Repository navigation
OpenSearch: model the new tls field (upstream cozystack#2682) #41
Description
cozystack/cozystack#2682 adds a tls object to packages/apps/opensearch/values.schema.json:
tls:
enabled: bool # tri-state: unset follows external, true/false overrideThe provider models tls for postgres, kafka, nats and qdrant but not for opensearch, so a cozystack_opensearch resource cannot set it.
The one thing not to copy from those four is a default. enabled is deliberately tri-state: when the key is absent the chart turns TLS on for external: true instances and leaves it off otherwise, and an explicit false disables it even for external ones. An Optional+Computed bool with Default: booldefault.StaticBool(false) would send that false on every plan and switch TLS off on every external instance the provider manages. Model it optional with no default and only send it when the user set it.
Activity
lexfrei commentedon Sep 2, 2026
One sequencing note, and it holds for #37, #40 and #42 as well. The provider's
assertSpecCoverageguard checks the keysexpandemits against the json tags of the pinnedgithub.com/cozystack/cozystack/api/apps/v1alpha1(v1.6.1 in go.mod today), and thetlsfield only exists on the cozystack branch until it ships in a release tag. So a provider PR for this cannot go green before that tag lands and the pin is bumped; the issue can be picked up when the cozystack PR merges, and the pin bump comes first.lexfrei commentedon Sep 10, 2026
The field changed shape upstream before merging, so the model above is out of date. It is now an enum rather than a bool:
It was renamed because
enableddid not describe what it does: TLS is served under both values and the field picks who issues the HTTP server certificate, soenabled: falsenever turned TLS off. mariadb spells the same thing the same way.The tri-state warning still stands and matters more now, since an enum has no natural zero value: unset follows
external, cert-manager for external instances and the operator otherwise, and an explicit value wins either way. Model it optional with no default and send it only when the user set it. ADefaultof either string would move every managed instance to that issuer on the next plan, which reissues certificates and re-anchors clients.feat(opensearch)!: issue HTTP and Dashboards certificates from cert-m…