mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-29 07:23:25 +08:00
Drew Newberry
1e34e8c576
* fix(drivers): require admission labels for external resources Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(drivers): address resource admission review findings Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(core): reserve driver-owned admission labels Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(core): clarify workspace admission label Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(drivers): clarify resource admission failures Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(e2e): configure resource admission fixtures Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(kubernetes): retry forbidden admission lookups Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(e2e): preserve external driver admission defaults Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
1117 lines
41 KiB
YAML
1117 lines
41 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
suite: gateway TOML config shape
|
|
templates:
|
|
- templates/gateway-config.yaml
|
|
- templates/deployment.yaml
|
|
- templates/peer-role.yaml
|
|
- templates/peer-service.yaml
|
|
- templates/statefulset.yaml
|
|
release:
|
|
name: openshell
|
|
namespace: my-namespace
|
|
|
|
tests:
|
|
- it: defaults to label admission with caller driver config disabled
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^allow_driver_config\s*=\s*false$'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\.resource_admission\]\s*enabled\s*=\s*true'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.drivers\.kubernetes\.resource_admission\.required_labels\]'
|
|
|
|
- it: preserves explicit admission opt-out without enabling driver config
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.drivers.kubernetes.resourceAdmission.enabled: false
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^allow_driver_config\s*=\s*false$'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\.resource_admission\]\s*enabled\s*=\s*false'
|
|
|
|
- it: renders replacement labels and literal workspace substitution
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.drivers.kubernetes.allowDriverConfig: true
|
|
server.drivers.kubernetes.resourceAdmission.requiredLabels:
|
|
platform.example.com/sandbox-attachable: "approved"
|
|
platform.example.com/team: '${workspace}'
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '"platform.example.com/sandbox-attachable" = "approved"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '"platform.example.com/team" = "\$\{workspace\}"'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'openshell.ai/sandbox-attachable'
|
|
|
|
- it: identifies the gateway by chart fullname by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^name\s*=\s*"openshell"$'
|
|
|
|
- it: renders an explicit gateway name
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.name: production-us-west
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^name\s*=\s*"production-us-west"$'
|
|
|
|
- it: renders schema version 2 and the Kubernetes compute driver selector
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\]\s*version\s*=\s*2'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\][^\[]*?compute_driver\s*=\s*"kubernetes"'
|
|
|
|
# Regression for Drew's P2: a ConfigMap-only mutation in `helm upgrade`
|
|
# must roll the StatefulSet, otherwise pods keep running with stale config.
|
|
- it: annotates the StatefulSet pod template with a ConfigMap checksum
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- exists:
|
|
path: spec.template.metadata.annotations["checksum/gateway-config"]
|
|
|
|
- it: mounts gateway.toml as a regular read-only subPath file
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: gateway-config
|
|
mountPath: /etc/openshell/gateway.toml
|
|
subPath: gateway.toml
|
|
readOnly: true
|
|
- contains:
|
|
path: spec.template.spec.volumes
|
|
content:
|
|
name: gateway-config
|
|
configMap:
|
|
name: openshell-config
|
|
|
|
- it: renders a StatefulSet by default
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- equal:
|
|
path: kind
|
|
value: StatefulSet
|
|
|
|
- it: treats a null workload map as the default StatefulSet
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
workload: null
|
|
asserts:
|
|
- equal:
|
|
path: kind
|
|
value: StatefulSet
|
|
|
|
- it: uses a stable gateway container name
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.containers[0].name
|
|
value: openshell-gateway
|
|
|
|
- it: enables anonymous telemetry by default
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_TELEMETRY_ENABLED
|
|
value: "true"
|
|
|
|
- it: disables anonymous telemetry when configured
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.telemetryEnabled: false
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_TELEMETRY_ENABLED
|
|
value: "false"
|
|
|
|
- it: renders OTLP tracing configuration when configured
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.otlp.endpoint: http://otel-collector.observability.svc:4317
|
|
server.otlp.serviceName: production-gateway
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\.otlp\].*?endpoint\s*=\s*"http://otel-collector\.observability\.svc:4317".*?service_name\s*=\s*"production-gateway"'
|
|
|
|
- it: omits OTLP tracing configuration by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.otlp\]'
