Aleksei SviridkinandClaude
9c0cf4395d
Phase 2: Create comprehensive tests for critical resources that had no coverage previously. New test files: - ingress_test.yaml: Full ingress coverage including className, annotations, hosts, paths, pathTypes, TLS, edge cases (70+ tests) - serviceaccount_test.yaml: ServiceAccount creation, custom names, annotations (AWS IRSA, GCP Workload Identity, Azure), automount settings, integration with deployment (60+ tests) - servicemonitor_test.yaml: Prometheus ServiceMonitor with dependencies, labels, endpoints, intervals, TLS, relabeling, metricRelabeling (70+ tests) - deployment_security_test.yaml: Pod and container security contexts, capabilities, host privileges (hostNetwork/IPC/PID), runtime and priority classes, DLNA scenarios (30+ tests) - deployment_scheduling_test.yaml: Node selector, tolerations, affinity (node/pod/podAnti), DNS policy and config, complete scenarios (30+ tests) Critical validations added: - ServiceMonitor requires both metrics.enabled AND serviceMonitor.enabled - hostNetwork automatically sets dnsPolicy to ClusterFirstWithHostNet - Ingress pathType validation (Prefix, Exact, ImplementationSpecific) - ServiceAccount integration with AWS IRSA, GCP WI, Azure WI Total: 5 new test files, 260+ new test cases Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
356 lines
11 KiB
YAML
356 lines
11 KiB
YAML
suite: test serviceaccount
|
|
templates:
|
|
- serviceaccount.yaml
|
|
- deployment.yaml
|
|
tests:
|
|
# =============================================================================
|
|
# DEFAULT BEHAVIOR
|
|
# =============================================================================
|
|
|
|
- it: should create ServiceAccount by default
|
|
template: serviceaccount.yaml
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
- isKind:
|
|
of: ServiceAccount
|
|
- isAPIVersion:
|
|
of: v1
|
|
|
|
- it: should have auto-generated name by default
|
|
template: serviceaccount.yaml
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: RELEASE-NAME-jellyfin
|
|
|
|
- it: should use ServiceAccount in deployment by default
|
|
template: deployment.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: RELEASE-NAME-jellyfin
|
|
|
|
- it: should automount service account token by default
|
|
template: deployment.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: true
|
|
|
|
# =============================================================================
|
|
# CREATE CONFIGURATION
|
|
# =============================================================================
|
|
|
|
- it: should not create ServiceAccount when create is false
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.create: false
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
|
|
- it: should use default ServiceAccount when create is false
|
|
template: deployment.yaml
|
|
set:
|
|
serviceAccount.create: false
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: default
|
|
|
|
- it: should create ServiceAccount when explicitly enabled
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.create: true
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 1
|
|
|
|
# =============================================================================
|
|
# CUSTOM NAME
|
|
# =============================================================================
|
|
|
|
- it: should use custom name when specified
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.name: my-custom-sa
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: my-custom-sa
|
|
|
|
- it: should use custom name in deployment
|
|
template: deployment.yaml
|
|
set:
|
|
serviceAccount.name: my-custom-sa
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: my-custom-sa
|
|
|
|
- it: should use custom name when create is false
|
|
template: deployment.yaml
|
|
set:
|
|
serviceAccount.create: false
|
|
serviceAccount.name: existing-sa
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: existing-sa
|
|
|
|
- it: should not create SA but use custom name when create is false
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.create: false
|
|
serviceAccount.name: existing-external-sa
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
|
|
# =============================================================================
|
|
# ANNOTATIONS
|
|
# =============================================================================
|
|
|
|
- it: should not have annotations by default
|
|
template: serviceaccount.yaml
|
|
asserts:
|
|
- isNull:
|
|
path: metadata.annotations
|
|
|
|
- it: should add custom annotations
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.annotations:
|
|
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-role
|
|
asserts:
|
|
- equal:
|
|
path: metadata.annotations.eks\.amazonaws\.com/role-arn
|
|
value: arn:aws:iam::123456789012:role/jellyfin-role
|
|
|
|
- it: should support multiple annotations
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.annotations:
|
|
annotation1: value1
|
|
annotation2: value2
|
|
annotation3: value3
|
|
asserts:
|
|
- equal:
|
|
path: metadata.annotations.annotation1
|
|
value: value1
|
|
- equal:
|
|
path: metadata.annotations.annotation2
|
|
value: value2
|
|
- equal:
|
|
path: metadata.annotations.annotation3
|
|
value: value3
|
|
|
|
- it: should support GCP Workload Identity annotation
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.annotations:
|
|
iam.gke.io/gcp-service-account: jellyfin@project-id.iam.gserviceaccount.com
|
|
asserts:
|
|
- equal:
|
|
path: metadata.annotations.iam\.gke\.io/gcp-service-account
|
|
value: jellyfin@project-id.iam.gserviceaccount.com
|
|
|
|
- it: should support Azure Workload Identity annotation
