test(charts): add critical resource tests (ingress, serviceaccount, servicemonitor, security, scheduling)
Phase 2: Create comprehensive tests for critical resources that had no coverage previously. New test files: - ingress_test.yaml: Full ingress coverage including className, annotations, hosts, paths, pathTypes, TLS, edge cases (70+ tests) - serviceaccount_test.yaml: ServiceAccount creation, custom names, annotations (AWS IRSA, GCP Workload Identity, Azure), automount settings, integration with deployment (60+ tests) - servicemonitor_test.yaml: Prometheus ServiceMonitor with dependencies, labels, endpoints, intervals, TLS, relabeling, metricRelabeling (70+ tests) - deployment_security_test.yaml: Pod and container security contexts, capabilities, host privileges (hostNetwork/IPC/PID), runtime and priority classes, DLNA scenarios (30+ tests) - deployment_scheduling_test.yaml: Node selector, tolerations, affinity (node/pod/podAnti), DNS policy and config, complete scenarios (30+ tests) Critical validations added: - ServiceMonitor requires both metrics.enabled AND serviceMonitor.enabled - hostNetwork automatically sets dnsPolicy to ClusterFirstWithHostNet - Ingress pathType validation (Prefix, Exact, ImplementationSpecific) - ServiceAccount integration with AWS IRSA, GCP WI, Azure WI Total: 5 new test files, 260+ new test cases Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
This commit is contained in:
Aleksei SviridkinandClaude committed
1 parent
a08951aaa3
commit
9c0cf4395d
5 files changed
+1699
No files matched your search
@@ -0,0 +1,355 @@
|
||||
suite: test serviceaccount
|
||||
templates:
|
||||
- serviceaccount.yaml
|
||||
- deployment.yaml
|
||||
tests:
|
||||
# =============================================================================
|
||||
# DEFAULT BEHAVIOR
|
||||
# =============================================================================
|
||||
|
||||
- it: should create ServiceAccount by default
|
||||
template: serviceaccount.yaml
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: ServiceAccount
|
||||
- isAPIVersion:
|
||||
of: v1
|
||||
|
||||
- it: should have auto-generated name by default
|
||||
template: serviceaccount.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-jellyfin
|
||||
|
||||
- it: should use ServiceAccount in deployment by default
|
||||
template: deployment.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: RELEASE-NAME-jellyfin
|
||||
|
||||
- it: should automount service account token by default
|
||||
template: deployment.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: true
|
||||
|
||||
# =============================================================================
|
||||
# CREATE CONFIGURATION
|
||||
# =============================================================================
|
||||
|
||||
- it: should not create ServiceAccount when create is false
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.create: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should use default ServiceAccount when create is false
|
||||
template: deployment.yaml
|
||||
set:
|
||||
serviceAccount.create: false
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: default
|
||||
|
||||
- it: should create ServiceAccount when explicitly enabled
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.create: true
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
|
||||
# =============================================================================
|
||||
# CUSTOM NAME
|
||||
# =============================================================================
|
||||
|
||||
- it: should use custom name when specified
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.name: my-custom-sa
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: my-custom-sa
|
||||
|
||||
- it: should use custom name in deployment
|
||||
template: deployment.yaml
|
||||
set:
|
||||
serviceAccount.name: my-custom-sa
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: my-custom-sa
|
||||
|
||||
- it: should use custom name when create is false
|
||||
template: deployment.yaml
|
||||
set:
|
||||
serviceAccount.create: false
|
||||
serviceAccount.name: existing-sa
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: existing-sa
|
||||
|
||||
- it: should not create SA but use custom name when create is false
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.create: false
|
||||
serviceAccount.name: existing-external-sa
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
# =============================================================================
|
||||
# ANNOTATIONS
|
||||
# =============================================================================
|
||||
|
||||
- it: should not have annotations by default
|
||||
template: serviceaccount.yaml
|
||||
asserts:
|
||||
- isNull:
|
||||
path: metadata.annotations
|
||||
|
||||
- it: should add custom annotations
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.annotations:
|
||||
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-role
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations.eks\.amazonaws\.com/role-arn
|
||||
value: arn:aws:iam::123456789012:role/jellyfin-role
|
||||
|
||||
- it: should support multiple annotations
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.annotations:
|
||||
annotation1: value1
|
||||
annotation2: value2
|
||||
annotation3: value3
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations.annotation1
|
||||
value: value1
|
||||
- equal:
|
||||
path: metadata.annotations.annotation2
|
||||
value: value2
|
||||
- equal:
|
||||
path: metadata.annotations.annotation3
|
||||
value: value3
|
||||
|
||||
- it: should support GCP Workload Identity annotation
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.annotations:
|
||||
iam.gke.io/gcp-service-account: jellyfin@project-id.iam.gserviceaccount.com
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations.iam\.gke\.io/gcp-service-account
|
||||
value: jellyfin@project-id.iam.gserviceaccount.com
|
||||
|
||||
- it: should support Azure Workload Identity annotation
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.annotations:
