d134e75371
The `cert-issuer-name` and `cert-issuer-kind` properties point an app's generated `Certificate` at a cert-manager issuer created outside of Dokku, allowing certificates to be issued through solvers the built-in letsencrypt integration cannot use, such as `dns01` for wildcard certificates. Setting an issuer enables https on its own, as a manually managed issuer has no email for Dokku to configure. An imported certificate still takes precedence, and `letsencrypt-server false` remains the single off switch. Dokku warns before a build starts when the referenced issuer is absent from the cluster, without blocking the deploy. Wildcard domains no longer collide with their apex domain when generating ingress names, and `letsencrypt-server` values are now validated when set rather than at deploy time.
249 lines
9.7 KiB
Bash
249 lines
9.7 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load test_helper
|
|
|
|
setup() {
|
|
global_setup
|
|
}
|
|
|
|
teardown() {
|
|
for prop in cert-issuer-kind cert-issuer-name deploy-timeout image-pull-secrets ingress-class kubeconfig-path kube-context kustomize-root-path namespace network-interface rollback-on-failure shm-size token; do
|
|
dokku scheduler-k3s:set --global "$prop" >/dev/null 2>/dev/null || true
|
|
done
|
|
global_teardown
|
|
}
|
|
|
|
# assert_k3s_global_unset_set verifies that a global property cycles correctly
|
|
# through the raw/computed split: when unset, the global key is empty and the
|
|
# computed key returns the built-in default; after setting, both pair members
|
|
# match the set value. Excludes letsencrypt-* properties whose set path applies
|
|
# cluster issuers via helm and requires a live k3s cluster.
|
|
assert_k3s_global_unset_set() {
|
|
declare prop="$1" expected_default="$2" set_value="$3"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global $prop"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-$prop\"'"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-$prop\"'"
|
|
assert_success
|
|
assert_output "$expected_default"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global $prop '$set_value'"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-$prop\"'"
|
|
assert_success
|
|
assert_output "$set_value"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-$prop\"'"
|
|
assert_success
|
|
assert_output "$set_value"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global $prop"
|
|
assert_success
|
|
}
|
|
|
|
@test "(scheduler-k3s:report --global) defaulted properties raw/computed cycle" {
|
|
assert_k3s_global_unset_set "deploy-timeout" "300s" "600s"
|
|
assert_k3s_global_unset_set "kustomize-root-path" "config/kustomize" "deploy/kustomize"
|
|
assert_k3s_global_unset_set "namespace" "default" "production"
|
|
assert_k3s_global_unset_set "rollback-on-failure" "false" "true"
|
|
assert_k3s_global_unset_set "ingress-class" "nginx" "traefik"
|
|
assert_k3s_global_unset_set "network-interface" "eth0" "eth1"
|
|
assert_k3s_global_unset_set "kubeconfig-path" "/etc/rancher/k3s/k3s.yaml" "/tmp/custom-kubeconfig.yaml"
|
|
assert_k3s_global_unset_set "cert-issuer-kind" "ClusterIssuer" "Issuer"
|
|
}
|
|
|
|
@test "(scheduler-k3s:report --global) empty-default properties expose computed sibling" {
|
|
for prop in image-pull-secrets shm-size kube-context cert-issuer-name; do
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global $prop"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-$prop\"'"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-$prop\"'"
|
|
assert_success
|
|
assert_output ""
|
|
done
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global image-pull-secrets my-secret"
|
|
assert_success
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global shm-size 64Mi"
|
|
assert_success
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global kube-context my-context"
|
|
assert_success
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global cert-issuer-name acme-dns"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-cert-issuer-name\"'"
|
|
assert_success
|
|
assert_output "acme-dns"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-cert-issuer-name\"'"
|
|
assert_success
|
|
assert_output "acme-dns"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-image-pull-secrets\"'"
|
|
assert_success
|
|
assert_output "my-secret"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-image-pull-secrets\"'"
|
|
assert_success
|
|
assert_output "my-secret"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-shm-size\"'"
|
|
assert_success
|
|
assert_output "64Mi"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-shm-size\"'"
|
|
assert_success