|
|
|
|
- it: renders OIDC transport security settings
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.oidc.issuer: https://issuer.example.com
|
|
server.oidc.dangerouslyAllowInsecureHttp: false
|
|
server.oidc.jwksAllowedOrigins[0]: https://keys.example.com
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^dangerously_allow_insecure_http\s*=\s*false$'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^jwks_allowed_origins\s*=\s*\["https://keys.example.com"\]$'
|
|
|
|
- it: treats a null OTLP map as disabled
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.otlp: null
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.otlp\]'
|
|
|
|
- it: mounts the OIDC CA bundle when TLS is disabled
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.disableTls: true
|
|
server.oidc.issuer: https://issuer.example.com
|
|
server.oidc.caConfigMapName: openshell-oidc-ca
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.containers[0].volumeMounts[4].name
|
|
value: oidc-ca
|
|
- equal:
|
|
path: spec.template.spec.containers[0].volumeMounts[4].mountPath
|
|
value: /etc/openshell-tls/oidc-ca
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].name
|
|
value: oidc-ca
|
|
- equal:
|
|
path: spec.template.spec.volumes[3].configMap.name
|
|
value: openshell-oidc-ca
|
|
|
|
# Regression for the P1 bug Drew flagged: grpc_endpoint MUST live in the
|
|
# Kubernetes driver table, not in [openshell.gateway]. The gateway-side
|
|
# schema has `deny_unknown_fields` and no `grpc_endpoint` field, so writing
|
|
# it at gateway scope makes `config_file::load` reject the default install.
|
|
- it: renders grpc_endpoint under [openshell.drivers.kubernetes], not [openshell.gateway]
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?grpc_endpoint'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\][^\[]*?grpc_endpoint'
|
|
|
|
- it: omits pull policies by default so Kubernetes applies its own defaults
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?m)^\s*(image_pull_policy|supervisor_image_pull_policy)\s*='
|
|
|
|
- it: renders canonical image pull policies in the Kubernetes driver table
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: if_not_present
|
|
supervisor.image.pullPolicy: never
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?image_pull_policy\s*=\s*"if_not_present".*?supervisor_image_pull_policy\s*=\s*"never"'
|
|
|
|
- it: translates legacy Kubernetes pull policy values to canonical gateway values
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: Always
|
|
supervisor.image.pullPolicy: IfNotPresent
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?image_pull_policy\s*=\s*"always".*?supervisor_image_pull_policy\s*=\s*"if_not_present"'
|
|
|
|
- it: rejects unsupported sandbox image pull policies
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: Sometimes
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: 'image pull policy "Sometimes" must be one of: always, if_not_present, never, Always, IfNotPresent, Never'
|
|
|
|
- it: rejects unsupported supervisor image pull policies
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
supervisor.image.pullPolicy: newer
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: 'image pull policy "newer" must be one of: always, if_not_present, never, Always, IfNotPresent, Never'
|
|
|
|
- it: renders driver-owned Kubernetes settings only in its driver table
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.hostGatewayIP: 10.0.0.1
|
|
server.enableUserNamespaces: true
|
|
supervisor.image.tag: test
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?namespace\s*=\s*"my-namespace".*?default_image\s*=.*?supervisor_image\s*=.*?host_gateway_ip\s*=\s*"10\.0\.0\.1".*?client_tls_secret_name\s*=.*?service_account_name\s*=\s*"openshell-sandbox".*?enable_user_namespaces\s*=\s*true.*?sa_token_ttl_secs\s*='
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\][^\[]*?(sandbox_namespace|default_image|supervisor_image|client_tls_secret_name|service_account_name|host_gateway_ip|enable_user_namespaces|sa_token_ttl_secs)\s*='
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'guest_tls_(ca|cert|key)\s*='
|
|
|
|
- it: renders user namespace enablement under [openshell.drivers.kubernetes]
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.enableUserNamespaces: true
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?enable_user_namespaces\s*=\s*true'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\][^\[]*?enable_user_namespaces'
|
|
|
|
- it: renders operator-owned upstream proxy settings under the Kubernetes driver
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
upstreamProxy.url: http://proxy.corp.example:8080
|
|
upstreamProxy.noProxy: .svc.cluster.local,10.96.0.0/12
|
|
upstreamProxy.authSecret.name: corporate-proxy-auth
|
|
upstreamProxy.authSecret.key: credentials
|
|
upstreamProxy.authAllowInsecure: true
|
|
upstreamProxy.connectByHostname: true
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?https_proxy\s*=\s*"http://proxy\.corp\.example:8080"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'proxy_auth_secret_name\s*=\s*"corporate-proxy-auth"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'proxy_auth_secret_key\s*=\s*"credentials"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'proxy_auth_allow_insecure\s*=\s*true'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'no_proxy\s*=\s*"\.svc\.cluster\.local,10\.96\.0\.0/12"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'proxy_connect_by_hostname\s*=\s*true'
