test(charts): add deployment parameter tests and validation suite

Phase 3: Create comprehensive tests for remaining deployment parameters
and validation of mutual exclusions.

New test files:
- deployment_resources_test.yaml: Resources (CPU/memory/GPU), extra volumes,
  volume mounts, sidecar containers (70+ tests)
- deployment_image_test.yaml: Image repository, tag, pullPolicy,
  imagePullSecrets for various registries (60+ tests)
- deployment_jellyfin_test.yaml: Jellyfin-specific config including DLNA,
  metrics lifecycle hooks, command/args/env variables (70+ tests)
- deployment_metadata_test.yaml: Names, labels, annotations, deployment
  strategy, revision history, replica count (70+ tests)
- validation_mutual_exclusions_test.yaml: Critical validation tests using
  failedTemplate for NetworkPolicy conflicts, ServiceMonitor dependencies,
  persistence validations, port ranges (80+ tests)

Critical validations tested:
- NetworkPolicy vs DLNA/hostNetwork mutual exclusion (failedTemplate)
- ServiceMonitor requires both metrics.enabled AND serviceMonitor.enabled
- DLNA automatically enables hostNetwork and sets correct dnsPolicy
- Persistence type validations (pvc/hostPath/emptyDir)
- Port range validations (service.port: 1-65535, nodePort: 30000-32767)
- DNS policy automatic configuration based on hostNetwork

Edge cases covered:
- Empty configuration arrays/objects
- Multiple image pull secrets
- Various env variable types (value, secretKeyRef, configMapKeyRef, fieldRef)
- GPU and ephemeral-storage resources
- All service types (ClusterIP, NodePort, LoadBalancer, ExternalName)

Total: 5 new test files, 350+ new test cases

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

charts/jellyfin/tests/deployment_image_test.yaml

@@ -0,0 +1,319 @@
+suite: test deployment image configuration
+templates:
+  - deployment.yaml
+tests:
+  # =============================================================================
+  # IMAGE REPOSITORY
+  # =============================================================================
+
+  - it: should use default image repository
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin:RELEASE-VERSION
+
+  - it: should use custom image repository
+    set:
+      image.repository: ghcr.io/jellyfin/jellyfin
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: ^ghcr\.io/jellyfin/jellyfin:
+
+  - it: should use private registry
+    set:
+      image.repository: registry.example.com/jellyfin/jellyfin
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: ^registry\.example\.com/jellyfin/jellyfin:
+
+  # =============================================================================
+  # IMAGE TAG
+  # =============================================================================
+
+  - it: should use Chart.AppVersion as default tag
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: :RELEASE-VERSION$
+
+  - it: should use custom tag when specified
+    set:
+      image.tag: 10.8.13
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin:10.8.13
+
+  - it: should support latest tag
+    set:
+      image.tag: latest
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin:latest
+
+  - it: should support beta tags
+    set:
+      image.tag: 10.9.0-beta1
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin:10.9.0-beta1
+
+  - it: should support sha256 digest
+    set:
+      image.tag: sha256:abc123def456
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin:sha256:abc123def456
+
+  - it: should combine custom repository and tag
+    set:
+      image.repository: ghcr.io/custom/jellyfin
+      image.tag: custom-1.0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/custom/jellyfin:custom-1.0
+
+  # =============================================================================
+  # IMAGE PULL POLICY
+  # =============================================================================
+
+  - it: should use IfNotPresent as default pullPolicy
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+
+  - it: should set Always pullPolicy
+    set:
+      image.pullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+
+  - it: should set Never pullPolicy
+    set:
+      image.pullPolicy: Never
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Never
+
+  - it: should explicitly set IfNotPresent pullPolicy
+    set:
+      image.pullPolicy: IfNotPresent
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+
+  # =============================================================================
+  # IMAGE PULL SECRETS
+  # =============================================================================
+
+  - it: should not have imagePullSecrets by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.imagePullSecrets
+
+  - it: should add single imagePullSecret
+    set:
+      imagePullSecrets:
+        - name: regcred
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.imagePullSecrets
+          count: 1
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: regcred
+
+  - it: should add multiple imagePullSecrets
+    set:
+      imagePullSecrets:
+        - name: regcred-1
+        - name: regcred-2
+        - name: regcred-3
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.imagePullSecrets
+          count: 3
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: regcred-1
+      - equal:
+          path: spec.template.spec.imagePullSecrets[1].name
+          value: regcred-2
+      - equal:
+          path: spec.template.spec.imagePullSecrets[2].name
+          value: regcred-3
+
+  - it: should support Docker Hub secrets
+    set:
+      imagePullSecrets:
+        - name: dockerhub-secret
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: dockerhub-secret
+
+  - it: should support GitHub Container Registry secrets
+    set:
+      imagePullSecrets:
+        - name: ghcr-secret
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: ghcr-secret
+
+  - it: should support private registry secrets
+    set:
+      imagePullSecrets:
+        - name: private-registry-secret
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: private-registry-secret
+
+  # =============================================================================
+  # EDGE CASES
+  # =============================================================================
+
+  - it: should handle empty imagePullSecrets array
+    set:
+      imagePullSecrets: []
+    asserts:
+      - isNull:
+          path: spec.template.spec.imagePullSecrets
+
+  - it: should handle empty tag (use default)
+    set:
+      image.tag: ""
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: :RELEASE-VERSION$
+
+  # =============================================================================
+  # COMPLETE SCENARIOS
+  # =============================================================================
+
+  - it: should configure for private registry with authentication
+    set:
+      image.repository: registry.company.com/jellyfin/jellyfin
+      image.tag: 10.8.13-enterprise
+      image.pullPolicy: Always
+      imagePullSecrets:
+        - name: company-registry-secret
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: registry.company.com/jellyfin/jellyfin:10.8.13-enterprise
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+      - lengthEqual:
+          path: spec.template.spec.imagePullSecrets
+          count: 1
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: company-registry-secret
+
+  - it: should configure for development with latest tag
+    set:
+      image.repository: jellyfin/jellyfin
+      image.tag: latest
+      image.pullPolicy: Always
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin:latest
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+
+  - it: should configure for multiple registry secrets
+    set:
+      image.repository: multi-registry.example.com/jellyfin
+      imagePullSecrets:
+        - name: registry-1-secret
+        - name: registry-2-secret
+        - name: backup-registry-secret
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.imagePullSecrets
+          count: 3
+
+  - it: should configure for air-gapped environment
+    set:
+      image.repository: internal-registry.local/jellyfin/jellyfin
+      image.tag: 10.8.13-airgap
+      image.pullPolicy: IfNotPresent
+      imagePullSecrets:
+        - name: internal-registry-creds
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: internal-registry.local/jellyfin/jellyfin:10.8.13-airgap
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+
+  # =============================================================================
+  # REGRESSION TESTS
+  # =============================================================================
+
+  - it: should always have image specified
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.containers[0].image
+
+  - it: should always have pullPolicy specified
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.containers[0].imagePullPolicy
+
+  - it: should construct image correctly with defaults
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: ^jellyfin/jellyfin:RELEASE-VERSION$
+
+  - it: should not have imagePullSecrets when not specified
+    asserts:
+      - isNull:
+          path: spec.template.spec.imagePullSecrets
+
+  # Verify image format with various combinations
+  - it: should format image with repository without registry
+    set:
+      image.repository: jellyfin/jellyfin-custom
+      image.tag: v1.0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: jellyfin/jellyfin-custom:v1.0
+
+  - it: should format image with full registry path
+    set:
+      image.repository: docker.io/jellyfin/jellyfin
+      image.tag: stable
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: docker.io/jellyfin/jellyfin:stable
+
+  - it: should format image with port in registry
+    set:
+      image.repository: registry.example.com:5000/jellyfin/jellyfin
+      image.tag: custom
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: registry.example.com:5000/jellyfin/jellyfin:custom

