@@ -855,33 +855,19 @@ spec:
855855 })
856856
857857 It ("should mount TLS certificates in controller deployment" , func () {
858- By ("waiting for controller deployment to be available" )
858+ By ("waiting for controller deployment to be available with TLS mount " )
859859 controllerDeploymentName := jumpstarterName + "-controller"
860860 Eventually (func (g Gomega ) {
861- deployment := & appsv1.Deployment {}
862- err := k8sClient .Get (ctx , types.NamespacedName {
863- Name : controllerDeploymentName ,
864- Namespace : certManagerTestNamespace ,
865- }, deployment )
866- g .Expect (err ).NotTo (HaveOccurred ())
867- }, 2 * time .Minute ).Should (Succeed ())
868-
869- verifyDeploymentHasTLSMount (certManagerTestNamespace , controllerDeploymentName )
861+ verifyDeploymentHasTLSMount (g , certManagerTestNamespace , controllerDeploymentName )
862+ }, 2 * time .Minute , 2 * time .Second ).Should (Succeed ())
870863 })
871864
872865 It ("should mount TLS certificates in router deployment" , func () {
873- By ("waiting for router deployment to be available" )
866+ By ("waiting for router deployment to be available with TLS mount " )
874867 routerDeploymentName := jumpstarterName + "-router-0"
875868 Eventually (func (g Gomega ) {
876- deployment := & appsv1.Deployment {}
877- err := k8sClient .Get (ctx , types.NamespacedName {
878- Name : routerDeploymentName ,
879- Namespace : certManagerTestNamespace ,
880- }, deployment )
881- g .Expect (err ).NotTo (HaveOccurred ())
882- }, 2 * time .Minute ).Should (Succeed ())
883-
884- verifyDeploymentHasTLSMount (certManagerTestNamespace , routerDeploymentName )
869+ verifyDeploymentHasTLSMount (g , certManagerTestNamespace , routerDeploymentName )
870+ }, 2 * time .Minute , 2 * time .Second ).Should (Succeed ())
885871 })
886872
887873 It ("should report CertManagerAvailable condition as True" , func () {
@@ -940,6 +926,86 @@ spec:
940926 }
941927 })
942928
929+ It ("should preserve certificates when cert-manager is disabled and re-enabled" , func () {
930+ By ("starting with cert-manager enabled and verifying TLS is configured" )
931+ controllerDeploymentName := jumpstarterName + "-controller"
932+ routerDeploymentName := jumpstarterName + "-router-0"
933+ controllerCertName := jumpstarterName + "-controller-tls"
934+ routerCertName := fmt .Sprintf ("%s-router-0-tls" , jumpstarterName )
935+ issuerNames := []string {
936+ jumpstarterName + "-selfsigned-issuer" ,
937+ jumpstarterName + "-ca-issuer" ,
938+ }
939+
940+ // Verify initial state has TLS configured
941+ Eventually (func (g Gomega ) {
942+ verifyDeploymentHasTLSMount (g , certManagerTestNamespace , controllerDeploymentName )
943+ verifyDeploymentHasTLSMount (g , certManagerTestNamespace , routerDeploymentName )
944+ }, 1 * time .Minute , 2 * time .Second ).Should (Succeed ())
945+
946+ By ("disabling cert-manager" )
947+ jumpstarter := & operatorv1alpha1.Jumpstarter {}
948+ err := k8sClient .Get (ctx , types.NamespacedName {
949+ Name : jumpstarterName ,
950+ Namespace : certManagerTestNamespace ,
951+ }, jumpstarter )
952+ Expect (err ).NotTo (HaveOccurred ())
953+
954+ jumpstarter .Spec .CertManager .Enabled = false
955+ err = k8sClient .Update (ctx , jumpstarter )
956+ Expect (err ).NotTo (HaveOccurred ())
957+
958+ By ("waiting for and verifying deployments are reconciled WITHOUT TLS configuration" )
959+ Eventually (func (g Gomega ) {
960+ verifyDeploymentHasNoTLSMount (g , certManagerTestNamespace , controllerDeploymentName )
961+ verifyDeploymentHasNoTLSMount (g , certManagerTestNamespace , routerDeploymentName )
962+ }, 2 * time .Minute , 2 * time .Second ).Should (Succeed ())
963+
964+ By ("verifying Certificate and Issuer resources still exist (not deleted)" )
965+ cert := & certmanagerv1.Certificate {}
966+ err = k8sClient .Get (ctx , types.NamespacedName {
967+ Name : controllerCertName ,
968+ Namespace : certManagerTestNamespace ,
969+ }, cert )
970+ Expect (err ).NotTo (HaveOccurred (), "Controller certificate should still exist" )
971+
972+ err = k8sClient .Get (ctx , types.NamespacedName {
973+ Name : routerCertName ,
974+ Namespace : certManagerTestNamespace ,
975+ }, cert )
976+ Expect (err ).NotTo (HaveOccurred (), "Router certificate should still exist" )
977+
978+ for _ , issuerName := range issuerNames {
979+ issuer := & certmanagerv1.Issuer {}
980+ err = k8sClient .Get (ctx , types.NamespacedName {
981+ Name : issuerName ,
982+ Namespace : certManagerTestNamespace ,
983+ }, issuer )
984+ Expect (err ).NotTo (HaveOccurred (), fmt .Sprintf ("Issuer %s should still exist" , issuerName ))
985+ }
986+
987+ By ("re-enabling cert-manager" )
988+ err = k8sClient .Get (ctx , types.NamespacedName {
989+ Name : jumpstarterName ,
990+ Namespace : certManagerTestNamespace ,
991+ }, jumpstarter )
992+ Expect (err ).NotTo (HaveOccurred ())
993+
994+ jumpstarter .Spec .CertManager .Enabled = true
995+ err = k8sClient .Update (ctx , jumpstarter )
996+ Expect (err ).NotTo (HaveOccurred ())
997+
998+ By ("verifying deployments are reconciled WITH TLS configuration again" )
999+ Eventually (func (g Gomega ) {
1000+ verifyDeploymentHasTLSMount (g , certManagerTestNamespace , controllerDeploymentName )
1001+ verifyDeploymentHasTLSMount (g , certManagerTestNamespace , routerDeploymentName )
1002+ }, 2 * time .Minute , 2 * time .Second ).Should (Succeed ())
1003+
1004+ By ("verifying system is ready with certificates" )
1005+ waitForCondition (certManagerTestNamespace , jumpstarterName ,
1006+ operatorv1alpha1 .ConditionTypeReady , metav1 .ConditionTrue , 3 * time .Minute )
1007+ })
1008+
9431009 AfterAll (func () {
9441010 DeleteTestNamespace (certManagerTestNamespace )
9451011 })
@@ -1368,15 +1434,14 @@ func verifyTLSSecret(namespace, name string) {
13681434}
13691435
13701436// verifyDeploymentHasTLSMount checks that a deployment has the TLS volume mount and env vars.
1371- func verifyDeploymentHasTLSMount (namespace , name string ) {
1372- By (fmt .Sprintf ("verifying deployment %s has TLS mount" , name ))
1373-
1437+ // This is used with Gomega assertions to verify the deployment has been reconciled with TLS.
1438+ func verifyDeploymentHasTLSMount (g Gomega , namespace , name string ) {
13741439 deployment := & appsv1.Deployment {}
13751440 err := k8sClient .Get (ctx , types.NamespacedName {
13761441 Name : name ,
13771442 Namespace : namespace ,
13781443 }, deployment )
1379- Expect (err ).NotTo (HaveOccurred ())
1444+ g . Expect (err ).NotTo (HaveOccurred ())
13801445
13811446 // Check for tls-certs volume
13821447 hasVolume := false
@@ -1386,10 +1451,10 @@ func verifyDeploymentHasTLSMount(namespace, name string) {
13861451 break
13871452 }
13881453 }
1389- Expect (hasVolume ).To (BeTrue (), fmt .Sprintf ("deployment %s missing tls-certs volume" , name ))
1454+ g . Expect (hasVolume ).To (BeTrue (), fmt .Sprintf ("deployment %s missing tls-certs volume" , name ))
13901455
13911456 // Check for volume mount in the first container
1392- Expect (deployment .Spec .Template .Spec .Containers ).NotTo (BeEmpty ())
1457+ g . Expect (deployment .Spec .Template .Spec .Containers ).NotTo (BeEmpty ())
13931458 container := deployment .Spec .Template .Spec .Containers [0 ]
13941459
13951460 hasMount := false
@@ -1399,7 +1464,7 @@ func verifyDeploymentHasTLSMount(namespace, name string) {
13991464 break
14001465 }
14011466 }
1402- Expect (hasMount ).To (BeTrue (), fmt .Sprintf ("deployment %s missing /tls volume mount" , name ))
1467+ g . Expect (hasMount ).To (BeTrue (), fmt .Sprintf ("deployment %s missing /tls volume mount" , name ))
14031468
14041469 // Check for EXTERNAL_CERT_PEM and EXTERNAL_KEY_PEM env vars
14051470 hasCertEnv := false
@@ -1412,8 +1477,45 @@ func verifyDeploymentHasTLSMount(namespace, name string) {
14121477 hasKeyEnv = true
14131478 }
14141479 }
1415- Expect (hasCertEnv ).To (BeTrue (), fmt .Sprintf ("deployment %s missing EXTERNAL_CERT_PEM env var" , name ))
1416- Expect (hasKeyEnv ).To (BeTrue (), fmt .Sprintf ("deployment %s missing EXTERNAL_KEY_PEM env var" , name ))
1480+ g .Expect (hasCertEnv ).To (BeTrue (), fmt .Sprintf ("deployment %s missing EXTERNAL_CERT_PEM env var" , name ))
1481+ g .Expect (hasKeyEnv ).To (BeTrue (), fmt .Sprintf ("deployment %s missing EXTERNAL_KEY_PEM env var" , name ))
1482+ }
1483+
1484+ // verifyDeploymentHasNoTLSMount checks that a deployment does NOT have TLS configuration.
1485+ // This is used with Gomega assertions to verify the deployment has been reconciled without TLS.
1486+ func verifyDeploymentHasNoTLSMount (g Gomega , namespace , name string ) {
1487+ deployment := & appsv1.Deployment {}
1488+ err := k8sClient .Get (ctx , types.NamespacedName {
1489+ Name : name ,
1490+ Namespace : namespace ,
1491+ }, deployment )
1492+ g .Expect (err ).NotTo (HaveOccurred ())
1493+
1494+ // Check that tls-certs volume is NOT present
1495+ for _ , vol := range deployment .Spec .Template .Spec .Volumes {
1496+ g .Expect (vol .Name ).NotTo (Equal ("tls-certs" ),
1497+ fmt .Sprintf ("deployment %s should not have tls-certs volume" , name ))
1498+ }
1499+
1500+ // Check for volume mount in the first container
1501+ g .Expect (deployment .Spec .Template .Spec .Containers ).NotTo (BeEmpty ())
1502+ container := deployment .Spec .Template .Spec .Containers [0 ]
1503+
1504+ // Check that /tls volume mount is NOT present
1505+ for _ , mount := range container .VolumeMounts {
1506+ if mount .Name == "tls-certs" {
1507+ g .Expect (mount .MountPath ).NotTo (Equal ("/tls" ),
1508+ fmt .Sprintf ("deployment %s should not have /tls volume mount" , name ))
1509+ }
1510+ }
1511+
1512+ // Check that EXTERNAL_CERT_PEM and EXTERNAL_KEY_PEM env vars are NOT present
1513+ for _ , env := range container .Env {
1514+ g .Expect (env .Name ).NotTo (Equal ("EXTERNAL_CERT_PEM" ),
1515+ fmt .Sprintf ("deployment %s should not have EXTERNAL_CERT_PEM env var" , name ))
1516+ g .Expect (env .Name ).NotTo (Equal ("EXTERNAL_KEY_PEM" ),
1517+ fmt .Sprintf ("deployment %s should not have EXTERNAL_KEY_PEM env var" , name ))
1518+ }
14171519}
14181520
14191521// dumpCertManagerResourcesOnFailure dumps cert-manager and Jumpstarter resources for debugging test failures.
0 commit comments