test: cover scheduler-k3s http to https redirect edges

Adds four Go template tests for ingress-route.yaml covering the imported-cert secret name, multiple domains per IngressRoute, the non-traefik ingress_class guard, and the https port_map dedup when an http port_map already covers the same container port. Also adds a bats integration test that deploys a TLS-enabled app under traefik and asserts both IngressRoute manifests and live http-to-https redirect plus https serving.
2026-05-24 16:42:51 -04:00
parent caa60fa1ef
commit 647af7bb0e
2 changed files with 198 additions and 4 deletions
--- a/plugins/scheduler-k3s/ingress_route_template_test.go
+++ b/plugins/scheduler-k3s/ingress_route_template_test.go
@@ -58,10 +58,7 @@ func renderIngressRouteTemplate(t *testing.T, values map[string]interface{}) []m
 		t.Fatalf("render: %v", err)
 	}

-	manifest, ok := rendered["test/templates/ingress-route.yaml"]
-	if !ok {
-		t.Fatalf("ingress-route.yaml not rendered; got: %v", rendered)
-	}
+	manifest := rendered["test/templates/ingress-route.yaml"]

 	var docs []map[string]interface{}
 	decoder := yaml.NewDecoder(strings.NewReader(manifest))
@@ -186,3 +183,114 @@ func TestIngressRouteTemplateWithoutTLSKeepsSingleHTTPRoute(t *testing.T) {
 		t.Fatalf("expected non-TLS route to omit tls block, got %#v", httpSpec["tls"])
 	}
 }
+
+func TestIngressRouteTemplateTLSImportedCertUsesSharedSecretName(t *testing.T) {
+	values := testIngressRouteValues(true)
+	web := values["processes"].(map[string]interface{})["web"].(map[string]interface{})["web"].(map[string]interface{})
+	web["tls"].(map[string]interface{})["use_imported_cert"] = true
+
+	docs := renderIngressRouteTemplate(t, values)
+	if len(docs) != 2 {
+		t.Fatalf("expected 2 ingress routes when tls enabled, got %d", len(docs))
+	}
+
+	httpsRoute := findDocByName(t, docs, "myapp-web-http-80-5000-websecure")
+	httpsSpec := httpsRoute["spec"].(map[string]interface{})
+	tls, ok := httpsSpec["tls"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected HTTPS route to include tls block, got %#v", httpsSpec["tls"])
+	}
+	if tls["secretName"] != "tls-myapp" {
+		t.Fatalf("expected HTTPS route secretName %q (imported cert), got %#v", "tls-myapp", tls["secretName"])
+	}
+}
+
+func TestIngressRouteTemplateMultipleDomainsRenderOneRoutePerDomain(t *testing.T) {
+	values := testIngressRouteValues(true)
+	web := values["processes"].(map[string]interface{})["web"].(map[string]interface{})["web"].(map[string]interface{})
+	web["domains"] = []interface{}{
+		map[string]interface{}{"name": "app.example.com"},
+		map[string]interface{}{"name": "www.example.com"},
+	}
+
+	docs := renderIngressRouteTemplate(t, values)
+	if len(docs) != 2 {
+		t.Fatalf("expected 2 ingress routes (one http, one websecure), got %d", len(docs))
+	}
+
+	httpRoute := findDocByName(t, docs, "myapp-web-http-80-5000")
+	httpRoutes := httpRoute["spec"].(map[string]interface{})["routes"].([]interface{})
+	if len(httpRoutes) != 2 {
+		t.Fatalf("expected HTTP route to have 2 entries (one per domain), got %d", len(httpRoutes))
+	}
+	for i, r := range httpRoutes {
+		route := r.(map[string]interface{})
+		if _, ok := route["middlewares"]; !ok {
+			t.Fatalf("expected HTTP route entry %d to contain redirect middleware, got %#v", i, route)
+		}
+	}
+	if got := httpRoutes[0].(map[string]interface{})["match"]; got != "Host(`app.example.com`)" {
+		t.Fatalf("expected HTTP route[0] match Host(`app.example.com`), got %#v", got)
+	}
+	if got := httpRoutes[1].(map[string]interface{})["match"]; got != "Host(`www.example.com`)" {
+		t.Fatalf("expected HTTP route[1] match Host(`www.example.com`), got %#v", got)
+	}
+
+	httpsRoute := findDocByName(t, docs, "myapp-web-http-80-5000-websecure")
+	httpsRoutes := httpsRoute["spec"].(map[string]interface{})["routes"].([]interface{})
+	if len(httpsRoutes) != 2 {
+		t.Fatalf("expected HTTPS route to have 2 entries (one per domain), got %d", len(httpsRoutes))
+	}
+	for i, r := range httpsRoutes {
+		route := r.(map[string]interface{})
+		if _, ok := route["middlewares"]; ok {
