries the cozy.local default under the subchart key + asserts: + - matchRegex: + path: stringData["values.yaml"] + pattern: '(?m)^mariadb-operator:\n clusterName: "cozy\.local"$' + + - it: tracks a non-default networking.clusterDomain + set: + networking.clusterDomain: example.test + asserts: + - matchRegex: + path: stringData["values.yaml"] + pattern: '(?m)^mariadb-operator:\n clusterName: "example\.test"$' + - notMatchRegex: + path: stringData["values.yaml"] + pattern: '(?m)^mariadb-operator:\n clusterName: "cozy\.local"$' diff --git a/packages/system/mariadb-operator/tests/cluster_name_test.yaml b/packages/system/mariadb-operator/tests/cluster_name_test.yaml new file mode 100644 index 000000000..45d762727 --- /dev/null +++ b/packages/system/mariadb-operator/tests/cluster_name_test.yaml @@ -0,0 +1,43 @@ +suite: mariadb-operator package resolves its pods in the platform cluster domain +release: + name: mariadb-operator + namespace: cozy-mariadb-operator +# core/platform hands the cluster domain to this package as +# mariadb-operator.clusterName in the shared values Secret. Guard that the +# vendored chart still threads that key into what the operator and the webhook +# certificate use, so a re-vendor that renames it goes red here. +tests: + - it: sets the operator CLUSTER_NAME from the injected domain + templates: + - charts/mariadb-operator/templates/operator/deployment.yaml + set: + mariadb-operator.clusterName: example.test + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: CLUSTER_NAME + value: example.test + + - it: issues the webhook certificate for the injected domain + templates: + - charts/mariadb-operator/templates/webhook/certificate.yaml + documentSelector: + path: kind + value: Certificate + set: + mariadb-operator.clusterName: example.test + asserts: + - contains: + path: spec.dnsNames + content: mariadb-operator-webhook.cozy-mariadb-operator.svc.example.test + + - it: keeps cozy.local as the standalone default + templates: + - charts/mariadb-operator/templates/operator/deployment.yaml + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: CLUSTER_NAME + value: cozy.local diff --git a/packages/system/mariadb-operator/values.yaml b/packages/system/mariadb-operator/values.yaml index 2728c084e..285975440 100644 --- a/packages/system/mariadb-operator/values.yaml +++ b/packages/system/mariadb-operator/values.yaml @@ -1,4 +1,6 @@ mariadb-operator: + # Fallback only: core/platform injects networking.clusterDomain into this key + # through the shared cozystack-values Secret (see its apps.yaml). clusterName: cozy.local metrics: enabled: true