|
|
|
|
- it: renders proxy_ca_bundle when a corporate CA ConfigMap is configured
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
upstreamProxy.url: https://proxy.corp.example:3130
|
|
upstreamProxy.caBundle.configMapName: corporate-proxy-ca
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?proxy_ca_bundle\s*=\s*"/etc/openshell-tls/proxy-ca/ca\.crt"'
|
|
|
|
- it: omits proxy_ca_bundle when no corporate CA ConfigMap is configured
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
upstreamProxy.url: http://proxy.corp.example:8080
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'proxy_ca_bundle\s*='
|
|
|
|
- it: uses the gateway built-in supervisor image by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_image\s*='
|
|
|
|
- it: uses the gateway built-in sandbox runtime image by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'sandbox_runtime_image\s*='
|
|
|
|
- it: renders independent sandbox runtime and supervisor image overrides
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
sandboxRuntime.image.repository: registry.example.com/openshell/sandbox
|
|
sandboxRuntime.image.tag: sandbox-build
|
|
sandboxRuntime.image.pullPolicy: Always
|
|
supervisor.image.repository: registry.example.com/openshell/supervisor
|
|
supervisor.image.tag: supervisor-build
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'sandbox_runtime_image\s*=\s*"registry\.example\.com/openshell/sandbox:sandbox-build"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'sandbox_runtime_image_pull_policy\s*=\s*"always"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_image\s*=\s*"registry\.example\.com/openshell/supervisor:supervisor-build"'
|
|
|
|
- it: renders a supervisor tag override with the official repository
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
supervisor.image.tag: 1.2.3
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_image\s*=\s*"ghcr\.io/nvidia/openshell/supervisor:1\.2\.3"'
|
|
|
|
- it: renders a supervisor repository override with the effective gateway tag
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
image.tag: gateway-build
|
|
supervisor.image.repository: registry.example.com/openshell/supervisor
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_image\s*=\s*"registry\.example\.com/openshell/supervisor:gateway-build"'
|
|
|
|
- it: renders complete supervisor repository and tag overrides
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
supervisor.image.repository: registry.example.com/openshell/supervisor
|
|
supervisor.image.tag: supervisor-build
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'supervisor_image\s*=\s*"registry\.example\.com/openshell/supervisor:supervisor-build"'
|
|
|
|
- it: configures managed SSH isolation with the gateway peer
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\.managed_ssh_ingress\].*?enabled\s*=\s*true.*?gateway_namespace\s*=\s*"my-namespace".*?gateway_pod_selector\s*=.*?app\.kubernetes\.io/name.*?openshell'
|
|
|
|
- it: renders sandbox image pull secrets under [openshell.drivers.kubernetes]
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullSecrets:
|
|
- name: regcred
|
|
- name: backup-regcred
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?image_pull_secrets\s*=\s*\["regcred", "backup-regcred"\]'
|
|
|
|
- it: does not reuse gateway image pull secrets for sandbox pods
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
imagePullSecrets:
|
|
- name: gateway-regcred
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'image_pull_secrets\s*='
|
|
|
|
- it: does not render local mTLS user auth for Kubernetes deployments
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.mtls_auth\]'
|
|
|
|
- it: does not allow unauthenticated users by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.auth\]'
|
|
|
|
- it: renders explicit unauthenticated user dev mode when enabled
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.auth.allowUnauthenticatedUsers: true
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\.auth\].*?allow_unauthenticated_users\s*=\s*true'
|
|
|
|
- it: omits the gRPC rate limit by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'grpc_rate_limit_requests\s*='
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'grpc_rate_limit_window_seconds\s*='
|
|
|
|
- it: renders fail-closed policy validation posture by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\].*?policy_validation_failure_mode\s*=\s*"fail_closed"'
|
|
|
|
- it: renders retain-last-valid policy validation posture
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.policyValidationFailureMode: retain_last_valid
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\].*?policy_validation_failure_mode\s*=\s*"retain_last_valid"'
|
|
|
|
- it: renders the gRPC rate limit under [openshell.gateway] when both values are positive
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.grpcRateLimit.requests: 120
|
|
server.grpcRateLimit.windowSeconds: 60
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\].*?grpc_rate_limit_requests\s*=\s*120'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.gateway\].*?grpc_rate_limit_window_seconds\s*=\s*60'