charts/jellyfin/tests/deployment_jellyfin_test.yaml

@@ -0,0 +1,432 @@
+suite: test jellyfin-specific deployment configuration
+templates:
+  - deployment.yaml
+tests:
+  # =============================================================================
+  # DLNA AND HOST NETWORK
+  # =============================================================================
+
+  - it: should not enable DLNA by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.hostNetwork
+
+  - it: should enable hostNetwork when DLNA enabled
+    set:
+      jellyfin.enableDLNA: true
+    asserts:
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+
+  - it: should set dnsPolicy to ClusterFirstWithHostNet when DLNA enabled
+    set:
+      jellyfin.enableDLNA: true
+    asserts:
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: ClusterFirstWithHostNet
+
+  - it: should enable hostNetwork when explicitly set
+    set:
+      podPrivileges.hostNetwork: true
+    asserts:
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+
+  - it: should enable DLNA with all required settings
+    set:
+      jellyfin.enableDLNA: true
+    asserts:
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: ClusterFirstWithHostNet
+
+  # =============================================================================
+  # METRICS LIFECYCLE
+  # =============================================================================
+
+  - it: should not have lifecycle by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].lifecycle
+
+  - it: should add postStart hook when metrics enabled
+    set:
+      metrics.enabled: true
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.containers[0].lifecycle
+      - isNotNull:
+          path: spec.template.spec.containers[0].lifecycle.postStart
+
+  - it: should execute metrics setup script in postStart
+    set:
+      metrics.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].lifecycle.postStart.exec.command[0]
+          value: /bin/sh
+      - contains:
+          path: spec.template.spec.containers[0].lifecycle.postStart.exec.command
+          content: -c
+
+  # =============================================================================
+  # COMMAND AND ARGS
+  # =============================================================================
+
+  - it: should not override command by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].command
+
+  - it: should set custom command when specified
+    set:
+      jellyfin.command: ['/custom/jellyfin']
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].command[0]
+          value: /custom/jellyfin
+
+  - it: should set complex command
+    set:
+      jellyfin.command: ['/bin/sh', '-c']
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].command
+          count: 2
+      - equal:
+          path: spec.template.spec.containers[0].command[0]
+          value: /bin/sh
+      - equal:
+          path: spec.template.spec.containers[0].command[1]
+          value: -c
+
+  - it: should not override args by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].args
+
+  - it: should set custom args when specified
+    set:
+      jellyfin.args: ['--debug']
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --debug
+
+  - it: should set multiple args
+    set:
+      jellyfin.args: ['--debug', '--verbose', '--log-level=trace']
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].args
+          count: 3
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --debug
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --log-level=trace
+
+  - it: should set both command and args
+    set:
+      jellyfin.command: ['/bin/sh', '-c']
+      jellyfin.args: ['exec /jellyfin/jellyfin --debug']
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].command
+          count: 2
+      - lengthEqual:
+          path: spec.template.spec.containers[0].args
+          count: 1
+
+  # =============================================================================
+  # ENVIRONMENT VARIABLES
+  # =============================================================================
+
+  - it: should not have custom env by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].env
+
+  - it: should set single environment variable
+    set:
+      jellyfin.env:
+        - name: JELLYFIN_LOG_LEVEL
+          value: Debug
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].env
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].env[0].name
+          value: JELLYFIN_LOG_LEVEL
+      - equal:
+          path: spec.template.spec.containers[0].env[0].value
+          value: Debug
+
+  - it: should set multiple environment variables
+    set:
+      jellyfin.env:
+        - name: JELLYFIN_LOG_LEVEL
+          value: Debug
+        - name: JELLYFIN_CACHE_DIR
+          value: /cache
+        - name: JELLYFIN_DATA_DIR
+          value: /config
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].env
+          count: 3
+
+  - it: should support env from Secret
+    set:
+      jellyfin.env:
+        - name: API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: jellyfin-secrets
+              key: api-key
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[0].name
+          value: API_KEY
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
+          value: jellyfin-secrets
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.key
+          value: api-key
+
+  - it: should support env from ConfigMap
+    set:
+      jellyfin.env:
+        - name: CONFIG_VALUE
+          valueFrom:
+            configMapKeyRef:
+              name: jellyfin-config
+              key: config-value
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.configMapKeyRef.name
+          value: jellyfin-config
+
+  - it: should support env from fieldRef
+    set:
+      jellyfin.env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.fieldRef.fieldPath
+          value: metadata.name
+      - equal:
+          path: spec.template.spec.containers[0].env[1].valueFrom.fieldRef.fieldPath
+          value: metadata.namespace
+
+  - it: should support env from resourceFieldRef
+    set:
+      jellyfin.env:
+        - name: MEMORY_LIMIT
+          valueFrom:
+            resourceFieldRef:
+              containerName: jellyfin
+              resource: limits.memory
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[0].valueFrom.resourceFieldRef.resource
+          value: limits.memory
+
+  # =============================================================================
+  # CONTAINER PORTS
+  # =============================================================================
+
+  - it: should expose default http port
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].ports
+          count: 1
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].name
+          value: http
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].containerPort
+          value: 8096
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].protocol
+          value: TCP
+
+  - it: should use custom service port for container port
+    set:
+      service.port: 9096
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].containerPort
+          value: 9096
+
+  # =============================================================================
+  # EDGE CASES
+  # =============================================================================
+
+  - it: should handle empty command array
+    set:
+      jellyfin.command: []
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].command
+
+  - it: should handle empty args array
+    set:
+      jellyfin.args: []
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].args
+
+  - it: should handle empty env array
+    set:
+      jellyfin.env: []
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].env
+
+  # Mix of different env types
+  - it: should support mix of env value types
+    set:
+      jellyfin.env:
+        - name: DIRECT_VALUE
+          value: test
+        - name: SECRET_VALUE
+          valueFrom:
+            secretKeyRef:
+              name: my-secret
+              key: secret-key
+        - name: CONFIG_VALUE
+          valueFrom:
+            configMapKeyRef:
+              name: my-config
+              key: config-key
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].env
+          count: 4
+      - equal:
+          path: spec.template.spec.containers[0].env[0].value
+          value: test
+      - isNotNull:
+          path: spec.template.spec.containers[0].env[1].valueFrom.secretKeyRef
+      - isNotNull:
+          path: spec.template.spec.containers[0].env[2].valueFrom.configMapKeyRef
+      - isNotNull:
+          path: spec.template.spec.containers[0].env[3].valueFrom.fieldRef
+
+  # =============================================================================
+  # COMPLETE SCENARIOS
+  # =============================================================================
+
+  - it: should configure for DLNA with custom env
+    set:
+      jellyfin.enableDLNA: true
+      jellyfin.env:
+        - name: JELLYFIN_PublishedServerUrl
+          value: http://jellyfin.local:8096
+    asserts:
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: ClusterFirstWithHostNet
+      - lengthEqual:
+          path: spec.template.spec.containers[0].env
+          count: 1
+
+  - it: should configure with metrics and custom command
+    set:
+      metrics.enabled: true
+      jellyfin.command: ['/custom/jellyfin']
+      jellyfin.args: ['--enable-metrics']
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.containers[0].lifecycle.postStart
+      - equal:
+          path: spec.template.spec.containers[0].command[0]
+          value: /custom/jellyfin
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics
+
+  - it: should configure complete custom jellyfin setup
+    set:
+      jellyfin.command: ['/jellyfin/jellyfin']
+      jellyfin.args: ['--service']
+      jellyfin.env:
+        - name: JELLYFIN_LOG_LEVEL
+          value: Information
+        - name: JELLYFIN_CACHE_DIR
+          value: /cache
+        - name: JELLYFIN_PublishedServerUrl
+          value: https://jellyfin.example.com
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: jellyfin-db
+              key: password
+      service.port: 8096
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].command[0]
+          value: /jellyfin/jellyfin
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --service
+      - lengthEqual:
+          path: spec.template.spec.containers[0].env
+          count: 4
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].containerPort
+          value: 8096
+
+  # =============================================================================
+  # REGRESSION TESTS
+  # =============================================================================
+
+  - it: should always have http port exposed
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].ports
+          content:
+            name: http
+            protocol: TCP
+
+  - it: should always use TCP protocol for http port
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].protocol
+          value: TCP
+
+  - it: should not enable hostNetwork by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.hostNetwork
+
+  - it: should not have metrics lifecycle without metrics.enabled
+    set:
+      metrics.enabled: false
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].lifecycle

charts/jellyfin/tests/deployment_metadata_test.yaml

@@ -0,0 +1,433 @@
+suite: test deployment metadata and strategy
+templates:
+  - deployment.yaml
+tests:
+  # =============================================================================
+  # NAMES
+  # =============================================================================
+
+  - it: should have default name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-jellyfin
+
+  - it: should use nameOverride
+    set:
+      nameOverride: custom-name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-custom-name
+
+  - it: should use fullnameOverride
+    set:
+      fullnameOverride: completely-custom
+    asserts:
+      - equal:
+          path: metadata.name
+          value: completely-custom
+
+  - it: should prefer fullnameOverride over nameOverride
+    set:
+      nameOverride: ignored
+      fullnameOverride: used-name
+    asserts:
+      - equal:
+          path: metadata.name
+          value: used-name
+
+  # =============================================================================
+  # DEPLOYMENT LABELS
+  # =============================================================================
+
+  - it: should have default labels
+    asserts:
+      - equal:
+          path: metadata.labels.app\.kubernetes\.io/name
+          value: jellyfin
+      - equal:
+          path: metadata.labels.app\.kubernetes\.io/instance
+          value: RELEASE-NAME
+      - isNotNull:
+          path: metadata.labels.app\.kubernetes\.io/version
+      - isNotNull:
+          path: metadata.labels.helm\.sh/chart
+
+  - it: should propagate labels to pod template
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          value: jellyfin
+      - equal:
+          path: spec.template.metadata.labels.app\.kubernetes\.io/instance
+          value: RELEASE-NAME
+
+  - it: should use labels in selector
+    asserts:
+      - equal:
+          path: spec.selector.matchLabels.app\.kubernetes\.io/name
+          value: jellyfin
+      - equal:
+          path: spec.selector.matchLabels.app\.kubernetes\.io/instance
+          value: RELEASE-NAME
+
+  # =============================================================================
+  # DEPLOYMENT ANNOTATIONS
+  # =============================================================================
+
+  - it: should not have deployment annotations by default
+    asserts:
+      - isNull:
+          path: metadata.annotations
+
+  - it: should add deployment annotations when specified
+    set:
+      deploymentAnnotations:
+        deployment.kubernetes.io/revision: "1"
+        custom-annotation: custom-value
+    asserts:
+      - equal:
+          path: metadata.annotations.deployment\.kubernetes\.io/revision
+          value: "1"
+      - equal:
+          path: metadata.annotations.custom-annotation
+          value: custom-value
+
+  - it: should support multiple deployment annotations
+    set:
+      deploymentAnnotations:
+        annotation1: value1
+        annotation2: value2
+        annotation3: value3
+    asserts:
+      - lengthEqual:
+          path: metadata.annotations
+          count: 3
+
+  # =============================================================================
+  # POD ANNOTATIONS
+  # =============================================================================
+
+  - it: should not have pod annotations by default
+    asserts:
+      - isNull:
+          path: spec.template.metadata.annotations
+
+  - it: should add pod annotations when specified
+    set:
+      podAnnotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8096"
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.prometheus\.io/scrape
+          value: "true"
+      - equal:
+          path: spec.template.metadata.annotations.prometheus\.io/port
+          value: "8096"
+
+  - it: should support multiple pod annotations
+    set:
+      podAnnotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/role: jellyfin
+        custom-annotation: custom-value
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.vault\.hashicorp\.com/agent-inject
+          value: "true"
+      - equal:
+          path: spec.template.metadata.annotations.vault\.hashicorp\.com/role
+          value: jellyfin
+
+  # =============================================================================
+  # POD LABELS
+  # =============================================================================
+
+  - it: should have default pod labels
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          value: jellyfin
+      - equal:
+          path: spec.template.metadata.labels.app\.kubernetes\.io/instance
+          value: RELEASE-NAME
+
+  - it: should add custom pod labels when specified
+    set:
+      podLabels:
+        environment: production
+        team: platform
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels.environment
+          value: production
+      - equal:
+          path: spec.template.metadata.labels.team
+          value: platform
+
+  - it: should merge custom pod labels with default labels
+    set:
+      podLabels:
+        custom: label
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          value: jellyfin
+      - equal:
+          path: spec.template.metadata.labels.custom
+          value: label
+
+  - it: should support multiple custom pod labels
+    set:
+      podLabels:
+        label1: value1
+        label2: value2
+        label3: value3
+        label4: value4
+    asserts:
+      - equal:
+          path: spec.template.metadata.labels.label1
+          value: value1
+      - equal:
+          path: spec.template.metadata.labels.label4
+          value: value4
+
+  # =============================================================================
+  # DEPLOYMENT STRATEGY
+  # =============================================================================
+
+  - it: should use RollingUpdate strategy by default
+    asserts:
+      - equal:
+          path: spec.strategy.type
+          value: RollingUpdate
+
+  - it: should set Recreate strategy
+    set:
+      deploymentStrategy.type: Recreate
+    asserts:
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+
+  - it: should explicitly set RollingUpdate strategy
