Skip to content

Commit 3914151

Browse files
cognifloydcognifloyd
committed
add ServiceAccount test
1 parent 143c059 commit 3914151

File tree

2 files changed

+218
-1
lines changed

2 files changed

+218
-1
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* Advanced Feature: Make securityContext (on Deployments/Jobs) and podSecurityContext (on Pods) configurable. This allows dropping all capabilities, for example. You can override the securityContext for `st2actionrunner`, `st2sensorcontainer`, and `st2client` if your actions or sensors need, for example, additional capabilites that the rest of StackStorm does not need. (#271) (by @cognifloyd)
55
* Prefix template helpers with chart name and format helper comments as template comments. (#272) (by @cognifloyd)
66
* New feature: Add `extra_volumes` to all python-based st2 deployments. This can facilitate changing log levels by loading logging conf file(s) from a custom ConfigMap. (#276) (by @cognifloyd)
7-
* Initialize basic unittest infrastructure using `helm-unittest`. Added tests for labels, custom annotations, SecurityContext, pullSecrets, pullPolicy, Resources, nodeSelector, tolerations, affinity, dnsPolicy, and dnsConfig. (#284, #288)
7+
* Initialize basic unittest infrastructure using `helm-unittest`. Added tests for labels, custom annotations, SecurityContext, pullSecrets, pullPolicy, Resources, nodeSelector, tolerations, affinity, dnsPolicy, dnsConfig, and ServiceAccount attach. (#284, #288)
88

99
## v0.80.0
1010
* Switch st2 to `v3.6` as a new default stable version (#274)