|
|
|
|
# The validation lives in gateway-config.yaml but surfaces through the
|
|
# statefulset checksum include, so the failure is asserted against that
|
|
# template (mirrors the postgres serviceBindings failure test below).
|
|
- it: fails to render when only requests is positive
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.grpcRateLimit.requests: 120
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "server.grpcRateLimit requires both requests and windowSeconds to be positive to enable rate limiting, or both 0/unset to disable it"
|
|
|
|
- it: fails to render when only windowSeconds is positive
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.grpcRateLimit.windowSeconds: 60
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "server.grpcRateLimit requires both requests and windowSeconds to be positive to enable rate limiting, or both 0/unset to disable it"
|
|
|
|
- it: fails to render when requests is negative
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.grpcRateLimit.requests: -1
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "server.grpcRateLimit.requests and server.grpcRateLimit.windowSeconds must not be negative; they map to unsigned gateway settings"
|
|
|
|
- it: fails to render when windowSeconds is negative
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.grpcRateLimit.windowSeconds: -5
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "server.grpcRateLimit.requests and server.grpcRateLimit.windowSeconds must not be negative; they map to unsigned gateway settings"
|
|
|
|
- it: uses the configured existing sandbox service account name
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
sandboxServiceAccount.create: false
|
|
sandboxServiceAccount.name: precreated-sandbox
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?service_account_name\s*=\s*"precreated-sandbox"'
|
|
|
|
- it: omits server_sans when no DNS SANs are configured
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'server_sans\s*='
|
|
|
|
- it: emits disable_tls=true and omits the [openshell.gateway.tls] section when disableTls is set
|
|
set:
|
|
server.disableTls: true
|
|
certManager.enabled: false
|
|
pkiInitJob.enabled: false
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'disable_tls\s*=\s*true'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.tls\]'
|
|
|
|
- it: omits client_ca_path from the TLS section when mTLS is disabled
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.tls.enableMtls: false
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.tls\]'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'cert_path\s*='
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'key_path\s*='
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'client_ca_path\s*='
|
|
|
|
- it: renders client_ca_path for built-in PKI by default
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'client_ca_path\s*=\s*"/etc/openshell-tls/client-ca/ca\.crt"'
|
|
|
|
- it: omits client_ca_path when clientCaSecretName is empty for HTTPS-only mode
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.tls.clientCaSecretName: ""
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.tls\]'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'cert_path\s*=\s*"/etc/openshell-tls/server/tls\.crt"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'key_path\s*=\s*"/etc/openshell-tls/server/tls\.key"'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'client_ca_path\s*='
|
|
|
|
- it: keeps external server certificate fields when clientCaSecretName is empty
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.serverIssuerRef.name: letsencrypt-prod
|
|
certManager.serverDnsNames:
|
|
- gateway.example.com
|
|
server.tls.clientCaSecretName: ""
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'client_ca_path\s*='
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'external_cert_path\s*=\s*"/etc/openshell-tls/server-external/tls\.crt"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'external_key_path\s*=\s*"/etc/openshell-tls/server-external/tls\.key"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'external_server_names\s*=\s*\["gateway\.example\.com"\]'
|
|
|
|
- it: omits client_ca_path for cert-manager shared CA when clientCaSecretName is empty
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.clientCaFromServerTlsSecret: true
|
|
server.tls.clientCaSecretName: ""
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.tls\]'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'cert_path\s*=\s*"/etc/openshell-tls/server/tls\.crt"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'key_path\s*=\s*"/etc/openshell-tls/server/tls\.key"'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'client_ca_path\s*='
|
|
|
|
- it: omits client_ca_path when cert-manager owns TLS and no client CA secret is set
