Commit Graph
7 Commits
Author SHA1 Message Date
Arsolitt d052227dc4 Merge branch 'main' into feat/tls-postgres
Resolve the conflict in the generated packages/system/postgres-rd/cozyrds/postgres.yaml by regenerating openAPISchema and keysOrder from the merged values. The CRD now carries both the chart's tls.enabled field and main's backup useSystemBucket / BackupClass-driven fields.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>
2026-05-29 11:29:58 +03:00
Andrey Kolkov f17ead3d26 feat(platform): add default backupclass
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
2026-05-28 13:49:59 +04:00
Arsolitt 0c7c39333a refactor(postgres): drop null from tls.enabled schema, use kindIs invalid pattern
Remove the jq post-processing patch that widened tls.enabled type to
["boolean","null"] in values.schema.json and the openAPISchema embedded
in the cozyrds CRD. Plain "type":"boolean" is emitted directly by
cozyvalues-gen and is the correct form.

The cozystack-api server unmarshals openAPISchema into
apiextv1.JSONSchemaProps whose Type field is a single string; an array
value silently zeros the field and disables server-side defaulting for
the entire app.

Tri-state semantics are preserved on the Helm template side via
kindIs "invalid": omitting tls.enabled triggers the external-based
fallback; null is no longer a valid input and is rejected by the schema.

Remove two helm-unittest cases that injected tls.enabled: null (now
intentionally rejected) and update the suite comment to match.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
2026-05-27 11:26:51 +03:00
Arsolitt 37347e23e0 test(postgres): align TLS suite with operator-managed mode
Drop the templates/certmanager.yaml suite entirely (the file no longer
exists) and rewrite the spec.certificates assertions to match the new
operator-managed flow: certificates block emitted only when both TLS is
on AND external is true, with serverAltDNSNames carrying just the
external hostname.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
2026-05-27 11:26:50 +03:00
Arsolitt d918b25d24 test(postgres): add TLS test coverage
- Add helm-unittest suite covering tri-state TLS (nil/false/true), CA/leaf cert
  properties, external SAN injection, and cert-manager resource absence when disabled

Signed-off-by: Arsolitt <arsolitt@gmail.com>
2026-05-27 11:26:49 +03:00
Aleksei SviridkinandMatthieu ROBIN 55850aa3d8 test(apps): backward-compat helm-unittest and CI invariants
Pin the 1:1 equivalence between legacy flat preset names and their
instance-type counterparts in helm-unittest for three charts that
exercise different preset shapes:

  - postgres   — top-level only
  - clickhouse — top + nested clickhouseKeeper preset
  - opensearch — top + nested dashboards preset

Each case asserts that nano <-> t1.nano, small <-> t1.small,
medium <-> c1.small, large <-> c1.medium, and micro <-> t1.micro
render the same CPU and memory.

packages/apps/{clickhouse,opensearch}/Makefile gain a `test:` target
that calls helm unittest so hack/helm-unit-tests.sh actually runs the
new suites in CI; without it the suites would land as dead weight.

hack/check-rd-presets.sh enforces two invariants in `make unit-tests`:

  - every packages/system/*-rd/cozyrds/*.yaml openAPISchema carries
    the canonical 47-preset enum (40 instance-type + 7 legacy);
  - no chart template carries a hardcoded legacy preset literal in
    a defaultingSanitize (list "<legacy>" ...) form.

Both turn an accidental drop of a per-chart Makefile step or an
accidental legacy hardcode into a CI failure rather than silent
production-time validation rejection.

Co-authored-by: Matthieu ROBIN <matthieu@hidora.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2026-05-11 21:09:50 +03:00
Andrey Kolkov ed5ae16e36 feat(platform): implement backup strategy for postgres application
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
2026-05-07 13:12:54 +04:00