Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

create-federation-secret job runs only when server.updatePartition is 0 #1512

Merged
merged 4 commits into from
Sep 26, 2022
Merged

create-federation-secret job runs only when server.updatePartition is 0 #1512

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4eb05b8
create-federation-secret job runs only
20sr20 Sep 16, 2022
38a5168
I added a test to check createFederationSecret/Job doesn't run when …
20sr20 Sep 23, 2022
3959a34
Added changelog entry for GH-1512
20sr20 Sep 23, 2022
d5c4049
Merge branch 'main' into fed-sec
david-yu Sep 26, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ BUG FIXES:
* Control plane
* Use global ACL auth method to provision ACL tokens for API Gateway in secondary datacenter [[GH-1481](https://github.com/hashicorp/consul-k8s/pull/1481)]
* Helm:
* Fixes a typo in the templating of `global.connectInject.disruptionBudget.maxUnavailable`. [[GH-1530](https://github.com/hashicorp/consul-k8s/pull/1530)].
* Only create Federation Secret Job when server.updatePartition is 0 [[GH-1512](https://github.com/hashicorp/consul-k8s/pull/1512)]
* Fixes a typo in the templating of `global.connectInject.disruptionBudget.maxUnavailable`. [[GH-1530](https://github.com/hashicorp/consul-k8s/pull/1530)]

IMPROVEMENTS:
* Helm:
Expand Down
2 changes: 2 additions & 0 deletions charts/consul/templates/create-federation-secret-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
{{- if .Values.global.federation.createFederationSecret }}
{{- if not .Values.global.federation.enabled }}{{ fail "global.federation.enabled must be true when global.federation.createFederationSecret is true" }}{{ end }}
{{- if and (not .Values.global.acls.createReplicationToken) .Values.global.acls.manageSystemACLs }}{{ fail "global.acls.createReplicationToken must be true when global.acls.manageSystemACLs is true because the federation secret must include the replication token" }}{{ end }}
{{- if eq (int .Values.server.updatePartition) 0 }}
apiVersion: batch/v1
kind: Job
metadata:
Expand Down Expand Up @@ -157,3 +158,4 @@ spec:
memory: "50Mi"
cpu: "50m"
{{- end }}
{{- end }}
15 changes: 15 additions & 0 deletions charts/consul/test/unit/create-federation-secret-job.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,21 @@ load _helpers
[[ "$output" =~ "global.acls.createReplicationToken must be true when global.acls.manageSystemACLs is true because the federation secret must include the replication token" ]]
}

@test "createFederationSecret/Job: disabled by updatepartition != 0" {
cd `chart_dir`
assert_empty helm template \
-s templates/create-federation-secret-job.yaml \
--set 'global.federation.enabled=true' \
--set 'global.federation.createFederationSecret=true' \
--set 'global.acls.createReplicationToken=true' \
--set 'global.acls.manageSystemACLs=true' \
--set 'global.tls.enabled=true' \
--set 'meshGateway.enabled=true' \
--set 'connectInject.enabled=true' \
--set 'server.updatePartition=1' \
.
}

@test "createFederationSecret/Job: mounts auto-created ca secrets by default" {
cd `chart_dir`
local volumes=$(helm template \
Expand Down