OpenShell/deploy/helm/openshell/tests/credential_drivers_test.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: credential drivers
templates:
  - templates/gateway-config.yaml
  - templates/credential-storage-key-encryption-key-secret.yaml
  - templates/statefulset.yaml
  - templates/deployment.yaml
  - templates/credential-secrets-role.yaml
  - templates/credential-secrets-rolebinding.yaml
release:
  name: openshell
  namespace: my-namespace

tests:
  - it: renders default encrypted credential storage by default
    template: templates/gateway-config.yaml
    asserts:
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*='
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.gateway\.credential_storage\].*?key_encryption_key_env\s*=\s*"OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'key_encryption_key_path\s*='

  - it: creates a retained default credential storage key-encryption key Secret by default
    template: templates/credential-storage-key-encryption-key-secret.yaml
    asserts:
      - equal:
          path: kind
          value: Secret
      - matchRegex:
          path: metadata.name
          pattern: 'credential-storage-key-encryption-key$'
      - equal:
          path: metadata.annotations["helm.sh/resource-policy"]
          value: keep
      - matchRegex:
          path: data["key-encryption-key"]
          pattern: '.+'

  - it: injects the default credential storage key-encryption key Secret into the gateway pod by default
    template: templates/statefulset.yaml
    asserts:
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            name: OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY
            valueFrom:
              secretKeyRef:
                name: openshell-credential-storage-key-encryption-key
                key: key-encryption-key

  - it: renders Kubernetes Secrets credential driver config
    template: templates/gateway-config.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*=\s*\["kubernetes-secrets"\]'
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.kubernetes-secrets\]\s*namespace\s*=\s*"provider-secrets"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'allow_reference_namespace'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.credential_drivers\.kubernetes-secrets\][^\[]*(workspace_mode|gateway_id)'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'transport\s*=\s*"in_tree"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.gateway\.credential_storage\]'

  - it: fills an absent schema-v2 Kubernetes Secrets namespace from the legacy alias
    template: templates/gateway-config.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
      gatewayConfig:
        openshell.gateway:
          credential_drivers:
            - kubernetes-secrets
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.kubernetes-secrets\].*?namespace\s*=\s*"provider-secrets"'

  - it: preserves the canonical credential namespace when the legacy alias selects the driver
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: legacy-secrets
      gatewayConfig:
        openshell.credential_drivers.kubernetes-secrets:
          namespace: provider-secrets
    asserts:
      - template: templates/gateway-config.yaml
        matchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*=\s*\["kubernetes-secrets"\]'
      - template: templates/gateway-config.yaml
        matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.kubernetes-secrets\]\s*namespace\s*=\s*"provider-secrets"'
      - template: templates/credential-secrets-role.yaml
        equal:
          path: metadata.namespace
          value: provider-secrets
      - template: templates/credential-secrets-rolebinding.yaml
        equal:
          path: metadata.namespace
          value: provider-secrets

  - it: renders Vault credential driver config
    template: templates/gateway-config.yaml
    set:
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://vault.vault.svc.cluster.local:8200
      server.credentialDrivers.vault.caConfigMapName: vault-ca
      server.credentialDrivers.vault.role: openshell-gateway
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: 'credential_drivers\s*=\s*\["vault"\]'
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.vault\].*?address\s*=\s*"https://vault\.vault\.svc\.cluster\.local:8200".*?auth_method\s*=\s*"kubernetes".*?ca_bundle\s*=\s*"/etc/openshell-tls/vault-ca/ca\.crt".*?role\s*=\s*"openshell-gateway"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: 'transport\s*=\s*"in_tree"'
      - notMatchRegex:
          path: data["gateway.toml"]
          pattern: '\[openshell\.gateway\.credential_storage\]'

  - it: fills absent schema-v2 Vault settings from legacy values without overwriting schema-v2 fields
    template: templates/gateway-config.yaml
    set:
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://legacy-vault.example:8200
      server.credentialDrivers.vault.authMethod: kubernetes
      server.credentialDrivers.vault.role: legacy-role
      gatewayConfig:
        openshell.gateway:
          credential_drivers:
            - vault
        openshell.credential_drivers.vault:
          role: schema-v2-role
    asserts:
      - matchRegex:
          path: data["gateway.toml"]
          pattern: '(?ms)\[openshell\.credential_drivers\.vault\].*?address\s*=\s*"https://legacy-vault\.example:8200".*?auth_method\s*=\s*"kubernetes".*?role\s*=\s*"schema-v2-role"'

