sunsingerus · Jun 24, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 19, 2026 · Jun 19, 2026
diff --git a/tests/e2e/manifests/chi/test-030008-permissive-non-fips.yaml b/tests/e2e/manifests/chi/test-030008-permissive-non-fips.yaml
@@ -0,0 +1,21 @@
+apiVersion: "clickhouse.altinity.com/v1"
+kind: "ClickHouseInstallation"
+metadata:
+  name: test-030008-permissive-non-fips
+spec:
+  configuration:
+    clusters:
+      - name: default
+        layout:
+          shardsCount: 1
+          replicasCount: 1
+  templates:
+    podTemplates:
+      - name: non-fips
+        spec:
+          containers:
+            - name: clickhouse-pod
+              image: altinity/clickhouse-server:25.8.16.10002.altinitystable
+  defaults:
+    templates:
+      podTemplate: non-fips
diff --git a/tests/e2e/manifests/chi/test-030016.yaml b/tests/e2e/manifests/chi/test-030016.yaml
@@ -0,0 +1,80 @@
+apiVersion: "clickhouse.altinity.com/v1"
+kind: "ClickHouseInstallation"
+metadata:
+  name: test-030009
+spec:
+  defaults:
+    templates:
+      podTemplate: test-030009
+  templates:
+    podTemplates:
+      - name: test-030009
+        spec:
+          containers:
+            - name: clickhouse
+              image: altinity/clickhouse-server:25.3.8.30001.altinityfips
+  security:
+    clickhouse:
+      tls:
+        rootCASecretRef:
+          name: clickhouse-certs
+          key: ca.crt
+  configuration:
+    clusters:
+      - name: default
+        secure: "yes"
+        insecure: "no"
+        layout:
+          shardsCount: 1
+          replicasCount: 1
+    settings:
+      http_port: _removed_
+      tcp_port: _removed_
+      interserver_http_port: _removed_
+      mysql_port: _removed_
+      postgresql_port: _removed_
+      https_port: 8443
+      tcp_port_secure: 9440
+      interserver_https_port: 9010
+    files:
+      openssl.xml: |
+        <yandex>
+          <openSSL>
+            <server>
+              <certificateFile>/etc/clickhouse-server/secrets.d/server.crt/clickhouse-certs/server.crt</certificateFile>
+              <privateKeyFile>/etc/clickhouse-server/secrets.d/server.key/clickhouse-certs/server.key</privateKeyFile>