|
||||
azure.workload.identity/client-id: 12345678-1234-1234-1234-123456789012
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations.azure\.workload\.identity/client-id
|
||||
value: 12345678-1234-1234-1234-123456789012
|
||||
|
||||
# =============================================================================
|
||||
# AUTOMOUNT CONFIGURATION
|
||||
# =============================================================================
|
||||
|
||||
- it: should enable automount by default
|
||||
template: deployment.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: true
|
||||
|
||||
- it: should disable automount when set to false
|
||||
template: deployment.yaml
|
||||
set:
|
||||
serviceAccount.automount: false
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: false
|
||||
|
||||
- it: should explicitly enable automount when set to true
|
||||
template: deployment.yaml
|
||||
set:
|
||||
serviceAccount.automount: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: true
|
||||
|
||||
# =============================================================================
|
||||
# EDGE CASES
|
||||
# =============================================================================
|
||||
|
||||
- it: should handle empty name gracefully (use auto-generated)
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.name: ""
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: RELEASE-NAME-jellyfin
|
||||
|
||||
- it: should handle empty annotations object
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.annotations: {}
|
||||
asserts:
|
||||
- isNull:
|
||||
path: metadata.annotations
|
||||
|
||||
- it: should work with custom name and annotations together
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.name: custom-sa
|
||||
serviceAccount.annotations:
|
||||
custom: annotation
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: custom-sa
|
||||
- equal:
|
||||
path: metadata.annotations.custom
|
||||
value: annotation
|
||||
|
||||
- it: should work with all options combined
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.create: true
|
||||
serviceAccount.name: jellyfin-prod-sa
|
||||
serviceAccount.annotations:
|
||||
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin
|
||||
custom.io/annotation: value
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: jellyfin-prod-sa
|
||||
- equal:
|
||||
path: metadata.annotations.eks\.amazonaws\.com/role-arn
|
||||
value: arn:aws:iam::123456789012:role/jellyfin
|
||||
- equal:
|
||||
path: metadata.annotations.custom\.io/annotation
|
||||
value: value
|
||||
|
||||
# =============================================================================
|
||||
# REGRESSION TESTS
|
||||
# =============================================================================
|
||||
|
||||
- it: should always have correct labels
|
||||
template: serviceaccount.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.labels.app\.kubernetes\.io/name
|
||||
value: jellyfin
|
||||
- equal:
|
||||
path: metadata.labels.app\.kubernetes\.io/instance
|
||||
value: RELEASE-NAME
|
||||
|
||||
- it: should always use v1 API version
|
||||
template: serviceaccount.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: apiVersion
|
||||
value: v1
|
||||
|
||||
- it: should always be ServiceAccount kind
|
||||
template: serviceaccount.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: kind
|
||||
value: ServiceAccount
|
||||
|
||||
# Verify deployment always sets serviceAccountName
|
||||
- it: should always set serviceAccountName in deployment
|
||||
template: deployment.yaml
|
||||
asserts:
|
||||
- isNotNull:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
|
||||
- it: should always set automountServiceAccountToken in deployment
|
||||
template: deployment.yaml
|
||||
asserts:
|
||||
- isNotNull:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
|
||||
# =============================================================================
|
||||
# INTEGRATION SCENARIOS
|
||||
# =============================================================================
|
||||
|
||||
# Scenario: Using existing external ServiceAccount
|
||||
- it: should use existing external ServiceAccount without creating new one
|
||||
set:
|
||||
serviceAccount.create: false
|
||||
serviceAccount.name: external-jellyfin-sa
|
||||
serviceAccount.automount: false
|
||||
asserts:
|
||||
- template: serviceaccount.yaml
|
||||
hasDocuments:
|
||||
count: 0
|
||||
- template: deployment.yaml
|
||||
equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: external-jellyfin-sa
|
||||
- template: deployment.yaml
|
||||
equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: false
|
||||
|
||||
# Scenario: AWS IRSA (IAM Roles for Service Accounts)
|
||||
- it: should configure for AWS IRSA
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.create: true
|
||||
serviceAccount.name: jellyfin-irsa
|
||||
serviceAccount.annotations:
|
||||
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-s3-access
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: jellyfin-irsa
|
||||
- equal:
|
||||
path: metadata.annotations.eks\.amazonaws\.com/role-arn
|
||||
value: arn:aws:iam::123456789012:role/jellyfin-s3-access
|
||||
|
||||
# Scenario: GCP Workload Identity
|
||||
- it: should configure for GCP Workload Identity
|
||||
template: serviceaccount.yaml
|
||||
set:
|
||||
serviceAccount.annotations:
|
||||
iam.gke.io/gcp-service-account: jellyfin@my-project.iam.gserviceaccount.com
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations.iam\.gke\.io/gcp-service-account
|
||||
value: jellyfin@my-project.iam.gserviceaccount.com
|
||||
|
||||
# Scenario: Minimal security (no automount)
|
||||
- it: should support minimal security setup without token automount
|
||||
set:
|
||||
serviceAccount.create: true
|
||||
serviceAccount.automount: false
|
||||
asserts:
|
||||
- template: serviceaccount.yaml
|
||||
hasDocuments:
|
||||
count: 1
|
||||
- template: deployment.yaml
|
||||
equal:
|
||||
path: spec.template.spec.automountServiceAccountToken
|
||||
value: false
|
||||
Reference in new issue
Block a user