Skip to content

Commit 2fa51bf

Browse files
IvanHuntersIvanHunters
committed
test(charts): isolate guard coverage for every guarded template
Add per-template guard suites so each guarded hostname site is exercised on its own: harbor harbor.yaml and httproute.yaml, bootbox machines.yaml, seaweedfs cosi-deployment.yaml, bucket deployment.yaml and httproute.yaml, monitoring alerta.yaml, grafana httproute.yaml and the grafanaHost helper via oidc-keycloak.yaml. Each suite renders only its target template, so removing that file's guard reddens it. Also add a postgres positive case that renders the Certificate with an apex set (external=true). Signed-off-by: IvanHunters <[email protected]>
1 parent de359f8 commit 2fa51bf

10 files changed

Lines changed: 335 additions & 0 deletions

‎packages/apps/harbor/tests/host_guard_harbor_cr_test.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
suite: harbor CR (harbor.yaml) guards an empty apex in isolation
2+
templates:
3+
- templates/harbor.yaml
4+
5+
release:
6+
name: harbor
7+
namespace: tenant-root
8+
9+
# Isolated to templates/harbor.yaml so reverting its own guard reddens this
10+
# suite even though sibling templates guard the same apex.
11+
12+
tests:
13+
- it: fails when _namespace is injected with an empty host and no host override
14+
set:
15+
_namespace:
16+
host: ""
17+
ingress: tenant-root
18+
_cluster:
19+
issuer-name: letsencrypt-prod
20+
solver: http01
21+
asserts:
22+
- failedTemplate:
23+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
24+
25+
- it: renders the credentials Secret URL from the apex when it is set
26+
set:
27+
_namespace:
28+
host: example.org
29+
ingress: tenant-root
30+
_cluster:
31+
issuer-name: letsencrypt-prod
32+
solver: http01
33+
documentSelector:
34+
path: kind
35+
value: Secret
36+
asserts:
37+
- equal:
38+
path: stringData.url
39+
value: https://harbor.example.org

‎packages/apps/harbor/tests/host_guard_httproute_test.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
suite: harbor HTTPRoute guards an empty apex in isolation
2+
templates:
3+
- templates/httproute.yaml
4+
5+
release:
6+
name: harbor
7+
namespace: tenant-root
8+
9+
tests:
10+
- it: fails when _namespace is injected with an empty host and no host override
11+
set:
12+
_namespace:
13+
host: ""
14+
ingress: tenant-root
15+
gateway: tenant-root
16+
asserts:
17+
- failedTemplate:
18+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
19+
20+
- it: renders the HTTPRoute hostname from the apex when it is set
21+
set:
22+
_namespace:
23+
host: example.org
24+
ingress: tenant-root
25+
gateway: tenant-root
26+
asserts:
27+
- equal:
28+
path: spec.hostnames[0]
29+
value: harbor.example.org

‎packages/apps/postgres/tests/host_guard_test.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,21 @@ tests:
4343
asserts:
4444
- isNull:
4545
path: spec.certificates
46+
47+
- it: renders the external cert SAN from the apex when it is set
48+
set:
49+
external: true
50+
tls:
51+
enabled: true
52+
_namespace:
53+
host: example.org
54+
_cluster:
55+
scheduling: {}
56+
cluster-domain: cozy.local
57+
documentSelector:
58+
path: kind
59+
value: Cluster
60+
asserts:
61+
- equal:
62+
path: spec.certificates.serverAltDNSNames[0]
63+
value: pg-test.example.org

‎packages/extra/bootbox/tests/host_guard_machines_test.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
suite: bootbox machines guards an empty apex in isolation
2+
templates:
3+
- templates/matchbox/machines.yaml
4+
5+
release:
6+
name: bootbox
7+
namespace: tenant-root
8+
9+
# The guard sits at the top of machines.yaml, before the machines range, so the
10+
# failing case needs no machines (the default [] is schema-valid). The positive
11+
# case supplies a schema-complete machine to emit a Hardware object.
12+
13+
tests:
14+
- it: fails when _namespace is injected with an empty host and no host override
15+
set:
16+
_namespace:
17+
host: ""
18+
ingress: tenant-root
19+
asserts:
20+
- failedTemplate:
21+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
22+
23+
- it: renders the iPXE URL from the apex when it is set
24+
set:
25+
_namespace:
26+
host: example.org
27+
ingress: tenant-root
28+
machines:
29+
- arch: x86_64
30+
hostname: node1
31+
mac: ["aa:bb:cc:dd:ee:ff"]
32+
uefi: true
33+
leaseTime: 3600
34+
ip:
35+
address: 192.0.2.10
36+
gateway: 192.0.2.1
37+
netmask: 255.255.255.0
38+
asserts:
39+
- equal:
40+
path: spec.interfaces[0].netboot.ipxe.url
41+
value: "https://bootbox.example.org/boot.ipxe"

‎packages/extra/seaweedfs/tests/host_guard_cosi_test.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
suite: seaweedfs COSI deployment guards an empty apex in isolation
2+
templates:
3+
- templates/client/cosi-deployment.yaml
4+
5+
release:
6+
name: seaweedfs
7+
namespace: tenant-root
8+
9+
tests:
10+
- it: fails when topology is Client and the apex is empty with no host override
11+
set:
12+
topology: Client
13+
_namespace:
14+
host: ""
15+
ingress: tenant-root
16+
filer:
17+
grpcHost: seaweedfs-filer
18+
grpcPort: 18888
19+
asserts:
20+
- failedTemplate:
21+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
22+
23+
- it: renders the S3 endpoint from the apex when it is set
24+
set:
25+
topology: Client
26+
_namespace:
27+
host: example.org
28+
ingress: tenant-root
29+
filer:
30+
grpcHost: seaweedfs-filer
31+
grpcPort: 18888
32+
asserts:
33+
- contains:
34+
path: spec.template.spec.containers[0].env
35+
content:
36+
name: ENDPOINT
37+
value: https://s3.example.org

‎packages/system/bucket/tests/host_guard_deployment_test.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
suite: bucket deployment guards an empty apex in isolation
2+
templates:
3+
- templates/deployment.yaml
4+
5+
release:
6+
name: bucket
7+
namespace: tenant-root
8+
9+
tests:
10+
- it: fails when _namespace is injected with an empty host
11+
set:
12+
_namespace:
13+
host: ""
14+
ingress: tenant-root
15+
asserts:
16+
- failedTemplate:
17+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
18+
19+
- it: renders the S3 endpoint from the apex when it is set
20+
set:
21+
_namespace:
22+
host: example.org
23+
ingress: tenant-root
24+
asserts:
25+
- contains:
26+
path: spec.template.spec.containers[0].env
27+
content:
28+
name: ENDPOINT
29+
value: s3.example.org

‎packages/system/bucket/tests/host_guard_httproute_test.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
suite: bucket HTTPRoute guards an empty apex in isolation
2+
templates:
3+
- templates/httproute.yaml
4+
5+
release:
6+
name: bucket
7+
namespace: tenant-root
8+
9+
tests:
10+
- it: fails when _namespace is injected with an empty host
11+
set:
12+
_namespace:
13+
host: ""
14+
ingress: tenant-root
15+
gateway: tenant-root
16+
asserts:
17+
- failedTemplate:
18+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
19+
20+
- it: renders the HTTPRoute hostname from the apex when it is set
21+
set:
22+
_namespace:
23+
host: example.org
24+
ingress: tenant-root
25+
gateway: tenant-root
26+
asserts:
27+
- equal:
28+
path: spec.hostnames[0]
29+
value: cozystack.example.org

‎packages/system/monitoring/tests/host_guard_alerta_test.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
suite: alerta guards an empty apex in isolation
2+
templates:
3+
- templates/alerta/alerta.yaml
4+
5+
release:
6+
name: monitoring
7+
namespace: tenant-root
8+
9+
tests:
10+
- it: fails when _namespace is injected with an empty host and no host override
11+
set:
12+
_namespace:
13+
host: ""
14+
ingress: tenant-root
15+
_cluster:
16+
issuer-name: letsencrypt-prod
17+
solver: http01
18+
gateway-enabled: "false"
19+
asserts:
20+
- failedTemplate:
21+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
22+
23+
- it: renders the alerta ingress host from the apex when it is set
24+
set:
25+
_namespace:
26+
host: example.org
27+
ingress: tenant-root
28+
_cluster:
29+
issuer-name: letsencrypt-prod
30+
solver: http01
31+
gateway-enabled: "false"
32+
documentSelector:
33+
path: kind
34+
value: Ingress
35+
asserts:
36+
- equal:
37+
path: spec.rules[0].host
38+
value: alerta.example.org

‎packages/system/monitoring/tests/host_guard_grafana_httproute_test.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
suite: grafana HTTPRoute guards an empty apex in isolation
2+
templates:
3+
- templates/grafana/httproute.yaml
4+
5+
release:
6+
name: monitoring
7+
namespace: tenant-root
8+
9+
tests:
10+
- it: fails when _namespace is injected with an empty host and no host override
11+
set:
12+
_namespace:
13+
host: ""
14+
ingress: tenant-root
15+
_cluster:
16+
gateway-enabled: "true"
17+
asserts:
18+
- failedTemplate:
19+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
20+
21+
- it: renders the HTTPRoute hostname from the apex when it is set
22+
set:
23+
_namespace:
24+
host: example.org
25+
ingress: tenant-root
26+
_cluster:
27+
gateway-enabled: "true"
28+
asserts:
29+
- equal:
30+
path: spec.hostnames[0]
31+
value: grafana.example.org

‎packages/system/monitoring/tests/host_guard_grafana_oidc_test.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
suite: grafana OIDC client (grafanaHost helper) guards an empty apex in isolation
2+
templates:
3+
- templates/grafana/oidc-keycloak.yaml
4+
5+
release:
6+
name: monitoring
7+
namespace: tenant-root
8+
9+
capabilities:
10+
apiVersions:
11+
- v1.edp.epam.com/v1
12+
13+
tests:
14+
- it: fails when mode is System and the apex is empty with no host override
15+
set:
16+
oidc:
17+
mode: System
18+
_cluster:
19+
oidc-enabled: "true"
20+
root-host: example.org
21+
_namespace:
22+
host: ""
23+
ingress: tenant-root
24+
asserts:
25+
- failedTemplate:
26+
errorMessage: "the tenant apex (_namespace.host) is empty and this app sets no host override, so its ingress hostname would be malformed. Set tenant.spec.host on this tenant, inherit it from a parent that has host set, or set this app's host value."
27+
28+
- it: renders the KeycloakClient webUrl from the apex when it is set
29+
set:
30+
oidc:
31+
mode: System
32+
_cluster:
33+
oidc-enabled: "true"
34+
root-host: example.org
35+
_namespace:
36+
host: example.org
37+
ingress: tenant-root
38+
documentSelector:
39+
path: kind
40+
value: KeycloakClient
41+
asserts:
42+
- equal:
43+
path: spec.webUrl
44+
value: https://grafana.example.org

0 commit comments

Comments
 (0)