Aleksei Sviridkin 7e26358817 test(nats): pin the tenant-CA anchor and key-bearing Secret exclusion ...

The ResourceDefinition and the dashboard Role are the tenant-facing half of
the trust-anchor delivery path, and neither is a chart template, so the
helm-unittest suite covers neither. Deleting the tenant-CA selector or
granting a key-bearing Secret by name both left the suite fully green.

nats-<name>-ca holds the CA private key and nats-<name>-tls the server key.
Granting either to a tenant would let the holder issue certificates rather
than merely verify them. What a client needs is ca.crt alone, delivered as
the key-free <release>.tenant-ca projection and selected by label, since a
label is stamped only on an object the platform produced while a name grant
conveys whatever occupies the name.

The include set is asserted as a whitelist so a key-bearing Secret cannot
slip in under a spelling the test did not anticipate.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Assisted-By: Claude <noreply@anthropic.com>

2026-08-12 18:42:13 +03:00

..

e2e-apps

test(e2e): poll users-Job DESIRED_USERS_JSON for target email, not just Job existence

2026-07-15 15:31:45 +03:00

e2e-chainsaw

fix(cozystack-basics): normalize tenant hostname VAP comparisons with lowerAscii (#3208)

2026-08-12 15:35:41 +05:00

lib

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

testdata

test(release): scope the trim pin to the parse step, fix two stale references

2026-07-27 14:03:49 +05:00

admin-kubeconfig-invariant.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

bats-no-exit-trap.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

boilerplate.go.txt

Introduce cozystack-controller (#560)

2025-01-09 12:24:51 +01:00

build-matrix_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

build-matrix.sh

fix(build): force full image rebuild on root Go source changes

2026-06-25 10:21:05 +05:00

buildkitd.toml

ci(build): route PR base-image pulls through mirror.gcr.io

2026-06-24 23:17:25 +03:00

capture-dataplane.bats

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

capture-previous-logs.bats

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cdi_golden_image_create.sh

[vm-default-images] Added new optional package

2026-04-14 19:59:19 +05:00

changelog-preserve.sh

ci(release): execute the release-changelog logic in tests, not just grep it

2026-07-24 11:34:17 +05:00

check-applicationdefinition-crd-ordering.bats

fix(platform): make *-rd sources depend on cozystack-engine

2026-06-24 22:43:56 +03:00

check-gpu-operator-variants.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-gpu-recording-rules.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.sh

fix(hack): wrap du in 'timeout 5s' to prevent preflight stall

2026-04-11 17:07:35 +03:00

check-kafka-rd-schema.bats

test(kafka): assert scalar boolean tls.enabled type in rd-schema check

2026-05-27 16:21:46 +03:00

check-kafka-rd-secrets.bats

test(kafka): add cluster-ca-cert checks to kafka-rd secrets bats test

2026-05-27 11:16:41 +03:00

check-migrations-target.sh

refactor(hack): replace ls|grep with pure-bash glob (shellcheck SC2010)

2026-07-14 13:08:54 +03:00

check-nats-rd-secrets.bats

test(nats): pin the tenant-CA anchor and key-bearing Secret exclusion

2026-08-12 18:42:13 +03:00

check-optional-repos.sh

Rename cozypkg to cozyhr

2025-12-25 16:54:22 +01:00

check-rd-presets.sh

fix(hack): tighten resourcesPreset enum check

2026-05-12 03:04:48 +03:00

cilium-leak-healer_test.bats

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

cni-plugins-staging-contract.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

codeowners-invariant.bats

test(codeowners): guard the coverage invariant with a unit check

2026-08-10 10:30:30 +02:00

collect-images.sh

[dx] Refactor collect-images functionality

2025-07-03 14:26:56 +03:00

common-envs_test.bats

test(hack): cover the default (non-export) build path (#3262)

2026-07-29 17:47:28 +05:00

common-envs.mk

fix(ci): gate release tags/pushes off under OCI_EXPORT_DIR (defense-in-depth)

2026-07-29 17:47:28 +05:00

cozyreport-summary.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cozyreport-talos.bats

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozyreport.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

cozyreport.sh

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozystack-version-stamp.bats

test(platform): enforce go-forward version stamps route through the helper

2026-06-24 15:32:52 +03:00

cozytest-capture-gate.bats

fix(tests): report a data-plane capture cut short by its backstop

2026-08-08 17:08:54 +03:00

cozytest.sh

docs(tests): correct five stale claims in the e2e capture tooling (#3662)

2026-08-09 04:08:35 +03:00

dcgm-default-counters.csv

fix(gpu-operator): pin upstream behavior changes; correct DLS licensing example

2026-04-30 14:52:56 +03:00

download-dashboards.sh

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

downstream-trigger-map.bats

docs(agents): add downstream repository checklist to the PR template

2026-07-14 17:07:47 +03:00

e2e-capture-dataplane.sh

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

e2e-capture-previous-logs.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

e2e-cilium-endpoint-leak-healer.sh

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

e2e-cilium-leak-healer.yaml

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

e2e-ghcr-mirror.yaml

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

e2e-install-cozystack.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

e2e-post-install-prep.sh

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

e2e-prepare-cluster.bats

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

e2e-prepull-images.sh

test(e2e): pre-pull platform images via staged-busybox DaemonSet

2026-05-25 11:56:30 +05:00

e2e-talos-image-cache.yaml

test(e2e): make the talos image cache reachable by tenant workers (#3254)

