OpenShell/deploy/helm/openshell/tests/credential_secrets_namespace_test.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: credential Secret namespace
templates:
  - templates/credential-secrets-namespace.yaml
release:
  name: openshell
  namespace: my-namespace

tests:
  - it: does not create a namespace by default
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - hasDocuments:
          count: 0

  - it: creates a retained credential namespace
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
      server.credentialDrivers.kubernetesSecrets.createNamespace: true
    asserts:
      - isKind:
          of: Namespace
      - equal:
          path: metadata.name
          value: provider-secrets
      - equal:
          path: metadata.annotations["helm.sh/resource-policy"]
          value: keep

  - it: creates a retained credential namespace when schema-v2 selects the driver
    set:
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
      server.credentialDrivers.kubernetesSecrets.createNamespace: true
      gatewayConfig:
        openshell.gateway:
          credential_drivers:
            - kubernetes-secrets
    asserts:
      - isKind:
          of: Namespace
      - equal:
          path: metadata.name
          value: provider-secrets
      - equal:
          path: metadata.annotations["helm.sh/resource-policy"]
          value: keep

  - it: requires a namespace other than the release namespace
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.createNamespace: true
    asserts:
      - failedTemplate:
          errorPattern: createNamespace requires

  - it: leaves an existing namespace owned by something else untouched
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
      server.credentialDrivers.kubernetesSecrets.createNamespace: true
    kubernetesProvider:
      scheme:
        "v1/Namespace":
          gvr:
            version: "v1"
            resource: "namespaces"
          namespaced: false
      objects:
        - kind: Namespace
          apiVersion: v1
          metadata:
            name: provider-secrets
    asserts:
      - hasDocuments:
          count: 0

  - it: adopts a namespace retained from the same release
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
      server.credentialDrivers.kubernetesSecrets.createNamespace: true
    kubernetesProvider:
      scheme:
        "v1/Namespace":
          gvr:
            version: "v1"
            resource: "namespaces"
          namespaced: false
      objects:
        - kind: Namespace
          apiVersion: v1
          metadata:
            name: provider-secrets
            annotations:
              meta.helm.sh/release-name: openshell
              meta.helm.sh/release-namespace: my-namespace
    asserts:
      - isKind:
          of: Namespace