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.annotations:
|
|
azure.workload.identity/client-id: 12345678-1234-1234-1234-123456789012
|
|
asserts:
|
|
- equal:
|
|
path: metadata.annotations.azure\.workload\.identity/client-id
|
|
value: 12345678-1234-1234-1234-123456789012
|
|
|
|
# =============================================================================
|
|
# AUTOMOUNT CONFIGURATION
|
|
# =============================================================================
|
|
|
|
- it: should enable automount by default
|
|
template: deployment.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: true
|
|
|
|
- it: should disable automount when set to false
|
|
template: deployment.yaml
|
|
set:
|
|
serviceAccount.automount: false
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: false
|
|
|
|
- it: should explicitly enable automount when set to true
|
|
template: deployment.yaml
|
|
set:
|
|
serviceAccount.automount: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: true
|
|
|
|
# =============================================================================
|
|
# EDGE CASES
|
|
# =============================================================================
|
|
|
|
- it: should handle empty name gracefully (use auto-generated)
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.name: ""
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: RELEASE-NAME-jellyfin
|
|
|
|
- it: should handle empty annotations object
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.annotations: {}
|
|
asserts:
|
|
- isNull:
|
|
path: metadata.annotations
|
|
|
|
- it: should work with custom name and annotations together
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.name: custom-sa
|
|
serviceAccount.annotations:
|
|
custom: annotation
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: custom-sa
|
|
- equal:
|
|
path: metadata.annotations.custom
|
|
value: annotation
|
|
|
|
- it: should work with all options combined
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.create: true
|
|
serviceAccount.name: jellyfin-prod-sa
|
|
serviceAccount.annotations:
|
|
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin
|
|
custom.io/annotation: value
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: jellyfin-prod-sa
|
|
- equal:
|
|
path: metadata.annotations.eks\.amazonaws\.com/role-arn
|
|
value: arn:aws:iam::123456789012:role/jellyfin
|
|
- equal:
|
|
path: metadata.annotations.custom\.io/annotation
|
|
value: value
|
|
|
|
# =============================================================================
|
|
# REGRESSION TESTS
|
|
# =============================================================================
|
|
|
|
- it: should always have correct labels
|
|
template: serviceaccount.yaml
|
|
asserts:
|
|
- equal:
|
|
path: metadata.labels.app\.kubernetes\.io/name
|
|
value: jellyfin
|
|
- equal:
|
|
path: metadata.labels.app\.kubernetes\.io/instance
|
|
value: RELEASE-NAME
|
|
|
|
- it: should always use v1 API version
|
|
template: serviceaccount.yaml
|
|
asserts:
|
|
- equal:
|
|
path: apiVersion
|
|
value: v1
|
|
|
|
- it: should always be ServiceAccount kind
|
|
template: serviceaccount.yaml
|
|
asserts:
|
|
- equal:
|
|
path: kind
|
|
value: ServiceAccount
|
|
|
|
# Verify deployment always sets serviceAccountName
|
|
- it: should always set serviceAccountName in deployment
|
|
template: deployment.yaml
|
|
asserts:
|
|
- isNotNull:
|
|
path: spec.template.spec.serviceAccountName
|
|
|
|
- it: should always set automountServiceAccountToken in deployment
|
|
template: deployment.yaml
|
|
asserts:
|
|
- isNotNull:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
|
|
# =============================================================================
|
|
# INTEGRATION SCENARIOS
|
|
# =============================================================================
|
|
|
|
# Scenario: Using existing external ServiceAccount
|
|
- it: should use existing external ServiceAccount without creating new one
|
|
set:
|
|
serviceAccount.create: false
|
|
serviceAccount.name: external-jellyfin-sa
|
|
serviceAccount.automount: false
|
|
asserts:
|
|
- template: serviceaccount.yaml
|
|
hasDocuments:
|
|
count: 0
|
|
- template: deployment.yaml
|
|
equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: external-jellyfin-sa
|
|
- template: deployment.yaml
|
|
equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: false
|
|
|
|
# Scenario: AWS IRSA (IAM Roles for Service Accounts)
|
|
- it: should configure for AWS IRSA
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.create: true
|
|
serviceAccount.name: jellyfin-irsa
|
|
serviceAccount.annotations:
|
|
eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-s3-access
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: jellyfin-irsa
|
|
- equal:
|
|
path: metadata.annotations.eks\.amazonaws\.com/role-arn
|
|
value: arn:aws:iam::123456789012:role/jellyfin-s3-access
|
|
|
|
# Scenario: GCP Workload Identity
|
|
- it: should configure for GCP Workload Identity
|
|
template: serviceaccount.yaml
|
|
set:
|
|
serviceAccount.annotations:
|
|
iam.gke.io/gcp-service-account: jellyfin@my-project.iam.gserviceaccount.com
|
|
asserts:
|
|
- equal:
|
|
path: metadata.annotations.iam\.gke\.io/gcp-service-account
|
|
value: jellyfin@my-project.iam.gserviceaccount.com
|
|
|
|
# Scenario: Minimal security (no automount)
|
|
- it: should support minimal security setup without token automount
|
|
set:
|
|
serviceAccount.create: true
|
|
serviceAccount.automount: false
|
|
asserts:
|
|
- template: serviceaccount.yaml
|
|
hasDocuments:
|
|
count: 1
|
|
- template: deployment.yaml
|
|
equal:
|
|
path: spec.template.spec.automountServiceAccountToken
|
|
value: false
|