mirror of
https://gh-proxy.org/https://github.com/klinsmaya/multica.git
synced 2026-11-08 09:26:50 +08:00
Bohan Jiangandmultica-agent
4f5fbc9216
* fix(vcs): report untrusted provider TLS certificates on connect (MUL-7639) ConnectVCS reported every non-token failure as "could not reach the provider instance" and logged nothing, so a Gitea behind a private CA looked like a network problem. Log the underlying validation error and tell certificate failures (untrusted CA, host name mismatch, other verification failures such as expiry) apart from unreachable instances. Status codes are unchanged. Co-authored-by: multica-agent <[email protected]> * feat(helm): trust extra CA certificates in the backend (MUL-7639) backend.extraCACerts.configMap mounts an existing ConfigMap of PEM certificates read-only and points SSL_CERT_DIR at the system directory plus the mount, so the backend trusts an internal CA without dropping public CAs or disabling TLS verification. Unset renders unchanged. Co-authored-by: multica-agent <[email protected]> * docs(self-host): document trusting a private CA (MUL-7639) Co-authored-by: multica-agent <[email protected]> * fix(helm): render when values predate extraCACerts (MUL-7639) helm upgrade --reuse-values from an older chart carries no backend.extraCACerts key, and reading .configMap on it failed the whole render with a nil pointer even when no CA was wanted. Fall back to an empty dict, and cover the missing-key, default and enabled renders in the chart test. Co-authored-by: multica-agent <[email protected]> * docs(self-host): restart Compose backend after replacing a CA (MUL-7639) up -d keeps the running container when only a mounted CA file changed, so the backend kept its old trust store. Use restart instead. Co-authored-by: multica-agent <[email protected]> --------- Co-authored-by: multica-agent <[email protected]>
92 lines
3.3 KiB
Bash
92 lines
3.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
CHART_DIR="$ROOT_DIR/deploy/helm/multica"
|
|
|
|
require_rendered_value() {
|
|
local rendered=$1
|
|
local expected=$2
|
|
|
|
if ! grep -Fq "$expected" <<<"$rendered"; then
|
|
echo "Missing expected Helm-rendered config value:"
|
|
echo " $expected"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
reject_rendered_value() {
|
|
local rendered=$1
|
|
local forbidden=$2
|
|
|
|
if grep -Fq "$forbidden" <<<"$rendered"; then
|
|
echo "Forbidden Helm-rendered config value:"
|
|
echo " $forbidden"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
helm lint "$CHART_DIR"
|
|
|
|
default_config="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/configmap.yaml
|
|
)"
|
|
require_rendered_value "$default_config" 'MULTICA_VCS_INTEGRATION_ENABLED: "true"'
|
|
require_rendered_value "$default_config" 'MULTICA_CLOUD_URL: ""'
|
|
require_rendered_value "$default_config" 'MULTICA_DATABASE_STARTUP_TIMEOUT: "3m"'
|
|
require_rendered_value "$default_config" 'MULTICA_DATABASE_CONNECT_TIMEOUT: "5s"'
|
|
|
|
require_rendered_value "$default_config" 'MAINTENANCE_PORT: ""'
|
|
maintenance_config="$(helm template multica "$CHART_DIR" --show-only templates/configmap.yaml --set-string backend.config.maintenancePort=6061)"
|
|
require_rendered_value "$maintenance_config" 'MAINTENANCE_PORT: "6061"'
|
|
maintenance_backend="$(helm template multica "$CHART_DIR" --show-only templates/backend.yaml --set-string backend.config.maintenancePort=6061)"
|
|
reject_rendered_value "$maintenance_backend" 'containerPort: 6061'
|
|
reject_rendered_value "$maintenance_backend" 'port: 6061'
|
|
|
|
default_backend="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/backend.yaml
|
|
)"
|
|
require_rendered_value "$default_backend" 'failureThreshold: 60'
|
|
liveness_block="$(sed -n '/livenessProbe:/,/resources:/p' <<<"$default_backend")"
|
|
require_rendered_value "$liveness_block" 'path: /health'
|
|
reject_rendered_value "$liveness_block" 'path: /healthz'
|
|
reject_rendered_value "$default_backend" 'SSL_CERT_DIR'
|
|
reject_rendered_value "$default_backend" 'extra-ca-certs'
|
|
|
|
# `helm upgrade --reuse-values` from a chart that predates extraCACerts renders
|
|
# without the key at all; that must still render, with no extra trust.
|
|
legacy_backend="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/backend.yaml \
|
|
--set backend.extraCACerts=null
|
|
)"
|
|
reject_rendered_value "$legacy_backend" 'SSL_CERT_DIR'
|
|
|
|
extra_ca_backend="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/backend.yaml \
|
|
--set backend.extraCACerts.configMap=internal-ca
|
|
)"
|
|
require_rendered_value "$extra_ca_backend" 'value: /etc/ssl/certs:/etc/multica/ca-certs'
|
|
require_rendered_value "$extra_ca_backend" 'mountPath: /etc/multica/ca-certs'
|
|
require_rendered_value "$extra_ca_backend" 'name: internal-ca'
|
|
require_rendered_value "$extra_ca_backend" 'mountPath: /app/data/uploads'
|
|
|
|
disabled_config="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/configmap.yaml \
|
|
--set backend.config.vcsIntegrationEnabled=false
|
|
)"
|
|
require_rendered_value "$disabled_config" 'MULTICA_VCS_INTEGRATION_ENABLED: "false"'
|
|
|
|
capacity_config="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/configmap.yaml \
|
|
--set-string backend.config.cloud.url=https://multica-cloud.internal
|
|
)"
|
|
require_rendered_value "$capacity_config" 'MULTICA_CLOUD_URL: "https://multica-cloud.internal"'
|
|
|
|
echo "helm config rendering ok"
|