suite: Test deployment on OpenShift
release:
  name: gitea-unittests
  namespace: testing
templates:
  - templates/deployment.yaml
  - templates/secret_admin.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
tests:
  - it: "Render OpenShift compatible defaults for the chart-managed containers"
    template: templates/deployment.yaml
    set:
      openshift.enabled: true
    asserts:
      - notExists:
          path: spec.template.spec.hostUsers
      - notExists:
          path: spec.template.spec.securityContext
      - equal:
          path: spec.template.spec.initContainers[0].securityContext
          value:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
      - equal:
          path: spec.template.spec.initContainers[1].securityContext
          value:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
      - equal:
          path: spec.template.spec.initContainers[2].securityContext
          value:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
      - equal:
          path: spec.template.spec.containers[0].securityContext
          value:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault

  - it: "Omit runAsUser 1000 for command init containers on OpenShift"
    template: templates/deployment.yaml
    set:
      openshift.enabled: true
      secrets.gpg.enabled: true
      secrets.gpg.existingSecret.enabled: true
      secrets.gpg.existingSecret.secretName: custom-gpg-secret
    asserts:
      - notExists:
          path: spec.template.spec.initContainers[2].securityContext.runAsUser
      - notExists:
          path: spec.template.spec.initContainers[3].securityContext.runAsUser

  - it: "Preserve explicit pod and container security context overrides on OpenShift"
    template: templates/deployment.yaml
    set:
      openshift:
        enabled: true
      deployment:
        hostUsers: true
        securityContext:
          fsGroup: 1000620000
        gitea:
          securityContext:
            runAsUser: 1000620000
            runAsGroup: 1000620000
    asserts:
      - equal:
          path: spec.template.spec.hostUsers
          value: true
      - equal:
          path: spec.template.spec.securityContext
          value:
            fsGroup: 1000620000
      - equal:
          path: spec.template.spec.initContainers[2].securityContext.runAsUser
          value: 1000620000
      - equal:
          path: spec.template.spec.containers[0].securityContext.runAsGroup
          value: 1000620000

  - it: "Render an explicit hostUsers=false override on OpenShift"
    template: templates/deployment.yaml
    set:
      openshift:
        enabled: true
      deployment:
        hostUsers: false
    asserts:
      - equal:
          path: spec.template.spec.hostUsers
          value: false