fix(tests): fix label/annotation paths and add missing templates

- Replace escaped dot notation (app\.kubernetes\.io/name) with bracket notation (["app.kubernetes.io/name"])
- Add missing templates to test suites (service.yaml, ingress.yaml, httpRoute.yaml, serviceaccount.yaml, persistentVolumeClaim.yaml)
- This fixes 40+ test failures related to unknown paths in labels and annotations

Test progress: 535/603 passing (89%), up from 495/603 (82%)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

charts/jellyfin/tests/deployment_metadata_test.yaml

@@ -44,32 +44,32 @@ tests:
   - it: should have default labels
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
       - isNotNull:
-          path: metadata.labels.app\.kubernetes\.io/version
+          path: metadata.labels["app.kubernetes.io/version"]
       - isNotNull:
-          path: metadata.labels.helm\.sh/chart
+          path: metadata.labels["helm.sh/chart"]
 
   - it: should propagate labels to pod template
     asserts:
       - equal:
-          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.template.metadata.labels.app\.kubernetes\.io/instance
+          path: spec.template.metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should use labels in selector
     asserts:
       - equal:
-          path: spec.selector.matchLabels.app\.kubernetes\.io/name
+          path: spec.selector.matchLabels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.selector.matchLabels.app\.kubernetes\.io/instance
+          path: spec.selector.matchLabels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   # =============================================================================
@@ -88,7 +88,7 @@ tests:
         custom-annotation: custom-value
     asserts:
       - equal:
-          path: metadata.annotations.deployment\.kubernetes\.io/revision
+          path: metadata.annotations["deployment.kubernetes.io/revision"]
           value: "1"
       - equal:
           path: metadata.annotations.custom-annotation
@@ -121,10 +121,10 @@ tests:
         prometheus.io/port: "8096"
     asserts:
       - equal:
-          path: spec.template.metadata.annotations.prometheus\.io/scrape
+          path: spec.template.metadata.annotations["prometheus.io/scrape"]
           value: "true"
       - equal:
-          path: spec.template.metadata.annotations.prometheus\.io/port
+          path: spec.template.metadata.annotations["prometheus.io/port"]
           value: "8096"
 
   - it: should support multiple pod annotations
@@ -135,10 +135,10 @@ tests:
         custom-annotation: custom-value
     asserts:
       - equal:
-          path: spec.template.metadata.annotations.vault\.hashicorp\.com/agent-inject
+          path: spec.template.metadata.annotations["vault.hashicorp.com/agent-inject"]
           value: "true"
       - equal:
-          path: spec.template.metadata.annotations.vault\.hashicorp\.com/role
+          path: spec.template.metadata.annotations["vault.hashicorp.com/role"]
           value: jellyfin
 
   # =============================================================================
@@ -148,10 +148,10 @@ tests:
   - it: should have default pod labels
     asserts:
       - equal:
-          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.template.metadata.labels.app\.kubernetes\.io/instance
+          path: spec.template.metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should add custom pod labels when specified
@@ -173,7 +173,7 @@ tests:
         custom: label
     asserts:
       - equal:
-          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
           path: spec.template.metadata.labels.custom
@@ -298,7 +298,7 @@ tests:
       podLabels: {}
     asserts:
       - isNotNull:
-          path: spec.template.metadata.labels.app\.kubernetes\.io/name
+          path: spec.template.metadata.labels["app.kubernetes.io/name"]
 
   - it: should handle empty deploymentAnnotations object
     set:
@@ -340,10 +340,10 @@ tests:
           path: metadata.name
           value: jellyfin-prod
       - equal:
-          path: metadata.annotations.deployment\.kubernetes\.io/revision
+          path: metadata.annotations["deployment.kubernetes.io/revision"]
           value: "5"
       - equal:
-          path: spec.template.metadata.annotations.prometheus\.io/scrape
+          path: spec.template.metadata.annotations["prometheus.io/scrape"]
           value: "true"
       - equal:
           path: spec.template.metadata.labels.environment
@@ -387,10 +387,10 @@ tests:
         vault.hashicorp.com/role: jellyfin-role
     asserts:
       - equal:
-          path: spec.template.metadata.annotations.vault\.hashicorp\.com/agent-inject
+          path: spec.template.metadata.annotations["vault.hashicorp.com/agent-inject"]
           value: "true"
       - equal:
-          path: spec.template.metadata.annotations.vault\.hashicorp\.com/role
+          path: spec.template.metadata.annotations["vault.hashicorp.com/role"]
           value: jellyfin-role
 
