github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: support per-app letsencrypt emails on k3s

Browse Source 
The `letsencrypt-email-prod` and `letsencrypt-email-stag` properties can now be set per app in addition to globally, resolving app-level before the global value for the app's selected `letsencrypt-server`. An app that sets its own email renders a namespaced cert-manager `Issuer` using that email, while apps without an override continue to use the shared `ClusterIssuer` with the global email.
This commit is contained in:
Jose Diaz-Gonzalez
2026-07-19 03:31:55 -04:00
parent 05ce8fb68e
commit dc802ddd19
11 changed files with 441 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
tests/unit/scheduler-k3s-certs-deploy-2.bats Normal file
View File

@@ -0,0 +1,74 @@
#!/usr/bin/env bats
load test_helper
TEST_APP="rdmtestapp"
setup() {
uninstall_k3s || true
global_setup
dokku nginx:stop
export KUBECONFIG="/etc/rancher/k3s/k3s.yaml"
}
teardown() {
global_teardown
dokku nginx:start
uninstall_k3s || true
}
@test "(scheduler-k3s:certs) app-level letsencrypt email renders a per-app namespaced Issuer" {
if [[ -z "$DOCKERHUB_USERNAME" ]] || [[ -z "$DOCKERHUB_TOKEN" ]]; then
skip "skipping due to missing docker.io credentials DOCKERHUB_USERNAME:DOCKERHUB_TOKEN"
fi
INGRESS_CLASS=nginx install_k3s
run /bin/bash -c "dokku apps:create $TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-server staging"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-email-stag app@dokku.me"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "dokku domains:set $TEST_APP $TEST_APP.dokku.me"
echo "output: $output"
echo "status: $status"
assert_success
run deploy_app python "dokku@$DOKKU_DOMAIN:$TEST_APP"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "sleep 30"
echo "output: $output"
echo "status: $status"
assert_success
run /bin/bash -c "kubectl get certificate ${TEST_APP}-web -n default -o jsonpath='{.spec.issuerRef.kind}'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "Issuer"
run /bin/bash -c "kubectl get certificate ${TEST_APP}-web -n default -o jsonpath='{.spec.issuerRef.name}'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "${TEST_APP}-letsencrypt-stag"
run /bin/bash -c "kubectl get issuer ${TEST_APP}-letsencrypt-stag -n default -o jsonpath='{.spec.acme.email}'"
echo "output: $output"
echo "status: $status"
assert_success
assert_output "app@dokku.me"
}

31
tests/unit/scheduler-k3s-report.bats
View File

@@ -123,6 +123,37 @@ assert_k3s_global_unset_set() {
assert_output ""
}
@test "(scheduler-k3s:report) app-level letsencrypt email overrides global and falls back when unset" {
run /bin/bash -c "dokku apps:create $TEST_APP"
assert_success
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-email-prod team@dokku.me"
assert_success
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-letsencrypt-email-prod\"'"
assert_success
assert_output "team@dokku.me"
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-email-prod\"'"
assert_success
assert_output "team@dokku.me"
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --scheduler-k3s-letsencrypt-email-prod"
assert_success
assert_output "team@dokku.me"
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-email-prod"
assert_success
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-letsencrypt-email-prod\"'"
assert_success
assert_output ""
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-email-prod\"'"
assert_success
assert_output ""
}
@test "(scheduler-k3s:report --global) token masked in stdout but exposed via json or explicit flag" {
run /bin/bash -c "dokku scheduler-k3s:set --global token"
assert_success