OpenShell/deploy/helm/openshell/tests/statefulset_client_ca_test.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

suite: statefulset client CA volume
templates:
  - templates/gateway-config.yaml
  - templates/statefulset.yaml
release:
  name: openshell
  namespace: my-namespace

tests:
  - it: mounts the server TLS secret ca.crt as client CA for built-in PKI
    template: templates/statefulset.yaml
    set:
      pkiInitJob.enabled: true
      certManager.enabled: false
    asserts:
      - contains:
          path: spec.template.spec.volumes
          content:
            name: tls-client-ca
            secret:
              secretName: openshell-server-tls
              items:
                - key: ca.crt
                  path: ca.crt

  - it: shares the cert-manager server TLS ca.crt when clientCaFromServerTlsSecret is true
    template: templates/statefulset.yaml
    set:
      certManager.enabled: true
      certManager.clientCaFromServerTlsSecret: true
    asserts:
      - contains:
          path: spec.template.spec.volumes
          content:
            name: tls-client-ca
            secret:
              secretName: openshell-server-tls
              items:
                - key: ca.crt
                  path: ca.crt

  # Regression: with cert-manager enabled and pkiInitJob left at its default
  # `true`, the client CA condition must honor certManager precedence and NOT
  # treat pkiInitJob.enabled as built-in TLS. With clientCaFromServerTlsSecret=false
  # the gateway must mount the separate clientCaSecretName, not the server TLS
  # cert secret.
  - it: uses clientCaSecretName under cert-manager even when pkiInitJob stays enabled
    template: templates/statefulset.yaml
    set:
      certManager.enabled: true
      certManager.clientCaFromServerTlsSecret: false
      pkiInitJob.enabled: true
      server.tls.clientCaSecretName: openshell-ca-tls
    asserts:
      - contains:
          path: spec.template.spec.volumes
          content:
            name: tls-client-ca
            secret:
              secretName: openshell-ca-tls

  - it: omits client CA volume and mount when mTLS is disabled
    template: templates/statefulset.yaml
    set:
      pkiInitJob.enabled: true
      certManager.enabled: false
      server.tls.enableMtls: false
    asserts:
      - notContains:
          path: spec.template.spec.volumes
          content:
            name: tls-client-ca
          any: true
      - notContains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: tls-client-ca
            mountPath: /etc/openshell-tls/client-ca
            readOnly: true

  # When cert-manager owns TLS, does not share its CA, and no separate client CA
  # secret is configured, there is no client CA to mount: the volume must not
  # render rather than mounting an empty secret name.
  - it: omits the client CA volume when cert-manager owns TLS and no client CA secret is set
    template: templates/statefulset.yaml
    set:
      certManager.enabled: true
      certManager.clientCaFromServerTlsSecret: false
      pkiInitJob.enabled: true
      server.tls.clientCaSecretName: ""
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: tls-client-ca
            mountPath: /etc/openshell-tls/client-ca
            readOnly: true

  # Explicit HTTPS-only opt-out must suppress built-in PKI client-CA wiring even
  # when pkiInitJob remains enabled (the default install path from #2095).
  - it: omits the client CA volume for built-in PKI when clientCaSecretName is empty
    template: templates/statefulset.yaml
    set:
      pkiInitJob.enabled: true
      certManager.enabled: false
      server.tls.clientCaSecretName: ""
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: tls-client-ca
            mountPath: /etc/openshell-tls/client-ca
            readOnly: true

  - it: omits the client CA volume when cert-manager shares server CA and clientCaSecretName is empty
    template: templates/statefulset.yaml
    set:
      certManager.enabled: true
      certManager.clientCaFromServerTlsSecret: true
      server.tls.clientCaSecretName: ""
    asserts:
      - notContains:
          path: spec.template.spec.containers[0].volumeMounts
          content:
            name: tls-client-ca
            mountPath: /etc/openshell-tls/client-ca
            readOnly: true