From f91f03ccbbf2b7ce74606ec9b8676d83cf01260b Mon Sep 17 00:00:00 2001 From: steiler Date: Wed, 12 Aug 2026 11:52:17 +0200 Subject: [PATCH] fix(ci): provision config-keyring Secret before waiting on data-server-controller config-server intentionally stopped shipping a default config-keyring Secret in its own deploy artifacts (commit 83d07f8, "added ENV keyring and removed keyring secret") to force real deployments to bring their own key material. The data-server-controller StatefulSet still mounts that Secret as a volume unconditionally, so without it the pod hangs in ContainerCreating for the full 10-minute Robot timeout instead of failing with a clear error. Add a CI-only placeholder Secret and apply it right after the generated artifacts.yaml (once the sdc-system namespace exists) and before 00-setup waits for the StatefulSet to become ready. Co-authored-by: Cursor --- tests/00-setup/02-artifacts.robot | 9 +++++++++ tests/00-setup/secret-config-keyring.yaml | 18 ++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 tests/00-setup/secret-config-keyring.yaml diff --git a/tests/00-setup/02-artifacts.robot b/tests/00-setup/02-artifacts.robot index 73c8f49..8a252e9 100644 --- a/tests/00-setup/02-artifacts.robot +++ b/tests/00-setup/02-artifacts.robot @@ -7,3 +7,12 @@ Resource ../Keywords/k8s/kubectl.robot Install SDCIO kubectl apply ./config-server/artifacts/out/artifacts.yaml +Install CI keyring secret + [Documentation] config-server no longer ships a default config-keyring + ... Secret in its own deploy artifacts (by design, to force real + ... deployments to bring their own key material). The data-server + ... StatefulSets mount this Secret as a volume regardless, so CI must + ... provision its own throwaway key or the pods hang in + ... ContainerCreating forever waiting for a Secret that never exists. + kubectl apply ./integration-tests/tests/00-setup/secret-config-keyring.yaml + diff --git a/tests/00-setup/secret-config-keyring.yaml b/tests/00-setup/secret-config-keyring.yaml new file mode 100644 index 0000000..deb35e4 --- /dev/null +++ b/tests/00-setup/secret-config-keyring.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Secret +metadata: + name: config-keyring + namespace: sdc-system + labels: + config.sdcio.dev/keyring: "true" +type: Opaque +stringData: + # CI-only placeholder key (same value as config-server's own placeholder + # sample, artifacts/in/secret_keyring.yaml). config-server intentionally + # stopped shipping a default keyring Secret in its own deploy artifacts + # (see sdcio/config-server commit 83d07f8, "added ENV keyring and removed + # keyring secret") so that real deployments are forced to provision their + # own key material instead of relying on a well-known default. The + # integration-tests cluster is not a real deployment, so it provisions its + # own throwaway key here. + keyring.json: '{"primary":"key-1","keys":{"key-1":"Fyap3X+pl8mYv2gV90sdmuy+YJ+FocFf5ygHGxZ+ws4="}}'