+              <dhParamsFile>/etc/clickhouse-server/secrets.d/dhparam.pem/clickhouse-certs/dhparam.pem</dhParamsFile>
+              <verificationMode>none</verificationMode>
+              <disableProtocols>sslv2,sslv3,tlsv1,tlsv1_1</disableProtocols>
+              <cipherList>ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256</cipherList>
+              <preferServerCiphers>true</preferServerCiphers>
+            </server>
+            <client>
+              <caConfig>/etc/clickhouse-server/secrets.d/ca.crt/clickhouse-certs/ca.crt</caConfig>
+              <loadDefaultCAFile>false</loadDefaultCAFile>
+              <verificationMode>strict</verificationMode>
+              <disableProtocols>sslv2,sslv3,tlsv1,tlsv1_1</disableProtocols>
+              <cipherList>ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256</cipherList>
+            </client>
+          </openSSL>
+        </yandex>
+      server.crt:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-certs
+            key: server.crt
+      server.key:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-certs
+            key: server.key
+      dhparam.pem:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-certs
+            key: dhparam.pem
+      ca.crt:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-certs
+            key: ca.crt
diff --git a/tests/e2e/manifests/chi/test-035-2-sustained-not-ready.yaml b/tests/e2e/manifests/chi/test-035-2-sustained-not-ready.yaml
@@ -31,6 +31,15 @@ spec:
                 initialDelaySeconds: 1
                 periodSeconds: 2
                 failureThreshold: 1
+              livenessProbe:
+                exec:
+                  command:
+                    - "/bin/bash"
+                    - "-c"
+                    - "test -f /tmp/ready"
+                initialDelaySeconds: 1
+                periodSeconds: 2
+                failureThreshold: 3
   defaults:
     templates:
       podTemplate: readiness-flap
diff --git a/tests/e2e/manifests/chopconf/test-030008-permissive-chopconf.yaml b/tests/e2e/manifests/chopconf/test-030008-permissive-chopconf.yaml
@@ -0,0 +1,8 @@
+apiVersion: "clickhouse.altinity.com/v1"
+kind: "ClickHouseOperatorConfiguration"
+metadata:
+  name: "test-030008-permissive-chopconf"
