Merge pull request #288 from StackStorm/helm-unittest

Add unit tests for a variety of chart aspects

Author: cognifloyd

.github/workflows/unit-tests.yaml

@@ -42,4 +42,4 @@ jobs:
     - name: Run helm-unittest
       # by default looks for tests/*_test.yaml
       run: |
-        helm unittest --color --helm3 -f tests/unit/*_test.yaml .
+        helm unittest --color --helm3 -f 'tests/unit/*_test.yaml' .

CHANGELOG.md

@@ -4,7 +4,7 @@
 * Advanced Feature: Make securityContext (on Deployments/Jobs) and podSecurityContext (on Pods) configurable. This allows dropping all capabilities, for example. You can override the securityContext for `st2actionrunner`, `st2sensorcontainer`, and `st2client` if your actions or sensors need, for example, additional capabilites that the rest of StackStorm does not need. (#271) (by @cognifloyd)
 * Prefix template helpers with chart name and format helper comments as template comments. (#272) (by @cognifloyd)
 * New feature: Add `extra_volumes` to all python-based st2 deployments. This can facilitate changing log levels by loading logging conf file(s) from a custom ConfigMap. (#276) (by @cognifloyd)
-* Initialize basic unittest infrastructure using `helm-unittest`. Added tests for custom annotations. (#284)
+* Initialize basic unittest infrastructure using `helm-unittest`. Added tests for labels, custom annotations, SecurityContext, pullSecrets, pullPolicy, Resources, nodeSelector, tolerations, affinity, dnsPolicy, dnsConfig, ServiceAccount attach, postStartScript, and both sensor-modes. (#284, #288)
 
 ## v0.80.0
 * Switch st2 to `v3.6` as a new default stable version (#274)

tests/README.md

@@ -17,7 +17,7 @@ helm dependency update
 
 To run the tests manually from the chart's root dir:
 ```
-helm unittest --helm3 -f tests/unit/*_test.yaml .
+helm unittest --helm3 -f 'tests/unit/*_test.yaml' .
 ```
 
 > Note! If you need to add unit tests, file names should follow this pattern: `tests/unit/name_your_test.yaml`

tests/unit/custom_annotations_test.yaml

@@ -89,7 +89,7 @@ tests:
         annotations: *deployment_annotations
       st2sensorcontainer:
         annotations: *deployment_annotations
-      st2: { packs: { sensors: [] } }  # ensure only 1 sensor
+      st2: { packs: { sensors: [] } } # ensure only 1 sensor
       st2actionrunner:
         annotations: *deployment_annotations
       st2garbagecollector:

tests/unit/dns_test.yaml

@@ -0,0 +1,60 @@
+---
+suite: DNS
+templates:
+  # primary template files
+  - deployments.yaml
+  - jobs.yaml
+
+  # included templates must also be listed
+  - configmaps_packs.yaml
+  - configmaps_rbac.yaml
+  - configmaps_st2-conf.yaml
+  - configmaps_st2-urls.yaml
+  - configmaps_st2web.yaml
+  - secrets_datastore_crypto_key.yaml
+  - secrets_ssh.yaml
+  - secrets_st2apikeys.yaml
+  - secrets_st2auth.yaml
+  - secrets_st2chatops.yaml
+
+tests:
+  - it: Deployments and Jobs default to no dnsPolicy or dnsConfig
+    templates:
+      - deployments.yaml
+      - jobs.yaml
+    set:
+      st2: 
+        packs: { sensors: [] } # ensure only 1 sensor
+        rbac: { enabled: true } # enable rbac job
+    asserts:
+      - isNull:
+          path: spec.template.spec.dnsPolicy
+      - isNull:
+          path: spec.template.spec.dnsConfig
+
+  - it: Deployments and Jobs accept custom dnsPolicy or dnsConfig
+    templates:
+      - deployments.yaml
+      - jobs.yaml
+    set:
+      dnsPolicy: &dnsPolicy ClusterFirstWithHostNet
+      dnsConfig: &dnsConfig
+        nameservers:
+          - 1.2.3.4
+        searches:
+          - ns1.svc.cluster-domain.example
+          - my.dns.search.suffix
+        options:
+          - name: ndots
+            value: "2"
+          - name: edns0
+      st2: 
+        packs: { sensors: [] } # ensure only 1 sensor
+        rbac: { enabled: true } # enable rbac job
+    asserts:
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: *dnsPolicy
+      - equal:
+          path: spec.template.spec.dnsConfig
+          value: *dnsConfig

