mirror of https://github.com/synctv-org/synctv
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
69 lines
2.4 KiB
Bash
69 lines
2.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$repo_root"
|
|
|
|
chart_dir="${SYNCTV_HELM_CHART_DIR:-helm/synctv}"
|
|
namespace="${SYNCTV_HELM_TEST_NAMESPACE:-synctv-secret-bootstrap-test}"
|
|
release="${SYNCTV_HELM_TEST_RELEASE:-synctv-bootstrap-test}"
|
|
secret_name="${release}-secrets"
|
|
stable_key="SYNCTV_JWT_SECRET"
|
|
managed_security_keys=(
|
|
SYNCTV_SECURITY_CREDENTIAL_ENCRYPTION_KEY
|
|
SYNCTV_SECURITY_TOTP_ENCRYPTION_KEY
|
|
SYNCTV_SECURITY_EMAIL_OUTBOX_ENCRYPTION_KEY
|
|
SYNCTV_SECURITY_OPAQUE_SERVER_SETUP_SECRET
|
|
SYNCTV_SECURITY_PROXY_SIGNING_KEY
|
|
SYNCTV_SECURITY_MEDIA_SWARM_SIGNING_KEY
|
|
SYNCTV_SECURITY_PROVIDER_SESSION_ENCRYPTION_KEY
|
|
SYNCTV_SECURITY_LOGIN_DISCOVERY_KEY
|
|
SYNCTV_SECURITY_WEBAUTHN_ENUMERATION_KEY
|
|
SYNCTV_FILE_UPLOAD_TOKEN_SECRET
|
|
)
|
|
|
|
cleanup() {
|
|
helm uninstall "$release" --namespace "$namespace" >/dev/null 2>&1 || true
|
|
kubectl delete namespace "$namespace" --wait=true --timeout=60s >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
cleanup
|
|
kubectl create namespace "$namespace" >/dev/null
|
|
|
|
helm install "$release" "$chart_dir" \
|
|
--namespace "$namespace" \
|
|
--timeout 5m \
|
|
--set postgresql.mode=external \
|
|
--set postgresql.external.host=postgres.invalid \
|
|
--set-string secrets.database.password=kind-test-database-password \
|
|
--set redis.mode=external \
|
|
--set redis.external.host=redis.invalid >/dev/null
|
|
|
|
stable_before="$(kubectl get secret "$secret_name" --namespace "$namespace" -o "jsonpath={.data.$stable_key}")"
|
|
test -n "$stable_before"
|
|
for key in "${managed_security_keys[@]}"; do
|
|
kubectl patch secret "$secret_name" \
|
|
--namespace "$namespace" \
|
|
--type=json \
|
|
-p="[{\"op\":\"remove\",\"path\":\"/data/$key\"}]" >/dev/null
|
|
done
|
|
|
|
helm upgrade "$release" "$chart_dir" \
|
|
--namespace "$namespace" \
|
|
--timeout 5m \
|
|
--set postgresql.mode=external \
|
|
--set postgresql.external.host=postgres.invalid \
|
|
--set-string secrets.database.password=kind-test-database-password \
|
|
--set redis.mode=external \
|
|
--set redis.external.host=redis.invalid >/dev/null
|
|
|
|
stable_after="$(kubectl get secret "$secret_name" --namespace "$namespace" -o "jsonpath={.data.$stable_key}")"
|
|
test "$stable_before" = "$stable_after"
|
|
for key in "${managed_security_keys[@]}"; do
|
|
reconciled="$(kubectl get secret "$secret_name" --namespace "$namespace" -o "jsonpath={.data.$key}")"
|
|
test -n "$reconciled"
|
|
done
|
|
|
|
echo "Helm Secret bootstrap upgrade test passed."
|