mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 06:14:29 +00:00
92e4101403
- Materialize required DB Kubernetes secrets from user-entered password before CNPG init - Auto-generate a temporary OpenTofu admin password in non-interactive runs when none is available - Update installer UI flows and tests to cover the new preflights/rotation Co-authored-by: Junie <junie@jetbrains.com>
77 lines
2.8 KiB
Bash
77 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Regression test: ArgoCD repo-server must be able to write to /var/run/argocd when
|
|
# the manifest uses hostPath-backed volumes (common on k3d nodes).
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
PROLE_HOME=$(cd "$SCRIPT_DIR/../.." && pwd)
|
|
|
|
MANIFEST="$PROLE_HOME/k8s/argocd/install.yaml"
|
|
|
|
python3 - "$MANIFEST" <<'PY'
|
|
import sys
|
|
|
|
import yaml
|
|
|
|
|
|
path = sys.argv[1]
|
|
with open(path, "r", encoding="utf-8") as f:
|
|
docs = list(yaml.safe_load_all(f))
|
|
|
|
targets = [
|
|
d
|
|
for d in docs
|
|
if isinstance(d, dict)
|
|
and d.get("kind") == "Deployment"
|
|
and d.get("metadata", {}).get("name") == "argocd-repo-server"
|
|
]
|
|
|
|
assert len(targets) == 1, f"expected exactly 1 argocd-repo-server deployment, got {len(targets)}"
|
|
|
|
spec = targets[0]["spec"]["template"]["spec"]
|
|
init_containers = spec.get("initContainers") or []
|
|
|
|
names = [c.get("name") for c in init_containers]
|
|
assert "init-permissions" in names, f"missing init-permissions initContainer; initContainers={names}"
|
|
assert "copyutil" in names, f"missing copyutil initContainer; initContainers={names}"
|
|
|
|
init_perm = next(c for c in init_containers if c.get("name") == "init-permissions")
|
|
sc = init_perm.get("securityContext") or {}
|
|
assert sc.get("runAsUser") == 0, f"init-permissions must run as root (runAsUser=0), got {sc.get('runAsUser')}"
|
|
|
|
# The init-permissions script must tolerate hostPath volumes that disallow chown
|
|
# (Operation not permitted) and still make the dirs writable.
|
|
init_args = init_perm.get("args") or []
|
|
init_joined = "\n".join(init_args) if isinstance(init_args, list) else str(init_args)
|
|
assert "chown" in init_joined, "init-permissions should attempt chown when possible"
|
|
assert "chown failed" in init_joined, "init-permissions must tolerate chown failures"
|
|
assert "chmod 0777" in init_joined, "init-permissions must apply permissive chmod when chown is not allowed"
|
|
|
|
mounts = init_perm.get("volumeMounts") or []
|
|
present = {(m.get("mountPath"), m.get("name")) for m in mounts}
|
|
required = {
|
|
("/var/run/argocd", "var-files"),
|
|
("/tmp", "tmp"),
|
|
("/helm-working-dir", "helm-working-dir"),
|
|
("/home/argocd/cmp-server/plugins", "plugins"),
|
|
("/app/config/gpg/keys", "gpg-keyring"),
|
|
}
|
|
missing = required - present
|
|
assert not missing, f"init-permissions missing required mounts: {sorted(missing)}"
|
|
|
|
copyutil = next(c for c in init_containers if c.get("name") == "copyutil")
|
|
copy_mounts = copyutil.get("volumeMounts") or []
|
|
assert any(
|
|
m.get("mountPath") == "/var/run/argocd" and m.get("name") == "var-files" for m in copy_mounts
|
|
), "copyutil must mount var-files at /var/run/argocd"
|
|
|
|
args = copyutil.get("args") or []
|
|
joined = " ".join(args) if isinstance(args, list) else str(args)
|
|
assert "/var/run/argocd/argocd" in joined, "copyutil must copy argocd binary into /var/run/argocd"
|
|
|
|
print("OK")
|
|
PY
|
|
|
|
echo "SUCCESS"
|