Tiered LDAP groups

tests/validate_manifests.py

@@ -51,6 +51,10 @@ assert plaintext_config["LDAP_URL"] == "ldap://openldap.openldap.svc.cluster.loc
 assert all(isinstance(value, str) for value in plaintext_config.values())
 assert "MEMBERSHIP_SECRET_KEY" not in config and "SHKEEPER_API_KEY" not in config
 tiers = json.loads(find(all_objects, "ConfigMap", "membership-tiers")["data"]["tiers.json"])
+service_groups = json.loads(find(all_objects, "ConfigMap", "membership-tiers")["data"]["service-groups.json"])
+assert config["MEMBERSHIP_SERVICE_GROUPS_FILE"] == "/etc/membership/tiers/service-groups.json"
+assert service_groups["0"] == ["cn=free-service,ou=groups,dc=example,dc=org"]
+assert len(service_groups["2"]) == 2
 assert len(tiers) == 5 and tiers["level-5"]["usd_amount"] == "64.00"
 assert [tiers[f"level-{level}"]["level"] for level in range(1, 6)] == list(range(1, 6))
 for name in ["membership", "membership-worker"]:
@@ -76,6 +80,9 @@ apache = find(all_objects, "ConfigMap", "httpd")["data"]
 assert "http://membership:8000/members/" in apache["membership.conf"]
 assert "X-Forwarded-Proto" in apache["membership.conf"]
 assert "Require all denied" in apache["membership.conf"]
+assert "LimitRequestBody 262144" in apache["membership.conf"]
+assert '<Location "/members/profile/">' in apache["membership.conf"]
+assert "LimitRequestBody 2097152" in apache["membership.conf"]
 assert "env=!membership_sensitive" in apache["httpd.conf"]
 assert "LoadModule proxy_http_module" in apache["httpd.conf"]
 source = find(all_objects, "Deployment", "httpd")["spec"]["template"]["spec"]["initContainers"][0]
@@ -83,6 +90,7 @@ assert "rm -rf" not in source["command"][-1]
 assert 'cp -a /tmp/www/htdocs/. /data/' in source["command"][-1]
 ingress = find(all_objects, "Ingress", "www")
 assert ingress["metadata"]["annotations"]["nginx.ingress.kubernetes.io/enable-access-log"] == "false"
+assert ingress["metadata"]["annotations"]["nginx.ingress.kubernetes.io/proxy-body-size"] == "2m"
 assert ingress["spec"]["rules"][0]["http"]["paths"][0]["backend"]["service"]["name"] == "httpd"
 for obj in docs("external-membership-workloads"):
     if obj["kind"] == "Deployment":