mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Arsolitt
0c7c39333a
Remove the jq post-processing patch that widened tls.enabled type to ["boolean","null"] in values.schema.json and the openAPISchema embedded in the cozyrds CRD. Plain "type":"boolean" is emitted directly by cozyvalues-gen and is the correct form. The cozystack-api server unmarshals openAPISchema into apiextv1.JSONSchemaProps whose Type field is a single string; an array value silently zeros the field and disables server-side defaulting for the entire app. Tri-state semantics are preserved on the Helm template side via kindIs "invalid": omitting tls.enabled triggers the external-based fallback; null is no longer a valid input and is rejected by the schema. Remove two helm-unittest cases that injected tls.enabled: null (now intentionally rejected) and update the suite comment to match. Signed-off-by: Arsolitt <arsolitt@gmail.com>
107 lines
3.2 KiB
YAML
107 lines
3.2 KiB
YAML
suite: postgres TLS configuration
|
|
|
|
# Covers the tri-state tls.enabled field for the operator-managed CNPG TLS mode.
|
|
# tls.enabled is a plain boolean; null is NOT a valid input form (schema rejects it).
|
|
# Omitting tls.enabled entirely triggers kindIs "invalid" → auto-on when external=true.
|
|
#
|
|
# - external: false, tls.enabled omitted → TLS off (default)
|
|
# - external: true, tls.enabled omitted → TLS auto-on
|
|
# - tls.enabled: true (explicit) → TLS on regardless of external
|
|
# - tls.enabled: false (explicit) → TLS off regardless of external
|
|
#
|
|
# In TLS-on mode the chart sets spec.certificates with serverAltDNSNames so the
|
|
# operator's own CA signs server certs. CNPG auto-derives SANs for the three
|
|
# built-in services (rw/r/ro) in four DNS forms each; the chart only appends
|
|
# the external hostname when external=true.
|
|
|
|
release:
|
|
name: pg-test
|
|
namespace: tenant-test
|
|
|
|
set:
|
|
_cluster:
|
|
scheduling: {}
|
|
cluster-domain: cozy.local
|
|
|
|
templates:
|
|
- templates/db.yaml
|
|
|
|
tests:
|
|
- it: Cluster has no spec.certificates when tls is off by default
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- isNull:
|
|
path: spec.certificates
|
|
|
|
- it: Cluster has no spec.certificates when tls explicitly disabled with external true
|
|
set:
|
|
external: true
|
|
_namespace:
|
|
host: example.cozy.local
|
|
tls:
|
|
enabled: false
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- isNull:
|
|
path: spec.certificates
|
|
|
|
- it: Cluster has no spec.certificates when tls explicitly enabled but external false
|
|
# In operator-managed mode the chart only emits spec.certificates when it
|
|
# has at least one extra SAN to inject (currently only the external host).
|
|
# With external false there is nothing to inject — let the operator use
|
|
# its auto-derived SAN set for the three built-in services.
|
|
set:
|
|
tls:
|
|
enabled: true
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- isNull:
|
|
path: spec.certificates
|
|
|
|
- it: Cluster has spec.certificates.serverAltDNSNames with external hostname when tls auto-on via external true
|
|
set:
|
|
external: true
|
|
_namespace:
|
|
host: example.cozy.local
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- exists:
|
|
path: spec.certificates
|
|
- notExists:
|
|
path: spec.certificates.serverCASecret
|
|
- notExists:
|
|
path: spec.certificates.serverTLSSecret
|
|
- contains:
|
|
path: spec.certificates.serverAltDNSNames
|
|
content: pg-test.example.cozy.local
|
|
- lengthEqual:
|
|
path: spec.certificates.serverAltDNSNames
|
|
count: 1
|
|
|
|
- it: Cluster has spec.certificates.serverAltDNSNames with external hostname when tls explicitly enabled and external true
|
|
set:
|
|
tls:
|
|
enabled: true
|
|
external: true
|
|
_namespace:
|
|
host: example.cozy.local
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- contains:
|
|
path: spec.certificates.serverAltDNSNames
|
|
content: pg-test.example.cozy.local
|
|
- lengthEqual:
|
|
path: spec.certificates.serverAltDNSNames
|
|
count: 1
|
|
|