From e8a333d0935af00895dbb8852353e66804b5eb52 Mon Sep 17 00:00:00 2001 From: AlpNuhoglu Date: Thu, 22 Oct 2026 03:16:32 +0300 Subject: [PATCH] test(d3): deploy a deliberately broken gateway To be reverted right after. The prod overlay gives the gateway a JWT_SECRET of 17 characters (a value in env overrides the Secret's from envFrom), so config.Validate refuses to start it in production. Plan D3's check: the deploy job must turn red and roll back to the previous commit with its own manifests, and production must keep serving throughout. The rollout waits for the 300 s progress deadline, which also exercises token renewal inside one long kubectl call. Plan: D3 Co-Authored-By: Claude Opus 5.5 --- deployments/k8s/overlays/prod/kustomization.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/deployments/k8s/overlays/prod/kustomization.yaml b/deployments/k8s/overlays/prod/kustomization.yaml index ed942c3..7adce0a 100644 --- a/deployments/k8s/overlays/prod/kustomization.yaml +++ b/deployments/k8s/overlays/prod/kustomization.yaml @@ -71,6 +71,20 @@ patches: value: name: TRUSTED_PROXIES value: 10.42.0.0/16 + # D3 TEST, reverted right after: a deliberately broken release. A value in + # env overrides the one from envFrom (the Secret), so the gateway gets a + # JWT_SECRET shorter than 32 characters and config.Validate refuses to + # start it. The deploy job must turn red, roll back to the previous + # commit, and production must keep serving throughout. + - target: + kind: Deployment + name: gateway + patch: |- + - op: add + path: /spec/template/spec/containers/0/env/- + value: + name: JWT_SECRET + value: d3-test-too-short # The public API name (C1). Its DNS record is an A record only, without # the Cloudflare proxy: the cluster is IPv4-only (finding #81), and a proxy # would end TLS at Cloudflare and hide the client's address from the