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.clientCaFromServerTlsSecret: false
|
|
pkiInitJob.enabled: true
|
|
server.tls.clientCaSecretName: ""
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.tls\]'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'cert_path\s*=\s*"/etc/openshell-tls/server/tls\.crt"'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'key_path\s*=\s*"/etc/openshell-tls/server/tls\.key"'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'client_ca_path\s*='
|
|
|
|
- it: renders server_sans from certManager.serverDnsNames
|
|
set:
|
|
certManager.enabled: true
|
|
certManager.serverDnsNames:
|
|
- openshell
|
|
- "*.dev.openshell.localhost"
|
|
pkiInitJob.enabled: false
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'server_sans\s*=\s*\["openshell", "\*\.dev\.openshell\.localhost"\]'
|
|
|
|
- it: passes sqlite db-url via --db-url arg by default
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "sqlite:/var/openshell/openshell.db"
|
|
|
|
- it: fails when clientCaSecretName is null
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.tls.clientCaSecretName: null
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "server.tls.clientCaSecretName cannot be null; omit the key to use the chart default (openshell-server-client-ca), or set to \"\" to disable client certificate verification for HTTPS-only mode"
|
|
|
|
- it: configures gateway peer identity and projected peer token
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.serviceName
|
|
value: openshell-peer
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_SERVICE_NAME
|
|
value: openshell-peer
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_TOKEN_AUDIENCE
|
|
value: openshell-gateway-peer
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_TLS_SERVER_NAME
|
|
value: openshell.my-namespace.svc.cluster.local
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_TLS_CA_FILE
|
|
value: /etc/openshell-tls/server/ca.crt
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_TLS_CERT_FILE
|
|
value: /etc/openshell-tls/peer-client/tls.crt
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_TLS_KEY_FILE
|
|
value: /etc/openshell-tls/peer-client/tls.key
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: gateway-peer-token
|
|
mountPath: /var/run/secrets/openshell-peer
|
|
readOnly: true
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: peer-client-tls
|
|
mountPath: /etc/openshell-tls/peer-client
|
|
readOnly: true
|
|
- equal:
|
|
path: spec.template.spec.volumes[2].projected.sources[0].serviceAccountToken.audience
|
|
value: openshell-gateway-peer
|
|
|
|
- it: configures gateway peer identity and projected peer token for Deployment
|
|
template: templates/deployment.yaml
|
|
set:
|
|
workload.kind: deployment
|
|
server.externalDbSecret: my-pg-secret
|
|
server.disableTls: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_ENDPOINT
|
|
value: http://$(OPENSHELL_POD_IP):8080
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_SERVICE_NAME
|
|
value: openshell-peer
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_PEER_TOKEN_AUDIENCE
|
|
value: openshell-gateway-peer
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: gateway-peer-token
|
|
mountPath: /var/run/secrets/openshell-peer
|
|
readOnly: true
|
|
- equal:
|
|
path: spec.template.spec.volumes[2].projected.sources[0].serviceAccountToken.audience
|
|
value: openshell-gateway-peer
|
|
|
|
- it: renders headless gateway peer service
|
|
template: templates/peer-service.yaml
|
|
asserts:
|
|
- equal:
|
|
path: metadata.name
|
|
value: openshell-peer
|
|
- equal:
|
|
path: spec.clusterIP
|
|
value: None
|
|
- equal:
|
|
path: spec.publishNotReadyAddresses
|
|
value: true
|
|
|
|
- it: grants release-namespace pod lookup for gateway peer identity validation
|
|
template: templates/peer-role.yaml
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 2
|
|
- equal:
|
|
path: metadata.namespace
|
|
value: my-namespace
|
|
documentIndex: 0
|
|
- equal:
|
|
path: rules[0].resources[0]
|
|
value: pods
|
|
documentIndex: 0
|
|
- equal:
|
|
path: subjects[0].name
|
|
value: openshell
|
|
documentIndex: 1
|
|
|
|
- it: fails when legacy postgres.enabled is set
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
postgres.enabled: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: "postgres.enabled was removed"
|
|
|
|
- it: fails when multiple replicas use the default SQLite database
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
replicaCount: 2
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: "replicaCount > 1 requires server.externalDbSecret"
|
|
|
|
- it: renders a Deployment for external database-backed gateway workloads
|
|
template: templates/deployment.yaml
|
|
set:
|
|
workload.kind: deployment
|
|
replicaCount: 2
|
|
server.externalDbSecret: my-pg-secret
|
|
server.credentialDrivers.kubernetesSecrets.enabled: true
|
|