+spec:
+  security:
+    images:
+      policy: Permissive
diff --git a/tests/e2e/manifests/secret/test-058-secret.yaml b/tests/e2e/manifests/secret/test-058-secret.yaml
@@ -7,70 +7,72 @@ type: Opaque
 stringData:
   ca.crt: |-
     -----BEGIN CERTIFICATE-----
-    MIIDFzCCAf+gAwIBAgIUKPAilo3+YvoeiIkvieiBp5GaXYUwDQYJKoZIhvcNAQEL
-    BQAwGzEZMBcGA1UEAwwQbWFyc25ldC5sb2NhbCBDQTAeFw0yNTA2MTkxMzE1MDda
-    Fw0yODA2MTgxMzE1MDdaMBsxGTAXBgNVBAMMEG1hcnNuZXQubG9jYWwgQ0EwggEi
-    MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCv5k1vd7s1KrPnENFB9Tw0dtYT
-    wlIzpulIKuXmbEGNXIB9SEV69A7UxUZrwF585kFX91LVq+SOb3WD0/KWjs7N+hXq
-    RLiLuObBVrehoFFRHUca/JZS3Gz9Wsrlsr8twnX5pxavfmnhXOdw/+3P47e22kQ8
-    zeAKaSfJ2wF9U9gic/uQWZmLUohrUaT0AejSQpXMm2dlk4ZhBos5BnDbQ+R+rsXu
-    WiTR4aS3W5Not/mV9neVJZpv2k5+02G0Wdhwy93Q44kEezSVBnSz3hvzEI5RmA72
-    LhqTR/Z3y7wZf57vxkqKjqaampwzIhFxtcpAl3j+UVHPV7WkrJ59OkfaxLdtAgMB
-    AAGjUzBRMB0GA1UdDgQWBBSPxwYV5VGN3/J5N8ipfzefxQyvAjAfBgNVHSMEGDAW
-    gBSPxwYV5VGN3/J5N8ipfzefxQyvAjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
-    DQEBCwUAA4IBAQCAKisQ/Ez9t88CzbrKkC4MA7rqLvHwV33sC9ttbsILk5kwvlyQ
-    yeeVYme6+KyK28UzuvUQrge6+JY4a33ki4G+gcltXHUaCxSWMGl20Kx++533uH4W
-    bLXmEPDsR1iPh+sl+3zJBs/aH3HSovBeaLu0pFRupKW5HWDDxgBz92JLVHfqHfY5
-    U4bHqOiLopbcRKOQTRAqP9IQsbCmVr4PU8/LWvdMWrYTpn5IIcq1CD0GpunQBxv1
-    N7YosHN5QijMvdHVTdR1B7m3ylJa5cVUPaR6HDrDkXJibaFdZBa0eIXZc3KwTon3
-    q/+BIPQNS7JiXY82j8OC2HcPFSuS7t5wqcQN
+    MIIDFzCCAf+gAwIBAgIUedodKbILyx2B9pb1EZgpr+1pzCcwDQYJKoZIhvcNAQEL
+    BQAwGzEZMBcGA1UEAwwQbWFyc25ldC5sb2NhbCBDQTAeFw0yNjA2MTkxODE2MTRa
+    Fw0zNjA2MTYxODE2MTRaMBsxGTAXBgNVBAMMEG1hcnNuZXQubG9jYWwgQ0EwggEi
+    MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1ubZ1rjGb+oRp5Uwl7W5ZFPuH
+    y1r0Q/+kzm/hp45xWP/oSvt6ltPTqdZsqg0EB7M0Nv5Rdhunv/W0qhUB4QaWNWt6
+    zVrIMjPtCZ/iTEinhNjWA0Ib9kTkCwzecvhz+P3rZXdu70jTdlBnnwIy0MXCnfnY
+    dCWfJFX6glgbiElFYjfcHli+1+BFL0XS+Ah5U0nNaY+Kx2gK8Mg5fYBbladszi21
+    k84kPphb6jWpTQaEqYePSHryQWsWzOtmyyYLGtrnaepOU7OjO+ATtfm7BIPztewT
+    Cheo/xSDRDJjHak1DgvPvcSGIFSxrMO+u3Ob55H109olBFAlMt6wPCKgCxBJAgMB
+    AAGjUzBRMB0GA1UdDgQWBBRBsK0WTIVB0By9aKbmOzaFMwkaGzAfBgNVHSMEGDAW
