keycloak: coverage tests + dashboard + reword cross-cutting tags

2026-08-24 21:07:27 -05:00
1 parent 0cb25c12e3
commit 4bebd4b6d2
@@ -0,0 +1,58 @@
+# =============================================================================
+# L2 BEHAVIORAL — IdP datastore is DR-critical  (R-IDP-05)              [RUNNABLE]
+# Spec: docs/15 identity-and-access; ADR-0014. Impl: platform/keycloak/postgres-cluster.yaml
+# (CloudNativePG Cluster on the 3-replica `longhorn` StorageClass).
+#
+# GIVEN Keycloak's PostgreSQL runs as a CloudNativePG Cluster,
+# WHEN  we inspect it
+#   ->  THEN it is healthy (>=1 ready instance) AND its data lives on the replicated `longhorn`
+#       StorageClass — i.e. the identity datastore is DR-critical / replicated (R-IDP-05). Keycloak is
+#       stateless and rebuilds from this DB + the git realm import.
+# (Full off-cluster backup/restore is R-STATE-03/Velero territory, hand-off OQ-BKP.)
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: keycloak-db-dr
+  labels:
+    conformance.home.k3s/R-IDP-05: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-IDP-05"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/executable: "true"
+    conformance.home.k3s/intent: >-
+      Keycloak's CloudNativePG database is healthy and stored on the 3-replica longhorn StorageClass.
+spec:
+  timeouts:
+    exec: 5m
+  steps:
+    - name: db-cluster-is-healthy
+      try:
+        - script:
+            content: |
+              set -u
+              for i in $(seq 1 30); do
+                ready="$(kubectl -n keycloak get clusters.postgresql.cnpg.io keycloak-db \
+                          -o jsonpath='{.status.readyInstances}' 2>/dev/null || true)"
+                echo "poll $i: readyInstances=$ready"
+                if [ "${ready:-0}" -ge 1 ]; then echo DB_READY_OK; break; fi
+                sleep 10
+              done
+            check:
+              (contains($stdout, 'DB_READY_OK')): true
+    - name: db-data-is-on-replicated-longhorn
+      try:
+        - script:
+            content: |
+              set -u
+              sc="$(kubectl -n keycloak get pvc -l cnpg.io/cluster=keycloak-db \
+                      -o jsonpath='{.items[0].spec.storageClassName}' 2>/dev/null || true)"
+              echo "db pvc storageClass=$sc"
+              if [ "$sc" = "longhorn" ]; then
+                echo DB_ON_LONGHORN_OK
+              else
+                echo "FAIL: Keycloak DB PVC not on the replicated longhorn StorageClass"; exit 1
+              fi
+            check:
+              (contains($stdout, 'DB_ON_LONGHORN_OK')): true