@@ -0,0 +1,140 @@
+#!/usr/bin/env bats
+# Unit test: the qdrant ResourceDefinition hands tenants the key-free trust
+# anchor and nothing else.
+#
+# The chart issues qdrant-<name>-ca (CA certificate AND CA private key, the
+# latter under tls.key) and qdrant-<name>-tls (server certificate AND server
+# private key). Neither may reach a tenant: read access to the CA key would
+# let the holder issue certificates for anything rather than merely verify the
+# server. What a client actually needs is ca.crt alone, delivered by the
+# CA-extraction controller as the key-free <release>.tenant-ca projection and
+# selected by LABEL rather than by name, because a name grant conveys whatever
+# happens to occupy that name.
+#
+# Asserted against the RENDERED chart, not against cozyrds/qdrant.yaml on
+# disk. templates/cozyrd.yaml globs cozyrds/* and emits each match through
+# .Files.Get, so what ships is the render: reading one source file would miss
+# a second file in that directory, and a dotfile the glob picks up. Helm
+# ignores dotfiles only under templates/, so one here does ship.
+#
+# This lives in bats rather than helm-unittest because packages/system/
+# qdrant-rd has no `test:` target, and hack/helm-unit-tests.sh skips any
+# package without one. If that package ever grows one, this belongs there.
+#
+# spec.secrets is compared WHOLE rather than probed for known-bad names.
+# Three ways this breaks are invisible to a name-by-name check:
+#
+#   - a name added under a different spelling, or via a helper;
+#   - an include with NO resourceNames and NO matchLabels, which restricts
+#     nothing;
+#   - a SECOND matchLabels include selecting a label the key-bearing Secrets
+#     also carry. cert-manager stamps controller.cert-manager.io/fao on the
+#     Secrets it creates, both of these among them, so one such entry grants
+#     the CA private key while every name in the file stays correct.
+
+REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
+CHART="$REPO_ROOT/packages/system/qdrant-rd"
+
+# The complete tenant-visible Secret surface. The API key by name; the trust
+# anchor by label. Nothing else.
+EXPECTED_SECRETS='{"exclude":[],"include":[{"resourceNames":["qdrant-{{ .name }}-apikey"]},{"matchLabels":{"internal.cozystack.io/tenant-ca":"true"}}]}'
+
+# Order within include is meaningless -- the matcher ORs across entries -- so
+# the array is sorted before comparing, and a missing exclude is normalized to
+# the empty list it means. Neither can hide a grant: sort preserves every
+# entry (it is not unique), and exclude only ever narrows.
+#
+# Kept as a filter string rather than a shell function because hack/cozytest.sh
+# inserts `return 0` before any line that is exactly `}`. A helper whose own
+# last command decides the outcome returns 0 regardless -- and whether a
+# wrapper propagates a failure at all then depends on the shell running it.
+# Repeating the helm invocation inline in each test costs two lines and owes
+# nothing to that.
+NORMALIZE='{exclude: (.exclude // []), include: (.include | sort)}'
+
+# Every document count below uses `yq eval-all`, never `yq eval`. `eval` runs
+# the expression once PER DOCUMENT, so `[.] | length` reports 1 per document
+# rather than the number of documents -- it prints "1" for a single document,
+# "1\n1" for two, and "1" for empty input, which would make a count check here
+# pass on exactly the cases it exists to catch. `eval-all` folds the stream
+# into one expression. Empty input still yields 1, since yq synthesizes a null
+# document, so emptiness is checked separately before counting.
+
+@test "qdrant-rd renders exactly one ApplicationDefinition" {
+  # stderr is deliberately not discarded: when the render breaks, helm's own
+  # message is the only thing that says why.
+  rendered=$(helm template qdrant-rd "$CHART") || return 1
+
+  # Fail closed: an empty render makes every assertion below vacuous, and yq
+  # cannot distinguish it from one document.