  - it: rejects multiple enabled credential drivers
    template: templates/statefulset.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://vault.vault.svc.cluster.local:8200
      server.credentialDrivers.vault.role: openshell-gateway
    asserts:
      - failedTemplate:
          errorPattern: "only one external server.credentialDrivers backend can be enabled at a time"

  - it: rejects multiple schema-v2 credential drivers
    template: templates/statefulset.yaml
    set:
      gatewayConfig:
        openshell.gateway:
          credential_drivers:
            - kubernetes-secrets
            - vault
    asserts:
      - failedTemplate:
          errorMessage: "gatewayConfig.openshell.gateway.credential_drivers may select only one backend"

  - it: rejects an explicit empty schema-v2 driver list
    template: templates/statefulset.yaml
    set:
      server.credentialDrivers.vault.enabled: true
      gatewayConfig:
        openshell.gateway:
          credential_drivers: []
    asserts:
      - failedTemplate:
          errorMessage: "gatewayConfig.openshell.gateway.credential_drivers must select exactly one backend or be omitted/null to use the chart default"

  - it: mounts the Vault CA ConfigMap into the gateway
    template: templates/statefulset.yaml
    set:
      server.credentialDrivers.vault.enabled: true
      server.credentialDrivers.vault.address: https://vault.vault.svc.cluster.local:8200
      server.credentialDrivers.vault.caConfigMapName: vault-ca
      server.credentialDrivers.vault.role: openshell-gateway
    asserts:
      - contains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: vault-ca
            mountPath: /etc/openshell-tls/vault-ca
            readOnly: true
      - contains:
          path: spec.template.spec.volumes
          content:
            name: vault-ca
            configMap:
              name: vault-ca
              items:
                - key: ca.crt
                  path: ca.crt

  - it: creates namespaced Kubernetes Secret manager RBAC
    template: templates/credential-secrets-role.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - equal:
          path: metadata.namespace
          value: provider-secrets
      - equal:
          path: rules[0].resources[0]
          value: secrets
      - equal:
          path: rules[0].verbs[0]
          value: get
      - contains:
          path: rules[0].verbs
          content: create
      - contains:
          path: rules[0].verbs
          content: patch
      - contains:
          path: rules[0].verbs
          content: delete

  - it: binds Kubernetes Secret manager RBAC to the gateway ServiceAccount
    template: templates/credential-secrets-rolebinding.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.namespace: provider-secrets
    asserts:
      - equal:
          path: metadata.namespace
          value: provider-secrets
      - equal:
          path: subjects[0].name
          value: openshell
      - equal:
          path: subjects[0].namespace
          value: my-namespace

  - it: honors the legacy Kubernetes Secrets RBAC opt-out
    template: templates/credential-secrets-role.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.rbac.create: false
    asserts:
      - hasDocuments:
          count: 0

  - it: omits the Kubernetes Secrets RoleBinding when RBAC is opted out
    template: templates/credential-secrets-rolebinding.yaml
    set:
      server.credentialDrivers.kubernetesSecrets.enabled: true
      server.credentialDrivers.kubernetesSecrets.rbac.create: false
    asserts:
      - hasDocuments:
          count: 0

  - it: allows default credential storage on a Deployment with an external database
    template: templates/deployment.yaml
    set:
      workload.kind: deployment
      server.externalDbSecret: openshell-pg
    asserts:
      - equal:
          path: kind
          value: Deployment
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            name: OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY
            valueFrom:
              secretKeyRef:
                name: openshell-credential-storage-key-encryption-key
                key: key-encryption-key

  - it: allows default credential storage with multiple replicas and an external database
    template: templates/statefulset.yaml
    set:
      replicaCount: 2
      server.externalDbSecret: openshell-pg
      workload.allowMultiReplicaStatefulSet: true
    asserts:
      - equal:
          path: spec.replicas
          value: 2
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            name: OPENSHELL_GATEWAY_CREDENTIAL_KEY_ENCRYPTION_KEY
            valueFrom:
              secretKeyRef:
                name: openshell-credential-storage-key-encryption-key
                key: key-encryption-key