+    set:
+      deploymentStrategy.type: RollingUpdate
+    asserts:
+      - equal:
+          path: spec.strategy.type
+          value: RollingUpdate
+
+  - it: should not have rollingUpdate params with Recreate strategy
+    set:
+      deploymentStrategy.type: Recreate
+    asserts:
+      - isNull:
+          path: spec.strategy.rollingUpdate
+
+  # =============================================================================
+  # REVISION HISTORY
+  # =============================================================================
+
+  - it: should have default revisionHistoryLimit of 3
+    asserts:
+      - equal:
+          path: spec.revisionHistoryLimit
+          value: 3
+
+  - it: should set custom revisionHistoryLimit
+    set:
+      revisionHistoryLimit: 10
+    asserts:
+      - equal:
+          path: spec.revisionHistoryLimit
+          value: 10
+
+  - it: should set revisionHistoryLimit to 0
+    set:
+      revisionHistoryLimit: 0
+    asserts:
+      - equal:
+          path: spec.revisionHistoryLimit
+          value: 0
+
+  # =============================================================================
+  # REPLICA COUNT
+  # =============================================================================
+
+  - it: should have default replicaCount of 1
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+
+  - it: should set custom replicaCount
+    set:
+      replicaCount: 2
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 2
+
+  - it: should support replicaCount of 3
+    set:
+      replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+
+  # Note: Jellyfin doesn't support horizontal scaling well, but chart allows it
+  # Users should be warned via NOTES.txt if replicaCount > 1
+
+  # =============================================================================
+  # EDGE CASES
+  # =============================================================================
+
+  - it: should handle empty podAnnotations object
+    set:
+      podAnnotations: {}
+    asserts:
+      - isNull:
+          path: spec.template.metadata.annotations
+
+  - it: should handle empty podLabels object
+    set:
+      podLabels: {}
+    asserts:
+      - isNotNull:
+          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+
+  - it: should handle empty deploymentAnnotations object
+    set:
+      deploymentAnnotations: {}
+    asserts:
+      - isNull:
+          path: metadata.annotations
+
+  - it: should handle empty nameOverride
+    set:
+      nameOverride: ""
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-jellyfin
+
+  # =============================================================================
+  # COMPLETE SCENARIOS
+  # =============================================================================
+
+  - it: should configure production deployment with full metadata
+    set:
+      fullnameOverride: jellyfin-prod
+      deploymentAnnotations:
+        deployment.kubernetes.io/revision: "5"
+        ci.build.number: "1234"
+      podAnnotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8096"
+      podLabels:
+        environment: production
+        team: media
+        version: v10.8.13
+      deploymentStrategy.type: RollingUpdate
+      revisionHistoryLimit: 10
+      replicaCount: 1
+    asserts:
+      - equal:
+          path: metadata.name
+          value: jellyfin-prod
+      - equal:
+          path: metadata.annotations.deployment\.kubernetes\.io/revision
+          value: "5"
+      - equal:
+          path: spec.template.metadata.annotations.prometheus\.io/scrape
+          value: "true"
+      - equal:
+          path: spec.template.metadata.labels.environment
+          value: production
+      - equal:
+          path: spec.strategy.type
+          value: RollingUpdate
+      - equal:
+          path: spec.revisionHistoryLimit
+          value: 10
+      - equal:
+          path: spec.replicas
+          value: 1
+
+  - it: should configure development deployment with Recreate strategy
+    set:
+      nameOverride: jellyfin-dev
+      podLabels:
+        environment: development
+      deploymentStrategy.type: Recreate
+      revisionHistoryLimit: 5
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-jellyfin-dev
+      - equal:
+          path: spec.template.metadata.labels.environment
+          value: development
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+      - equal:
+          path: spec.revisionHistoryLimit
+          value: 5
+
+  - it: should configure with vault injection annotations
+    set:
+      podAnnotations:
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-inject-secret-jellyfin: secret/data/jellyfin
+        vault.hashicorp.com/role: jellyfin-role
+    asserts:
+      - equal:
+          path: spec.template.metadata.annotations.vault\.hashicorp\.com/agent-inject
+          value: "true"
+      - equal:
+          path: spec.template.metadata.annotations.vault\.hashicorp\.com/role
+          value: jellyfin-role
+
+  # =============================================================================
+  # REGRESSION TESTS
+  # =============================================================================
+
+  - it: should always have standard Kubernetes labels
+    asserts:
+      - isNotNull:
+          path: metadata.labels.app\.kubernetes\.io/name
+      - isNotNull:
+          path: metadata.labels.app\.kubernetes\.io/instance
+      - isNotNull:
+          path: metadata.labels.app\.kubernetes\.io/version
+      - isNotNull:
+          path: metadata.labels.helm\.sh/chart
+
+  - it: should always have matching selectors
+    asserts:
+      - equal:
+          path: spec.selector.matchLabels.app\.kubernetes\.io/name
+          value: jellyfin
+      - equal:
+          path: spec.selector.matchLabels.app\.kubernetes\.io/instance
+          value: RELEASE-NAME
+
+  - it: should always have spec.strategy defined
+    asserts:
+      - isNotNull:
+          path: spec.strategy
+
+  - it: should always have spec.replicas defined
+    asserts:
+      - isNotNull:
+          path: spec.replicas
+
+  - it: should always have spec.revisionHistoryLimit defined
+    asserts:
+      - isNotNull:
+          path: spec.revisionHistoryLimit