2026-07-09 18:21:07 +05:00

e2e-test-openapi.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

etcd-probe_test.bats

test(etcd): stop losing the metrics probe's output to the attach race

2026-07-19 20:16:01 +03:00

gate-concurrency-contract.bats

test(ci): require the discarded-label guard per job, not just agreement

2026-08-08 02:26:19 +03:00

ghcr-mirror_test.bats

fix(e2e): harden the ghcr.io mirror resolver and bound its diagnostics

2026-08-09 16:17:33 +03:00

helm-unit-tests.bats

test(helm): sweep packages/tests so the library suite stands on its own

2026-08-08 16:46:36 +03:00

helm-unit-tests.sh

test(helm): sweep packages/tests so the library suite stands on its own

2026-08-08 16:46:36 +03:00

image-pin-consistency.bats

fix(backupstrategy-controller): give chBackupClientImage a producer

2026-07-21 23:15:46 +05:00

kubernetes-md0-migration.bats

test(platform): cover migration 47 fail-closed contract

2026-06-30 12:08:18 +05:00

kubernetes-pre-delete-hook.bats

fix(apps/kubernetes): report the pre-delete cleanup outcome honestly

2026-08-07 06:49:56 +03:00

md-no-hardwrap.bats

feat(agents): add md-no-hardwrap hook enforcing the prose rule

2026-07-14 14:37:52 +03:00

migrate-to-version-1.0.sh

Fixed packages name conversion in migration script

2026-03-03 19:10:39 +05:00

migration-50-etcd-adopt.bats

feat(platform): make the etcd-adoption skip-backup hatch reachable

2026-07-20 11:29:09 +05:00

migration-seaweedfs-db-adopt.bats

test(seaweedfs): run the db-adopt migrations in the shell they ship with

2026-07-20 15:40:49 +05:00

monitoring-pvc-backfill-migration.bats

test(monitoring): reproduce the real vmselect cache PVC name in the backfill test

2026-07-08 22:27:42 +03:00

multus-install-cni-plugins.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror.sh

fix(nightly): rewrite an image host that is the whole scalar value

2026-07-28 18:07:34 +02:00

overlay-main-images_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

overlay-main-images.sh

fix(ci): preserve a PR's own edits to non-rebuilt package image refs

2026-06-30 16:56:33 +03:00

package.mk

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

parse-rc-tag.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

pod-label-census_test.bats

fix(e2e): select catch pod logs by the nested release instance label

2026-08-05 16:46:50 +03:00

post-install-prep.bats

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

pre-checks.sh

Fix osx grep have no -P flag (#438)

2024-10-21 11:59:56 +02:00

promote-gate-contract.bats

docs(hack): fix a wrong claim about grep-error propagation in two contract tests

2026-08-10 12:08:02 +03:00

promote-retag_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

promote-retag.sh

fix(release): prove a stable tag is absent before copying over it

2026-07-27 13:56:45 +05:00

promote-rewrite-tags_test.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

promote-rewrite-tags.sh

test(ci): make the image-ref guards see split-host and unparseable files

2026-07-21 21:08:15 +05:00

release-changelog-behaviour.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-changelog-contract.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-freeze-contract.bats

docs(hack): fix a wrong claim about grep-error propagation in two contract tests (#3620)

2026-08-11 19:40:01 +05:00

remediation-guard.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

run-kubernetes-drain_test.bats

test(e2e): fix post-merge seams the conflict markers missed

2026-07-08 18:06:22 +05:00

run-kubernetes-node-join_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-schedulable_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-serial-console_test.bats

test(e2e): capture the tenant worker guest serial console

2026-08-08 05:48:38 +03:00

run-kubernetes-talos-diagnostics_test.bats

test(hack): clean up the Talos diagnostics tests without an EXIT trap

2026-08-07 23:53:40 +03:00

run-kubernetes-talos-spec_test.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

sandbox-cidr-disjoint.bats

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

seaweedfs-guard-parity.bats

fix(seaweedfs): stop the naming guard guessing which volume generation holds the data

2026-07-20 15:40:48 +05:00

seaweedfs-naming-audit.bats

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

seaweedfs-naming-audit.sh

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

select-changelog-source.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

select-e2e_test.bats

fix(ci): decide E2E coverage per changed path

2026-08-09 22:24:37 +03:00

select-e2e.sh

feat(clickhouse): let the backup sidecar trust a private S3 CA, unblocking the backup e2e round-trip (#3385)

2026-08-10 21:17:47 +04:00

select-install_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

select-install.sh

test(e2e): fold the clickhouse backup Tests into the app's own suite

2026-07-30 16:04:03 +04:00

talos-image-cache_test.bats

test(e2e): pin that an unanswered mirror lookup is not a mirror absence

2026-08-09 13:31:54 +03:00

talos-reconcile-heredoc_test.bats

fix(kubernetes): escape tenant values in the worker reconcile heredoc

2026-08-09 16:17:26 +03:00

tenant-pre-delete-hook.bats

fix(tenant): bound the pre-delete cleanup waits and the hook Job

2026-08-07 14:38:06 +03:00

update-codegen.sh

feat(cozystack-controller): extract application CA into a key-free tenant Secret

2026-07-21 23:59:48 +03:00

update-crd.sh

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

upload-assets.sh

[docs] Added openapi generation tool

2026-03-25 15:57:25 +05:00

upload-releasenotes.sh

Add AI-agent for changelogs generation

2025-11-26 20:18:43 +01:00

validate-changelog.sh

ci(release): fix second-round review findings

2026-07-24 11:34:17 +05:00