+    gBRBsK0WTIVB0By9aKbmOzaFMwkaGzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+    DQEBCwUAA4IBAQAtDF1q3C2HVzsxjcCwAFDJ8o6Gb91fLOMqtJaiyJd4loWiTd2g
+    TAZWKAgt8d4SoKdlB72L3igWDHiVf+bA2fB2/CkrVyFG3Z/B3D3p+lqP29SE6zEX
+    luL7uFcSWcer9SAv/sQL6iw8djOlAxGvqvF4UhDdg7mMgSa+0bugdRe+q5IhWbEy
+    iD+yHZMBcFglDuaIK2I5Vq7TRjcAe0rdhzY5aaPm8brbk8F/dd9PRKA9TSe12BlA
+    jlziq3YlrKZ4CI3PpcXbFWVNOEMYUniIjs67YA/mDcEQkg1m7aHSteQ3MynALcOj
+    9ER8pWfYNorCogEPg7qTIaRDrMmH8axSaVkJ
     -----END CERTIFICATE-----
   server.crt: |-
     -----BEGIN CERTIFICATE-----
-    MIIDJTCCAg2gAwIBAgIUFZBt5OVfoThrbao6LQ+CA1c2538wDQYJKoZIhvcNAQEL
-    BQAwGzEZMBcGA1UEAwwQbWFyc25ldC5sb2NhbCBDQTAeFw0yNTA2MTkxMzE2MTNa
-    Fw0yNjA2MTkxMzE2MTNaMBIxEDAOBgNVBAMMB2Nobm9kZTEwggEiMA0GCSqGSIb3
-    DQEBAQUAA4IBDwAwggEKAoIBAQDMqNisnlgEiRTYCk1dEvgcRN7FQiNDxwWKSGjo
-    zhsbQYmS7ZcRD6wRKQD9Sb62eKtPGvrOrC5dIdTWgBFMPbbkrlGgYisoD8GDRKN0
-    Bw8E0/g8eC+jl2TjwZ4F+zsJeMZXhchJeXFCrMTF5t/NuetMVMqxwe4mA+5RB4hW
-    rlxwJ4PPdgNBb9nJ5X28cDnLkrfexnd4UY+Ckp
BD0
Fs6BkE1uVxFg+UQ38R1wnsE/up
-    Yj1MSbDig3gcz9UmHyAeUFyEoZmyxbJ53b/tVA1HgENnP6n/nN0FG8N6z3yolKk2
-    xjdHHEJTkuA9dzvO3zRLS+0z/XeJJRed2AJ0SOD2Qs3ntY3/AgMBAAGjajBoMCYG
-    A1UdEQQfMB2CFWNobm9kZTEubWFyc25ldC5sb2NhbIcEwKgB3TAdBgNVHQ4EFgQU
-    3E9tBAiCqqJLSVQKi5sXzHLC9PkwHwYDVR0jBBgwFoAUj8cGFeVRjd/yeTfIqX83
-    n8UMrwIwDQYJKoZIhvcNAQELBQADggEBABQIXDzlc/wINnkSfcncEAfIY5WvVTdl
-    Nilr6nVd1Fgq7JAlVD1WrbZ52xZLK3xg+T99Wezks/Js9x243DWt+qwlCKe/xlrC
-    ezzI3BunnhRxw/7IRm0soTvPNNImcZ2Fuwhn/ojlOg+37NttdTLKlJu2+RguRWLf
-    95sXdxhhfTWrkhe1gWFmmDyl02hFpWRO1A/Ogy+hJ+yuruTrlokcM5zJ1L50kyi5
-    iL3/ZXMZxWw1BDSSXlbUUZQnwXJuHQbVTd4NwRO6tLVlQyNj45gRf3WeygVzbQmq
-    sAjL7iOqF7iCwHEri5FWyDJ0Sj5b2YJKV1LLIEMiE8dJesN0O+OlH9U=
+    MIIDXjCCAkagAwIBAgIUdEhy/CkXE5rcDiG78vqri1g5RiUwDQYJKoZIhvcNAQEL
+    BQAwGzEZMBcGA1UEAwwQbWFyc25ldC5sb2NhbCBDQTAeFw0yNjA2MTkxODE2MTRa
+    Fw0yOTA2MTgxODE2MTRaMBIxEDAOBgNVBAMMB2Nobm9kZTEwggEiMA0GCSqGSIb3
+    DQEBAQUAA4IBDwAwggEKAoIBAQDPf9HxzkRKAtnL5YbLzyn3tzkbyeKeJuyGptOC
+    +0oSS17Ssj72fR5FBcIvsPFg7LTtSf+6lEO9uMrWhib8/dygvDv85fBUTVkSj2ol
+    vUnJrDPrhapfAsbGjhLDr/gjXMSnWp+E9gLo+GB3gHhLqDpAWfYZMEaW9jW+7TO5
+    7EliRCY/devUJPN4JMF91OGDmdqsLkYKdkUxmLkFxCCKfHwfV1adO9zwG1NFz6l4
