THREESCALE 12122: Fix tests suite with SSL by jlledom · Pull Request #576 · 3scale/zync

jlledom · 2026-01-28T09:55:56Z

This is kinda part of https://issues.redhat.com/browse/THREESCALE-12122

Que was not supporting SSL protected DBs at all, and then I opened #573 to fix it. I tested and everything works fine now, and Que can work with a SSL DB properly. However, I found out during the Rails 8 upgrade that the test suite is also broken when using a SSL DB, so this PR is to fix that.

You can find more context in this discussion: #560 (comment)

Now we have a PR only for this, I think it the time to edit the pipeline and add a job to test SSL DBs as well.

jlledom · 2026-01-29T13:40:52Z

.gitleaks.toml

+[allowlist]
+description = "Global Allowlist"
+
+# Ignore based on any subset of the file path
+paths = [
+    # Ignore all fake private keys for CircleCI, they are for tests
+    '''.circleci\/.+\.(pem|key)$'''
+]


This is to bypass our secret leak detector. The certificates I pushed here are fake.

jlledom · 2026-01-29T13:41:42Z

.circleci/config.yml

@@ -1,4 +1,77 @@
 version: 2.1
+
+commands:


Both jobs run the same tests, this is to reuse them

jlledom · 2026-01-29T13:43:46Z

.circleci/config.yml

+commands:
+  bundle_install:
+    parameters:
+      run_in_zync:


When true, we run the command inside zync container, required for SSL

jlledom · 2026-01-29T13:45:18Z

.circleci/config.yml

+      postgresql_image:
+        type: string
+    machine:
+      image: ubuntu-2204:current


The docker executor doesn't accept mounting volumes to the postgres container, I faced the same issue when I added SSL pipelines to apisonator. We must use the mahine executor and launch the containers manually.

I read that setup_remote_docker step allows for using docker from within the main container, so that we can use the old approach, just add the setup remote docker step to then run postgres as we wish.

But also it is in fact not hard to start postgres with a custom entrypoint that generates a SSL certificate.

podman run --rm -e POSTGRES_HOST_AUTH_METHOD=trust -e POSTGRES_DB=test --entrypoint bash cimg/postgres:15.15 -c ' openssl req -nodes -new -x509 -subj "/CN=localhost" -keyout /server.key -out /server.crt && chown postgres /server.* && exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/server.crt -c ssl_key_file=/server.key '

Then we can extract the CA in the main container with:

openssl s_client \ -starttls postgres \ -connect localhost:5432 \ -showcerts < /dev/null > ca.pem

I think both options are preferable to switching to the VM executor especially if we anticipate using custom executors. WDYT about these options?

That might work, I don't know, but I don't think it's worth the effort because every change you make in the CircleCI file, even if it seems easy, always ends up taking a whole day of try & error. I don't see much improvement on using a docker executor over a machine executor to justify the effort.

even if it seems easy, always ends up taking a whole day of try & error

That's true. But also this native executor is very shitty with some old software like old podman and stuff. And then it makes it much harder to use custom executors. Also current approach looks complicated, although I can't tell if using pure docker executor will make it noticeably less complicated 🤔

It's gonna be complicated whatever approach we try. CircleCI won't allow you to pass until you hit your head against a wall for at least 8 hours.

ok, probably it is just me that I don't want to touch native executor ever. Let's let @mayorova give an opinion on using native vs docker executors. No need to review the whole thing. Just opinion about using executors.

Or actually, if we use only docker, wouldn't that avoid the need to have so many <<parameters.run_in_zync>> declarations? It's hard to follow.

It seems to me one config is run on host, one is run in container. It also may result in differences caused by ruby and libraries used. My experience is that sadly ruby is slightly different in RH distros.

I think we can merge this as it is, it does its job, so it's already an improvement (compared to not having any SSL tests).

We can change the approach at any time, if anyone wants to work on this.

UPDATE: I do agree though that the current solution is ugly 😬 It's difficult to understand. But... I still think having something now is more valuable than have it more perfect, but with a delay.

jlledom · 2026-01-29T13:46:19Z

.circleci/config.yml

+                cp /tmp/server.crt /server.crt
+                cp /tmp/server.key /server.key
+                cp /tmp/ca.crt /ca.crt
+                chown postgres:postgres /server.crt /server.key /ca.crt
+                chmod 600 /server.key
+                exec docker-entrypoint.sh postgres -c ssl=on -c ssl_cert_file=/server.crt -c ssl_key_file=/server.key -c ssl_ca_file=/ca.crt


All this is because postgres doesn't accept a cert key which is not owned by itself and with 0600 permissions

jlledom · 2026-01-29T13:46:59Z

.circleci/config.yml

-      - store_test_results:
-          path: test/reports
-
+            chmod 600 $(pwd)/.circleci/circleci.key && \


postgres doesn't accept the client not owning the client key neither, and permissions must be 0600 as well

akostadinov · 2026-01-29T13:55:00Z

.circleci/config.yml

+          run_in_zync: true
+      - boot_zync:
+          run_in_zync: true
      - save_cache:


save cache should be directly under bundle install maybe 🤔

Done: 97f24d7

akostadinov · 2026-01-29T13:55:39Z

.circleci/config.yml

+            <<# parameters.run_in_zync >>
+            circleci tests glob "test/**/*_test.rb" | circleci tests run --command="xargs docker exec zync bundle exec rake test TESTOPTS='-v'" --verbose --split-by=timings
+            <</ parameters.run_in_zync >>
+            <<^ parameters.run_in_zync >>


can you explain a little the parameters syntax and choices?

Yes:

<<# parameters.run_in_zync >>: This means "if parameters.run_in_zync is true"
<<^ parameters.run_in_zync >>: This means "if parameters.run_in_zync is false"
<</ parameters.run_in_zync >>: This is just to close the if statement

So when run_in_zync is true, it runs the tests inside the zync container (it adds docker exec zync ...). Otherwise it doesn't.

.circleci/ca-circleci-cert.pem

Fix tests with SSL

e5dcae2

jlledom mentioned this pull request Jan 28, 2026

🚨 [security] Update rails 7.1.6 → 8.0.2.1 (major) #560

Merged

jlledom self-assigned this Jan 28, 2026

jlledom force-pushed the THREESCALE-12122-test-ssl branch from 644af9b to 43544ee Compare January 29, 2026 08:14

New job to run tests suite over SSL

2b3ef8e

jlledom force-pushed the THREESCALE-12122-test-ssl branch from 3e96487 to 2b3ef8e Compare January 29, 2026 13:38

jlledom commented Jan 29, 2026

View reviewed changes

.circleci/config.yml

@@ -1,4 +1,77 @@

version: 2.1

commands:

Copy link

Contributor Author

jlledom Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both jobs run the same tests, this is to reuse them

jlledom commented Jan 29, 2026

View reviewed changes

jlledom marked this pull request as ready for review January 29, 2026 13:47

jlledom requested review from akostadinov and mayorova January 29, 2026 13:48

akostadinov reviewed Jan 29, 2026

View reviewed changes

.circleci/ca-circleci-cert.pem Show resolved Hide resolved

3scale deleted a comment from jlledom Jan 30, 2026

Save cache after bundle install

97f24d7

mayorova approved these changes Feb 11, 2026

View reviewed changes

jlledom requested a review from akostadinov February 12, 2026 07:57

Conversation

jlledom commented Jan 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akostadinov Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akostadinov Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mayorova Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

akostadinov Feb 9, 2026 •

edited

Loading

akostadinov Feb 11, 2026 •

edited

Loading

mayorova Feb 11, 2026 •

edited

Loading