+			t.Fatalf("expected HTTPS route entry %d to omit redirect middleware, got %#v", i, route)
+		}
+	}
+	if got := httpsRoutes[0].(map[string]interface{})["match"]; got != "Host(`app.example.com`)" {
+		t.Fatalf("expected HTTPS route[0] match Host(`app.example.com`), got %#v", got)
+	}
+	if got := httpsRoutes[1].(map[string]interface{})["match"]; got != "Host(`www.example.com`)" {
+		t.Fatalf("expected HTTPS route[1] match Host(`www.example.com`), got %#v", got)
+	}
+}
+
+func TestIngressRouteTemplateNonTraefikIngressClassRendersNothing(t *testing.T) {
+	values := testIngressRouteValues(true)
+	values["global"].(map[string]interface{})["network"].(map[string]interface{})["ingress_class"] = "nginx"
+
+	docs := renderIngressRouteTemplate(t, values)
+	if len(docs) != 0 {
+		t.Fatalf("expected 0 ingress routes when ingress_class is not traefik, got %d: %#v", len(docs), docs)
+	}
+}
+
+func TestIngressRouteTemplateHTTPSPortMapSkippedWhenHTTPCovers(t *testing.T) {
+	values := testIngressRouteValues(true)
+	web := values["processes"].(map[string]interface{})["web"].(map[string]interface{})["web"].(map[string]interface{})
+	web["port_maps"] = []interface{}{
+		map[string]interface{}{
+			"name":           "http-80-5000",
+			"scheme":         "http",
+			"container_port": float64(5000),
+		},
+		map[string]interface{}{
+			"name":           "https-443-5000",
+			"scheme":         "https",
+			"container_port": float64(5000),
+		},
+	}
+
+	docs := renderIngressRouteTemplate(t, values)
+	if len(docs) != 2 {
+		t.Fatalf("expected 2 ingress routes (http + websecure for http-80-5000 only), got %d", len(docs))
+	}
+	for _, doc := range docs {
+		name := doc["metadata"].(map[string]interface{})["name"].(string)
+		if strings.Contains(name, "https-443-5000") {
+			t.Fatalf("expected no IngressRoute for https-443-5000 (covered by http-80-5000), got %q", name)
+		}
+	}
+	findDocByName(t, docs, "myapp-web-http-80-5000")
+	findDocByName(t, docs, "myapp-web-http-80-5000-websecure")
+}
--- a/tests/unit/scheduler-k3s-certs-redirect.bats
+++ b/tests/unit/scheduler-k3s-certs-redirect.bats
@@ -0,0 +1,86 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+TEST_APP="rdmtestapp"
+
+setup_local_tls() {
+  TLS=$BATS_TMPDIR/tls
+  mkdir -p $TLS
+  tar xf $BATS_TEST_DIRNAME/server_ssl.tar -C $TLS
+  sudo chown -R dokku:dokku $TLS
+}
+
+teardown_local_tls() {
+  TLS=$BATS_TMPDIR/tls
+  rm -R $TLS
+}
+
+setup() {
+  uninstall_k3s || true
+  global_setup
+  dokku nginx:stop
+  export KUBECONFIG="/etc/rancher/k3s/k3s.yaml"
+  setup_local_tls
+}
+
+teardown() {
+  global_teardown
+  dokku nginx:start
+  uninstall_k3s || true
+  teardown_local_tls
+}
+
+@test "(scheduler-k3s) [ingress] traefik redirects http to https when tls is enabled" {
+  if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
+    skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
+  fi
+
+  INGRESS_CLASS=traefik install_k3s
+
+  run /bin/bash -c "dokku apps:create $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku domains:set $TEST_APP $TEST_APP.dokku.me"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "dokku certs:add $TEST_APP $BATS_TMPDIR/tls/server.crt $BATS_TMPDIR/tls/server.key"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "sleep 30"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  run /bin/bash -c "kubectl get ingressroute ${TEST_APP}-web-http-80-5000 -n default -o jsonpath='{.spec.routes[0].middlewares[0].name}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "${TEST_APP}-web-redirect-to-https"
+
+  run /bin/bash -c "kubectl get ingressroute ${TEST_APP}-web-http-80-5000 -n default -o jsonpath='{.spec.tls.secretName}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output ""
+
+  run /bin/bash -c "kubectl get ingressroute ${TEST_APP}-web-http-80-5000-websecure -n default -o jsonpath='{.spec.tls.secretName}'"
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+  assert_output "tls-${TEST_APP}"
+
+  assert_http_redirect "http://$TEST_APP.dokku.me" "https://$TEST_APP.dokku.me/"
+  assert_http_localhost_response "https" "$TEST_APP.dokku.me" "443" "" "python/http.server"
+}