charts/jellyfin/tests/deployment_resources_test.yaml

@@ -0,0 +1,518 @@
+suite: test deployment resources and volumes
+templates:
+  - deployment.yaml
+tests:
+  # =============================================================================
+  # RESOURCES
+  # =============================================================================
+
+  - it: should not have resources by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].resources
+
+  - it: should set CPU requests
+    set:
+      resources:
+        requests:
+          cpu: 100m
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 100m
+
+  - it: should set memory requests
+    set:
+      resources:
+        requests:
+          memory: 128Mi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.memory
+          value: 128Mi
+
+  - it: should set CPU limits
+    set:
+      resources:
+        limits:
+          cpu: 500m
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 500m
+
+  - it: should set memory limits
+    set:
+      resources:
+        limits:
+          memory: 512Mi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 512Mi
+
+  - it: should set both requests and limits
+    set:
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          cpu: 1000m
+          memory: 1Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.cpu
+          value: 100m
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.memory
+          value: 256Mi
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 1000m
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 1Gi
+
+  - it: should support GPU resources
+    set:
+      resources:
+        limits:
+          nvidia.com/gpu: 1
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.nvidia\.com/gpu
+          value: 1
+
+  - it: should support ephemeral-storage
+    set:
+      resources:
+        requests:
+          ephemeral-storage: 1Gi
+        limits:
+          ephemeral-storage: 2Gi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.requests.ephemeral-storage
+          value: 1Gi
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.ephemeral-storage
+          value: 2Gi
+
+  # =============================================================================
+  # EXTRA VOLUMES
+  # =============================================================================
+
+  - it: should not have extra volumes by default
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.volumes
+          count: 3  # config, media, cache only
+
+  - it: should add extraVolumes when specified
+    set:
+      volumes:
+        - name: extra-storage
+          emptyDir: {}
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.volumes
+          count: 4
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: extra-storage
+            emptyDir: {}
+
+  - it: should add multiple extraVolumes
+    set:
+      volumes:
+        - name: extra-1
+          emptyDir: {}
+        - name: extra-2
+          secret:
+            secretName: my-secret
+        - name: extra-3
+          configMap:
+            name: my-configmap
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.volumes
+          count: 6
+
+  - it: should support secret volume
+    set:
+      volumes:
+        - name: secret-vol
+          secret:
+            secretName: my-secret
+            optional: false
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: secret-vol
+            secret:
+              secretName: my-secret
+              optional: false
+
+  - it: should support configMap volume
+    set:
+      volumes:
+        - name: config-vol
+          configMap:
+            name: my-config
+            items:
+              - key: config.yaml
+                path: config.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config-vol
+            configMap:
+              name: my-config
+              items:
+                - key: config.yaml
+                  path: config.yaml
+
+  - it: should support NFS volume
+    set:
+      volumes:
+        - name: nfs-storage
+          nfs:
+            server: nfs-server.example.com
+            path: /exported/path
+            readOnly: false
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: nfs-storage
+            nfs:
+              server: nfs-server.example.com
+              path: /exported/path
+              readOnly: false
+
+  - it: should support PVC volume
+    set:
+      volumes:
+        - name: pvc-storage
+          persistentVolumeClaim:
+            claimName: existing-pvc
+            readOnly: false
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: pvc-storage
+            persistentVolumeClaim:
+              claimName: existing-pvc
+              readOnly: false
+
+  # =============================================================================
+  # VOLUME MOUNTS
+  # =============================================================================
+
+  - it: should not have extra volume mounts by default
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].volumeMounts
+          count: 3  # config, media, cache only
+
+  - it: should add volumeMounts when specified
+    set:
+      volumeMounts:
+        - name: extra-storage
+          mountPath: /extra
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].volumeMounts
+          count: 4
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: extra-storage
+            mountPath: /extra
+
+  - it: should add multiple volumeMounts
+    set:
+      volumeMounts:
+        - name: extra-1
+          mountPath: /extra1
+        - name: extra-2
+          mountPath: /extra2
+          readOnly: true
+        - name: extra-3
+          mountPath: /extra3
+          subPath: subdir
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].volumeMounts
+          count: 6
+
+  - it: should support volumeMount with all options
+    set:
+      volumeMounts:
+        - name: complete-mount
+          mountPath: /complete
+          subPath: subdir
+          readOnly: true
+          mountPropagation: HostToContainer
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: complete-mount
+            mountPath: /complete
+            subPath: subdir
+            readOnly: true
+            mountPropagation: HostToContainer
+
+  # =============================================================================
