Merge "Fix trailing comma bug in DockerWorker.generate_tls()" into stable/2026.1

2 files changed, 62 insertions, 2 deletions

diff --git a/ansible/module_utils/kolla_docker_worker.py b/ansible/module_utils/kolla_docker_worker.py
index f488bab66..db41d5599 100644
--- a/ansible/module_utils/kolla_docker_worker.py
+++ b/ansible/module_utils/kolla_docker_worker.py
@@ -41,8 +41,8 @@ class DockerWorker(ContainerWorker):
 
     def generate_tls(self):
         tls = {'verify': self.params.get('tls_verify')}
-        tls_cert = self.params.get('tls_cert'),
-        tls_key = self.params.get('tls_key'),
+        tls_cert = self.params.get('tls_cert')
+        tls_key = self.params.get('tls_key')
         tls_cacert = self.params.get('tls_cacert')
 
         if tls['verify']:
diff --git a/tests/kolla_container_tests/test_docker_worker.py b/tests/kolla_container_tests/test_docker_worker.py
index e32da66cb..90f1a2d41 100644
--- a/tests/kolla_container_tests/test_docker_worker.py
+++ b/tests/kolla_container_tests/test_docker_worker.py
@@ -1161,6 +1161,66 @@ class TestVolume(base.BaseTestCase):
         )
 
 
+class TestTLS(base.BaseTestCase):
+
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_disabled_by_default(self, mock_tls_config):
+        self.dw = get_DockerWorker({'name': 'test_container'})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(verify=None)
+
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_enabled_no_certs(self, mock_tls_config):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(verify=True)
+
+    @mock.patch('os.path.isfile', return_value=True)
+    @mock.patch('os.access', return_value=True)
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_with_client_cert_and_key(self, mock_tls_config,
+                                                 mock_access, mock_isfile):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True,
+            'tls_cert': '/path/to/cert.pem',
+            'tls_key': '/path/to/key.pem'})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(
+            verify=True,
+            client_cert=('/path/to/cert.pem', '/path/to/key.pem'))
+
+    @mock.patch('os.path.isfile', return_value=True)
+    @mock.patch('os.access', return_value=True)
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_with_cacert(self, mock_tls_config,
+                                    mock_access, mock_isfile):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True,
+            'tls_cacert': '/path/to/ca.pem'})
+        self.dw.generate_tls()
+        mock_tls_config.assert_called_once_with(
+            verify='/path/to/ca.pem')
+
+    @mock.patch('os.path.isfile', return_value=False)
+    @mock.patch('os.access', return_value=True)
+    @mock.patch('docker.tls.TLSConfig')
+    def test_tls_verify_cert_file_missing_fails(self, mock_tls_config,
+                                                mock_access, mock_isfile):
+        self.dw = get_DockerWorker({
+            'name': 'test_container',
+            'tls_verify': True,
+            'tls_cert': '/missing/cert.pem',
+            'tls_key': '/missing/key.pem'})
+        self.dw.generate_tls()
+        self.dw.module.fail_json.assert_any_call(
+            failed=True,
+            msg='There is no file at "/missing/cert.pem"')
+
+
 class TestAttrComp(base.BaseTestCase):
 
     def setUp(self):