mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Taylor Mutch
5f58cb018f
* fix(helm): create sandbox JWT secret under cert-manager The cert-manager install path (certManager.enabled=true, pkiInitJob.enabled=false) left the gateway StatefulSet unable to start because nothing created the openshell-jwt-keys Secret: cert-manager owns TLS Secrets but does not mint the sandbox JWT signing key, and the certgen hook only rendered when pkiInitJob.enabled was true. Separate JWT signing-key provisioning from TLS PKI provisioning: - certgen: add a --jwt-only mode that creates only the Opaque JWT signing Secret, for use when another controller owns TLS Secrets. - certgen.yaml: render the hook when pkiInitJob.enabled OR certManager.enabled is true. cert-manager takes precedence and runs the hook with --jwt-only even if pkiInitJob.enabled remains true. Remove the mutual-exclusion failure between the two values. - _helpers.tpl: add openshell.sandboxJwtSecretName, shared by the hook and the StatefulSet mount. - Update values, README, docs, architecture, and the debug-openshell-cluster skill to reflect the new precedence; the documented cert-manager install no longer needs pkiInitJob.enabled=false. Closes #1691 * fix(helm): honor cert-manager precedence for client CA volume The client CA volume logic treated pkiInitJob.enabled as proof that built-in PKI owns the client CA. With cert-manager precedence now allowing certManager.enabled=true alongside the default pkiInitJob.enabled=true, that assumption mounts the server TLS cert secret as the client CA and ignores certManager.clientCaFromServerTlsSecret=false, which can break mTLS or trust the wrong CA. Gate the pkiInitJob.enabled term with (not certManager.enabled) in all three client CA conditions (volume mount, volume definition, and secret selection) so cert-manager owns TLS when enabled. Add a Helm test suite covering built-in PKI, cert-manager shared CA, the regression config (cert-manager + clientCaFromServerTlsSecret=false + default pkiInitJob), and the no-client-CA case.
117 lines
3.6 KiB
YAML
117 lines
3.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
suite: certgen hook
|
|
templates:
|
|
- templates/certgen.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
tests:
|
|
- it: renders combined TLS and JWT certgen hook by default
|
|
template: templates/certgen.yaml
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 4
|
|
- equal:
|
|
path: kind
|
|
value: Job
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-secret-name=openshell-server-tls"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--client-secret-name=openshell-client-tls"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=openshell-jwt-keys"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-only"
|
|
documentIndex: 3
|
|
|
|
- it: renders JWT-only certgen hook when cert-manager owns TLS
|
|
template: templates/certgen.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
pkiInitJob.enabled: false
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 4
|
|
- equal:
|
|
path: kind
|
|
value: Job
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-only"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=openshell-jwt-keys"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-secret-name=openshell-server-tls"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--client-secret-name=openshell-client-tls"
|
|
documentIndex: 3
|
|
|
|
- it: uses the configured sandbox JWT secret name
|
|
template: templates/certgen.yaml
|
|
set:
|
|
server.sandboxJwt.signingSecretName: custom-jwt-keys
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=custom-jwt-keys"
|
|
documentIndex: 3
|
|
|
|
- it: renders JWT-only hook when cert-manager is enabled even if pkiInitJob remains enabled
|
|
template: templates/certgen.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
pkiInitJob.enabled: true
|
|
pkiInitJob.serverDnsNames:
|
|
- extra.example.test
|
|
pkiInitJob.serverIpAddresses:
|
|
- 192.0.2.10
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 4
|
|
- equal:
|
|
path: kind
|
|
value: Job
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-only"
|
|
documentIndex: 3
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--jwt-secret-name=openshell-jwt-keys"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-secret-name=openshell-server-tls"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--client-secret-name=openshell-client-tls"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-san=extra.example.test"
|
|
documentIndex: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--server-san=192.0.2.10"
|
|
documentIndex: 3
|