OpenShell/deploy/helm/openshell/tests/gateway_config_test.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: gateway TOML config shape
templates:
  - templates/gateway-config.yaml
  - templates/statefulset.yaml
release:
  name: openshell
  namespace: my-namespace

tests:
  # Regression for Drew's P2: a ConfigMap-only mutation in `helm upgrade`
  # must roll the StatefulSet, otherwise pods keep running with stale config.
  - it: annotates the StatefulSet pod template with a ConfigMap checksum
    template: templates/statefulset.yaml
    asserts:
      - exists:
          path: spec.template.metadata.annotations["checksum/gateway-config"]

  - it: mounts the OIDC CA bundle when TLS is disabled
    template: templates/statefulset.yaml
    set:
      server.disableTls: true
      server.oidc.issuer: https://issuer.example.com
      server.oidc.caConfigMapName: openshell-oidc-ca
    asserts:
      - equal:
          path: spec.template.spec.containers[0].volumeMounts[3].name
          value: oidc-ca
      - equal:
          path: spec.template.spec.containers[0].volumeMounts[3].mountPath
          value: /etc/openshell-tls/oidc-ca
      - equal:
          path: spec.template.spec.volumes[2].name
          value: oidc-ca
      - equal:
          path: spec.template.spec.volumes[2].configMap.name
          value: openshell-oidc-ca

  # Regression for the P1 bug Drew flagged: grpc_endpoint MUST live in the
  # Kubernetes driver table, not in [openshell.gateway]. The gateway-side
  # schema has `deny_unknown_fields` and no `grpc_endpoint` field, so writing
  # it at gateway scope makes `config_file::load` reject the default install.
  - it: renders grpc_endpoint under [openshell.drivers.kubernetes], not [openshell.gateway]
    template: templates/gateway-config.yaml
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?grpc_endpoint'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.gateway\][^\[]*?grpc_endpoint'

  - it: renders the sandbox service account name under [openshell.drivers.kubernetes]
    template: templates/gateway-config.yaml
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?service_account_name\s*=\s*"openshell-sandbox"'

  - it: does not render local mTLS user auth for Kubernetes deployments
    template: templates/gateway-config.yaml
    asserts:
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.gateway\.mtls_auth\]'

  - it: does not allow unauthenticated users by default
    template: templates/gateway-config.yaml
    asserts:
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.gateway\.auth\]'

  - it: renders explicit unauthenticated user dev mode when enabled
    template: templates/gateway-config.yaml
    set:
      server.auth.allowUnauthenticatedUsers: true
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.gateway\.auth\].*?allow_unauthenticated_users\s*=\s*true'

  - it: uses the configured existing sandbox service account name
    template: templates/gateway-config.yaml
    set:
      sandboxServiceAccount.create: false
      sandboxServiceAccount.name: precreated-sandbox
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.drivers\.kubernetes\].*?service_account_name\s*=\s*"precreated-sandbox"'

  - it: omits server_sans when no DNS SANs are configured
    template: templates/gateway-config.yaml
    asserts:
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'server_sans\s*='

  - it: emits disable_tls=true and omits the [openshell.gateway.tls] section when disableTls is set
    set:
      server.disableTls: true
      certManager.enabled: false
      pkiInitJob.enabled: false
    template: templates/gateway-config.yaml
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: 'disable_tls\s*=\s*true'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.gateway\.tls\]'

  - it: renders server_sans from certManager.serverDnsNames
    set:
      certManager.enabled: true
      certManager.serverDnsNames:
        - openshell
        - "*.dev.openshell.localhost"
      pkiInitJob.enabled: false
    template: templates/gateway-config.yaml
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: 'server_sans\s*=\s*\["openshell", "\*\.dev\.openshell\.localhost"\]'