73 lines
3.9 KiB
Python
Executable File
73 lines
3.9 KiB
Python
Executable File
"""Check real Ansible-rendered values and Helm manifests without a cluster."""
|
|
|
|
import base64
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
from kubernetes_validate import validate
|
|
from ansible.parsing.dataloader import DataLoader
|
|
from ansible.template import Templar
|
|
|
|
# Resolve the site's actual workflow variables with fixture credentials only;
|
|
# verify both Matrix-only migration and opt-in website integration.
|
|
defaults = yaml.safe_load(Path('defaults/main.yml').read_text())
|
|
site = yaml.safe_load(Path('playbooks/deploy-eom.yml').read_text())[0]['vars']
|
|
for website_enabled in (False, True):
|
|
variables = {
|
|
**defaults, **site,
|
|
'dex_admin_password': 'fixture-db',
|
|
'openldap_readonly_password': 'fixture-ldap',
|
|
'matrix_dex_oidc_client_id': 'matrix-fixture',
|
|
'matrix_dex_oidc_client_secret': 'fixture-matrix',
|
|
}
|
|
if website_enabled:
|
|
variables['www_dex_client_secret'] = 'fixture-www'
|
|
resolved = Templar(loader=DataLoader(), variables=variables).template(site)
|
|
assert resolved['dex_issuer'] == 'https://dex.eom.dev/'
|
|
assert resolved['dex_postgres_password'] == 'fixture-db'
|
|
assert resolved['dex_ldap_group_user_attribute'] == 'cn'
|
|
assert resolved['dex_theme_enabled'] is True
|
|
assert resolved['dex_postgres_manage'] is False
|
|
assert bool(resolved['dex_static_clients']) == website_enabled
|
|
assert bool(resolved['dex_additional_connectors']) == website_enabled
|
|
if website_enabled:
|
|
assert resolved['dex_static_clients'][0]['secret'] == 'fixture-www'
|
|
assert resolved['dex_additional_connectors'][0]['config']['userSearch']['idAttr'] == 'entryUUID'
|
|
|
|
values = yaml.safe_load(Path('/tmp/dex-values.yml').read_text())
|
|
config = values['config']
|
|
assert config['issuer'] == 'https://dex.example.com/'
|
|
assert config['storage']['config']['database'] == 'dex'
|
|
assert 'databbase' not in config['storage']['config']
|
|
ldap = config['connectors'][0]
|
|
assert ldap['id'] == 'ldap'
|
|
assert ldap['config']['insecureNoSSL'] is True
|
|
assert ldap['config']['startTLS'] is False
|
|
assert ldap['config']['userSearch']['idAttr'] == 'uid'
|
|
assert ldap['config']['groupSearch']['userMatchers'][0]['userAttr'] == 'DN'
|
|
assert config['staticClients'][0]['id'] == 'matrix-fixture'
|
|
assert config['frontend']['logoURL'] == 'theme/logo.svg'
|
|
assert config['frontend']['dir'] == '/srv/dex/web'
|
|
assert len(values['volumeMounts']) == 2
|
|
assert all(mount['readOnly'] for mount in values['volumeMounts'])
|
|
optional = yaml.safe_load(Path('/tmp/dex-values-optional.yml').read_text())
|
|
assert 'frontend' not in optional['config']
|
|
assert optional['config']['connectors'][0]['config']['startTLS'] is True
|
|
assert optional['config']['staticClients'][0]['secretEnv'] == 'WWW_DEX_CLIENT_SECRET'
|
|
assert optional['envFrom'][0]['secretRef']['name'] == 'dex-client-secrets'
|
|
minimal = yaml.safe_load(Path('/tmp/dex-values-minimal.yml').read_text())
|
|
assert minimal['config']['staticClients'] == []
|
|
assert minimal['volumes'] == [] and minimal['volumeMounts'] == []
|
|
objects = [obj for obj in yaml.safe_load_all(Path('/tmp/dex-manifests.yml').read_text()) if obj]
|
|
for obj in objects:
|
|
validate(obj, desired_version='1.31.0', strict=True)
|
|
deployment = next(obj for obj in objects if obj['kind'] == 'Deployment')
|
|
assert deployment['metadata']['name'] == 'dex'
|
|
mounts = deployment['spec']['template']['spec']['containers'][0]['volumeMounts']
|
|
assert any(mount['mountPath'].endswith('/light/styles.css') for mount in mounts)
|
|
secret = next(obj for obj in objects if obj['kind'] == 'Secret')
|
|
stored = yaml.safe_load(base64.b64decode(secret['data']['config.yaml']))
|
|
assert stored['storage']['config']['password'] == 'fixture-not-a-real-password'
|
|
assert not any(obj['kind'] in ['PersistentVolumeClaim', 'StatefulSet'] for obj in objects)
|
|
print(f'PASS: {len(objects)} real Helm resources; legacy identity/plain LDAP preserved, optional TLS, clients, theme mounts and Secret config validated')
|