refactor: reduce tls scenarios in kuttl testing

Author: sweb

tests/templates/kuttl/smoke/10-install-zookeeper.yaml.j2

@@ -22,17 +22,15 @@ spec:
 {% endif %}
     pullPolicy: IfNotPresent
   clusterConfig:
-{% if test_scenario['values']['use-server-tls'] == 'true' %}
+{% if test_scenario['values']['use-tls'] == 'true' %}
     tls:
       serverSecretClass: zk-client-secret
+    authentication:
+      - authenticationClass: zk-client-auth-tls
 {% else %}
     tls:
       serverSecretClass: null
 {% endif %}
-{% if test_scenario['values']['use-client-auth-tls'] == 'true' %}
-    authentication:
-      - authenticationClass: zk-client-auth-tls
-{% endif %}
 {% if lookup('env', 'VECTOR_AGGREGATOR') %}
     vectorAggregatorConfigMapName: vector-aggregator-discovery
 {% endif %}
@@ -85,7 +83,7 @@ spec:
                     cpu: 300m
                   limits:
                     cpu: 600m
-{% if test_scenario['values']['use-client-auth-tls'] == 'true' %}
+{% if test_scenario['values']['use-tls'] == 'true' %}
 ---
 apiVersion: authentication.stackable.tech/v1alpha1
 kind: AuthenticationClass
@@ -109,7 +107,7 @@ spec:
           namespace: default
         autoGenerate: true
 {% endif %}
-{% if test_scenario['values']['use-server-tls'] == 'true' %}
+{% if test_scenario['values']['use-tls'] == 'true' %}
 ---
 apiVersion: secrets.stackable.tech/v1alpha1
 kind: SecretClass

tests/templates/kuttl/smoke/13-assert.yaml.j2

@@ -1,7 +1,6 @@
 {# Templating flags used throughout this file. #}
-{% set use_client_tls = test_scenario['values']['use-server-tls'] == 'true'
-                     or test_scenario['values']['use-client-auth-tls'] == 'true' %}
-{% set use_client_auth = test_scenario['values']['use-client-auth-tls'] == 'true' %}
+{% set use_client_tls = test_scenario['values']['use-tls'] == 'true' %}
+{% set use_client_auth = test_scenario['values']['use-tls'] == 'true' %}
 {% set vector_enabled = lookup('env', 'VECTOR_AGGREGATOR') | length > 0 %}
 {% set zk_client_port = 2282 if use_client_tls else 2181 %}
 ---

tests/templates/kuttl/smoke/14-assert.yaml.j2

@@ -1,7 +1,6 @@
 {# Templating flags used throughout this file. #}
-{% set use_client_tls = test_scenario['values']['use-server-tls'] == 'true'
-                     or test_scenario['values']['use-client-auth-tls'] == 'true' %}
-{% set use_client_auth = test_scenario['values']['use-client-auth-tls'] == 'true' %}
+{% set use_client_tls = test_scenario['values']['use-tls'] == 'true' %}
+{% set use_client_auth = test_scenario['values']['use-tls'] == 'true' %}
 {% set zk_client_port = 2282 if use_client_tls else 2181 %}
 ---
 # Snapshot the full `.data` of each operator-managed ConfigMap.

tests/templates/kuttl/smoke/21-assert.yaml.j2

@@ -6,6 +6,6 @@ metadata:
 commands:
   - script: kubectl exec -n $NAMESPACE zk-test-helper-0 -- python /tmp/test_zookeeper.py -n $NAMESPACE
   - script: kubectl exec -n $NAMESPACE test-zk-server-primary-0 --container='zookeeper' -- /tmp/test_heap.sh
-{% if test_scenario['values']['use-client-auth-tls'] == 'true' or test_scenario['values']['use-server-tls'] == 'true' %}
+{% if test_scenario['values']['use-tls'] == 'true' %}
   - script: kubectl exec -n $NAMESPACE test-zk-server-primary-0 --container='zookeeper' -- /tmp/test_tls.sh $NAMESPACE
 {% endif %}

tests/templates/kuttl/smoke/21-prepare-test-zookeeper.yaml.j2

@@ -4,6 +4,6 @@ kind: TestStep
 commands:
   - script: kubectl cp -n $NAMESPACE ./test_zookeeper.py  zk-test-helper-0:/tmp
   - script: kubectl cp -n $NAMESPACE ./test_heap.sh test-zk-server-primary-0:/tmp --container='zookeeper'
-{% if test_scenario['values']['use-client-auth-tls'] == 'true' or test_scenario['values']['use-server-tls'] == 'true' %}
+{% if test_scenario['values']['use-tls'] == 'true' %}
   - script: kubectl cp -n $NAMESPACE ./test_tls.sh test-zk-server-primary-0:/tmp --container='zookeeper'
 {% endif %}

tests/templates/kuttl/smoke/test_tls.sh.j2

@@ -3,7 +3,7 @@
 
 NAMESPACE=$1
 
-{% if test_scenario['values']['use-client-auth-tls'] == 'true' or test_scenario['values']['use-server-tls'] == 'true' %}
+{% if test_scenario['values']['use-tls'] == 'true' %}
 SERVER="test-zk-server.${NAMESPACE}.svc.cluster.local:2282"
 {% else %}
 SERVER="test-zk-server.${NAMESPACE}.svc.cluster.local:2181"

tests/test-definition.yaml

@@ -11,11 +11,13 @@ dimensions:
       - 3.9.5
       # To use a custom image, add a comma and the full name after the product version
       # - x.x.x,oci.stackable.tech/sdp/zookeeper:x.x.x-stackable0.0.0-dev
-  - name: use-server-tls
-    values:
-      - "true"
-      - "false"
-  - name: use-client-auth-tls
+  # A single toggle for the runtime smoke test: "true" enables server TLS *and*
+  # client-auth (mutual) TLS together, "false" disables TLS entirely. The full
+  # use-server-tls x use-client-auth-tls config-text matrix (server-only TLS, the
+  # auth-forces-TLS cross term, port/ssl.* lines) is covered exhaustively by the
+  # Rust unit tests in zk_controller.rs, so the runtime smoke only needs one TLS
+  # run (exercising test_tls.sh's mutual handshake) and one non-TLS run.
+  - name: use-tls
     values:
       - "true"
       - "false"
@@ -26,8 +28,7 @@ tests:
   - name: smoke
     dimensions:
       - zookeeper
-      - use-server-tls
-      - use-client-auth-tls
+      - use-tls
       - openshift
   - name: delete-rolegroup
     dimensions:
@@ -51,9 +52,7 @@ suites:
       - dimensions:
           - name: zookeeper
             expr: last
-          - name: use-server-tls
-            expr: "true"
-          - name: use-client-auth-tls
+          - name: use-tls
             expr: "true"
   - name: smoke-latest
     select:
@@ -68,9 +67,7 @@ suites:
       - dimensions:
           - name: zookeeper
             expr: last
-          - name: use-server-tls
-            expr: "true"
-          - name: use-client-auth-tls
+          - name: use-tls
             expr: "true"
           - name: openshift
             expr: "true"