mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 11:37:31 +09:00
Alexey Artamonov
2b5877eff9
users[].password is gone from the chart, its schema and the API type. Every application-user password is generated into <release>-credentials and kept across reconciles by lookup, so an upgraded release keeps the password it already has and a password left in values is ignored. The init-job mounts that Secret and applies each password with ALTER ROLE and a psql variable, so no password is rendered into the init-script Secret that Helm keeps in release history. While bootstrap is enabled the Secret is marked credentials-pending, and NOTES say the generated passwords apply once the init-job runs. Names reach superuser SQL and the init-script shell, so render-time guards reject a username, database or extension name outside [-._a-zA-Z0-9] or past the length PostgreSQL silently truncates: 63 bytes for a role or extension, 54 for a database, whose <db>_readonly role would otherwise truncate and fail the next run. A username over 63 bytes that the credentials Secret already carries still upgrades. users.postgres, the CNPG superuser, is rejected in every bootstrap state. Changing a database's key in values drops the database, so the reject message and the README give the rename that keeps the data: a platform administrator renames it and its roles as the CNPG superuser before the key changes. The init-job cannot hang its Helm hook: the readiness wait ends on elapsed time below activeDeadlineSeconds and the Job never retries, so a purged restore target fails with a diagnostic. The delete-users pass reads managed users from pg_shdescription instead of parsing the version-dependent \du+ layout, which on PostgreSQL 16 and later matched nothing and left a removed user able to log in; it compares names as CREATE ROLE stores them and reassigns a removed user's objects in every database before dropping it. A database without roles renders, and extension names are quoted for hyphenated names and folded to lowercase so they resolve as they did unquoted. A value that carries its own surrounding quotes, the only way a hyphenated extension rendered before, has that pair removed and keeps its case, so such a release still upgrades. The README reads a password with jq, since jsonpath splits a dotted key. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>
72 lines
2.0 KiB
YAML
72 lines
2.0 KiB
YAML
suite: postgres credentials generation
|
|
|
|
# Passwords are always chart-generated (no plaintext input) and preserved across
|
|
# reconciles by the lookup in init-script.yaml. This suite renders without a
|
|
# kubernetesProvider, so lookup() returns nothing and every render generates fresh
|
|
# passwords; the lookup-backed preserve path is covered in credentials_lookup_test.yaml.
|
|
|
|
release:
|
|
name: pg-test
|
|
namespace: tenant-test
|
|
|
|
templates:
|
|
- templates/init-script.yaml
|
|
|
|
tests:
|
|
- it: generates a 16-char alphanumeric password for each defined user
|
|
set:
|
|
users:
|
|
testuser: {}
|
|
documentSelector:
|
|
path: metadata.name
|
|
value: pg-test-credentials
|
|
asserts:
|
|
- matchRegex:
|
|
path: stringData.testuser
|
|
pattern: ^[a-zA-Z0-9]{16}$
|
|
|
|
- it: ignores a value-supplied password and generates one instead
|
|
# Pins the breaking-change contract: the schema no longer declares
|
|
# `password`, but nothing rejects a leftover key, so prove it is dropped
|
|
# rather than honoured.
|
|
set:
|
|
users:
|
|
testuser:
|
|
password: value-supplied-secret
|
|
documentSelector:
|
|
path: metadata.name
|
|
value: pg-test-credentials
|
|
asserts:
|
|
- matchRegex:
|
|
path: stringData.testuser
|
|
pattern: ^[a-zA-Z0-9]{16}$
|
|
- notMatchRegex:
|
|
path: stringData.testuser
|
|
pattern: value-supplied-secret
|
|
|
|
- it: flags the credentials Secret as pending during a restore
|
|
set:
|
|
users:
|
|
testuser: {}
|
|
bootstrap:
|
|
enabled: true
|
|
oldName: pg-old
|
|
documentSelector:
|
|
path: metadata.name
|
|
value: pg-test-credentials
|
|
asserts:
|
|
- equal:
|
|
path: metadata.annotations["postgres.cozystack.io/credentials-pending"]
|
|
value: "true"
|
|
|
|
- it: does not flag the credentials Secret as pending outside a restore
|
|
set:
|
|
users:
|
|
testuser: {}
|
|
documentSelector:
|
|
path: metadata.name
|
|
value: pg-test-credentials
|
|
asserts:
|
|
- notExists:
|
|
path: metadata.annotations["postgres.cozystack.io/credentials-pending"]
|