The round-trip Test was skipping: it exited 0 behind CLICKHOUSE_E2E_S3_ROUNDTRIP,
so "PASS (1.01s)" meant the gate fired, not that backup and restore worked. Only
the contracts Test ran, which proves the chart still exposes the sidecar and its
auth Secret — not that a byte ever reaches S3 and comes back.
The gate existed because the sidecar could not verify the in-cluster SeaweedFS
certificate. backup.endpointCA closes that, so adopt the shape mariadb and
postgres already use to run their round-trips un-gated:
- examples: resolve the S3 endpoint from S3_ENDPOINT when set (BucketInfo
advertises the external ingress URL, an unroutable placeholder in CI), copy the
seaweedfs CA (auto-discovered from its cert-manager Certificate when the
fullname default is absent) into a per-release Secret, and reference it from
backup.endpointCA on both the source and the to-copy target. NAMESPACE now
defaults to tenant-root, matching the other backup demos.
- suite: drop the gate, run in tenant-root — an isolated tenant's Cilium egress
allowlist blocks its Pods from reaching tenant-root's seaweedfs — and pre-clean
with cleanup.sh, because tenant-root is shared and a leftover Succeeded
BackupJob would satisfy the harness's wait without a backup running.
cleanup.sh also drops the copied CA Secret; the platform's own is never touched.
Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrey Kolkov <androndo@gmail.com>
