stacklok / toolhive / 40548468431

73%

Build Type

push

github

Committed by web-flow

Commit Message

Enable TLS for operator-wide Redis defaults (#6838)

* Enable TLS for operator Redis defaults

Allow workloads using global Redis session defaults to request verified TLS with system roots or a namespace-local CA Secret. Reuse the session TLS wiring and CA projection paths while preserving explicit workload overrides and existing plaintext defaults.

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

* Use explicit invalid TLS test values

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

* Inject Redis defaults from operator startup

Read and validate global Redis settings once and inject the same snapshot
into session configuration, password references, CA mounts, and drift checks.
Keep TLS helpers independent of the environment and remove the panic path.

Pin runtime configuration to the generated CA projection for all three
workload kinds, including environment changes after startup. Document
missing-CA mount failures and the operator restart requirement.

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

* Verify vMCP Redis defaults forwarding

Exercise the reconciler-to-ConfigMap path with injected plaintext and TLS
defaults so missing converter option forwarding cannot silently select
in-memory storage. Preserve explicit Redis overrides in the same test.

Document the changed default behavior for direct Go converter callers and
their migration path, while distinguishing the preserved operator fallback.

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

---------

Signed-off-by: Sanskarzz <sanskar.gur@gmail.com>

Coverage Stats

74 of 85 new or added lines in 11 files covered. (87.06%)

13 existing lines in 3 files now uncovered.

90067 of 125197 relevant lines covered (71.94%)

130.26 hits per line