mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-19 05:50:41 +08:00
Taylor Mutch
5f58cb018f
* fix(helm): create sandbox JWT secret under cert-manager The cert-manager install path (certManager.enabled=true, pkiInitJob.enabled=false) left the gateway StatefulSet unable to start because nothing created the openshell-jwt-keys Secret: cert-manager owns TLS Secrets but does not mint the sandbox JWT signing key, and the certgen hook only rendered when pkiInitJob.enabled was true. Separate JWT signing-key provisioning from TLS PKI provisioning: - certgen: add a --jwt-only mode that creates only the Opaque JWT signing Secret, for use when another controller owns TLS Secrets. - certgen.yaml: render the hook when pkiInitJob.enabled OR certManager.enabled is true. cert-manager takes precedence and runs the hook with --jwt-only even if pkiInitJob.enabled remains true. Remove the mutual-exclusion failure between the two values. - _helpers.tpl: add openshell.sandboxJwtSecretName, shared by the hook and the StatefulSet mount. - Update values, README, docs, architecture, and the debug-openshell-cluster skill to reflect the new precedence; the documented cert-manager install no longer needs pkiInitJob.enabled=false. Closes #1691 * fix(helm): honor cert-manager precedence for client CA volume The client CA volume logic treated pkiInitJob.enabled as proof that built-in PKI owns the client CA. With cert-manager precedence now allowing certManager.enabled=true alongside the default pkiInitJob.enabled=true, that assumption mounts the server TLS cert secret as the client CA and ignores certManager.clientCaFromServerTlsSecret=false, which can break mTLS or trust the wrong CA. Gate the pkiInitJob.enabled term with (not certManager.enabled) in all three client CA conditions (volume mount, volume definition, and secret selection) so cert-manager owns TLS when enabled. Add a Helm test suite covering built-in PKI, cert-manager shared CA, the regression config (cert-manager + clientCaFromServerTlsSecret=false + default pkiInitJob), and the no-client-CA case.
86 lines
3.0 KiB
YAML
86 lines
3.0 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
suite: statefulset client CA volume
|
|
templates:
|
|
- templates/gateway-config.yaml
|
|
- templates/statefulset.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
tests:
|
|
- it: mounts the server TLS secret ca.crt as client CA for built-in PKI
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
pkiInitJob.enabled: true
|
|
certManager.enabled: false
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].name
|
|
value: tls-client-ca
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].secret.secretName
|
|
value: openshell-server-tls
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].secret.items[0].key
|
|
value: ca.crt
|
|
|
|
- it: shares the cert-manager server TLS ca.crt when clientCaFromServerTlsSecret is true
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.clientCaFromServerTlsSecret: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].name
|
|
value: tls-client-ca
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].secret.secretName
|
|
value: openshell-server-tls
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].secret.items[0].key
|
|
value: ca.crt
|
|
|
|
# Regression: with cert-manager enabled and pkiInitJob left at its default
|
|
# `true`, the client CA condition must honor certManager precedence and NOT
|
|
# treat pkiInitJob.enabled as built-in TLS. With clientCaFromServerTlsSecret=false
|
|
# the gateway must mount the separate clientCaSecretName, not the server TLS
|
|
# cert secret.
|
|
- it: uses clientCaSecretName under cert-manager even when pkiInitJob stays enabled
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.clientCaFromServerTlsSecret: false
|
|
pkiInitJob.enabled: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].name
|
|
value: tls-client-ca
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].secret.secretName
|
|
value: openshell-server-client-ca
|
|
- notExists:
|
|
path: spec.template.spec.volumes[3].secret.items
|
|
|
|
# When cert-manager owns TLS, does not share its CA, and no separate client CA
|
|
# secret is configured, there is no client CA to mount: the volume must not
|
|
# render rather than mounting an empty secret name.
|
|
- it: omits the client CA volume when cert-manager owns TLS and no client CA secret is set
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.clientCaFromServerTlsSecret: false
|
|
pkiInitJob.enabled: true
|
|
server.tls.clientCaSecretName: ""
|
|
asserts:
|
|
- lengthEqual:
|
|
path: spec.template.spec.volumes
|
|
count: 3
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: tls-client-ca
|
|
mountPath: /etc/openshell-tls/client-ca
|
|
readOnly: true
|