wip amend integration tests

Author: labrenbe

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -215,7 +215,10 @@ impl<'a> RoleGroupBuilder<'a> {
     /// Builds the [`PodTemplateSpec`] for the role-group [`StatefulSet`]
     fn build_pod_template(&self) -> PodTemplateSpec {
         let mut node_role_labels = Labels::new();
-        let service_scopes = vec![self.resource_names.headless_service_name()];
+        let service_scopes = vec![
+            self.resource_names.cluster_name.to_string(),
+            self.resource_names.headless_service_name().to_string(),
+        ];
 
         for node_role in self.role_group_config.config.node_roles.iter() {
             node_role_labels.insert(Self::build_node_role_label(node_role));
@@ -261,8 +264,6 @@ impl<'a> RoleGroupBuilder<'a> {
                 self.resource_names.role_group_config_map()
             };
 
-        let requested_secret_lifetime = self.role_group_config.config.requested_secret_lifetime;
-
         let mut volumes = vec![
             Volume {
                 name: CONFIG_VOLUME_NAME.to_string(),
@@ -300,7 +301,7 @@ impl<'a> RoleGroupBuilder<'a> {
                 tls_secret_class_name,
                 service_scopes,
                 SecretFormat::TlsPem,
-                &requested_secret_lifetime,
+                &self.role_group_config.config.requested_secret_lifetime,
                 Some(&LISTENER_VOLUME_NAME.to_string()),
             ))
         };

tests/templates/kuttl/smoke/10-assert.yaml.j2

@@ -656,13 +656,13 @@ data:
     plugins.security.allow_default_init_securityindex: "true"
     plugins.security.nodes_dn: ["CN=generated certificate for pod"]
     plugins.security.ssl.http.enabled: "true"
-    plugins.security.ssl.http.pemcert_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt"
-    plugins.security.ssl.http.pemkey_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key"
-    plugins.security.ssl.http.pemtrustedcas_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt"
+    plugins.security.ssl.http.pemcert_filepath: "/stackable/tls/tls.crt"
+    plugins.security.ssl.http.pemkey_filepath: "/stackable/tls/tls.key"
+    plugins.security.ssl.http.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
     plugins.security.ssl.transport.enabled: "true"
-    plugins.security.ssl.transport.pemcert_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt"
-    plugins.security.ssl.transport.pemkey_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key"
-    plugins.security.ssl.transport.pemtrustedcas_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt"
+    plugins.security.ssl.transport.pemcert_filepath: "/stackable/tls/tls.crt"
+    plugins.security.ssl.transport.pemkey_filepath: "/stackable/tls/tls.key"
+    plugins.security.ssl.transport.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -691,13 +691,13 @@ data:
     plugins.security.allow_default_init_securityindex: "true"
     plugins.security.nodes_dn: ["CN=generated certificate for pod"]
     plugins.security.ssl.http.enabled: "true"
-    plugins.security.ssl.http.pemcert_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt"
-    plugins.security.ssl.http.pemkey_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key"
-    plugins.security.ssl.http.pemtrustedcas_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt"
+    plugins.security.ssl.http.pemcert_filepath: "/stackable/tls/tls.crt"
+    plugins.security.ssl.http.pemkey_filepath: "/stackable/tls/tls.key"
+    plugins.security.ssl.http.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
     plugins.security.ssl.transport.enabled: "true"
-    plugins.security.ssl.transport.pemcert_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt"
-    plugins.security.ssl.transport.pemkey_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key"
-    plugins.security.ssl.transport.pemtrustedcas_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt"
+    plugins.security.ssl.transport.pemcert_filepath: "/stackable/tls/tls.crt"
+    plugins.security.ssl.transport.pemkey_filepath: "/stackable/tls/tls.key"
+    plugins.security.ssl.transport.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
 ---
 apiVersion: v1
 kind: Service

tests/templates/kuttl/smoke/10-install-opensearch.yaml.j2

@@ -12,8 +12,10 @@ spec:
     productVersion: "{{ test_scenario['values']['opensearch'] }}"
 {% endif %}
     pullPolicy: IfNotPresent
-{% if lookup('env', 'VECTOR_AGGREGATOR') %}
   clusterConfig:
+    tls:
+      secretClass: tls
+{% if lookup('env', 'VECTOR_AGGREGATOR') %}
     vectorAggregatorConfigMapName: vector-aggregator-discovery
 {% endif %}
   nodes:
@@ -31,15 +33,6 @@ spec:
                 capacity: 100Mi
           listenerClass: external-stable
         replicas: 3
-        podOverrides:
-          spec:
-            volumes:
-              - name: tls
-                ephemeral:
-                  volumeClaimTemplate:
-                    metadata:
-                      annotations:
-                        secrets.stackable.tech/scope: node,pod,service=opensearch,service=opensearch-nodes-cluster-manager-headless
       data:
         config:
           nodeRoles:
@@ -52,15 +45,6 @@ spec:
                 capacity: 2Gi
           listenerClass: cluster-internal
         replicas: 2
-        podOverrides:
-          spec:
-            volumes:
-              - name: tls
-                ephemeral:
-                  volumeClaimTemplate:
-                    metadata:
-                      annotations:
-                        secrets.stackable.tech/scope: node,pod,service=opensearch-nodes-data-headless
     envOverrides:
       # Only required for the official image
       # The official image (built with https://github.com/opensearch-project/opensearch-build)
@@ -78,14 +62,6 @@ spec:
         # not be created even if enough disk space would be available.
         cluster.routing.allocation.disk.threshold_enabled: "false"
         plugins.security.allow_default_init_securityindex: "true"
-        plugins.security.ssl.transport.enabled: "true"
-        plugins.security.ssl.transport.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
-        plugins.security.ssl.transport.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
-        plugins.security.ssl.transport.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
-        plugins.security.ssl.http.enabled: "true"
-        plugins.security.ssl.http.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.crt
-        plugins.security.ssl.http.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/tls.key
-        plugins.security.ssl.http.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/ca.crt
     podOverrides:
       spec:
         containers:
@@ -94,27 +70,11 @@ spec:
               - name: security-config
                 mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/opensearch-security
                 readOnly: true
-              - name: tls
-                mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/tls
-                readOnly: true
         volumes:
           - name: security-config
             secret:
               secretName: opensearch-security-config
               defaultMode: 0o660
-          - name: tls
-            ephemeral:
-              volumeClaimTemplate:
-                metadata:
-                  annotations:
-                    secrets.stackable.tech/class: tls
-                spec:
-                  storageClassName: secrets.stackable.tech
-                  accessModes:
-                    - ReadWriteOnce
-                  resources:
-                    requests:
-                      storage: "1"
 ---
 apiVersion: v1
 kind: Secret