Several comments described a shape the chart does not render. A test comment
claimed the chart carries a management cacertfile while the assertion directly
below it pins that no additionalConfig exists at all; the suite title and two
section headers advertised a management HTTPS block that is never rendered; and
a scope note named interNodeTLS, which is not a field on RabbitmqCluster — the
CRD exposes exactly secretName, caSecretName and disableNonTLSListeners.
Two tests were named for something they did not assert. The inter-node scope
test checked disableNonTLSListeners, which by this chart's own reasoning has no
bearing on port 25672; it now checks caSecretName, which is the field that would
actually configure inter-node mTLS.
State the ResourceDefinition backstop's real standing. The exclude list is
defence in depth, not the first line: promotion runs on the tenantresource label
that the lineage webhook stamps only when it resolves an ancestor, and a
cert-manager Secret has no ownerReference or Helm metadata, so it fails closed
before include or exclude is consulted. The list covers the case where that
stops holding.
Pin the dashboard Role's complete grant rather than only the absence of
known-bad names — every existing assertion there was a notContains, so a Role
that gained an unrelated Secret satisfied all of them.
Record what upgrading an existing external instance does: tls.enabled inherits
external, so the broker pods roll once when the operator mounts the new Secret,
and the instance gains a cert-manager dependency. No client breaks, but a
stateful broker restarting is not something to discover from a diff.
Drop four tests that duplicated earlier ones verbatim.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin
a021bfa324