65 lines
2.6 KiB
Python
65 lines
2.6 KiB
Python
|
"""Static guards for the kc.coulomb.social production reissue for the NK49 attempt.
|
||
|
|
|
||
|
|
The reissue must never touch the live sso/kc-tls Secret or reuse the live
|
||
|
|
letsencrypt-prod ClusterIssuer/account key. These checks are offline.
|
||
|
|
"""
|
||
|
|
from pathlib import Path
|
||
|
|
import unittest
|
||
|
|
|
||
|
|
import yaml
|
||
|
|
|
||
|
|
ROOT = Path(__file__).parents[1]
|
||
|
|
MANIFEST = ROOT / "install/cert-manager/attempt/kc-le-prod-nk49.yaml"
|
||
|
|
RUNBOOK = ROOT / "docs/keycape-tls-le-prod-nk49-attempt.md"
|
||
|
|
NAMESPACE = "tls-attempt-kc"
|
||
|
|
PRODUCTION = "https://acme-v02.api.letsencrypt.org/directory"
|
||
|
|
|
||
|
|
|
||
|
|
def load():
|
||
|
|
return [d for d in yaml.safe_load_all(MANIFEST.read_text()) if d]
|
||
|
|
|
||
|
|
|
||
|
|
def by_kind(docs, kind):
|
||
|
|
found = [d for d in docs if d["kind"] == kind]
|
||
|
|
assert len(found) == 1, kind
|
||
|
|
return found[0]
|
||
|
|
|
||
|
|
|
||
|
|
class ProductionAttemptManifest(unittest.TestCase):
|
||
|
|
def setUp(self):
|
||
|
|
self.docs = load()
|
||
|
|
|
||
|
|
def test_only_expected_kinds_no_cluster_scope_no_secrets(self):
|
||
|
|
self.assertEqual(sorted(d["kind"] for d in self.docs), ["Certificate", "Issuer", "Namespace"])
|
||
|
|
|
||
|
|
def test_everything_is_in_the_throwaway_namespace(self):
|
||
|
|
self.assertEqual(by_kind(self.docs, "Namespace")["metadata"]["name"], NAMESPACE)
|
||
|
|
for doc in self.docs:
|
||
|
|
if doc["kind"] != "Namespace":
|
||
|
|
self.assertEqual(doc["metadata"]["namespace"], NAMESPACE)
|
||
|
|
self.assertNotIn("namespace: sso", MANIFEST.read_text())
|
||
|
|
|
||
|
|
def test_issuer_is_production_with_its_own_account_key(self):
|
||
|
|
acme = by_kind(self.docs, "Issuer")["spec"]["acme"]
|
||
|
|
self.assertEqual(acme["server"], PRODUCTION)
|
||
|
|
self.assertNotIn("staging", yaml.safe_dump(self.docs))
|
||
|
|
self.assertNotEqual(acme["privateKeySecretRef"]["name"], "letsencrypt-prod-account-key")
|
||
|
|
self.assertEqual(acme["solvers"], [{"http01": {"ingress": {"ingressClassName": "traefik"}}}])
|
||
|
|
|
||
|
|
def test_certificate_cannot_overwrite_live_secret(self):
|
||
|
|
spec = by_kind(self.docs, "Certificate")["spec"]
|
||
|
|
self.assertNotEqual(spec["secretName"], "kc-tls")
|
||
|
|
self.assertEqual(spec["dnsNames"], ["kc.coulomb.social"])
|
||
|
|
issuer = by_kind(self.docs, "Issuer")["metadata"]["name"]
|
||
|
|
self.assertEqual(spec["issuerRef"], {"group": "cert-manager.io", "kind": "Issuer", "name": issuer})
|
||
|
|
|
||
|
|
def test_runbook_names_manifest_cleanup_and_root(self):
|
||
|
|
text = RUNBOOK.read_text()
|
||
|
|
self.assertIn("install/cert-manager/attempt/kc-le-prod-nk49.yaml", text)
|
||
|
|
self.assertIn(f"kubectl delete namespace {NAMESPACE}", text)
|
||
|
|
self.assertIn("22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1", text)
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|