d186b6ff29
When updating the Vault config (and corresponding) configmap, we now generate a checksum of the config and set it as an annotation on both the configmap and the Vault StatefulSet pod template. This allows the deployer to know what pods need to be restarted to pick up the a changed config. We still recommend using the standard upgrade [method for Vault on Kubernetes](https://developer.hashicorp.com/vault/tutorials/kubernetes/kubernetes-raft-deployment-guide#upgrading-vault-on-kubernetes), i.e., using the `OnDelete` strategy for the Vault StatefulSet, so updating the config and doing a `helm upgrade` should not trigger the pods to restart, and then deleting pods one at a time, starting with the standby pods. With `kubectl` and `jq`, you can check check which pods need to be updated by first getting the value of the current configmap checksum: ```shell kubectl get pods -o json | jq -r ".items[] | select(.metadata.annotations.\"config/checksum\" != $(kubectl get configmap vault-config -o json | jq '.metadata.annotations."config/checksum"') ) | .metadata.name" ``` Fixes #748. --------- Co-authored-by: Tom Proctor <tomhjp@users.noreply.github.com>
160 lines
5.4 KiB
Bash
Executable file
160 lines
5.4 KiB
Bash
Executable file
#!/usr/bin/env bats
|
|
|
|
load _helpers
|
|
|
|
@test "server/ConfigMap: enabled by default" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
. | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "true" ]
|
|
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.ha.enabled=true' \
|
|
. | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "true" ]
|
|
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.ha.enabled=true' \
|
|
--set 'server.ha.raft.enabled=true' \
|
|
. | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "true" ]
|
|
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.standalone.enabled=true' \
|
|
. | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "true" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: raft config disabled by default" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.ha.enabled=true' \
|
|
. | tee /dev/stderr |
|
|
grep "raft" | yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" != "true" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: raft config can be enabled" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.ha.enabled=true' \
|
|
--set 'server.ha.raft.enabled=true' \
|
|
. | tee /dev/stderr |
|
|
grep "raft" | yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "true" ]
|
|
}
|
|
|
|
|
|
@test "server/ConfigMap: disabled by server.dev.enabled true" {
|
|
cd `chart_dir`
|
|
local actual=$( (helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.dev.enabled=true' \
|
|
. || echo "---") | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "false" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: disable with global.enabled" {
|
|
cd `chart_dir`
|
|
local actual=$( (helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'global.enabled=false' \
|
|
. || echo "---") | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "false" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: namespace" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--namespace foo \
|
|
. | tee /dev/stderr |
|
|
yq -r '.metadata.namespace' | tee /dev/stderr)
|
|
[ "${actual}" = "foo" ]
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'global.namespace=bar' \
|
|
--namespace foo \
|
|
. | tee /dev/stderr |
|
|
yq -r '.metadata.namespace' | tee /dev/stderr)
|
|
[ "${actual}" = "bar" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: standalone extraConfig is set" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.standalone.enabled=true' \
|
|
--set 'server.standalone.config="{\"hello\": \"world\"}"' \
|
|
. | tee /dev/stderr |
|
|
yq '.data["extraconfig-from-values.hcl"] | match("world") | length' | tee /dev/stderr)
|
|
[ ! -z "${actual}" ]
|
|
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.standalone.enabled=true' \
|
|
--set 'server.standalone.config="{\"foo\": \"bar\"}"' \
|
|
. | tee /dev/stderr |
|
|
yq '.data["extraconfig-from-values.hcl"] | match("bar") | length' | tee /dev/stderr)
|
|
[ ! -z "${actual}" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: ha extraConfig is set" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.ha.enabled=true' \
|
|
--set 'server.ha.config="{\"hello\": \"world\"}"' \
|
|
. | tee /dev/stderr |
|
|
yq '.data["extraconfig-from-values.hcl"] | match("world") | length' | tee /dev/stderr)
|
|
[ ! -z "${actual}" ]
|
|
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.ha.enabled=true' \
|
|
--set 'server.ha.config="{\"foo\": \"bar\"}"' \
|
|
. | tee /dev/stderr |
|
|
yq '.data["extraconfig-from-values.hcl"] | match("bar") | length' | tee /dev/stderr)
|
|
[ ! -z "${actual}" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: disabled by injector.externalVaultAddr" {
|
|
cd `chart_dir`
|
|
local actual=$( (helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'injector.externalVaultAddr=http://vault-outside' \
|
|
. || echo "---") | tee /dev/stderr |
|
|
yq 'length > 0' | tee /dev/stderr)
|
|
[ "${actual}" = "false" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: config checksum annotation defaults to off" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
. | tee /dev/stderr |
|
|
yq '.metadata.annotations["vault.hashicorp.com/config-checksum"] == null' | tee /dev/stderr)
|
|
[ "${actual}" = "true" ]
|
|
}
|
|
|
|
@test "server/ConfigMap: config checksum annotation can be enabled" {
|
|
cd `chart_dir`
|
|
local actual=$(helm template \
|
|
--show-only templates/server-config-configmap.yaml \
|
|
--set 'server.includeConfigAnnotation=true' \
|
|
. | tee /dev/stderr |
|
|
yq '.metadata.annotations["vault.hashicorp.com/config-checksum"] == null' | tee /dev/stderr)
|
|
[ "${actual}" = "false" ]
|
|
}
|