+  # EXTRA CONTAINERS
+  # =============================================================================
+
+  - it: should not have extra containers by default
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers
+          count: 1
+
+  - it: should add extraContainers when specified
+    set:
+      extraContainers:
+        - name: sidecar
+          image: nginx:latest
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers
+          count: 2
+      - equal:
+          path: spec.template.spec.containers[1].name
+          value: sidecar
+
+  - it: should add multiple extraContainers
+    set:
+      extraContainers:
+        - name: sidecar-1
+          image: nginx:latest
+        - name: sidecar-2
+          image: busybox:latest
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers
+          count: 3
+
+  - it: should preserve full sidecar container spec
+    set:
+      extraContainers:
+        - name: metrics-exporter
+          image: prom/node-exporter:latest
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9100
+              name: metrics
+          env:
+            - name: EXPORT_INTERVAL
+              value: "30s"
+          volumeMounts:
+            - name: proc
+              mountPath: /host/proc
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+      volumes:
+        - name: proc
+          hostPath:
+            path: /proc
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[1].name
+          value: metrics-exporter
+      - equal:
+          path: spec.template.spec.containers[1].image
+          value: prom/node-exporter:latest
+      - equal:
+          path: spec.template.spec.containers[1].ports[0].containerPort
+          value: 9100
+      - equal:
+          path: spec.template.spec.containers[1].env[0].name
+          value: EXPORT_INTERVAL
+      - equal:
+          path: spec.template.spec.containers[1].volumeMounts[0].mountPath
+          value: /host/proc
+      - equal:
+          path: spec.template.spec.containers[1].resources.requests.cpu
+          value: 50m
+
+  # =============================================================================
+  # EDGE CASES AND VALIDATIONS
+  # =============================================================================
+
+  - it: should handle empty resources object
+    set:
+      resources: {}
+    asserts:
+      - isNull:
+          path: spec.template.spec.containers[0].resources
+
+  - it: should handle empty volumes array
+    set:
+      volumes: []
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.volumes
+          count: 3  # Still have default volumes
+
+  - it: should handle empty volumeMounts array
+    set:
+      volumeMounts: []
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers[0].volumeMounts
+          count: 3  # Still have default mounts
+
+  - it: should handle empty extraContainers array
+    set:
+      extraContainers: []
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers
+          count: 1
+
+  # Combine volumes and volumeMounts
+  - it: should combine extraVolumes and volumeMounts correctly
+    set:
+      volumes:
+        - name: shared-data
+          emptyDir: {}
+      volumeMounts:
+        - name: shared-data
+          mountPath: /shared
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: shared-data
+            emptyDir: {}
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: shared-data
+            mountPath: /shared
+
+  # =============================================================================
+  # COMPLETE SCENARIOS
+  # =============================================================================
+
+  - it: should configure complete resource-constrained setup
+    set:
+      resources:
+        requests:
+          cpu: 500m
+          memory: 1Gi
+        limits:
+          cpu: 2000m
+          memory: 4Gi
+      volumes:
+        - name: transcode-cache
+          emptyDir:
+            medium: Memory
+            sizeLimit: 8Gi
+        - name: backup
+          nfs:
+            server: backup.example.com
+            path: /backups/jellyfin
+      volumeMounts:
+        - name: transcode-cache
+          mountPath: /transcode
+        - name: backup
+          mountPath: /backup
+          readOnly: false
+    asserts:
+      - isNotNull:
+          path: spec.template.spec.containers[0].resources
+      - lengthEqual:
+          path: spec.template.spec.volumes
+          count: 5  # config, media, cache + 2 extra
+      - lengthEqual:
+          path: spec.template.spec.containers[0].volumeMounts
+          count: 5
+
+  - it: should configure sidecar with shared volume
+    set:
+      extraContainers:
+        - name: log-forwarder
+          image: fluent/fluent-bit:latest
+          volumeMounts:
+            - name: logs
+              mountPath: /fluent-bit/logs
+      volumes:
+        - name: logs
+          emptyDir: {}
+      volumeMounts:
+        - name: logs
+          mountPath: /logs
+    asserts:
+      - lengthEqual:
+          path: spec.template.spec.containers
+          count: 2
+      - equal:
+          path: spec.template.spec.containers[1].volumeMounts[0].name
+          value: logs
+
+  # =============================================================================
+  # REGRESSION TESTS
+  # =============================================================================
+
+  - it: should always have default volumes
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: config
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: media
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: cache
+
+  - it: should always have default volume mounts
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: config
+            mountPath: /config
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: media
+            mountPath: /media
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: cache
+            mountPath: /cache
+
+  - it: should always have jellyfin as first container
+    set:
+      extraContainers:
+        - name: sidecar
+          image: nginx:latest
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: jellyfin
+      - equal:
+          path: spec.template.spec.containers[1].name
+          value: sidecar

