volker.raschekandCopilot
4884dc0fe0
The files in templates/gitea/ used a mix of naming styles: lowercase concatenations (poddisruptionbudget.yaml, serviceaccount.yaml, servicemonitor.yaml, pvc.yaml), camelCase (httpService.yaml, sshService.yaml) and kind-suffixed names (gpg-secret.yaml, metrics-secret.yaml). It was therefore not obvious from a file name which Kubernetes resource it renders, and the naming contradicted the camelCase convention the Gateway API templates already follow. Files are now named after the kind they render, with a lowercase suffix distinguishing several resources of the same kind: config.yaml -> secret_config.yaml + secret_inlineConfig.yaml gpg-secret.yaml -> secret_gpg.yaml init.yaml -> secret_init.yaml metrics-secret.yaml -> secret_metrics.yaml httpService.yaml -> service_http.yaml sshService.yaml -> service_ssh.yaml poddisruptionbudget.yaml -> podDisruptionBudget.yaml pvc.yaml -> persistentVolumeClaim.yaml serviceaccount.yaml -> serviceAccount.yaml servicemonitor.yaml -> serviceMonitor.yaml config.yaml rendered two Secrets from a single file, which forced every unit test to address them via documentIndex. It is split so that each file renders exactly one resource. The rendered manifests are unchanged; only file names and the references to them were touched. This includes the checksum/config annotation in deployment.yaml and all helm unit test suites. The HA guard assertions had to move from deployment.yaml to secret_config.yaml: Helm sorts templates in reverse alphabetical order, so secret_config.yaml is now rendered before deployment.yaml and the fail() is reported for that file directly instead of bubbling up through the include chain of the Deployment. Users relying on the template paths (e.g. `helm template --show-only` or post-renderers) have to adjust to the new file names. Co-authored-by: Copilot <copilot@github.com>
107 lines
3.2 KiB
YAML
107 lines
3.2 KiB
YAML
suite: deployment template (openshift)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/gitea/deployment.yaml
|
|
- templates/gitea/secret_config.yaml
|
|
tests:
|
|
- it: renders openshift-compatible defaults for chart-managed containers
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift.enabled: true
|
|
asserts:
|
|
- notExists:
|
|
path: spec.template.spec.hostUsers
|
|
- notExists:
|
|
path: spec.template.spec.securityContext
|
|
- equal:
|
|
path: spec.template.spec.initContainers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.initContainers[1].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
- it: does not force runAsUser 1000 for command init containers on OpenShift
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift.enabled: true
|
|
signing.enabled: true
|
|
signing.existingSecret: custom-gpg-secret
|
|
asserts:
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[3].securityContext.runAsUser
|
|
|
|
- it: preserves explicit pod and container security context overrides on OpenShift
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift:
|
|
enabled: true
|
|
hostUsers: true
|
|
podSecurityContext:
|
|
fsGroup: 1000620000
|
|
containerSecurityContext:
|
|
runAsUser: 1000620000
|
|
runAsGroup: 1000620000
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.hostUsers
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1000620000
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
|
value: 1000620000
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.runAsGroup
|
|
value: 1000620000
|
|
|
|
- it: renders an explicit hostUsers=false override on OpenShift
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift:
|
|
enabled: true
|
|
hostUsers: false
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.hostUsers
|
|
value: false
|