OpenShell/deploy/helm/openshell/tests/credential_drivers_test.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: credential drivers
templates:
  - templates/gateway-config.yaml
  - templates/credential-storage-key-encryption-key-secret.yaml
  - templates/statefulset.yaml
  - templates/deployment.yaml
  - templates/credential-secrets-role.yaml
  - templates/credential-secrets-rolebinding.yaml
release:
  name: openshell
  namespace: my-namespace

tests:
  - it: renders default encrypted credential storage by default
    template: templates/gateway-config.yaml
    asserts:
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*='
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.gateway\.credential_storage\].*?key_encryption_key_env\s*=\s*"OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'key_encryption_key_path\s*='

  - it: creates a retained default credential storage key-encryption key Secret by default
    template: templates/credential-storage-key-encryption-key-secret.yaml
    asserts:
      - equal:
          path: kind
          value: Secret
      - matchRegex:
          path: metadata.name
          pattern: 'credential-storage-key-encryption-key$'
      - equal:
          path: metadata.annotations["helm.sh/resource-policy"]
          value: keep
      - matchRegex:
          path: data["key-encryption-key"]
          pattern: '.+'

  - it: injects the default credential storage key-encryption key Secret into the gateway pod by default
    template: templates/statefulset.yaml
    asserts:
      - equal:
          path: spec.template.spec.containers[0].env[0].name
          value: OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY
      - matchRegex:
          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.name
          pattern: 'credential-storage-key-encryption-key$'
      - equal:
          path: spec.template.spec.containers[0].env[0].valueFrom.secretKeyRef.key
          value: key-encryption-key

  - it: renders Kubernetes Secrets credential driver config
    template: templates/gateway-config.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*=\s*\["kubernetes-secrets"\]'
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.kubernetes-secrets\].*?namespace\s*=\s*"provider-secrets".*?allow_reference_namespace\s*=\s*false'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'transport\s*=\s*"in_tree"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.gateway\.credential_storage\]'

  - it: renders Vault credential driver config
    template: templates/gateway-config.yaml
    set:
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://vault.vault.svc.cluster.local:8200
      server.credentialDrivers.vault.caConfigMapName: vault-ca
      server.credentialDrivers.vault.role: openshell-gateway
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*=\s*\["vault"\]'
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.vault\].*?address\s*=\s*"https://vault\.vault\.svc\.cluster\.local:8200".*?ca_bundle\s*=\s*"/etc/openshell-tls/vault-ca/ca\.crt".*?auth_method\s*=\s*"kubernetes".*?role\s*=\s*"openshell-gateway"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'transport\s*=\s*"in_tree"'

  - it: rejects multiple enabled credential drivers
    template: templates/statefulset.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://vault.vault.svc.cluster.local:8200
      server.credentialDrivers.vault.role: openshell-gateway
    asserts:
      - failedTemplate:
          errorPattern: "only one external server.credentialDrivers backend can be enabled at a time"

  - it: mounts the Vault CA ConfigMap into the gateway
    template: templates/statefulset.yaml
    set:
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://vault.vault.svc.cluster.local:8200
      server.credentialDrivers.vault.caConfigMapName: vault-ca
      server.credentialDrivers.vault.role: openshell-gateway
    asserts:
      - contains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: vault-ca
            mountPath: /etc/openshell-tls/vault-ca
            readOnly: true
      - contains:
          path: spec.template.spec.volumes
          content:
            name: vault-ca
            configMap:
              name: vault-ca
              items:
                - key: ca.crt
                  path: ca.crt

  - it: creates namespaced Kubernetes Secret manager RBAC
    template: templates/credential-secrets-role.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - equal:
          path: metadata.namespace
          value: provider-secrets
      - equal:
          path: rules[0].resources[0]
          value: secrets
      - equal:
          path: rules[0].verbs[0]
          value: get
      - contains:
          path: rules[0].verbs
          content: create
      - contains:
          path: rules[0].verbs
          content: patch
      - contains:
          path: rules[0].verbs
          content: delete

  - it: binds Kubernetes Secret manager RBAC to the gateway ServiceAccount
    template: templates/credential-secrets-rolebinding.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - equal:
          path: metadata.namespace
          value: provider-secrets
      - equal:
          path: subjects[0].name
          value: openshell
      - equal:
          path: subjects[0].namespace
          value: my-namespace

  - it: allows default credential storage on a Deployment with an external database
    template: templates/deployment.yaml
    set:
      workload.kind: deployment
      server.externalDbSecret: openshell-pg
    asserts:
      - equal:
          path: kind
          value: Deployment
      - equal:
          path: spec.template.spec.containers[0].env[0].name
          value: OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY

  - it: allows default credential storage with multiple replicas and an external database
    template: templates/statefulset.yaml
    set:
      replicaCount: 2
      server.externalDbSecret: openshell-pg
      workload.allowMultiReplicaStatefulSet: true
    asserts:
      - equal:
          path: spec.replicas
          value: 2
      - equal:
          path: spec.template.spec.containers[0].env[0].name
          value: OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY