From 5b84d1ab04c50ecef47f4ed04be74cbdbcb7411d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Manciot?= Date: Thu, 20 Aug 2026 17:44:07 +0200 Subject: [PATCH] chore(chart): appVersion 0.3.0, chart 0.3.6 + retire the licence public-key value (#57) Fifth repo in the 0.3.0 train. The chart depends on arrow, not jdbc, so it can land while the jdbc release finishes. Chart.yaml version 0.3.5 -> 0.3.6 Chart.yaml appVersion 0.2.5 -> 0.3.0 workflow IMAGE_TAG 0.2.5 -> 0.3.0 7 golden renders regenerated IMAGE_TAG is the surface whose own comment records it going stale on the 0.2.2 train and again on 0.2.4. Moved here in the same commit as appVersion. All five images verified published on DockerHub at 0.3.0 before appVersion moved -- the federation image and all four softclient4es{6,7,8,9}-arrow-flight-sql sidecars -- because a Chart.yaml pointing at a tag that does not exist breaks every install. BREAKING, and the reason this is more than a version bump: extensions 0.3.0 embeds the licence trust root, so SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted. The chart set that variable from license.publicKeySecretName, and the docs recommended it as THE remedy for "Unknown key ID". Left alone, the chart would have kept advertising a knob that silently does nothing. The env block is gone and the value now ABORTS the render with an actionable message, rather than being deleted: Helm ignores unknown --set keys, so removing the key outright would have been just as silent as leaving it. A value that used to decide HOW a licence is verified has to fail loudly. Who is affected: nobody holding a licence issued by the SoftClient4ES licence server -- that verifies against the embedded root with no configuration, air-gapped included, so the value was always redundant for them. Only a non-production-signed JWT breaks, and those operators now find out at "helm upgrade" instead of via CrashLoopBackOff. CI: SC4ES_TEST_PUBLIC_KEY is gone (6 references). Note that two of them were "--set license.publicKeySecretName=sc4es-license", which the new guard would have aborted -- the Pro-tier install and upgrade jobs would have failed had the workflow not moved with the chart. The Pro gate now needs one secret, and SC4ES_PRO_TEST_JWT must hold a licence-server-issued JWT. New CI gate asserts the guard fires AND that the abort still names the value (an abort whose text drifted generic leaves an operator with nothing to act on), plus that no committed values file renders the variable. Verified: helm lint clean; all 7 goldens match a fresh render; the golden diff is label/tag/checksum only, no structural change; zero kind:Secret preserved; three-region and heterogeneous-ready still byte-identical; kubeconform 3/3 valid; the guard aborts with the right message; the normal Pro path (license.secretName alone) still renders and still injects SOFTCLIENT4ES_LICENSE_KEY; workflow YAML parses. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/federation-helm.yml | 82 ++++++++++++------- softclient4es-federation/Chart.yaml | 20 ++++- softclient4es-federation/README.md | 23 +++--- .../docs/operator-guide.md | 4 +- .../examples/three-region/README.md | 8 +- .../templates/deployment.yaml | 22 ++--- .../tests/golden/default.yaml | 18 ++-- .../golden/example-heterogeneous-ready.yaml | 70 ++++++++-------- .../tests/golden/example-single-cluster.yaml | 42 +++++----- .../tests/golden/example-three-region.yaml | 70 ++++++++-------- .../tests/golden/ingress-tls.yaml | 46 +++++------ .../tests/golden/secret-auth.yaml | 42 +++++----- .../tests/golden/two-sidecars.yaml | 56 ++++++------- softclient4es-federation/values.yaml | 19 +++-- 14 files changed, 277 insertions(+), 245 deletions(-) diff --git a/.github/workflows/federation-helm.yml b/.github/workflows/federation-helm.yml index 7a02490..69d28a1 100644 --- a/.github/workflows/federation-helm.yml +++ b/.github/workflows/federation-helm.yml @@ -20,12 +20,13 @@ # SKIPPED WITH A `::warning::` ANNOTATION (not failed). All static-validation gates run # UNCONDITIONALLY on every PR with zero external deps. # -# LICENSE: the multi-sidecar (Pro) tiers are BEST-EFFORT, gated on TWO repo secrets -# together (skip-not-fail if either missing), on top of image availability: (1) secret -# SC4ES_PRO_TEST_JWT, (2) secret SC4ES_TEST_PUBLIC_KEY (injected as -# SOFTCLIENT4ES_LICENSE_PUBLIC_KEY so the verifier resolves the test kid OFFLINE). The -# published federation image must itself be Pro-capable (JWT-verifying SPI on classpath, -# Story 16.1 OQ-5) for the Pro JWT to verify — an OSS-only image falls back to Community. +# LICENSE: the multi-sidecar (Pro) tiers are BEST-EFFORT, gated on ONE repo secret +# (skip-not-fail if missing), on top of image availability: SC4ES_PRO_TEST_JWT. As of +# appVersion 0.3.0 the trust root is embedded in the image, so the JWT must be ISSUED BY +# THE SOFTCLIENT4ES LICENCE SERVER — a self-signed test JWT can no longer be made to +# verify by supplying its public key, and SC4ES_TEST_PUBLIC_KEY is gone. The published +# federation image must itself be Pro-capable (JWT-verifying SPI on classpath, Story 16.1 +# OQ-5) for the Pro JWT to verify — an OSS-only image falls back to Community. # single-cluster + per-ES-version + secret backends + uninstall + ALL static gates are # license-free and run unconditionally (when the images are published). name: Federation Helm Chart @@ -63,7 +64,7 @@ env: # public DockerHub tags at this version so the chart DEFAULTS resolve the kind-loaded images. # MUST match Chart.yaml appVersion — stale on the 0.2.2 train, reconciled on 0.2.3, # stale again on 0.2.4 (the chart bumped, this did not), reconciled on 0.2.5. - IMAGE_TAG: '0.2.5' + IMAGE_TAG: '0.3.0' FED_IMAGE: softnetwork/softclient4es-federation SIDECAR_IMAGE_PREFIX: softnetwork/softclient4es # softclient4es-arrow-flight-sql # A pre-baked ADBC client image avoids the smoke Job's runtime pip install (air-gap). When @@ -138,6 +139,28 @@ jobs: run: | n=$(helm template fed "${CHART_DIR}" | grep -c '^kind: Secret' || true) [ "$n" = "0" ] || { echo "::error::chart must NOT render a kind:Secret (got $n)"; exit 1; } + - name: assert the removed licence public-key value fails LOUDLY (appVersion 0.3.0) + run: | + # The trust root is embedded in the image, so SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is + # ignored. A value that used to decide HOW a licence is verified must not decay into a + # silent no-op, so the chart aborts the render instead. Both halves are asserted: that + # it fails, and that the message still NAMES the value — an abort whose text drifted + # into something generic would leave an operator with no idea what to remove. + if out=$(helm template fed "${CHART_DIR}" --set license.publicKeySecretName=x 2>&1); then + echo "::error::chart rendered with license.publicKeySecretName set — the guard is gone" + exit 1 + fi + case "$out" in + *license.publicKeySecretName*is\ no\ longer\ supported*) : ;; + *) echo "::error::render aborted, but not with the actionable guard message:"; echo "$out"; exit 1 ;; + esac + # And the variable must appear in NO rendered manifest, under any committed values. + for f in "${CHART_DIR}/tests/values"/*.yaml "${CHART_DIR}/examples"/*/values.yaml; do + [ -f "$f" ] || continue + if helm template fed "${CHART_DIR}" -f "$f" | grep -q 'SOFTCLIENT4ES_LICENSE_PUBLIC_KEY'; then + echo "::error::$f still renders SOFTCLIENT4ES_LICENSE_PUBLIC_KEY"; exit 1 + fi + done - name: heterogeneous-ready discriminator (16.4 A2b — only signal vs three-region) run: | # three-region and heterogeneous-ready goldens are BYTE-IDENTICAL by design (Helm @@ -225,13 +248,13 @@ jobs: - name: Skip multi-sidecar install when no Pro test license (FACT C + FACT F, best-effort tier) id: lic if: ${{ matrix.license && steps.guard.outputs.skip != 'true' }} - # The 3-sidecar tier needs BOTH: a Pro test JWT and its public verification key (so the - # verifier resolves the test kid OFFLINE). Missing EITHER → SKIP (annotation), never fail. - # (The published federation image must itself be Pro-capable — 16.1 OQ-5 — for the JWT to - # verify; an OSS-only image silently falls back to Community and CrashLoops at 3 clusters.) + # The 3-sidecar tier needs a licence-server-issued Pro JWT. Missing → SKIP (annotation), + # never fail. (The published federation image must itself be Pro-capable — 16.1 OQ-5 — for + # the JWT to verify; an OSS-only image silently falls back to Community and CrashLoops at + # 3 clusters.) run: | - if [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ] || [ -z "${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" ]; then - echo "::warning::missing SC4ES_PRO_TEST_JWT and/or SC4ES_TEST_PUBLIC_KEY — ${{ matrix.example }} (3 sidecars) needs a Pro JWT + its public key (FACT F #2); skipping (best-effort)" + if [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ]; then + echo "::warning::missing SC4ES_PRO_TEST_JWT — ${{ matrix.example }} (3 sidecars) needs a licence-server-issued Pro JWT; skipping (best-effort)" echo "skip=true" >> "$GITHUB_OUTPUT" fi - name: Set up Helm @@ -258,30 +281,28 @@ jobs: - name: Deploy ES container(s) per sidecar (FACT D — reachable ES required) if: ${{ steps.guard.outputs.skip != 'true' && steps.lic.outputs.skip != 'true' }} run: ./.github/scripts/deploy-es.sh "${{ matrix.example }}" '${{ matrix.es }}' - - name: Create Pro license + public-key Secret (multi-sidecar only — FACT F #2) + - name: Create Pro license Secret (multi-sidecar only) if: ${{ matrix.license && steps.guard.outputs.skip != 'true' && steps.lic.outputs.skip != 'true' }} run: | - # ONE Secret carries both the JWT (license-key) and the public verification JWK - # (license-public-key → SOFTCLIENT4ES_LICENSE_PUBLIC_KEY, the air-gap path in - # LicenseKeyVerifier.loadPublicKey Step 3 — without it the test kid never resolves). + # JWT only. The verification key is embedded in the image as of appVersion 0.3.0, so + # there is no public-key half to supply any more. kubectl create secret generic sc4es-license \ - --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" \ - --from-literal=license-public-key="${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" + --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" # The three-region example pins per-region license.secretName=sc4es-pro-license; also # create that name so its bearer-auth sidecars + the federation share the test token. kubectl create secret generic sc4es-pro-license \ - --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" \ - --from-literal=license-public-key="${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" || true + --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" || true - name: helm install if: ${{ steps.guard.outputs.skip != 'true' && steps.lic.outputs.skip != 'true' }} run: | # The example values point sidecars[].elasticsearch.url at external https://*.example.com # placeholders. deploy-es.sh stands up in-cluster ES Services; override each URL to the - # matching plaintext in-cluster Service. license/public-key are pointed at sc4es-license - # for the multi-sidecar tier. + # matching plaintext in-cluster Service. The licence Secret is pointed at sc4es-license + # for the multi-sidecar tier. NOTE: --set license.publicKeySecretName would now ABORT + # the render by design (the chart fails on it as of appVersion 0.3.0). extra="" if [ "${{ matrix.license }}" = "true" ]; then - extra="--set license.secretName=sc4es-license --set license.publicKeySecretName=sc4es-license" + extra="--set license.secretName=sc4es-license" fi # The three-region/heterogeneous examples set sidecars[].auth.method=bearer pointing at # per-region sc4es-arrow-* Secrets that this CI does NOT create (the dedicated @@ -447,12 +468,12 @@ jobs: run: sudo sysctl -w vm.max_map_count=262144 - name: Skip if examples missing or no Pro test license (FACT C + FACT F) id: guard - # Upgrade ends at 3 clusters → same Pro gate as install-topology: JWT secret AND - # public-key secret (+ the published image must be Pro-capable, 16.1 OQ-5). + # Upgrade ends at 3 clusters → same Pro gate as install-topology: the JWT secret + # (+ the published image must be Pro-capable, 16.1 OQ-5). run: | if [ ! -f "${CHART_DIR}/examples/single-cluster/values.yaml" ] || [ ! -f "${CHART_DIR}/examples/three-region/values.yaml" ] \ - || [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ] || [ -z "${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" ]; then - echo "::warning::upgrade test needs both examples (16.4) + SC4ES_PRO_TEST_JWT + SC4ES_TEST_PUBLIC_KEY (and a Pro-capable image, FACT F); skipping" + || [ -z "${{ secrets.SC4ES_PRO_TEST_JWT }}" ]; then + echo "::warning::upgrade test needs both examples (16.4) + SC4ES_PRO_TEST_JWT (and a Pro-capable image, FACT F); skipping" echo "skip=true" >> "$GITHUB_OUTPUT" fi - name: Set up Helm @@ -478,8 +499,7 @@ jobs: ./.github/scripts/deploy-es.sh secrets '8' for n in sc4es-license sc4es-pro-license; do kubectl create secret generic "$n" \ - --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" \ - --from-literal=license-public-key="${{ secrets.SC4ES_TEST_PUBLIC_KEY }}" || true + --from-literal=license-key="${{ secrets.SC4ES_PRO_TEST_JWT }}" || true done helm install fed "${CHART_DIR}" -f "${CHART_DIR}/examples/single-cluster/values.yaml" \ ${TEST_ADBC_IMAGE:+--set test.image=$TEST_ADBC_IMAGE} \ @@ -493,7 +513,7 @@ jobs: # + catalog count, not the per-region bearer Secrets (which it does not create). helm upgrade fed "${CHART_DIR}" -f "${CHART_DIR}/examples/three-region/values.yaml" \ ${TEST_ADBC_IMAGE:+--set test.image=$TEST_ADBC_IMAGE} \ - --set license.secretName=sc4es-license --set license.publicKeySecretName=sc4es-license \ + --set license.secretName=sc4es-license \ --set sidecars[0].elasticsearch.url=http://es-us-east-1:9200 \ --set sidecars[1].elasticsearch.url=http://es-eu-west-1:9200 \ --set sidecars[2].elasticsearch.url=http://es-ap-south-1:9200 \ diff --git a/softclient4es-federation/Chart.yaml b/softclient4es-federation/Chart.yaml index ce587bf..f4a9893 100644 --- a/softclient4es-federation/Chart.yaml +++ b/softclient4es-federation/Chart.yaml @@ -43,12 +43,28 @@ type: application # #141, a real health probe #146, and the server images ship a default # logback.xml so they no longer boot at ROOT DEBUG #138), rolled into the # federation + sidecar images. -version: 0.3.5 +# 0.3.6: appVersion 0.3.0 — elasticsql 0.21.0 (sliced PIT row extraction #238: +# one reader per primary shard, merged into a single stream, with a new +# `elastic.scroll { size, max-slices }` HOCON surface and ELASTIC_SCROLL_* +# env overrides; row order of an un-ordered extraction now INTERLEAVES +# across slices, and a quota-capped result is an arbitrary subset) +# + extensions 0.3.0 + arrow 0.3.0 (the advertised-schema probe is +# bounded, so a LIMITed SELECT no longer hits Elasticsearch a second time +# softclient4es-arrow#163), rolled into the federation + sidecar images. +# BREAKING (chart): the licence trust root is now embedded in the image, so +# SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted. `license. +# publicKeySecretName` / `publicKeyKey` are retained ONLY to abort the render +# with an actionable message — a value that used to decide HOW a licence is +# verified must not decay into a silent no-op. Remove them from your values. +# A licence issued by the SoftClient4ES licence server verifies with no extra +# configuration, air-gapped clusters included; a self-signed JWT can no longer +# be made to verify by supplying its public key. +version: 0.3.6 # The federation application/image version this chart deploys by default. # Keep in sync with docker.io/softnetwork/softclient4es-federation:. # Verified published on DockerHub for the federation image AND all four # softclient4es{6,7,8,9}-arrow-flight-sql sidecar images. -appVersion: "0.2.5" +appVersion: "0.3.0" keywords: - elasticsearch - flight-sql diff --git a/softclient4es-federation/README.md b/softclient4es-federation/README.md index 78a8427..7c2c4c6 100644 --- a/softclient4es-federation/README.md +++ b/softclient4es-federation/README.md @@ -88,8 +88,8 @@ helm uninstall fed | `federation.upgradeUrl` | `https://portal.softclient4es.com/pricing` | `FEDERATION_UPGRADE_URL`. | | `telemetry.enabled` | `true` | `SOFTCLIENT4ES_TELEMETRY_ENABLED` daily-ping opt-out (`false` opts out). | | `license.secretName` | `""` | Secret holding license/API key; empty = Community. | -| `license.publicKeySecretName` | `""` | Secret holding the Ed25519 public JWK for OFFLINE license verification → `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`; empty = use JWKS fetch. | -| `license.publicKeyKey` | `license-public-key` | Data key within `license.publicKeySecretName`. | +| `license.publicKeySecretName` | `""` | **Removed in appVersion 0.3.0** — the trust root is embedded in the image. Setting it aborts the render. Leave empty. | +| `license.publicKeyKey` | `""` | **Removed in appVersion 0.3.0** — see above. Leave empty. | | `service.type` | `ClusterIP` | Service type. | | `service.port` | `32020` | `FEDERATION_PORT` (Flight SQL); the only port exposed by the Service. | | `resources` | req `1Gi`/`500m`, lim `2Gi`/`1000m` | Container resource requests/limits. | @@ -194,12 +194,11 @@ The test Pod defaults to `python:3.12-slim` and `pip install`s the ADBC driver a with `--set test.image=` (and `--set test.adbcVersion=` to control the driver version when the runtime install IS used). This is the same Job CI runs. -> **Offline license verification (`license.publicKeySecretName`).** When the federation must -> verify a license JWT WITHOUT reaching the license server's JWKS endpoint (air-gapped clusters, -> or a JWT whose `kid` is not in the prod JWKS), set `license.publicKeySecretName` to a Secret -> whose `license.publicKeyKey` data key holds the matching Ed25519 public JWK. It is mounted as -> `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` (the air-gap path in the license verifier). Leave empty (the -> default) to use the normal JWKS fetch — it renders nothing, so the golden render is unaffected. +> **Offline license verification (appVersion 0.3.0 and later).** Nothing to configure. The +> licence trust root is embedded in the image, so a licence issued by the SoftClient4ES licence +> server verifies with no network access and no extra values — air-gapped clusters included. +> `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` is no longer consulted, and `license.publicKeySecretName` +> now **aborts the render** rather than becoming a silent no-op. Remove it from your values. ## Secrets, TLS & Ingress @@ -372,9 +371,9 @@ than fail — the static-validation gates run unconditionally on every PR with z \* The multi-cluster (Pro) tiers run only when ALL of: (1) the federation image bundles the JWT-verifying SPI (a **Pro-capable** image — an OSS-only image ships only the Community SPI and -cannot verify ANY Pro JWT), (2) the `SC4ES_PRO_TEST_JWT` repo secret, and (3) the -`SC4ES_TEST_PUBLIC_KEY` repo secret (injected as `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` via -`license.publicKeySecretName` so the JWT verifies offline) are present. Otherwise they are +cannot verify ANY Pro JWT), and (2) the `SC4ES_PRO_TEST_JWT` repo secret, holding a JWT **issued +by the SoftClient4ES licence server** (since appVersion 0.3.0 a self-signed test JWT can no longer +be made to verify by supplying its public key) are present. Otherwise they are **skipped with a CI annotation** (not a failure). A **single-cluster** federation is license-FREE (Community `maxClusters=1`) and is always tested; the static three-region/heterogeneous golden proves the mixed-version RENDER on every PR even when the live multi-cluster install is skipped. @@ -397,7 +396,7 @@ failed. The golden gate renders with NO `--set image.tag`. | `kubeconform` invalid resource | a manifest field renamed/typo (e.g. `replicaCount` vs `replicas`) | fix the template; `replicas` is the Deployment field | | `heterogeneous-ready` discriminator fails | `three-region` and `heterogeneous-ready` overlays drifted (one copied over the other) | restore the commented R2b `duckdb-attach` preview in `heterogeneous-ready` (the goldens are byte-identical — this grep is the only signal) | | federation pod CrashLoopBackOff (3 sidecars, license supplied but Community at runtime) | the image lacks the JWT SPI — it cannot verify the Pro JWT → falls back to Community → `maxClusters=1` exceeded | use a Pro-CAPABLE federation image (JWT SPI on classpath, 16.1 OQ-5); injecting a JWT into an OSS-only image does nothing | -| federation pod CrashLoopBackOff (`InvalidLicense: Unknown key ID: …`) | the JWT verification key didn't resolve (no JWKS entry for the kid AND no `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`) | set `license.publicKeySecretName` → `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` (the offline verifier path), or ensure the license-server JWKS carries the kid | +| federation pod CrashLoopBackOff (`InvalidLicense: Unknown key ID: …`) | the JWT was not signed by a key this image trusts — as of appVersion 0.3.0 the trust root is embedded, so a self-signed or test-signed JWT can no longer be made to verify | use a licence issued by the SoftClient4ES licence server. Supplying a public key is no longer possible and `license.publicKeySecretName` now aborts the render | | federation pod CrashLoopBackOff (3 sidecars, no license at all) | Community `maxClusters=1` exceeded | supply a Pro/Enterprise license (`license.secretName`) — by design | | federation pod CrashLoopBackOff (`validate()` / `FlightCredentials`) | Secret-backed cred didn't arrive (wrong key / ESO sync lag) | check the Secret exists + keys match the contract table above; self-heals on next restart | | federation NotReady, smoke connect-refused | a sidecar's backing ES is down/unreachable (all-or-nothing gRPC readiness) | ensure every sidecar's ES is reachable; or set `federation.probes.useGrpc=false` for partial availability | diff --git a/softclient4es-federation/docs/operator-guide.md b/softclient4es-federation/docs/operator-guide.md index 35e9d91..40c2699 100644 --- a/softclient4es-federation/docs/operator-guide.md +++ b/softclient4es-federation/docs/operator-guide.md @@ -116,7 +116,7 @@ See [`examples/heterogeneous-ready/README.md`](../examples/heterogeneous-ready/R | `federation.probes.useGrpc` | — (probe wiring) | — | true | | `federation.tls.{enabled,secretName}` | — (Ingress) | — | false | | `ingress.{enabled,className,annotations,hosts,tls}` | — (Ingress) | — | false | -| `license.publicKeySecretName` (+ `license.publicKeyKey`) | — | `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` | `""` / `license-public-key` | +| `license.publicKeySecretName` (+ `license.publicKeyKey`) | — | *(removed in appVersion 0.3.0 — setting it aborts the render)* | `""` / `""` | **Sidecar** (per `sidecars[]`; image auto-selected by `elasticsearchVersion`; HOCON root `arrow.flight.*` + elasticsql core `elastic.credentials.*`): @@ -170,7 +170,7 @@ The federation reads its license from a referenced Secret as `SOFTCLIENT4ES_LICE Exceeding the quota → the federation logs the over-quota error and `sys.exit(1)` → **CrashLoopBackOff by design** (see §10). Federation is NOT a paid feature — single-cluster is the free adoption tier; the quota is on *cluster count*. To opt out of the daily anonymous usage ping, set `telemetry.enabled: false` (→ `SOFTCLIENT4ES_TELEMETRY_ENABLED=false`); this has zero impact on functionality or your license. -> **Offline verification.** For air-gapped or strict-egress clusters, mount the Ed25519 public JWK via `license.publicKeySecretName` (key `license.publicKeyKey`, default `license-public-key`) → `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`. This lets the federation verify a Pro/Enterprise JWT entirely offline (no portal round-trip). It is gated independently of `license.secretName`. +> **Offline verification.** Nothing to configure as of appVersion 0.3.0. The licence trust root is embedded in the image, so a Pro/Enterprise licence issued by the SoftClient4ES licence server verifies entirely offline — air-gapped and strict-egress clusters included — with no portal round-trip and no public key to mount. `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY` is no longer consulted, and `license.publicKeySecretName` now aborts the render instead of silently doing nothing. ## 8. ES-version mixing & migration diff --git a/softclient4es-federation/examples/three-region/README.md b/softclient4es-federation/examples/three-region/README.md index caaf28c..3af89aa 100644 --- a/softclient4es-federation/examples/three-region/README.md +++ b/softclient4es-federation/examples/three-region/README.md @@ -29,10 +29,10 @@ kubectl create secret generic sc4es-pro-license --from-literal=license-key="$SC4 > bundled ONLY in the Pro/Enterprise-capable federation image. The Community/OSS image > ships only the Community license manager, so it ignores any injected JWT, resolves to > Community (`maxClusters=1`), and **still CrashLoops** on this 3-cluster example. The -> image must ALSO be able to resolve the license SIGNING public key offline (env -> `SOFTCLIENT4ES_LICENSE_PUBLIC_KEY`, or the issuer's JWKS endpoint must be reachable). -> Use a Pro/Enterprise-entitled federation image + provision the public key; consult the -> licensing/operator guide for the exact image + key provisioning. This precondition is +> As of appVersion 0.3.0 the signing trust root is embedded in the image, so no key needs +> provisioning — but the JWT must be one the SoftClient4ES licence server issued. +> Use a Pro/Enterprise-entitled federation image; consult the licensing/operator guide for +> the exact image. This precondition is > tracked for the CI/install path (Story 16.5 FACT F / Story 16.1 OQ-5). A bare > `--set image.tag` of the OSS snapshot image WILL CrashLoop even with a valid JWT Secret. diff --git a/softclient4es-federation/templates/deployment.yaml b/softclient4es-federation/templates/deployment.yaml index 5e5cbe2..49ff5da 100644 --- a/softclient4es-federation/templates/deployment.yaml +++ b/softclient4es-federation/templates/deployment.yaml @@ -3,6 +3,15 @@ CONFIG_FORCE_* credential env from the SAME Secret the sidecar reads. */ -}} {{- $secretAuth := false }} {{- range $s := .Values.sidecars }}{{- if and $s.auth (ne (lower (default "none" $s.auth.method)) "none") $s.auth.credentialsSecretName }}{{- $secretAuth = true }}{{- end }}{{- end }} +{{- /* appVersion 0.3.0: the licence trust root is now embedded in the image and + SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted. This value used to decide + HOW a licence was verified, so quietly dropping it would leave an operator believing + an offline key is still in force. Fail the render instead, so it surfaces at + `helm upgrade` rather than as a CrashLoopBackOff. Nothing fires at the "" default, + so every committed golden stays byte-stable. */ -}} +{{- if .Values.license.publicKeySecretName }} +{{- fail "license.publicKeySecretName is no longer supported: as of appVersion 0.3.0 the licence trust root is embedded in the image, and SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is ignored. Remove license.publicKeySecretName (and license.publicKeyKey). A licence issued by the SoftClient4ES licence server verifies with no extra configuration." }} +{{- end }} apiVersion: apps/v1 kind: Deployment metadata: @@ -78,19 +87,6 @@ spec: key: {{ .Values.license.apiKeyKey | default "api-key" }} optional: true {{- end }} - {{- /* Story 16.5 (FACT F #2): offline license public-key for air-gapped / - test-signed JWT verification (LicenseKeyVerifier.loadPublicKey Step 3). - Gated INDEPENDENTLY of license.secretName so the multi-sidecar CI can - point it at the same Secret. Renders nothing at the "" default, so the - golden and every example are byte-stable. */}} - {{- if .Values.license.publicKeySecretName }} - - name: SOFTCLIENT4ES_LICENSE_PUBLIC_KEY - valueFrom: - secretKeyRef: - name: {{ .Values.license.publicKeySecretName }} - key: {{ .Values.license.publicKeyKey | default "license-public-key" }} - optional: true - {{- end }} {{- if gt (len .Values.sidecars) 0 }} # Point Typesafe Config at the mounted ConfigMap so ConfigFactory.load() # picks up the `servers` map (which has NO env override). The native-packager diff --git a/softclient4es-federation/tests/golden/default.yaml b/softclient4es-federation/tests/golden/default.yaml index 37c1884..0c80b42 100644 --- a/softclient4es-federation/tests/golden/default.yaml +++ b/softclient4es-federation/tests/golden/default.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -44,10 +44,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -60,10 +60,10 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -78,7 +78,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false diff --git a/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml b/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml index 22754fe..7ad0672 100644 --- a/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml +++ b/softclient4es-federation/tests/golden/example-heterogeneous-ready.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: ConfigMap metadata: name: fed-softclient4es-federation-config labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -84,10 +84,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -108,12 +108,12 @@ kind: Service metadata: name: fed-softclient4es-federation-us-east-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: us-east-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -135,12 +135,12 @@ kind: Service metadata: name: fed-softclient4es-federation-eu-west-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: eu-west-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -162,12 +162,12 @@ kind: Service metadata: name: fed-softclient4es-federation-ap-south-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: ap-south-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -189,10 +189,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -205,17 +205,17 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es annotations: # Roll the federation Pod whenever the rendered servers ConfigMap changes # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect. - checksum/config: f814c5bf194d000857da84ae0b4b94f77041021b26407b0879e256a5f7f1dc06 + checksum/config: c1c2ef1ac349925f16819a12b41899c413dd877a767257867addefee5f405a52 spec: serviceAccountName: fed-softclient4es-federation securityContext: @@ -227,7 +227,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -359,12 +359,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-us-east-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: us-east-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -378,12 +378,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: us-east-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -397,7 +397,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -549,12 +549,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-eu-west-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: eu-west-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -568,12 +568,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: eu-west-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -587,7 +587,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -739,12 +739,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-ap-south-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: ap-south-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -758,12 +758,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: ap-south-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -777,7 +777,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -929,10 +929,10 @@ kind: Pod metadata: name: fed-softclient4es-federation-test-catalogs labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es diff --git a/softclient4es-federation/tests/golden/example-single-cluster.yaml b/softclient4es-federation/tests/golden/example-single-cluster.yaml index 6705ccd..be0c8a8 100644 --- a/softclient4es-federation/tests/golden/example-single-cluster.yaml +++ b/softclient4es-federation/tests/golden/example-single-cluster.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: ConfigMap metadata: name: fed-softclient4es-federation-config labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -49,10 +49,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -73,12 +73,12 @@ kind: Service metadata: name: fed-softclient4es-federation-primary labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: primary - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -100,10 +100,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -116,17 +116,17 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es annotations: # Roll the federation Pod whenever the rendered servers ConfigMap changes # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect. - checksum/config: 4eddee3a366f96b211e7f8fc5c3c46217c722cc447dedae7c13ec9d836a1c432 + checksum/config: 836802080cd49217ebf335ad3a77fee4443ab02e72eeb0a7104c278c1a262dc4 spec: serviceAccountName: fed-softclient4es-federation securityContext: @@ -138,7 +138,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -240,12 +240,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-primary labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: primary - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -259,12 +259,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: primary - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -278,7 +278,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -394,10 +394,10 @@ kind: Pod metadata: name: fed-softclient4es-federation-test-catalogs labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es diff --git a/softclient4es-federation/tests/golden/example-three-region.yaml b/softclient4es-federation/tests/golden/example-three-region.yaml index 22754fe..7ad0672 100644 --- a/softclient4es-federation/tests/golden/example-three-region.yaml +++ b/softclient4es-federation/tests/golden/example-three-region.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: ConfigMap metadata: name: fed-softclient4es-federation-config labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -84,10 +84,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -108,12 +108,12 @@ kind: Service metadata: name: fed-softclient4es-federation-us-east-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: us-east-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -135,12 +135,12 @@ kind: Service metadata: name: fed-softclient4es-federation-eu-west-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: eu-west-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -162,12 +162,12 @@ kind: Service metadata: name: fed-softclient4es-federation-ap-south-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: ap-south-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -189,10 +189,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -205,17 +205,17 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es annotations: # Roll the federation Pod whenever the rendered servers ConfigMap changes # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect. - checksum/config: f814c5bf194d000857da84ae0b4b94f77041021b26407b0879e256a5f7f1dc06 + checksum/config: c1c2ef1ac349925f16819a12b41899c413dd877a767257867addefee5f405a52 spec: serviceAccountName: fed-softclient4es-federation securityContext: @@ -227,7 +227,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -359,12 +359,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-us-east-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: us-east-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -378,12 +378,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: us-east-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -397,7 +397,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -549,12 +549,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-eu-west-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: eu-west-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -568,12 +568,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: eu-west-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -587,7 +587,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -739,12 +739,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-ap-south-1 labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: ap-south-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -758,12 +758,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: ap-south-1 - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -777,7 +777,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -929,10 +929,10 @@ kind: Pod metadata: name: fed-softclient4es-federation-test-catalogs labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es diff --git a/softclient4es-federation/tests/golden/ingress-tls.yaml b/softclient4es-federation/tests/golden/ingress-tls.yaml index 70e10b7..528221c 100644 --- a/softclient4es-federation/tests/golden/ingress-tls.yaml +++ b/softclient4es-federation/tests/golden/ingress-tls.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: ConfigMap metadata: name: fed-softclient4es-federation-config labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -49,10 +49,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -73,12 +73,12 @@ kind: Service metadata: name: fed-softclient4es-federation-prod-us labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -100,10 +100,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -116,17 +116,17 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es annotations: # Roll the federation Pod whenever the rendered servers ConfigMap changes # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect. - checksum/config: efa831fb157f8c40d9037ce2f518332a6d7429014630e4fb33defe62a0d74240 + checksum/config: 763da5d4fd22cd5365b7075c0eaa9351c7995285cb6c231ccb8e2a76d74b3a98 spec: serviceAccountName: fed-softclient4es-federation securityContext: @@ -138,7 +138,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -240,12 +240,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-prod-us labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -259,12 +259,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -278,7 +278,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -362,10 +362,10 @@ kind: Ingress metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -401,10 +401,10 @@ kind: Pod metadata: name: fed-softclient4es-federation-test-catalogs labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es diff --git a/softclient4es-federation/tests/golden/secret-auth.yaml b/softclient4es-federation/tests/golden/secret-auth.yaml index 00e2ffe..d69162b 100644 --- a/softclient4es-federation/tests/golden/secret-auth.yaml +++ b/softclient4es-federation/tests/golden/secret-auth.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: ConfigMap metadata: name: fed-softclient4es-federation-config labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -58,10 +58,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -82,12 +82,12 @@ kind: Service metadata: name: fed-softclient4es-federation-prod-us labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -109,10 +109,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -125,17 +125,17 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es annotations: # Roll the federation Pod whenever the rendered servers ConfigMap changes # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect. - checksum/config: 50d761219cc3ad4854d09c55768918608bf0f94aab623aebb2124ba061111804 + checksum/config: 0c6c87ce340dc0d637cc004a129a0b4881d61d2cdb37f2a9260e79fd862f3383 spec: serviceAccountName: fed-softclient4es-federation securityContext: @@ -147,7 +147,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -255,12 +255,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-prod-us labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -274,12 +274,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -293,7 +293,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -433,10 +433,10 @@ kind: Pod metadata: name: fed-softclient4es-federation-test-catalogs labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es diff --git a/softclient4es-federation/tests/golden/two-sidecars.yaml b/softclient4es-federation/tests/golden/two-sidecars.yaml index 64ee42c..71f3a82 100644 --- a/softclient4es-federation/tests/golden/two-sidecars.yaml +++ b/softclient4es-federation/tests/golden/two-sidecars.yaml @@ -5,10 +5,10 @@ kind: ServiceAccount metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -20,10 +20,10 @@ kind: ConfigMap metadata: name: fed-softclient4es-federation-config labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -53,10 +53,10 @@ kind: Service metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -77,12 +77,12 @@ kind: Service metadata: name: fed-softclient4es-federation-prod-us labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -104,12 +104,12 @@ kind: Service metadata: name: fed-softclient4es-federation-prod-eu labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-eu - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -131,10 +131,10 @@ kind: Deployment metadata: name: fed-softclient4es-federation labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es @@ -147,17 +147,17 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es annotations: # Roll the federation Pod whenever the rendered servers ConfigMap changes # (add/remove/edit a sidecar) so `helm upgrade` actually takes effect. - checksum/config: 4301553f05eaeaddc68ed4ebb4deaef0eb3b2d822a89d770fe49c86342921f7d + checksum/config: 4d15952118ec4dd9cf322390ec134005f6e3385bf78b15ee28250c7aa94f6357 spec: serviceAccountName: fed-softclient4es-federation securityContext: @@ -169,7 +169,7 @@ spec: type: RuntimeDefault containers: - name: federation - image: "docker.io/softnetwork/softclient4es-federation:0.2.5" + image: "docker.io/softnetwork/softclient4es-federation:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -283,12 +283,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-prod-us labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -302,12 +302,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-us - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -321,7 +321,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es8-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -447,12 +447,12 @@ kind: Deployment metadata: name: fed-softclient4es-federation-prod-eu labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-eu - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -466,12 +466,12 @@ spec: template: metadata: labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed app.kubernetes.io/component: sidecar softclient4es.app/sidecar: prod-eu - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: softclient4es spec: @@ -485,7 +485,7 @@ spec: type: RuntimeDefault containers: - name: sidecar - image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.2.5" + image: "docker.io/softnetwork/softclient4es9-arrow-flight-sql:0.3.0" imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false @@ -611,10 +611,10 @@ kind: Pod metadata: name: fed-softclient4es-federation-test-catalogs labels: - helm.sh/chart: softclient4es-federation-0.3.5 + helm.sh/chart: softclient4es-federation-0.3.6 app.kubernetes.io/name: softclient4es-federation app.kubernetes.io/instance: fed - app.kubernetes.io/version: "0.2.5" + app.kubernetes.io/version: "0.3.0" app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: federation app.kubernetes.io/part-of: softclient4es diff --git a/softclient4es-federation/values.yaml b/softclient4es-federation/values.yaml index 9882140..815e462 100644 --- a/softclient4es-federation/values.yaml +++ b/softclient4es-federation/values.yaml @@ -115,16 +115,17 @@ license: secretName: "" licenseKeyKey: license-key # Secret data key holding the JWT license -> SOFTCLIENT4ES_LICENSE_KEY apiKeyKey: api-key # Secret data key holding the API key -> SOFTCLIENT4ES_API_KEY - # ── Offline license public-key (Story 16.5, FACT F #2) ──────────────────────── - # OPTIONAL. When the federation must verify a license JWT WITHOUT reaching the - # license server's JWKS endpoint (air-gapped clusters, or a test-signed JWT whose - # `kid` is not in the prod JWKS), point publicKeySecretName at a Secret whose - # `publicKeyKey` data key holds the matching Ed25519 public JWK. It is mounted as - # SOFTCLIENT4ES_LICENSE_PUBLIC_KEY — the air-gap path in LicenseKeyVerifier.loadPublicKey - # (Step 3, VERIFIED). Leave empty (the default) to use the normal JWKS fetch. Renders - # NOTHING when empty, so the golden render and every shipped example are unaffected. + # ── Offline license public-key — REMOVED in appVersion 0.3.0 ───────────────── + # The licence trust root is now embedded in the image, so a licence issued by the + # SoftClient4ES licence server verifies with NO extra configuration, air-gapped or + # not. SOFTCLIENT4ES_LICENSE_PUBLIC_KEY is no longer consulted. + # + # These keys are retained ONLY so the chart can fail loudly if they are still set: + # a value that used to change how a licence is verified must not become a silent + # no-op. Setting publicKeySecretName aborts the render with an actionable message. + # Leave both empty. publicKeySecretName: "" - publicKeyKey: license-public-key # Secret data key holding the Ed25519 public JWK -> SOFTCLIENT4ES_LICENSE_PUBLIC_KEY + publicKeyKey: "" service: type: ClusterIP