charts/jellyfin/tests/validation_mutual_exclusions_test.yaml

@@ -0,0 +1,484 @@
+suite: test validation and mutual exclusions
+templates:
+  - deployment.yaml
+  - networkpolicy.yaml
+  - serviceMonitor.yaml
+tests:
+  # =============================================================================
+  # NETWORKPOLICY MUTUAL EXCLUSIONS
+  # =============================================================================
+
+  - it: should fail when NetworkPolicy enabled with DLNA
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      jellyfin.enableDLNA: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
+
+  - it: should fail when NetworkPolicy enabled with hostNetwork
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      podPrivileges.hostNetwork: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
+
+  - it: should fail when NetworkPolicy enabled with both DLNA and hostNetwork
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      jellyfin.enableDLNA: true
+      podPrivileges.hostNetwork: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
+
+  - it: should succeed when NetworkPolicy enabled without DLNA or hostNetwork
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      jellyfin.enableDLNA: false
+      podPrivileges.hostNetwork: false
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: should succeed when NetworkPolicy disabled with DLNA
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: false
+      jellyfin.enableDLNA: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  # =============================================================================
+  # SERVICEMONITOR DEPENDENCIES
+  # =============================================================================
+
+  - it: should not create ServiceMonitor when only metrics.enabled
+    template: serviceMonitor.yaml
+    set:
+      metrics.enabled: true
+      metrics.serviceMonitor.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not create ServiceMonitor when only serviceMonitor.enabled
+    template: serviceMonitor.yaml
+    set:
+      metrics.enabled: false
+      metrics.serviceMonitor.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create ServiceMonitor when both enabled
+    template: serviceMonitor.yaml
+    set:
+      metrics.enabled: true
+      metrics.serviceMonitor.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  # =============================================================================
+  # DLNA AND HOSTNETWORK SCENARIOS
+  # =============================================================================
+
+  - it: should enable hostNetwork automatically when DLNA enabled
+    template: deployment.yaml
+    set:
+      jellyfin.enableDLNA: true
+    asserts:
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: ClusterFirstWithHostNet
+
+  - it: should not enable hostNetwork when DLNA disabled
+    template: deployment.yaml
+    set:
+      jellyfin.enableDLNA: false
+    asserts:
+      - isNull:
+          path: spec.template.spec.hostNetwork
+
+  - it: should allow hostNetwork without DLNA
+    template: deployment.yaml
+    set:
+      jellyfin.enableDLNA: false
+      podPrivileges.hostNetwork: true
+    asserts:
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+
+  # =============================================================================
+  # REPLICACOUNT VALIDATION (WARNING, NOT ERROR)
+  # =============================================================================
+
+  # Note: Jellyfin doesn't support horizontal scaling, but chart allows it
+  # Users should be warned but not prevented from setting replicaCount > 1
+
+  - it: should allow replicaCount of 1 (recommended)
+    template: deployment.yaml
+    set:
+      replicaCount: 1
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+
+  - it: should allow replicaCount > 1 (not recommended but not forbidden)
+    template: deployment.yaml
+    set:
+      replicaCount: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+
+  # =============================================================================
+  # PERSISTENCE VALIDATIONS
+  # =============================================================================
+
+  # These are handled by values.schema.json, testing that templates work correctly
+
+  - it: should handle persistence.media.type=pvc without errors
+    template: deployment.yaml
+    set:
+      persistence.media.type: pvc
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: media
+
+  - it: should handle persistence.media.type=hostPath with path
+    template: deployment.yaml
+    set:
+      persistence.media.type: hostPath
+      persistence.media.hostPath: /mnt/media
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: media
+            hostPath:
+              path: /mnt/media
+
+  - it: should handle persistence.media.type=emptyDir
+    template: deployment.yaml
+    set:
+      persistence.media.type: emptyDir
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: media
+            emptyDir: {}
+
+  # existingClaim should not create PVC but should mount it
+  - it: should not create PVC when existingClaim is used
+    template: persistentVolumeClaim.yaml
+    set:
+      persistence.media.type: pvc
+      persistence.media.existingClaim: my-existing-claim
+    asserts:
+      - hasDocuments:
+          count: 1  # only config, not media
+
+  - it: should mount existingClaim in deployment
+    template: deployment.yaml
+    set:
+      persistence.media.type: pvc
+      persistence.media.existingClaim: my-existing-claim
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: media
+            persistentVolumeClaim:
+              claimName: my-existing-claim
+
+  # =============================================================================
+  # INGRESS VALIDATIONS
+  # =============================================================================
+
+  - it: should allow ingress with empty hosts (edge case, likely misconfiguration)
+    template: ingress.yaml
+    set:
+      ingress.enabled: true
+      ingress.hosts: []
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isNull:
+          path: spec.rules
+
+  - it: should allow ingress with hosts
+    template: ingress.yaml
+    set:
+      ingress.enabled: true
+      ingress.hosts:
+        - host: jellyfin.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isNotNull:
+          path: spec.rules
+
+  # =============================================================================
+  # HTTPROUTE VALIDATIONS
