# Fixtures for the garage install-test: the two Secrets the 1Password operator
# would otherwise materialize from the OnePasswordItems the chart renders
# (release name: ci, stub CRD in ci/common/).
#
# NO THROWAWAY INFRASTRUCTURE: Garage depends on nothing - no database, no
# cache, no other service. The whole deployment is one process and two volumes,
# which is also why this chart is cheap enough to test on every PR.
#
# THE FIELD NAMES MATTER AS MUCH AS THE VALUES, and here the VALUES matter too,
# which is unusual for a fixture: Garage validates all four of them on start and
# refuses to run on a malformed one. So these are not placeholders - a value
# that merely looks right (a 31-byte RPC secret, a 6-character access key) fails
# the run, which is exactly the check that makes the fixture worth having.
apiVersion: v1
kind: Secret
metadata:
  name: ci-garage-rpc-secret
stringData:
  # EXACTLY 32 bytes, hex-encoded = 64 hex characters. Garage decodes this and
  # rejects anything else with "Invalid RPC secret key: expected 32 bytes of
  # random hex" - it is the network key of the RPC layer, required even for a
  # single node.
  #
  # A throwaway value, and a visibly throwaway one: this is not a secret, it is
  # a test vector. Nothing here survives the run, the cluster is deleted with
  # the job, and the node it keys has no peers.
  rpc-secret: "c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1c1"
---
apiVersion: v1
kind: Secret
metadata:
  name: ci-garage-s3-secret
stringData:
  # The three fields Garage IMPORTS on start with --default-access-key and
  # --default-bucket. Each one is validated (src/model/key_table.rs,
  # src/model/bucket_alias_table.rs):
  #   access-key  at least 8 characters, ASCII alphanumeric plus - _ .
  #   secret-key  at least 16 characters, printable ASCII
  #   bucket      a valid S3 bucket name, 3-63 characters, lowercase
  # Shortening any of them below its minimum is the quickest way to check that
  # this test really exercises the import path: the container exits instead of
  # starting.
  access-key: "ciGarageTestKey01"
  secret-key: "c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2"
  bucket: "ci-garage-test"