mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
a021bfa324
Several comments described a shape the chart does not render. A test comment claimed the chart carries a management cacertfile while the assertion directly below it pins that no additionalConfig exists at all; the suite title and two section headers advertised a management HTTPS block that is never rendered; and a scope note named interNodeTLS, which is not a field on RabbitmqCluster — the CRD exposes exactly secretName, caSecretName and disableNonTLSListeners. Two tests were named for something they did not assert. The inter-node scope test checked disableNonTLSListeners, which by this chart's own reasoning has no bearing on port 25672; it now checks caSecretName, which is the field that would actually configure inter-node mTLS. State the ResourceDefinition backstop's real standing. The exclude list is defence in depth, not the first line: promotion runs on the tenantresource label that the lineage webhook stamps only when it resolves an ancestor, and a cert-manager Secret has no ownerReference or Helm metadata, so it fails closed before include or exclude is consulted. The list covers the case where that stops holding. Pin the dashboard Role's complete grant rather than only the absence of known-bad names — every existing assertion there was a notContains, so a Role that gained an unrelated Secret satisfied all of them. Record what upgrading an existing external instance does: tls.enabled inherits external, so the broker pods roll once when the operator mounts the new Secret, and the instance gains a cert-manager dependency. No client breaks, but a stateful broker restarting is not something to discover from a diff. Drop four tests that duplicated earlier ones verbatim. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>