asserts:
|
|
- equal:
|
|
path: kind
|
|
value: Deployment
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 2
|
|
- equal:
|
|
path: spec.template.spec.containers[0].name
|
|
value: openshell-gateway
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: gateway-config
|
|
mountPath: /etc/openshell/gateway.toml
|
|
subPath: gateway.toml
|
|
readOnly: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: openshell-data
|
|
mountPath: /var/openshell
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_DB_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: my-pg-secret
|
|
key: uri
|
|
|
|
- it: fails when a Deployment uses the default SQLite database
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
workload.kind: deployment
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: "workload.kind=deployment requires server.externalDbSecret"
|
|
|
|
- it: fails when multiple replicas use a StatefulSet without an override
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
replicaCount: 2
|
|
server.externalDbSecret: my-pg-secret
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: "replicaCount > 1 with workload.kind=statefulset requires workload.allowMultiReplicaStatefulSet=true"
|
|
|
|
- it: allows a multi-replica StatefulSet with an external database and explicit override
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
replicaCount: 2
|
|
server.externalDbSecret: my-pg-secret
|
|
workload.allowMultiReplicaStatefulSet: true
|
|
server.credentialDrivers.kubernetesSecrets.enabled: true
|
|
asserts:
|
|
- equal:
|
|
path: kind
|
|
value: StatefulSet
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 2
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: openshell-data
|
|
mountPath: /var/openshell
|
|
|
|
- it: fails when workload.kind is invalid
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
workload.kind: daemonset
|
|
asserts:
|
|
- failedTemplate:
|
|
errorPattern: "workload.kind must be one of: statefulset, deployment"
|
|
|
|
- it: does not pass --db-url in args when externalDbSecret is set
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.externalDbSecret: my-pg-secret
|
|
asserts:
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].args
|
|
content: "--db-url"
|
|
|
|
- it: references externalDbSecret when set
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
server.externalDbSecret: my-pg-secret
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_DB_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: my-pg-secret
|
|
key: uri
|
|
|
|
- it: renders HA external database configuration from the CI overlay as a Deployment
|
|
template: templates/deployment.yaml
|
|
values:
|
|
- ../ci/values-high-availability.yaml
|
|
asserts:
|
|
- equal:
|
|
path: kind
|
|
value: Deployment
|
|
- equal:
|
|
path: spec.replicas
|
|
value: 2
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_DB_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openshell-ha-pg
|
|
key: uri
|
|
- it: renders provider SPIFFE token grants while keeping gateway JWT auth
|
|
set:
|
|
server.providerTokenGrants.spiffe.enabled: true
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.gateway_jwt\]'
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: 'provider_spiffe_workload_api_socket_path\s*=\s*"/spiffe-workload-api/spire-agent\.sock"'
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: '\[openshell\.gateway\.spiffe\]'
|
|
|
|
- it: mounts the gateway SPIFFE socket while keeping sandbox JWT auth
|
|
set:
|
|
server.providerTokenGrants.spiffe.enabled: true
|
|
template: templates/statefulset.yaml
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: OPENSHELL_GATEWAY_SPIFFE_WORKLOAD_API_SOCKET
|
|
value: /spiffe-workload-api/spire-agent.sock
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: sandbox-jwt
|
|
mountPath: /etc/openshell-jwt
|
|
readOnly: true
|
|
- contains:
|
|
path: spec.template.spec.containers[0].volumeMounts
|
|
content:
|
|
name: spiffe-workload-api
|
|
mountPath: /spiffe-workload-api
|
|
readOnly: true
|
|
- contains:
|
|
path: spec.template.spec.volumes
|
|
content:
|
|
name: sandbox-jwt
|
|
secret:
|
|
defaultMode: 256
|
|
secretName: openshell-jwt-keys
|
|
- contains:
|
|
path: spec.template.spec.volumes
|
|
content:
|
|
name: spiffe-workload-api
|
|
csi:
|
|
driver: csi.spiffe.io
|
|
readOnly: true
|
|
|
|
- it: fails when serverIssuerRef is set but certManager is disabled
|
|
template: templates/statefulset.yaml
|
|
set:
|
|
certManager.serverIssuerRef.name: letsencrypt-prod
|
|
certManager.enabled: false
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "certManager.serverIssuerRef.name is set but certManager.enabled is false \u2014 the external server certificate, its Secret mount, and the gateway TLS configuration all require cert-manager to be enabled. Set certManager.enabled=true or remove certManager.serverIssuerRef.name."