‎tests/unit/service_account_test.yaml‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
---
2+
suite: ServiceAccount
3+
templates:
4+
# primary template files
5+
- service-account.yaml
6+
- deployments.yaml
7+
8+
# ServiceAccount doesn't attach to Jobs
9+
10+
# included templates must also be listed
11+
- configmaps_packs.yaml
12+
- configmaps_rbac.yaml
13+
- configmaps_st2-conf.yaml
14+
- configmaps_st2web.yaml
15+
- secrets_datastore_crypto_key.yaml
16+
- secrets_ssh.yaml
17+
- secrets_st2auth.yaml
18+
- secrets_st2chatops.yaml
19+
20+
# ServiceAccount
21+
# serviceAccount.create
22+
# attach ServiceAccount
23+
# st2web: { serviceAccount: { attach: true } }
24+
# st2auth: { serviceAccount: { attach: true } }
25+
# st2api: { serviceAccount: { attach: true } }
26+
# st2stream: { serviceAccount: { attach: true } }
27+
# st2rulesengine: { serviceAccount: { attach: true } }
28+
# st2timersengine: { serviceAccount: { attach: true } }
29+
# st2workflowengine: { serviceAccount: { attach: true } }
30+
# st2scheduler: { serviceAccount: { attach: true } }
31+
# st2notifier: { serviceAccount: { attach: true } }
32+
# st2actionrunner: { serviceAccount: { attach: true } }
33+
# st2sensorcontainer: { serviceAccount: { attach: true } }
34+
# st2garbagecollector: { serviceAccount: { attach: true } }
35+
# st2chatops: { serviceAccount: { attach: true } }
36+
37+
tests:
38+
- it: ServiceAccount created by default
39+
template: service-account.yaml
40+
asserts:
41+
- hasDocuments:
42+
count: 1
43+
- isKind:
44+
of: ServiceAccount
45+
- isAPIVersion:
46+
of: v1
47+
# service account name is chart name by default
48+
- equal:
49+
path: metadata.name
50+
value: stackstorm-ha
51+
52+
- it: ServiceAccount creation can be disabled
53+
template: service-account.yaml
54+
set:
55+
serviceAccount:
56+
create: false
57+
asserts:
58+
- hasDocuments:
59+
count: 0
60+
61+
- it: Deployments do not attach ServiceAccount by default
62+
template: deployments.yaml
63+
set:
64+
st2:
65+
packs: { sensors: [] } # ensure only 1 sensor
66+
st2chatops:
67+
enabled: true
68+
asserts:
69+
- hasDocuments:
70+
count: 14
71+
- isNull:
72+
path: spec.template.spec.serviceAccountName
73+
74+
- it: Deployments can attach ServiceAccount with default name (except st2client)
75+
template: deployments.yaml
76+
set:
77+
st2:
78+
packs: { sensors: [] } # ensure only 1 sensor
79+
st2web:
80+
serviceAccount: &attach_sa
81+
attach: true
82+
st2auth:
83+
serviceAccount: *attach_sa
84+
st2api:
85+
serviceAccount: *attach_sa
86+
st2stream:
87+
serviceAccount: *attach_sa
88+
st2rulesengine:
89+
serviceAccount: *attach_sa
90+
st2timersengine:
91+
serviceAccount: *attach_sa
92+
st2workflowengine:
93+
serviceAccount: *attach_sa
94+
st2scheduler:
95+
serviceAccount: *attach_sa
96+
st2notifier:
97+
serviceAccount: *attach_sa
98+
st2actionrunner:
99+
serviceAccount: *attach_sa
100+
st2sensorcontainer:
101+
serviceAccount: *attach_sa
102+
st2garbagecollector:
103+
serviceAccount: *attach_sa
104+
st2chatops:
105+
enabled: true
106+
serviceAccount: *attach_sa
107+
asserts:
108+
- hasDocuments:
109+
count: 14
110+
# st2client does not allow attaching serviceAccount
111+
- isNull:
112+
path: spec.template.spec.serviceAccountName
113+
documentIndex: 12
114+
115+
# all but st2client means documentIndexes 0-11,13
116+
- equal: &assert_sa_default
117+
path: spec.template.spec.serviceAccountName
118+
value: stackstorm-ha
119+
documentIndex: 0
120+
- equal: *assert_sa_default
121+
documentIndex: 1
122+
- equal: *assert_sa_default
123+
documentIndex: 2
124+
- equal: *assert_sa_default
125+
documentIndex: 3
126+
- equal: *assert_sa_default
127+
documentIndex: 4
128+
- equal: *assert_sa_default
129+
documentIndex: 5
130+
- equal: *assert_sa_default
131+
documentIndex: 6
132+
- equal: *assert_sa_default
133+
documentIndex: 7
134+
- equal: *assert_sa_default
135+
documentIndex: 8
136+
- equal: *assert_sa_default
137+
documentIndex: 9
138+
- equal: *assert_sa_default
139+
documentIndex: 10
140+
- equal: *assert_sa_default
141+
documentIndex: 11
142+
- equal: *assert_sa_default
143+
documentIndex: 13
144+
145+
146+
- it: Deployments can attach ServiceAccount with alternate name (except st2client)
147+
template: deployments.yaml
148+
set:
149+
serviceAccount:
150+
serviceAccountName: custom-service-account
151+
st2:
152+
packs: { sensors: [] } # ensure only 1 sensor
153+
st2web:
154+
serviceAccount: *attach_sa
155+
st2auth:
156+
serviceAccount: *attach_sa
157+
st2api:
158+
serviceAccount: *attach_sa
159+
st2stream:
160+
serviceAccount: *attach_sa
161+
st2rulesengine:
162+
serviceAccount: *attach_sa
163+
st2timersengine:
164+
serviceAccount: *attach_sa
165+
st2workflowengine:
166+
serviceAccount: *attach_sa
167+
st2scheduler:
168+
serviceAccount: *attach_sa
169+
st2notifier:
170+
serviceAccount: *attach_sa
171+
st2actionrunner:
172+
serviceAccount: *attach_sa
173+
st2sensorcontainer:
174+
serviceAccount: *attach_sa
175+
st2garbagecollector:
176+
serviceAccount: *attach_sa
177+
st2chatops:
178+
enabled: true
179+
serviceAccount: *attach_sa
180+
asserts:
181+
- hasDocuments:
182+
count: 14
183+
# st2client does not allow attaching serviceAccount
184+
- isNull:
185+
path: spec.template.spec.serviceAccountName
186+
documentIndex: 12
187+
188+
# all but st2client means documentIndexes 0-11,13
189+
- equal: &assert_sa_custom
190+
path: spec.template.spec.serviceAccountName
191+
value: custom-service-account
192+
documentIndex: 0
193+
- equal: *assert_sa_custom
194+
documentIndex: 1
195+
- equal: *assert_sa_custom
196+
documentIndex: 2
197+
- equal: *assert_sa_custom
198+
documentIndex: 3
199+
- equal: *assert_sa_custom
200+
documentIndex: 4
201+
- equal: *assert_sa_custom
202+
documentIndex: 5
203+
- equal: *assert_sa_custom
204+
documentIndex: 6
205+
- equal: *assert_sa_custom
206+
documentIndex: 7
207+
- equal: *assert_sa_custom
208+
documentIndex: 8
209+
- equal: *assert_sa_custom
210+
documentIndex: 9
211+
- equal: *assert_sa_custom
212+
documentIndex: 10
213+
- equal: *assert_sa_custom
214+
documentIndex: 11
215+
- equal: *assert_sa_custom
216+
documentIndex: 13
217+

0 commit comments

Comments
 (0)