Review feedback on #3261 (gemini-code-assist, coderabbitai, myasnikovdaniil):
- Exact SAN match. _san_present read the Certificate SANs as {.spec.dnsNames}
(a bracketed JSON blob that `tr ','` cannot split) and matched with a
substring `grep -qF`, so a wildcard that is a substring of a longer SAN
(e.g. *.etcd.<ns>.svc inside *.etcd.<ns>.svc.cluster.local) could
false-positive and skip the re-issue. Read {.spec.dnsNames[*]} (space
separated) and match exactly with `grep -qxF`, matching the Secret-annotation
branch.
- Wait on the re-issued Secret, not the patched spec. The post-patch wait loop
called _san_present, which returns as soon as the Certificate spec.dnsNames
contains the wildcard -- but the patch just added it there, so the loop broke
on the first iteration before cert-manager re-issued the Secret, and the
"re-issued" log printed unconfirmed. Add _secret_has_san (Secret alt-names
annotation only, same empty-read retry + exact match) and gate the wait on it.
- IPv6-safe kubeconfig server. The synthesized kubeconfig used
https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT, which is an invalid
URL on an IPv6-only cluster (a bare IPv6 host must be bracketed). Use
https://kubernetes.default.svc -- IP-family-agnostic, validated by the mounted
SA CA, and the same server URL kubectl synthesizes in-cluster.
Tests (the review blocker): extend the bats suite (and its fake kubectl) with
two cases pinning these contracts -- a superstring dnsName must NOT skip the
re-issue patch, and etcd-migrate must be invoked with a synthesized in-cluster
kubeconfig whose server is kubernetes.default.svc (not the bare IPv6 host),
authenticating via the SA token file + CA. Both the kubeconfig path and the SA
directory are now env-overridable (ETCD_MIGRATE_KUBECONFIG, ETCD_ADOPT_SA_DIR)
so the synthesis is exercisable off-cluster; production defaults are unchanged.
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Introduced a new configuration file for Kubernetes deployments,
enhancing clarity on parameters and settings.
- Added common parameters for NATS, including external access and
persistent volume settings.
- **Bug Fixes**
- Improved error handling and feedback in Helm release management
scripts.
- **Chores**
- Reduced verbosity in test output by removing unnecessary echo
statements in the testing Makefile.
- Added success return statements in various check scripts to ensure
proper termination.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Andrey Kolkov