   # =============================================================================
@@ -400,21 +400,21 @@ tests:
   - it: should always have standard Kubernetes labels
     asserts:
       - isNotNull:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
       - isNotNull:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
       - isNotNull:
-          path: metadata.labels.app\.kubernetes\.io/version
+          path: metadata.labels["app.kubernetes.io/version"]
       - isNotNull:
-          path: metadata.labels.helm\.sh/chart
+          path: metadata.labels["helm.sh/chart"]
 
   - it: should always have matching selectors
     asserts:
       - equal:
-          path: spec.selector.matchLabels.app\.kubernetes\.io/name
+          path: spec.selector.matchLabels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.selector.matchLabels.app\.kubernetes\.io/instance
+          path: spec.selector.matchLabels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should always have spec.strategy defined

charts/jellyfin/tests/deployment_resources_test.yaml

@@ -81,7 +81,7 @@ tests:
           nvidia.com/gpu: 1
     asserts:
       - equal:
-          path: spec.template.spec.containers[0].resources.limits.nvidia\.com/gpu
+          path: spec.template.spec.containers[0].resources.limits["nvidia.com/gpu"]
           value: 1
 
   - it: should support ephemeral-storage

charts/jellyfin/tests/ingress_test.yaml

@@ -86,10 +86,10 @@ tests:
         nginx.ingress.kubernetes.io/proxy-body-size: 100m
     asserts:
       - equal:
-          path: metadata.annotations.kubernetes\.io/ingress\.class
+          path: metadata.annotations.kubernetes.io/ingress\.class
           value: nginx
       - equal:
-          path: metadata.annotations.nginx\.ingress\.kubernetes\.io/proxy-body-size
+          path: metadata.annotations["nginx.ingress.kubernetes.io/proxy-body-size"]
           value: 100m
 
   - it: should support multiple annotations
@@ -101,13 +101,13 @@ tests:
         nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     asserts:
       - equal:
-          path: metadata.annotations.cert-manager\.io/cluster-issuer
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
           value: letsencrypt-prod
       - equal:
-          path: metadata.annotations.nginx\.ingress\.kubernetes\.io/ssl-redirect
+          path: metadata.annotations["nginx.ingress.kubernetes.io/ssl-redirect"]
           value: "true"
       - equal:
-          path: metadata.annotations.nginx\.ingress\.kubernetes\.io/force-ssl-redirect
+          path: metadata.annotations["nginx.ingress.kubernetes.io/force-ssl-redirect"]
           value: "true"
 
   # =============================================================================
@@ -397,7 +397,7 @@ tests:
           path: spec.ingressClassName
           value: nginx
       - equal:
-          path: metadata.annotations.cert-manager\.io/cluster-issuer
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
           value: letsencrypt-prod
       - equal:
           path: spec.rules[0].host
@@ -466,8 +466,8 @@ tests:
       ingress.enabled: true
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME

charts/jellyfin/tests/integration_common_configs_test.yaml

@@ -3,8 +3,10 @@ templates:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - httpRoute.yaml
   - networkpolicy.yaml
   - serviceMonitor.yaml
+  - serviceaccount.yaml
   - persistentVolumeClaim.yaml
 tests:
   # =============================================================================
@@ -288,11 +290,11 @@ tests:
     asserts:
       - template: serviceaccount.yaml
         equal:
-          path: metadata.annotations.eks\.amazonaws\.com/role-arn
+          path: metadata.annotations["eks.amazonaws.com/role-arn"]
           value: arn:aws:iam::123456789012:role/jellyfin-s3
       - template: service.yaml
         equal:
-          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type
+          path: metadata.annotations["service.beta.kubernetes.io/aws-load-balancer-type"]
           value: nlb
       - template: ingress.yaml
         equal:
@@ -316,11 +318,11 @@ tests:
     asserts:
       - template: serviceaccount.yaml
         equal:
-          path: metadata.annotations.iam\.gke\.io/gcp-service-account
+          path: metadata.annotations["iam.gke.io/gcp-service-account"]
           value: jellyfin@project-id.iam.gserviceaccount.com
       - template: service.yaml
         equal:
-          path: metadata.annotations.cloud\.google\.com/neg
+          path: metadata.annotations["cloud.google.com/neg"]
           value: '{"ingress": true}'
 
   # =============================================================================

charts/jellyfin/tests/networkpolicy_test.yaml

@@ -111,7 +111,7 @@ tests:
       - isNotNull:
           path: spec.ingress[1].from[0].namespaceSelector
       - equal:
-          path: spec.ingress[1].from[0].namespaceSelector.matchLabels.kubernetes.io/metadata.name
+          path: spec.ingress[1].from[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"]
           value: monitoring
 
   - it: should add custom ingress rules
@@ -163,7 +163,7 @@ tests:
       networkPolicy.egress.dnsNamespace: custom-dns-ns
     asserts:
       - equal:
-          path: spec.egress[0].to[0].namespaceSelector.matchLabels.kubernetes.io/metadata.name
+          path: spec.egress[0].to[0].namespaceSelector.matchLabels["kubernetes.io/metadata.name"]
           value: custom-dns-ns
 
   - it: should allow custom DNS pod selector
@@ -290,10 +290,10 @@ tests:
       networkPolicy.enabled: true
     asserts:
       - equal:
-          path: spec.podSelector.matchLabels.app\.kubernetes\.io/name
+          path: spec.podSelector.matchLabels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.podSelector.matchLabels.app\.kubernetes\.io/instance
+          path: spec.podSelector.matchLabels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   # =============================================================================

charts/jellyfin/tests/regression_defaults_test.yaml

@@ -379,34 +379,34 @@ tests:
     template: deployment.yaml
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
       - isNotNull:
-          path: metadata.labels.app\.kubernetes\.io/version
+          path: metadata.labels["app.kubernetes.io/version"]
       - isNotNull:
-          path: metadata.labels.helm\.sh/chart
+          path: metadata.labels["helm.sh/chart"]
 
   - it: should have standard labels on service
     template: service.yaml
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should have standard labels on serviceaccount
     template: serviceaccount.yaml
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should have standard labels on PVCs
@@ -414,10 +414,10 @@ tests:
     documentIndex: 0
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   # =============================================================================

charts/jellyfin/tests/service_test.yaml

@@ -45,10 +45,10 @@ tests:
   - it: should have correct pod selector labels
     asserts:
       - equal:
-          path: spec.selector.app\.kubernetes\.io/name
+          path: spec.selector["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.selector.app\.kubernetes\.io/instance
+          path: spec.selector["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   # =============================================================================
@@ -208,10 +208,10 @@ tests:
         external-dns.alpha.kubernetes.io/hostname: jellyfin.example.com
     asserts:
       - equal:
-          path: metadata.annotations.service\.beta\.kubernetes\.io/aws-load-balancer-type
+          path: metadata.annotations["service.beta.kubernetes.io/aws-load-balancer-type"]
           value: nlb
       - equal:
-          path: metadata.annotations.external-dns\.alpha\.kubernetes\.io/hostname
+          path: metadata.annotations["external-dns.alpha.kubernetes.io/hostname"]
           value: jellyfin.example.com
 
   - it: should support empty annotations object

charts/jellyfin/tests/serviceaccount_test.yaml

@@ -125,7 +125,7 @@ tests:
         eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-role
     asserts:
       - equal:
-          path: metadata.annotations.eks\.amazonaws\.com/role-arn
+          path: metadata.annotations["eks.amazonaws.com/role-arn"]
           value: arn:aws:iam::123456789012:role/jellyfin-role
 
