mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 16:47:20 +09:00
Timofei Larkin
2fac379457
The chart generated every user's password at render time into <release>-credentials, which tenants could read again at any time and which Helm history kept for MaxHistory revisions, so a deployment whose policy requires a credential shown once could not run PostgreSQL here. The accounts move under CloudNativePG's managed roles, each pointing at the account Secret the Cozystack API seeds, so the operator creates the role with the SCRAM verifier the Secret holds and applies a changed Secret live, and a password set inside PostgreSQL is reverted. Every role is rendered as the init-script created it, because the operator reverts an attribute that differs, revokes a parent role missing from inRoles and clears a comment the spec leaves unset, while the init-script still finds the roles to drop by that comment and by membership in the marker. The init-script stops creating, passwording and altering accounts, where it would be a second writer, and keeps the two things the operator has no field for: the marker membership narrowed to a record, and createrole_self_grant. The refusal to adopt a role the chart did not mark moves into a pre-upgrade hook, because the operator adopts a managed role within seconds of the spec reaching it and the post-upgrade init-job would find it adopted already. The definition declares the credentials block, so the API seeds, serves and mints for the kind, and no longer selects the credentials Secret, which the chart no longer renders or grants. BREAKING CHANGE: PostgreSQL passwords are no longer readable from <release>-credentials. A password is issued once, by a mint on the account's Credential in core.cozystack.io, and replaced by the next mint; deleting a Postgres application whose release is suspended is refused. The conversion needs a platform variant with migrations enabled. Assisted-by: LLM Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
47 lines
1.3 KiB
YAML
47 lines
1.3 KiB
YAML
suite: NOTES.txt restore warning is gated on both bootstrap and users
|
|
templates:
|
|
- templates/NOTES.txt
|
|
release:
|
|
name: pg-test
|
|
namespace: tenant-test
|
|
tests:
|
|
- it: warns during a restore when the release defines users
|
|
set:
|
|
bootstrap:
|
|
enabled: true
|
|
users:
|
|
testuser: {}
|
|
asserts:
|
|
- matchRegexRaw:
|
|
pattern: 'provisioned as a restore'
|
|
# The passwords of a restored application come from its account Secrets,
|
|
# applied by CloudNativePG once the primary is up, and a seeded account
|
|
# has none issued until a mint. The note must say that, and must not
|
|
# describe a chart-rendered Secret or a pending-credentials flag, which
|
|
# the conversion removed.
|
|
- matchRegexRaw:
|
|
pattern: 'mint'
|
|
- notMatchRegexRaw:
|
|
pattern: 'credentials-pending'
|
|
- notMatchRegexRaw:
|
|
pattern: 'pg-test-credentials'
|
|
|
|
- it: stays quiet during a restore when there are no users
|
|
set:
|
|
bootstrap:
|
|
enabled: true
|
|
users: {}
|
|
asserts:
|
|
- notMatchRegexRaw:
|
|
pattern: 'provisioned as a restore'
|
|
|
|
- it: stays quiet for a normal install
|
|
set:
|
|
bootstrap:
|
|
enabled: false
|
|
users:
|
|
testuser: {}
|
|
asserts:
|
|
- notMatchRegexRaw:
|
|
pattern: 'provisioned as a restore'
|