prisma-risk / tsoracle / 26488457806
95%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 89
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 94.926%. Remained the same
26488457806

push

github

web-flow 
fix(kube-e2e): register new member with FQDN so TLS cell's SAN check matches (#520)

The TLS cell mints a leaf cert covering `<rel>-<i>.<rel>-peer.<ns>.svc.cluster.local`
(see e2e/kube/driver/src/bin/gen-certs.rs:150-160) and the chart's entrypoint
already wires the initial members 0/1/2 with that FQDN form (deploy/entrypoint.sh:55).
But step 5 (dynamic-membership soak) was constructing the new learner's
raft/service/admin addresses as the short DNS form `<rel>-3.<rel>-peer:<port>`.

openraft's peer transport dials `https://{raft_addr}` and the tsoracle client
uses the stored `service_endpoint` as the TLS authority on a leader-hint
redirect, so the short form fails SNI/hostname verification against the
fan-SAN leaf cert. `openssl verify -verify_hostname tsoracle-tls-3.tsoracle-tls-peer`
reproduces it: `error 62 ... hostname mismatch`.

Detect the kubectl context namespace at step 5 and compose the three
addresses as the same FQDN form `gen-certs` and the chart entrypoint use.
The insecure cell composes the FQDN too — plaintext consensus doesn't
require it, but one code path keeps the two cells in sync and the cluster's
DNS search path resolves the FQDN just as readily as the short form.
`find_leader_pod`'s `${raft_field%%.*}` parser still strips at the first
dot, so the change is transparent to it.

Signed-off-by: Sebastian Thiebaud <sebastian@prismarisk.com>

13694 of 14426 relevant lines covered (94.93%)

368770.91 hits per line

Jobs
ID Job ID Ran Files Coverage
1 26488457806.1 89
94.93
 GitHub Action Run
Source Files on build 26488457806