   - it: should support multiple annotations
@@ -153,7 +153,7 @@ tests:
         iam.gke.io/gcp-service-account: jellyfin@project-id.iam.gserviceaccount.com
     asserts:
       - equal:
-          path: metadata.annotations.iam\.gke\.io/gcp-service-account
+          path: metadata.annotations["iam.gke.io/gcp-service-account"]
           value: jellyfin@project-id.iam.gserviceaccount.com
 
   - it: should support Azure Workload Identity annotation
@@ -163,7 +163,7 @@ tests:
         azure.workload.identity/client-id: 12345678-1234-1234-1234-123456789012
     asserts:
       - equal:
-          path: metadata.annotations.azure\.workload\.identity/client-id
+          path: metadata.annotations["azure.workload.identity/client-id"]
           value: 12345678-1234-1234-1234-123456789012
 
   # =============================================================================
@@ -243,10 +243,10 @@ tests:
           path: metadata.name
           value: jellyfin-prod-sa
       - equal:
-          path: metadata.annotations.eks\.amazonaws\.com/role-arn
+          path: metadata.annotations["eks.amazonaws.com/role-arn"]
           value: arn:aws:iam::123456789012:role/jellyfin
       - equal:
-          path: metadata.annotations.custom\.io/annotation
+          path: metadata.annotations["custom.io/annotation"]
           value: value
 
   # =============================================================================
@@ -257,10 +257,10 @@ tests:
     template: serviceaccount.yaml
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should always use v1 API version
@@ -326,7 +326,7 @@ tests:
           path: metadata.name
           value: jellyfin-irsa
       - equal:
-          path: metadata.annotations.eks\.amazonaws\.com/role-arn
+          path: metadata.annotations["eks.amazonaws.com/role-arn"]
           value: arn:aws:iam::123456789012:role/jellyfin-s3-access
 
   # Scenario: GCP Workload Identity
@@ -337,7 +337,7 @@ tests:
         iam.gke.io/gcp-service-account: jellyfin@my-project.iam.gserviceaccount.com
     asserts:
       - equal:
-          path: metadata.annotations.iam\.gke\.io/gcp-service-account
+          path: metadata.annotations["iam.gke.io/gcp-service-account"]
           value: jellyfin@my-project.iam.gserviceaccount.com
 
   # Scenario: Minimal security (no automount)

charts/jellyfin/tests/servicemonitor_test.yaml

@@ -75,10 +75,10 @@ tests:
       metrics.serviceMonitor.enabled: true
     asserts:
       - equal:
-          path: spec.selector.matchLabels.app\.kubernetes\.io/name
+          path: spec.selector.matchLabels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: spec.selector.matchLabels.app\.kubernetes\.io/instance
+          path: spec.selector.matchLabels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   # =============================================================================
@@ -91,7 +91,7 @@ tests:
       metrics.serviceMonitor.enabled: true
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
 
   - it: should add custom labels when specified
@@ -117,7 +117,7 @@ tests:
         custom: label
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
           path: metadata.labels.custom
@@ -385,7 +385,7 @@ tests:
       metrics.serviceMonitor.labels: {}
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
 
   - it: should handle empty relabelings array
@@ -468,10 +468,10 @@ tests:
       metrics.serviceMonitor.enabled: true
     asserts:
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/name
+          path: metadata.labels["app.kubernetes.io/name"]
           value: jellyfin
       - equal:
-          path: metadata.labels.app\.kubernetes\.io/instance
+          path: metadata.labels["app.kubernetes.io/instance"]
           value: RELEASE-NAME
 
   - it: should always have exactly one endpoint

charts/jellyfin/tests/validation_mutual_exclusions_test.yaml

@@ -3,6 +3,10 @@ templates:
   - deployment.yaml
   - networkpolicy.yaml
   - serviceMonitor.yaml
+  - service.yaml
+  - ingress.yaml
+  - httpRoute.yaml
+  - persistentVolumeClaim.yaml
 tests:
   # =============================================================================
   # NETWORKPOLICY MUTUAL EXCLUSIONS