TLS

tests/validate_manifests.py

@@ -43,6 +43,12 @@ assert len({(obj["kind"], obj["metadata"]["name"]) for obj in all_objects}) == l
 config = find(all_objects, "ConfigMap", "membership-config")["data"]
 assert all(isinstance(value, str) for value in config.values())
 assert config["MEMBERSHIP_PUBLIC_URL"] == "https://www.eom.dev"
+assert config["LDAP_ALLOW_INSECURE"] == "0"
+assert config["LDAP_URL"].startswith("ldaps://")
+plaintext_config = find(docs("plaintext-membership-config"), "ConfigMap", "membership-config")["data"]
+assert plaintext_config["LDAP_ALLOW_INSECURE"] == "1"
+assert plaintext_config["LDAP_URL"] == "ldap://openldap.openldap.svc.cluster.local:389"
+assert all(isinstance(value, str) for value in plaintext_config.values())
 assert "MEMBERSHIP_SECRET_KEY" not in config and "SHKEEPER_API_KEY" not in config
 tiers = json.loads(find(all_objects, "ConfigMap", "membership-tiers")["data"]["tiers.json"])
 assert len(tiers) == 5 and tiers["level-4"]["usd_amount"] == "64.00"
@@ -83,7 +89,8 @@ for obj in docs("external-membership-workloads"):
 external_config = docs("external-membership-config")
 assert not any(obj["kind"] == "NetworkPolicy" and obj["metadata"]["name"] == "membership-db" for obj in external_config)
 assert find(external_config, "ConfigMap", "membership-config")["data"]["POSTGRES_SSLMODE"] == "verify-full"
+assert find(external_config, "ConfigMap", "membership-config")["data"]["LDAP_ALLOW_INSECURE"] == "0"
 disabled = docs("disabled-website")
 assert not any(obj["kind"] == "OnionService" for obj in disabled)
 assert "ProxyPass" not in find(disabled, "ConfigMap", "httpd")["data"]["membership.conf"]
-print(f"PASS: {len(all_objects)} Kubernetes objects; default, external/CA/SHKeeper and disabled variants")
+print(f"PASS: {len(all_objects)} Kubernetes objects; default, plaintext LDAP, external/CA/SHKeeper and disabled variants")