mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 08:37:31 +09:00
Aleksei Sviridkin
48e3d1d611
The tenant Gateway's TLS-passthrough listeners are designed to route databases by SNI under a per-engine subdomain (*.redis.<apex>, *.postgres.<apex>), and a passthrough listener forwards the handshake untouched, so the engine's own server certificate must carry <release>.<engine>.<apex> or a verifying client fails the hostname check. The name is issued next to the existing flat <release>.<apex>, under the same TLS-and-external condition, so that a later move between the two hostname schemes reissues no certificate and leaves clients on the same trust anchor. Nothing renders a route yet; the certificate is prepared ahead of it. Adding the name changes the SAN list, so existing external TLS releases get their server certificate reissued once on upgrade, from the same CA. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
113 lines
3.4 KiB
YAML
113 lines
3.4 KiB
YAML
suite: postgres TLS configuration
|
|
|
|
# Covers the tri-state tls.enabled field for the operator-managed CNPG TLS mode.
|
|
# tls.enabled is a plain boolean; null is NOT a valid input form (schema rejects it).
|
|
# Omitting tls.enabled entirely triggers kindIs "invalid" → auto-on when external=true.
|
|
#
|
|
# - external: false, tls.enabled omitted → TLS off (default)
|
|
# - external: true, tls.enabled omitted → TLS auto-on
|
|
# - tls.enabled: true (explicit) → TLS on regardless of external
|
|
# - tls.enabled: false (explicit) → TLS off regardless of external
|
|
#
|
|
# In TLS-on mode the chart sets spec.certificates with serverAltDNSNames so the
|
|
# operator's own CA signs server certs. CNPG auto-derives SANs for the three
|
|
# built-in services (rw/r/ro) in four DNS forms each; the chart only appends
|
|
# the external hostnames when external=true.
|
|
|
|
release:
|
|
name: pg-test
|
|
namespace: tenant-test
|
|
|
|
set:
|
|
_cluster:
|
|
scheduling: {}
|
|
cluster-domain: cozy.local
|
|
|
|
templates:
|
|
- templates/db.yaml
|
|
|
|
tests:
|
|
- it: Cluster has no spec.certificates when tls is off by default
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- isNull:
|
|
path: spec.certificates
|
|
|
|
- it: Cluster has no spec.certificates when tls explicitly disabled with external true
|
|
set:
|
|
external: true
|
|
_namespace:
|
|
host: example.cozy.local
|
|
tls:
|
|
enabled: false
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- isNull:
|
|
path: spec.certificates
|
|
|
|
- it: Cluster has no spec.certificates when tls explicitly enabled but external false
|
|
# In operator-managed mode the chart only emits spec.certificates when it
|
|
# has at least one extra SAN to inject (currently only the external host).
|
|
# With external false there is nothing to inject — let the operator use
|
|
# its auto-derived SAN set for the three built-in services.
|
|
set:
|
|
tls:
|
|
enabled: true
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- isNull:
|
|
path: spec.certificates
|
|
|
|
- it: Cluster has spec.certificates.serverAltDNSNames with external hostnames when tls auto-on via external true
|
|
set:
|
|
external: true
|
|
_namespace:
|
|
host: example.cozy.local
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- exists:
|
|
path: spec.certificates
|
|
- notExists:
|
|
path: spec.certificates.serverCASecret
|
|
- notExists:
|
|
path: spec.certificates.serverTLSSecret
|
|
- contains:
|
|
path: spec.certificates.serverAltDNSNames
|
|
content: pg-test.example.cozy.local
|
|
- contains:
|
|
path: spec.certificates.serverAltDNSNames
|
|
content: pg-test.postgres.example.cozy.local
|
|
- lengthEqual:
|
|
path: spec.certificates.serverAltDNSNames
|
|
count: 2
|
|
|
|
- it: Cluster has spec.certificates.serverAltDNSNames with external hostnames when tls explicitly enabled and external true
|
|
set:
|
|
tls:
|
|
enabled: true
|
|
external: true
|
|
_namespace:
|
|
host: example.cozy.local
|
|
documentSelector:
|
|
path: kind
|
|
value: Cluster
|
|
asserts:
|
|
- contains:
|
|
path: spec.certificates.serverAltDNSNames
|
|
content: pg-test.example.cozy.local
|
|
- contains:
|
|
path: spec.certificates.serverAltDNSNames
|
|
content: pg-test.postgres.example.cozy.local
|
|
- lengthEqual:
|
|
path: spec.certificates.serverAltDNSNames
|
|
count: 2
|
|
|