+  if [ -z "$rendered" ]; then
+    echo "helm template produced no output for $CHART -- guard is blind." >&2
+    return 1
+  fi
+
+  count=$(printf '%s\n' "$rendered" | yq eval-all '[.] | length' -) || return 1
+
+  if [ "$count" != "1" ]; then
+    echo "Expected exactly 1 rendered document from $CHART, got: $count" >&2
+    echo "templates/cozyrd.yaml globs cozyrds/*, so every file there -- including" >&2
+    echo "a dotfile -- ships its own tenant grants. Extend this suite before" >&2
+    echo "adding one." >&2
+    return 1
+  fi
+}
+
+@test "qdrant-rd selects the key-free tenant-CA projection by label" {
+  rendered=$(helm template qdrant-rd "$CHART") || return 1
+
+  if [ -z "$rendered" ]; then
+    echo "helm template produced no output for $CHART -- guard is blind." >&2
+    return 1
+  fi
+
+  count=$(printf '%s\n' "$rendered" | yq eval-all \
+    '[.. | select(has("secrets")) | .secrets.include[] | select(.matchLabels."internal.cozystack.io/tenant-ca" == "true")] | length' \
+    -) || return 1
+
+  if [ "$count" -lt 1 ]; then
+    echo 'qdrant-rd does not select internal.cozystack.io/tenant-ca: "true"' >&2
+    echo "Without it the tenant cannot read ca.crt and TLS verification is impossible." >&2
+    return 1
+  fi
+}
+
+# Whole-structure comparison. Anything added to the tenant's Secret surface --
+# by name, by label, or by an unrestricted entry -- changes this string.
+@test "qdrant-rd exposes no Secret beyond the API key and the trust anchor" {
+  rendered=$(helm template qdrant-rd "$CHART") || return 1
+
+  if [ -z "$rendered" ]; then
+    echo "helm template produced no output for $CHART -- guard is blind." >&2
+    return 1
+  fi
+
+  # eval-all again: with `eval`, a second rendered document would emit a
+  # second JSON object and the comparison below would run on a concatenation.
+  actual=$(printf '%s\n' "$rendered" \
+    | yq eval-all --output-format=json '[.. | select(has("secrets")) | .secrets]' - \
+    | jq --sort-keys --compact-output "if length == 1 then .[0] else . end | $NORMALIZE") || return 1
+
+  expected=$(printf '%s' "$EXPECTED_SECRETS" \
+    | jq --sort-keys --compact-output "$NORMALIZE") || return 1
+
+  # Fail closed: an empty or null result means spec.secrets stopped being
+  # readable at this path, so the guard is no longer observing what it claims.
+  if [ -z "$actual" ] || [ "$actual" = "null" ]; then
+    echo "spec.secrets is missing or unreadable in the rendered ResourceDefinition -- guard is blind." >&2
+    return 1
+  fi
+
+  if [ "$actual" != "$expected" ]; then
+    echo "Unexpected tenant Secret surface in the rendered qdrant-rd spec.secrets:" >&2
+    echo "  actual:   $actual" >&2
+    echo "  expected: $expected" >&2
+    echo "qdrant-<name>-ca holds the CA PRIVATE KEY and qdrant-<name>-tls the" >&2
+    echo "server private key. Neither may be granted to a tenant, by name or by" >&2
+    echo "a label they also carry -- cert-manager stamps its own labels on both." >&2
+    return 1
+  fi
+}
@@ -54,3 +54,17 @@ This setting is ignored if the corresponding `resources` value is set.
 Presets follow a cloud-style `<series>.<size>` naming convention. Five series cover the full CPU-to-memory ratio range (`t1` 1:0.5, `c1` 1:1, `s1` 1:2, `u1` 1:4, `m1` 1:8) and each series ships eight sizes (`nano` through `4xlarge`). The legacy flat names (`nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`) remain accepted as deprecated aliases of their 1:1 instance-type equivalents.
 
 See [`docs/operations/resource-presets.md`](../../../docs/operations/resource-presets.md) for the full size matrix and the legacy-to-instance-type mapping.
+
+### tls
+
+With TLS on, the chart issues the server certificate from a self-signed CA it creates per release. The trust anchor for verifying that certificate is published as `qdrant-<name>.tenant-ca`, where `<name>` is the name of the `Qdrant` resource: an object holding `ca.crt` and nothing else, delivered to tenants through the `core.cozystack.io/tenantsecrets` API that the base tenant roles already grant.