|
|
|
|
- it: does not render the schema-v1 compute_drivers selector
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?m)^\\s*compute_drivers\\s*="
|
|
|
|
- it: uses the release fullname and namespace for default Kubernetes settings
|
|
template: templates/gateway-config.yaml
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)name\\s*=\\s*\\\"openshell\\\".*?\\[openshell\\.drivers\\.kubernetes\\].*?namespace\\s*=\\s*\\\"my-namespace\\\".*?grpc_endpoint\\s*=\\s*\\\"https://openshell\\.my-namespace\\.svc\\.cluster\\.local:8080\\\""
|
|
|
|
- it: uses an explicit server grpc endpoint verbatim
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.grpcEndpoint: https://gateway.example.test:9443
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?grpc_endpoint\\s*=\\s*\\\"https://gateway\\.example\\.test:9443\\\""
|
|
|
|
- it: uses HTTP callback and omits client TLS secret when TLS is disabled
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.disableTls: true
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?grpc_endpoint\\s*=\\s*\\\"http://openshell\\.my-namespace\\.svc\\.cluster\\.local:8080\\\""
|
|
- notMatchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "client_tls_secret_name\\s*="
|
|
|
|
- it: accepts Always pull policy spelling for sandbox and supervisor
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: Always
|
|
supervisor.image.pullPolicy: Always
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?image_pull_policy\\s*=\\s*\\\"always\\\".*?supervisor_image_pull_policy\\s*=\\s*\\\"always\\\""
|
|
|
|
- it: accepts IfNotPresent pull policy spelling for sandbox and supervisor
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: IfNotPresent
|
|
supervisor.image.pullPolicy: IfNotPresent
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?image_pull_policy\\s*=\\s*\\\"if_not_present\\\".*?supervisor_image_pull_policy\\s*=\\s*\\\"if_not_present\\\""
|
|
|
|
- it: accepts Never pull policy spelling for sandbox and supervisor
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: Never
|
|
supervisor.image.pullPolicy: Never
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?image_pull_policy\\s*=\\s*\\\"never\\\".*?supervisor_image_pull_policy\\s*=\\s*\\\"never\\\""
|
|
|
|
- it: accepts canonical lowercase pull policies for sandbox and supervisor
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: always
|
|
supervisor.image.pullPolicy: always
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?image_pull_policy\\s*=\\s*\\\"always\\\".*?supervisor_image_pull_policy\\s*=\\s*\\\"always\\\""
|
|
|
|
- it: accepts canonical if_not_present pull policies for sandbox and supervisor
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: if_not_present
|
|
supervisor.image.pullPolicy: if_not_present
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?image_pull_policy\\s*=\\s*\\\"if_not_present\\\".*?supervisor_image_pull_policy\\s*=\\s*\\\"if_not_present\\\""
|
|
|
|
- it: accepts canonical never pull policies for sandbox and supervisor
|
|
template: templates/gateway-config.yaml
|
|
set:
|
|
server.sandboxImagePullPolicy: never
|
|
supervisor.image.pullPolicy: never
|
|
asserts:
|
|
- matchRegex:
|
|
path: data["gateway.toml"]
|
|
pattern: "(?ms)\\[openshell\\.drivers\\.kubernetes\\].*?image_pull_policy\\s*=\\s*\\\"never\\\".*?supervisor_image_pull_policy\\s*=\\s*\\\"never\\\""
|