tests/unit/image_pull_test.yaml

@@ -0,0 +1,118 @@
+---
+suite: Image Pull
+templates:
+  # primary template files
+  - deployments.yaml
+  - jobs.yaml
+  - service-account.yaml
+
+  # included templates must also be listed
+  - configmaps_packs.yaml
+  - configmaps_rbac.yaml
+  - configmaps_st2-conf.yaml
+  - configmaps_st2-urls.yaml
+  - configmaps_st2web.yaml
+  - secrets_datastore_crypto_key.yaml
+  - secrets_ssh.yaml
+  - secrets_st2apikeys.yaml
+  - secrets_st2auth.yaml
+  - secrets_st2chatops.yaml
+
+# relevant values:
+#   imagePullPolicy
+#     image.pullPolicy
+#     serviceAccount.pullPolicy
+#     st2.packs.images[].pullPolicy
+#   imagePullSecreets
+#     image.pullSecret
+#     serviceAccount.pullSecret
+#     st2.packs.images[].pullSecret
+
+tests:
+  - it: Deployments and Jobs use default pullPolicy and pullSecret
+    templates:
+      - deployments.yaml
+        # st2auth, st2api,
+        # st2stream, st2web,
+        # st2rulesengine, st2timersengine,
+        # st2workflowengine, st2scheduler,
+        # st2notifier, (1) st2sensorcontainer,
+        # st2actionrunner, st2garbagecollector,
+        # st2client, st2chatops
+      - jobs.yaml
+        # job-st2-apply-rbac-defintions
+        # job-st2-apikey-load
+        # job-st2-key-load
+        # job-st2-register-content
+    set:
+      # image.pullPolicy defaults to IfNotPresent
+      # image.pullSecret defaults to None
+      serviceAccount:
+        create: true
+        # show that this does not affect pod specs
+        pullSecret: service-account-pull-secret
+      st2:
+        rbac: { enabled: true } # enable rbac job
+        packs: { sensors: [] } # ensure only 1 sensor
+      st2chatops:
+        enabled: true
+    asserts:
+      - isNull:
+          path: spec.template.spec.imagePullSecrets
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: IfNotPresent
+      # path can only select one element, not all initContainers (if present).
+      #- equal:
+      #    path: 'spec.template.spec.initContainers[].imagePullPolicy'
+      #    value: IfNotPresent
+
+  - it: Deployments and Jobs use custom pullPolicy and pullSecret
+    templates:
+      - deployments.yaml
+      - jobs.yaml
+    set:
+      image:
+        pullPolicy: Always
+        pullSecret: custom-pull-secret
+      serviceAccount:
+        create: true
+        # show that this does not affect pod specs
+        pullSecret: service-account-pull-secret
+      st2:
+        rbac: { enabled: true } # enable rbac job
+        packs: { sensors: [] } # ensure only 1 sensor
+      st2chatops:
+        enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: custom-pull-secret
+      - equal:
+          path: spec.template.spec.containers[0].imagePullPolicy
+          value: Always
+      # path can only select one element, not all initContainers (if present).
+      #- equal:
+      #    path: 'spec.template.spec.initContainers[].imagePullPolicy'
+      #    value: Always
+
+  - it: ServiceAccount has no imagePullSecret by default
+    template: service-account.yaml
+    set:
+      serviceAccount:
+        create: true
+    asserts:
+      - isNull:
+          path: imagePullSecrets
+
+  - it: ServiceAccount accepts custom imagePullSecret
+    template: service-account.yaml
+    set:
+      serviceAccount:
+        create: true
+        # show that this does not affect pod specs
+        pullSecret: service-account-pull-secret
+    asserts:
+      - equal:
+          path: imagePullSecrets[0].name
+          value: service-account-pull-secret