d9c3d084be
# What this PR does Short summary: this PR improves security and configuration management for Helm deployment. Please take a look at the details below. ## Which issue(s) this PR fixes Issues: - Cannot explicitly define redis database (only 0 and 1 numbers are used) - Cannot securely use TLS for Redis (cannot set CA certificate; cannot set client certificates) - Cannot securely use TLS for Postgres (cannot set CA certificate; cannot set client certificates; cannot set `verify-full` validation) - ~~Chart option `securityContext.readOnlyRootFilesystem: true` issues CrashLoopBack pod state~~ will be moved to new PR ## Checklist - [x] ~~Unit, integration, and e2e (if applicable) tests updated~~ (not required) - [x] Documentation added (or `pr:no public docs` PR label added if not required) - [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not required) - [x] Helm tests are fixed and updated - [x] Manually verified the features: - [x] postgres TLS connection with `verify-full` validation - [x] redis TLS connection with `cert_required` validation - [x] redis protocol and database number controls - [x] all containers properly work in read-only root filesystem - [x] all changes are backward compatible (doesn't break old deployments) ## Changelog - Fixed helm tests - Added configuration options for secure TLS communication with dependencies like Redis, MySQL, and Postgres - ~~Added configuration option for relocating `celerybeat` database file (read-only root filesystem issue)~~ will be moved to new PR - Improved redis database configuration options - Now only single redis database is used - Added ability to mount custom volumes (with CA certificates, for example) into Helm chart - ~~Fixed issue with read-only root filesystem for Helm chart~~ will be moved to new PR - Add ability to work with Redis ACL (and AWS ElastiCache)
164 lines
4.9 KiB
YAML
164 lines
4.9 KiB
YAML
suite: test PostgreSQL envs for deployments
|
|
templates:
|
|
- engine/deployment.yaml
|
|
- engine/job-migrate.yaml
|
|
- celery/deployment.yaml
|
|
- telegram-polling/deployment.yaml
|
|
release:
|
|
name: oncall
|
|
tests:
|
|
- it: postgresql.enabled=false -> external PostgreSQL default settings
|
|
set:
|
|
telegramPolling.enabled: true
|
|
database.type: postgresql
|
|
postgresql.enabled: false
|
|
externalPostgresql.host: custom-postgres-host
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_TYPE
|
|
value: postgresql
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_NAME
|
|
value: oncall
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PORT
|
|
value: "5432"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_USER
|
|
value: postgres
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_HOST
|
|
value: custom-postgres-host
|
|
|
|
- it: externalPostgresql -> should use external PostgreSQL custom settings
|
|
set:
|
|
telegramPolling.enabled: true
|
|
database.type: postgresql
|
|
postgresql.enabled: false
|
|
externalPostgresql:
|
|
host: test-host
|
|
port: 5555
|
|
db_name: grafana_oncall
|
|
user: test_user
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_TYPE
|
|
value: postgresql
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_NAME
|
|
value: grafana_oncall
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PORT
|
|
value: "5555"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_USER
|
|
value: test_user
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_HOST
|
|
value: test-host
|
|
|
|
- it: externalPostgresql -> should use external PostgreSQL custom settings with additional options
|
|
set:
|
|
telegramPolling.enabled: true
|
|
database.type: postgresql
|
|
postgresql.enabled: false
|
|
externalPostgresql:
|
|
host: test-host
|
|
port: 5555
|
|
db_name: grafana_oncall
|
|
user: test_user
|
|
options: "sslmode=verify-full sslrootcert=/mnt/ca.crt sslcert=/mnt/client.crt sslkey=/mnt/client.key"
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_OPTIONS
|
|
value: sslmode=verify-full sslrootcert=/mnt/ca.crt sslcert=/mnt/client.crt sslkey=/mnt/client.key
|
|
|
|
- it: postgresql.enabled=true -> internal PostgreSQL default settings
|
|
set:
|
|
telegramPolling.enabled: true
|
|
database.type: postgresql
|
|
postgresql.enabled: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_TYPE
|
|
value: postgresql
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_NAME
|
|
value: oncall
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PORT
|
|
value: "5432"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_USER
|
|
value: postgres
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_HOST
|
|
value: oncall-postgresql
|
|
|
|
- it: postgresql.auth -> should use internal PostgreSQL custom settings
|
|
set:
|
|
telegramPolling.enabled: true
|
|
database.type: postgresql
|
|
postgresql:
|
|
enabled: true
|
|
auth:
|
|
database: grafana_oncall
|
|
username: grafana_oncall
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_TYPE
|
|
value: postgresql
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_NAME
|
|
value: grafana_oncall
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PORT
|
|
value: "5432"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_USER
|
|
value: grafana_oncall
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_HOST
|
|
value: oncall-postgresql
|