OpenShell/deploy/helm/openshell/tests/clusterrole_test.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: ClusterRole RBAC
templates:
  - templates/clusterrole.yaml
release:
  name: openshell
  namespace: my-namespace

tests:
  - it: includes the release namespace in the ClusterRole name
    asserts:
      - equal:
          path: metadata.name
          value: openshell-node-reader-my-namespace

  - it: grants managed namespace NetworkPolicy apply permissions
    set:
      server.drivers.kubernetes.workspaceMode: managed
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: ["networking.k8s.io"]
            resources: ["networkpolicies"]
            verbs: ["get", "create", "patch", "update"]

  - it: limits namespaced admission reads to PVCs
    set:
      server.drivers.kubernetes.workspaceMode: managed
      server.drivers.kubernetes.allowDriverConfig: true
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["persistentvolumeclaims"]
            verbs: ["get"]
      - notContains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["get"]
      - notContains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["configmaps"]
            verbs: ["get"]

  - it: omits PVC admission reads when caller driver config is disabled
    set:
      server.drivers.kubernetes.workspaceMode: managed
    asserts:
      - notContains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["persistentvolumeclaims"]
            verbs: ["get"]

  - it: preserves sandbox-runtime fence permissions when gateway isolation is disabled
    set:
      server.drivers.kubernetes.workspaceMode: managed
      networkPolicy.enabled: false
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: ["networking.k8s.io"]
            resources: ["networkpolicies"]
            verbs: ["create", "get"]
      - notContains:
          path: rules
          content:
            apiGroups: ["networking.k8s.io"]
            resources: ["networkpolicies"]
            verbs: ["get", "create", "patch", "update"]

  - it: grants broad secret access when credential driver is enabled (operator)
    set:
      server.drivers.kubernetes.workspaceMode: operator
      server.credentialDrivers.kubernetesSecrets.enabled: true
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["get", "create", "patch", "delete"]

  - it: restricts operator TLS sync to the configured secret
    set:
      server.drivers.kubernetes.workspaceMode: operator
      server.tls.clientTlsSecretName: custom-client-tls
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            resourceNames: ["custom-client-tls"]
            verbs: ["get", "patch"]

  - it: grants operator bootstrap secret lifecycle permissions when TLS and credential storage are disabled
    set:
      server.drivers.kubernetes.workspaceMode: operator
      server.disableTls: true
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["create", "list", "delete"]
      - notContains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["get", "create", "patch", "delete"]

  - it: restricts managed copies to TLS and configured image-pull secrets
    set:
      server.drivers.kubernetes.workspaceMode: managed
      server.tls.clientTlsSecretName: custom-client-tls
      server.sandboxImagePullSecrets:
        - name: registry-one
        - name: registry-two
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            resourceNames: ["custom-client-tls", "registry-one", "registry-two"]
            verbs: ["get", "patch"]
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["create", "list", "delete"]

  - it: restricts managed copies to image-pull secrets when TLS is disabled
    set:
      server.drivers.kubernetes.workspaceMode: managed
      server.disableTls: true
      server.sandboxImagePullSecrets:
        - name: registry-one
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            resourceNames: ["registry-one"]
            verbs: ["get", "patch"]
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["create", "list", "delete"]

  - it: omits secrets rule entirely in shared mode
    set:
      server.drivers.kubernetes.workspaceMode: shared
    asserts:
      - notContains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
          any: true

  - it: grants managed sandbox-runtime companion permissions
    set:
      server.drivers.kubernetes.workspaceMode: managed
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["pods"]
            verbs: ["create", "delete", "get", "list", "patch", "watch"]
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["services"]
            verbs: ["create", "get"]
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["create", "list", "delete"]

  - it: grants operator sandbox-runtime companion permissions
    set:
      server.drivers.kubernetes.workspaceMode: operator
    asserts:
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["pods"]
            verbs: ["create", "delete", "get", "list", "patch", "watch"]
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["services"]
            verbs: ["create", "get"]
      - contains:
          path: rules
          content:
            apiGroups: [""]
            resources: ["secrets"]
            verbs: ["create", "list", "delete"]