+  # =============================================================================
+
+  - it: should not create HTTPRoute by default
+    template: httpRoute.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create HTTPRoute when enabled
+    template: httpRoute.yaml
+    set:
+      httpRoute.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: should allow HTTPRoute with empty parentRefs (edge case)
+    template: httpRoute.yaml
+    set:
+      httpRoute.enabled: true
+      httpRoute.parentRefs: []
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: should allow HTTPRoute with empty hostnames (edge case)
+    template: httpRoute.yaml
+    set:
+      httpRoute.enabled: true
+      httpRoute.hostnames: []
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  # =============================================================================
+  # SERVICE TYPE VALIDATIONS
+  # =============================================================================
+
+  - it: should create service with ClusterIP type
+    template: service.yaml
+    set:
+      service.type: ClusterIP
+    asserts:
+      - equal:
+          path: spec.type
+          value: ClusterIP
+
+  - it: should create service with NodePort type
+    template: service.yaml
+    set:
+      service.type: NodePort
+    asserts:
+      - equal:
+          path: spec.type
+          value: NodePort
+
+  - it: should create service with LoadBalancer type
+    template: service.yaml
+    set:
+      service.type: LoadBalancer
+    asserts:
+      - equal:
+          path: spec.type
+          value: LoadBalancer
+
+  - it: should create service with ExternalName type
+    template: service.yaml
+    set:
+      service.type: ExternalName
+      service.externalName: jellyfin.example.com
+    asserts:
+      - equal:
+          path: spec.type
+          value: ExternalName
+
+  # =============================================================================
+  # PORT RANGE VALIDATIONS
+  # =============================================================================
+
+  # These are validated by values.schema.json, testing templates work correctly
+
+  - it: should accept service.port in valid range (1-65535)
+    template: service.yaml
+    set:
+      service.port: 8096
+    asserts:
+      - equal:
+          path: spec.ports[0].port
+          value: 8096
+
+  - it: should accept nodePort in valid range (30000-32767)
+    template: service.yaml
+    set:
+      service.type: NodePort
+      service.nodePort: 30096
+    asserts:
+      - equal:
+          path: spec.ports[0].nodePort
+          value: 30096
+
+  - it: should accept nodePort at lower boundary
+    template: service.yaml
+    set:
+      service.type: NodePort
+      service.nodePort: 30000
+    asserts:
+      - equal:
+          path: spec.ports[0].nodePort
+          value: 30000
+
+  - it: should accept nodePort at upper boundary
+    template: service.yaml
+    set:
+      service.type: NodePort
+      service.nodePort: 32767
+    asserts:
+      - equal:
+          path: spec.ports[0].nodePort
+          value: 32767
+
+  # =============================================================================
+  # DNS POLICY VALIDATIONS
+  # =============================================================================
+
+  - it: should use ClusterFirst dnsPolicy by default
+    template: deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: ClusterFirst
+
+  - it: should use ClusterFirstWithHostNet when hostNetwork enabled
+    template: deployment.yaml
+    set:
+      podPrivileges.hostNetwork: true
+    asserts:
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: ClusterFirstWithHostNet
+
+  - it: should allow custom dnsPolicy override
+    template: deployment.yaml
+    set:
+      dnsPolicy: None
+    asserts:
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: None
+
+  # =============================================================================
+  # COMPLEX VALIDATION SCENARIOS
+  # =============================================================================
+
+  - it: should fail with all conflicting options enabled
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      jellyfin.enableDLNA: true
+      podPrivileges.hostNetwork: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "NetworkPolicy cannot be enabled when hostNetwork is enabled"
+
+  - it: should succeed with compatible options
+    set:
+      metrics.enabled: true
+      metrics.serviceMonitor.enabled: true
+      jellyfin.enableDLNA: false
+      networkPolicy.enabled: true
+      persistence.media.type: pvc
+      service.type: LoadBalancer
+    asserts:
+      - template: serviceMonitor.yaml
+        hasDocuments:
+          count: 1
+      - template: networkpolicy.yaml
+        hasDocuments:
+          count: 1
+      - template: deployment.yaml
+        isNull:
+          path: spec.template.spec.hostNetwork
+
+  - it: should configure for DLNA without NetworkPolicy
+    set:
+      jellyfin.enableDLNA: true
+      networkPolicy.enabled: false
+    asserts:
+      - template: deployment.yaml
+        equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+      - template: networkpolicy.yaml
+        hasDocuments:
+          count: 0
+
+  # =============================================================================
+  # REGRESSION TESTS FOR VALIDATIONS
+  # =============================================================================
+
+  - it: should maintain hostNetwork=false by default
+    template: deployment.yaml
+    asserts:
+      - isNull:
+          path: spec.template.spec.hostNetwork
+
+  - it: should maintain NetworkPolicy disabled by default
+    template: networkpolicy.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should maintain ServiceMonitor disabled by default
+    template: serviceMonitor.yaml
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should allow all features when properly configured
+    set:
+      metrics.enabled: true
+      metrics.serviceMonitor.enabled: true
+      networkPolicy.enabled: true
+      jellyfin.enableDLNA: false
+      ingress.enabled: true
+      ingress.hosts:
+        - host: jellyfin.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - template: serviceMonitor.yaml
+        hasDocuments:
+          count: 1
+      - template: networkpolicy.yaml
+        hasDocuments:
+          count: 1
+      - template: ingress.yaml
+        hasDocuments:
+          count: 1
+      - template: deployment.yaml
+        isNull:
+          path: spec.template.spec.hostNetwork