+
+```bash
+kubectl --context <ctx> --namespace <tenant> \
+  get tenantsecret qdrant-<name>.tenant-ca \
+  --output jsonpath='{.data.ca\.crt}' | base64 --decode
+```
+
+It is the only object that hands over the CA certificate without also handing over a private key, which is why it exists. The `qdrant-<name>-ca` Secret the chart creates stores the CA **private key** alongside the certificate — read access to it would let the holder issue certificates for anything, so it is never granted to a tenant.
+
+It is reached through `tenantsecrets` rather than by reading the Secret directly, and that is deliberate: `tenantsecrets` surfaces only objects the platform has vouched for (those the application's definition selects), whereas a direct grant on the name would convey whatever happens to occupy that name.
@@ -0,0 +1,13 @@
+{{- /* Gated on the same condition as certmanager.yaml: the source Secret only exists when TLS is on. */}}
+{{- if eq (include "qdrant.tls.enabled" .) "true" }}
+---
+apiVersion: internal.cozystack.io/v1alpha1
+kind: TenantProjection
+metadata:
+  name: {{ .Release.Name }}-ca
+spec:
+  projections:
+    - type: CACert
+      sourceSecretName: {{ .Release.Name }}-ca
+      sourceKey: ca.crt
+{{- end }}
@@ -107,6 +107,72 @@ tests:
           value: false
         documentIndex: 3
 
+  ###################################################
+  # Key-bearing Secrets stay invisible to tenants   #
+  ###################################################
+
+  # Both Certificates below mint a private key. Neither may carry the labels
+  # the tenant read path selects on; only the controller-authored projection
+  # may.
+  #
+  # That path has two gates and this label is the second one. tenantsecrets
+  # serves Secrets labelled internal.cozystack.io/tenantresource=true, and the
+  # lineage webhook sets that by matching the Secret against the application
+  # definition's spec.secrets selectors, one of which is the tenant-ca label
+  # below. It only gets that far for a Secret whose owner it can resolve:
+  # pkg/lineage walks ownerReferences, then falls back to a
+  # helm.toolkit.fluxcd.io/name label, and returns no owner otherwise, in
+  # which case the webhook stamps nothing at all. A Secret cert-manager writes
+  # has neither while enableCertificateOwnerRef is false, which is how
+  # cert-manager ships here, so the label on its own is inert today.
+  #
+  # It stops being inert under --enable-certificate-owner-ref, which puts an
+  # ownerReference to the Certificate on the Secret, and the Certificate does
+  # carry the Flux label the walk needs. Same if a secretTemplate ever copies
+  # that label across. So the guard is not protecting against today's config;
+  # it is keeping a cluster flag from being what decides whether the CA
+  # private key is tenant-readable.
+  #
+  # Selected by the Secret each Certificate writes rather than by position: a
+  # documentIndex would follow the slot, so reordering this template would let
+  # a labelled key-bearing Certificate slide out from under the assertion and
+  # pass green.
+  - it: the key-bearing CA Secret is never marked tenant-readable
+    release:
+      name: test-qdrant
+      namespace: tenant-test
+    set:
+      tls:
+        enabled: true
+      _cluster:
+        cluster-domain: cozy.local
+    documentSelector:
+      path: spec.secretName
+      value: test-qdrant-ca
+    asserts:
+      - notExists:
+          path: spec.secretTemplate.labels["internal.cozystack.io/tenant-ca"]
+      - notExists:
+          path: spec.secretTemplate.labels["internal.cozystack.io/tenantresource"]
+
+  - it: the key-bearing leaf Secret is never marked tenant-readable
+    release:
+      name: test-qdrant
+      namespace: tenant-test
+    set:
+      tls:
+        enabled: true
+      _cluster:
+        cluster-domain: cozy.local
+    documentSelector:
+      path: spec.secretName
+      value: test-qdrant-tls
+    asserts:
+      - notExists:
+          path: spec.secretTemplate.labels["internal.cozystack.io/tenant-ca"]
+      - notExists:
+          path: spec.secretTemplate.labels["internal.cozystack.io/tenantresource"]
+
   - it: leaf cert has server auth and client auth EKU
     release:
       name: test-qdrant