+    KSN8VF8rAXfw6mB9IrXoqW3Wub2YcikhXhq7FqE5yXcHBnR6DkypUVpns8+sfWEe
+    N/uoDunvaPk4Pibe7r9aOsonYzqUyOma0sHqCMg5Ze2Zj4N9AgMBAAGjgaIwgZ8w
+    SAYDVR0RBEEwP4IVY2hub2RlMS5tYXJzbmV0LmxvY2FsgiBjaGktdGVzdC0wNTgt
+    cm9vdC1jYS1kZWZhdWx0LTAtMIcEwKgB3TATBgNVHSUEDDAKBggrBgEFBQcDATAd
+    BgNVHQ4EFgQUEutarWBu1ZsicSVA4j3SftBlsfIwHwYDVR0jBBgwFoAUQbCtFkyF
+    QdAcvWim5js2hTMJGhswDQYJKoZIhvcNAQELBQADggEBAHmG8J/HsdOHbZ8L28WS
+    wNJcAfC3g6rVAqm7qbYUzAUeBDB4SroFaydLecBN8DupaKT0JzCm5HetxLiqQ+M3
+    kQ8qij6hTtafvNMJzsRnJLw7zRV5fSiNAOcZWEEM7sOMKlKtPMq3dkoUTLddWJ9J
+    GuJ3oWUf0csgMmuzmhurzKb1TlbF3elv4u5g1K9bpwny5kSRyDLVcpFW39JzKwmR
+    NmtTVrEGLcAwfD6hRpl8ITN5pfDHfNg3BYkawB4obl1QI7K+1sPbwyliguojiuXo
+    a157F6fQCAN2WoQxDbmueenqFRnapZu4nBm0HSZqxU7CYSpCWBidlLZebP1oW6WW
+    D6I=
     -----END CERTIFICATE-----
   server.key: |-
     -----BEGIN PRIVATE KEY-----
-    MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDMqNisnlgEiRTY
-    Ck1dEvgcRN7FQiNDxwWKSGjozhsbQYmS7ZcRD6wRKQD9Sb62eKtPGvrOrC5dIdTW
-    gBFMPbbkrlGgYisoD8GDRKN0Bw8E0/g8eC+jl2TjwZ4F+zsJeMZXhchJeXFCrMTF
-    5t/NuetMVMqxwe4mA+5RB4hWrlxwJ4PPdgNBb9nJ5X28cDnLkrfexnd4UY+CkpFs
-    6BkE1uVxFg+UQ38R1wnsE/upYj1MSbDig3gcz9UmHyAeUFyEoZmyxbJ53b/tVA1H
-    gENnP6n/nN0FG8N6z3yolKk2xjdHHEJTkuA9dzvO3zRLS+0z/XeJJRed2AJ0SOD2
-    Qs3ntY3/AgMBAAECggEAL9/Nc6/Esibo79KVH1EZJe+8VtNuUWQEeUEP/Wl9MMaH
-    ao3WeUC7xPXdC+MM0D1xAVuz0NW5MMMBuT2TDk0fc+YNJSHhq4joAQ901ubxzfTR
-    zD9nEXMQQDDiCM8ok8IjT4T1ga59XpXwn8SulL7Jen0ZPzS4wz7HKEBFVdWKvRct
-    24mW0H45ea5M6V1XUaMvzWSHbuFpT6C1MhvjdyEoNGvwbvw+xwwEc8W3tnEAP63d
-    8wWPQf9kecVWbvg6ck8ufIfJnEMOR7u20V0sNki/JtD9mRCWEEn2wLunzflYW23x
-    WHrhPtz0wwoZLLGB2mn8+E9BNgXf06V/2Iitvrwz3QKBgQD2xq4/9H9wjsCAqK/0
-    sth4JOIpmCcMT77Vz2iwjkrkJehpS6j1By3FOzQSQkaG8G2j/f9Zr8ofiscU1V/n
-    B+4ghGl21gZcCzxi67Ygp8rSTUN+ocpHODGN26jIUk8Jtf6c0BsiHJU5CrdcDwm5
-    voR5Y1Ixaq5PWpegatUc1GUPKwKBgQDUTyqYyuOA4ul/bt8xYlO+puQ3G8ITTLW2
-    JB8a7jdjED7+XMOwWh4CW9M81dnIVP6UyfCdPlSC3W6q3p/DgMPbtV1w93L9AXpS
-    HN5wrFqPUKAuXqxIWrIwDCk6oRmvQMXui/jUGZUHDK47h5EeU/PbDOWvWSSKzlNW
-    q3985tRyfQKBgQCVuMFryBmx3spoxO/MlN3FNwuIlOnMDG4KJwaraAmEFoPFrsPZ
-    tftNGLhlA5TqteCviKFudrs5G+fhefvvnd4aGHwsP3ooSiDfG4eqlGL36Sy0HdEu
-    GKfoG4dx0o5lo+fQmGp97b2TmC7bSbxq125kf6AUn1cWii5Ig8i87xhJdQKBgEmB
