59 lines
2.5 KiB
YAML
59 lines
2.5 KiB
YAML
# =============================================================================
|
|
# L2 BEHAVIORAL — IdP datastore is DR-critical (R-IDP-05) [RUNNABLE]
|
|
# Spec: docs/15 identity-and-access; ADR-0014. Impl: platform/keycloak/postgres-cluster.yaml
|
|
# (CloudNativePG Cluster on the 3-replica `longhorn` StorageClass).
|
|
#
|
|
# GIVEN Keycloak's PostgreSQL runs as a CloudNativePG Cluster,
|
|
# WHEN we inspect it
|
|
# -> THEN it is healthy (>=1 ready instance) AND its data lives on the replicated `longhorn`
|
|
# StorageClass — i.e. the identity datastore is DR-critical / replicated (R-IDP-05). Keycloak is
|
|
# stateless and rebuilds from this DB + the git realm import.
|
|
# (Full off-cluster backup/restore is R-STATE-03/Velero territory, hand-off OQ-BKP.)
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: keycloak-db-dr
|
|
labels:
|
|
conformance.home.k3s/R-IDP-05: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-IDP-05"
|
|
conformance.home.k3s/layer: "L2"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
conformance.home.k3s/executable: "true"
|
|
conformance.home.k3s/intent: >-
|
|
Keycloak's CloudNativePG database is healthy and stored on the 3-replica longhorn StorageClass.
|
|
spec:
|
|
timeouts:
|
|
exec: 5m
|
|
steps:
|
|
- name: db-cluster-is-healthy
|
|
try:
|
|
- script:
|
|
content: |
|
|
set -u
|
|
for i in $(seq 1 30); do
|
|
ready="$(kubectl -n keycloak get clusters.postgresql.cnpg.io keycloak-db \
|
|
-o jsonpath='{.status.readyInstances}' 2>/dev/null || true)"
|
|
echo "poll $i: readyInstances=$ready"
|
|
if [ "${ready:-0}" -ge 1 ]; then echo DB_READY_OK; break; fi
|
|
sleep 10
|
|
done
|
|
check:
|
|
(contains($stdout, 'DB_READY_OK')): true
|
|
- name: db-data-is-on-replicated-longhorn
|
|
try:
|
|
- script:
|
|
content: |
|
|
set -u
|
|
sc="$(kubectl -n keycloak get pvc -l cnpg.io/cluster=keycloak-db \
|
|
-o jsonpath='{.items[0].spec.storageClassName}' 2>/dev/null || true)"
|
|
echo "db pvc storageClass=$sc"
|
|
if [ "$sc" = "longhorn" ]; then
|
|
echo DB_ON_LONGHORN_OK
|
|
else
|
|
echo "FAIL: Keycloak DB PVC not on the replicated longhorn StorageClass"; exit 1
|
|
fi
|
|
check:
|
|
(contains($stdout, 'DB_ON_LONGHORN_OK')): true
|