d9c3d084be
# What this PR does Short summary: this PR improves security and configuration management for Helm deployment. Please take a look at the details below. ## Which issue(s) this PR fixes Issues: - Cannot explicitly define redis database (only 0 and 1 numbers are used) - Cannot securely use TLS for Redis (cannot set CA certificate; cannot set client certificates) - Cannot securely use TLS for Postgres (cannot set CA certificate; cannot set client certificates; cannot set `verify-full` validation) - ~~Chart option `securityContext.readOnlyRootFilesystem: true` issues CrashLoopBack pod state~~ will be moved to new PR ## Checklist - [x] ~~Unit, integration, and e2e (if applicable) tests updated~~ (not required) - [x] Documentation added (or `pr:no public docs` PR label added if not required) - [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not required) - [x] Helm tests are fixed and updated - [x] Manually verified the features: - [x] postgres TLS connection with `verify-full` validation - [x] redis TLS connection with `cert_required` validation - [x] redis protocol and database number controls - [x] all containers properly work in read-only root filesystem - [x] all changes are backward compatible (doesn't break old deployments) ## Changelog - Fixed helm tests - Added configuration options for secure TLS communication with dependencies like Redis, MySQL, and Postgres - ~~Added configuration option for relocating `celerybeat` database file (read-only root filesystem issue)~~ will be moved to new PR - Improved redis database configuration options - Now only single redis database is used - Added ability to mount custom volumes (with CA certificates, for example) into Helm chart - ~~Fixed issue with read-only root filesystem for Helm chart~~ will be moved to new PR - Add ability to work with Redis ACL (and AWS ElastiCache)
75 lines
2.2 KiB
YAML
75 lines
2.2 KiB
YAML
suite: test telegram polling deployment
|
|
templates:
|
|
- telegram-polling/deployment.yaml
|
|
release:
|
|
name: oncall
|
|
chart:
|
|
appVersion: v1.2.36
|
|
tests:
|
|
- it: telegramPolling.enabled=false -> should not create deployment (default)
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
|
|
- it: telegramPolling.enabled=true -> should create telegram polling deployment
|
|
set:
|
|
telegramPolling.enabled: true
|
|
asserts:
|
|
- containsDocument:
|
|
kind: Deployment
|
|
apiVersion: apps/v1
|
|
metadata.name: oncall-telegram-polling
|
|
- isSubset:
|
|
path: metadata.labels
|
|
content:
|
|
app.kubernetes.io/component: telegram-polling
|
|
app.kubernetes.io/instance: oncall
|
|
app.kubernetes.io/name: oncall
|
|
- isSubset:
|
|
path: spec.selector.matchLabels
|
|
content:
|
|
app.kubernetes.io/component: telegram-polling
|
|
app.kubernetes.io/instance: oncall
|
|
app.kubernetes.io/name: oncall
|
|
- isSubset:
|
|
path: spec.template.metadata.labels
|
|
content:
|
|
app.kubernetes.io/component: telegram-polling
|
|
app.kubernetes.io/instance: oncall
|
|
app.kubernetes.io/name: oncall
|
|
# Should contain only one replica to avoid Conflict while polling Telegram updates
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 1
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: oncall
|
|
- contains:
|
|
path: spec.template.spec.initContainers
|
|
content:
|
|
name: wait-for-db
|
|
any: true
|
|
- matchSnapshot:
|
|
path: spec.template.spec.containers
|
|
|
|
- it: telegramPolling.resources -> should specify resources
|
|
set:
|
|
telegramPolling:
|
|
enabled: true
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.containers[0].resources
|
|
value:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|