-    RzwzMmUTKshl+Hw+kMP3QBgcUisgaeEvzF0kkKSJoWWrdE0ARleGtzHe0FHdq26U
-    I+wtAlF0nLYn8aRcVnMg7cMIyRTziAgZ2qGj6o6n2W10da1vSTX9X+DemeflQyH9
-    8B5u5PvV1hTiMMoRQuJaKsN014P/PzdIlREHUhJ5AoGBAOODAt0nM4Jz4u8DykI/
-    sPjMZ0yY62FWdAvzbIZAiZ/OPPE+fV1OGAsakot01mAym9xWM7kgIt3oWDPfaLN1
-    vyt/evXV9YfnyVbhLfxbonhCWHRCiLE7CTulbQpdDkYx6D87SmEdtKbmJa4lwpVK
-    zBy5BhOMzamzojiV/4d1B30k
+    MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDPf9HxzkRKAtnL
+    5YbLzyn3tzkbyeKeJuyGptOC+0oSS17Ssj72fR5FBcIvsPFg7LTtSf+6lEO9uMrW
+    hib8/dygvDv85fBUTVkSj2olvUnJrDPrhapfAsbGjhLDr/gjXMSnWp+E9gLo+GB3
+    gHhLqDpAWfYZMEaW9jW+7TO57EliRCY/devUJPN4JMF91OGDmdqsLkYKdkUxmLkF
+    xCCKfHwfV1adO9zwG1NFz6l4KSN8VF8rAXfw6mB9IrXoqW3Wub2YcikhXhq7FqE5
+    yXcHBnR6DkypUVpns8+sfWEeN/uoDunvaPk4Pibe7r9aOsonYzqUyOma0sHqCMg5
+    Ze2Zj4N9AgMBAAECggEAH4beubwq0Qn02I+DtxS/XiVnFmtKtNfaKS1Qxr5yhywP
+    eLjfaykgf8E7u25Jhn4AkWskYU9kqX9ZxlV0uAzESGHBRZAUP2LPLUxABwLnIq64
+    5siU1cHAvOtaO4RRkeHm+TyCLzwHvij60z1gSbKCQ0PH6hTVLNu019EHgnC9x6Go
+    GoCsaCeVghE7FjhM7L0UsP8/9sI7QUPJ7tgi8wMVzFGmx3Yg0pE/DyOIqkHCo5YQ
+    /87KAhXbFMkSM7ZuDxuXbw98Kdf7cxuFfH5zvYlt7X4S/U6EBtHJZNLYkoRcMu5/
+    DzYk5AgPqz8ws0UKubDLDRQbsRtj7EQTX2zz3s0fEQKBgQDm5m/SACxp5sLeF30E
+    KQ+TRMPs8sNnMDTpb80fDmmspdH7T/Lzn07trhaYOUXz7DsNJiI0czlgy7mZ+fu9
+    /lNFlCuXM6BH3ryFFPSEsMlZbJHvil7XdtBsQ31KCU1RMDDNMhhMZroIAdM17Tha
+    MjxKYNeGt5BMqMCFtswU6ZMGmQKBgQDmDi1SnIDbR+l5mDWQlbW6uIriVBJnCTEH
+    rhQQBPl0AOuJHOcA0lvGL3GZxGkRyFu88nT151WShyC2TyYql927p2PivL+uGB0p
+    6SmGKlk+0PdU5aDc91iXZDZW4f0ESfVuSLFTkG8wJS/mYPIWHFHXQV81lR068T/W
+    IfoomSGGhQKBgGhJa/fNXEH4l8r3kN9wLDi3tkYu31Kb00ob1OlR+SihPFXlpjWi
+    nmN7XXkjZRTmfUVTE9/cqu2tFgcVgT4uwC2M3qNMDfhoAX2aGVZVApwBDWjDdlKa
+    t0gus0fdK66ftWr4VUEspJk5OcwBeJJEXja5xp5yChqVnV7HUSWg2WcBAoGAXsys
+    xIQVXUcO4LpmKERo9J6jLIy0YJ0bBS0ou0kxein+5StxzZbhlpNqXpDfMyK7GutW
+    YxaG3rCsPDP1aEvYZUGfGYnp+tWY/vJD2DOPPyFhKizN0wBiE1CKS9coKiJH7sAp
+    wmOcTdylFmwQlifpWahokW3285kCUz0BFsWzWPkCgYAm+ESRUwlqsybGf4yTyOLO
+    DDamA6WL35Je5HjzS8HzjBNRWdPtuQGyVxg+ZB/oVYBF5ga3EcL8MBPTuNFEtYM6
+    OMLIJjJW/DNEAuXgv47ZFo5EtqY0M9C5dCS+MyiCRjMNPUbw8OpzrGgJnLkchCdN
+    toco0TrtKpHDTpJZCPMiIg==
     -----END PRIVATE KEY-----