|
|
assert_output "64Mi"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-kube-context\"'"
|
|
assert_success
|
|
assert_output "my-context"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-kube-context\"'"
|
|
assert_success
|
|
assert_output "my-context"
|
|
}
|
|
|
|
@test "(scheduler-k3s:report --global) letsencrypt properties unset state" {
|
|
for prop in letsencrypt-server letsencrypt-email-prod letsencrypt-email-stag; do
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-$prop\"'"
|
|
assert_success
|
|
assert_output ""
|
|
done
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-server\"'"
|
|
assert_success
|
|
assert_output "prod"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-email-prod\"'"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-email-stag\"'"
|
|
assert_success
|
|
assert_output ""
|
|
}
|
|
|
|
@test "(scheduler-k3s:set) rejects invalid cert issuer and letsencrypt server values" {
|
|
run /bin/bash -c "dokku apps:create $TEST_APP"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP cert-issuer-kind Certificate"
|
|
assert_failure
|
|
assert_output_contains "Invalid cert-issuer-kind"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP cert-issuer-name my_own_issuer_name"
|
|
assert_failure
|
|
assert_output_contains "Invalid cert-issuer-name"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-server prodd"
|
|
assert_failure
|
|
assert_output_contains "Invalid letsencrypt-server"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-cert-issuer-kind\"'"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP cert-issuer-kind clusterissuer"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-cert-issuer-kind\"'"
|
|
assert_success
|
|
assert_output "ClusterIssuer"
|
|
}
|
|
|
|
@test "(scheduler-k3s:report) app-level letsencrypt email overrides global and falls back when unset" {
|
|
run /bin/bash -c "dokku apps:create $TEST_APP"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-email-prod team@dokku.me"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-letsencrypt-email-prod\"'"
|
|
assert_success
|
|
assert_output "team@dokku.me"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-email-prod\"'"
|
|
assert_success
|
|
assert_output "team@dokku.me"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --scheduler-k3s-letsencrypt-email-prod"
|
|
assert_success
|
|
assert_output "team@dokku.me"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set $TEST_APP letsencrypt-email-prod"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-letsencrypt-email-prod\"'"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report $TEST_APP --format json | jq -r '.\"scheduler-k3s-computed-letsencrypt-email-prod\"'"
|
|
assert_success
|
|
assert_output ""
|
|
}
|
|
|
|
@test "(scheduler-k3s:report --global) token masked in stdout but exposed via json or explicit flag" {
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global token"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -e 'has(\"scheduler-k3s-global-token\")'"
|
|
assert_success
|
|
assert_output "true"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-token\"'"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --scheduler-k3s-global-token"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global token sometoken"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global"
|
|
assert_success
|
|
assert_output_contains "*******"
|
|
assert_output_not_contains "sometoken"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r '.\"scheduler-k3s-global-token\"'"
|
|
assert_success
|
|
assert_output "sometoken"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --scheduler-k3s-global-token"
|
|
assert_success
|
|
assert_output "sometoken"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:set --global token"
|
|
assert_success
|
|
}
|
|
|
|
@test "(scheduler-k3s:report) emits new stripped JSON keys alongside legacy" {
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r 'has(\"global-deploy-timeout\") and has(\"scheduler-k3s-global-deploy-timeout\")'"
|
|
assert_success
|
|
assert_output "true"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r 'has(\"computed-deploy-timeout\") and has(\"scheduler-k3s-computed-deploy-timeout\")'"
|
|
assert_success
|
|
assert_output "true"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r 'has(\"global-namespace\") and has(\"scheduler-k3s-global-namespace\")'"
|
|
assert_success
|
|
assert_output "true"
|
|
|
|
run /bin/bash -c "dokku scheduler-k3s:report --global --format json | jq -r 'has(\"computed-namespace\") and has(\"scheduler-k3s-computed-namespace\")'"
|
|
assert_success
|
|
assert_output "true"
|
|
}
|