suite: pod service account name test
templates:
  - common.yaml
release:
  name: test-release-name
  namespace: test-release-namespace
tests:
  - it: should assign serviceAccount to primary pod
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: CronJob
          schedule: "* * * * *"
          podSpec: {}
        workload-name2:
          enabled: true
          primary: false
          type: Deployment
          podSpec: {}
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
    asserts:
      - documentIndex: &cronJobDoc 1
        isKind:
          of: CronJob
      - documentIndex: *cronJobDoc
        equal:
          path: metadata.name
          value: test-release-name-common-test
      - documentIndex: *cronJobDoc
        equal:
          path: spec.jobTemplate.spec.template.spec.serviceAccountName
          value: test-release-name-common-test
      - documentIndex: &otherDeploymentDoc 2
        isKind:
          of: Deployment
      - documentIndex: *otherDeploymentDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: default

  - it: should assign serviceAccount to all pods
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec: {}
        workload-name2:
          enabled: true
          primary: false
          type: Deployment
          podSpec: {}
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
          targetSelectAll: true
    asserts:
      - documentIndex: &deploymentDoc 1
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: test-release-name-common-test
      - documentIndex: &otherDeploymentDoc 2
        isKind:
          of: Deployment
      - documentIndex: *otherDeploymentDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: test-release-name-common-test

  - it: should assign serviceAccount to selected pods
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: DaemonSet
          podSpec: {}
        workload-name2:
          enabled: true
          primary: false
          type: Deployment
          podSpec: {}
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
          targetSelector:
            - workload-name1
        sa-name2:
          enabled: true
          primary: false
          targetSelector:
            - workload-name2
    asserts:
      - documentIndex: &daemonSetDoc 2
        isKind:
          of: DaemonSet
      - documentIndex: *daemonSetDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: test-release-name-common-test
      - documentIndex: &otherDeploymentDoc 3
        isKind:
          of: Deployment
      - documentIndex: *otherDeploymentDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: test-release-name-common-test-sa-name2

  - it: should assign serviceAccount to selected pods
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: DaemonSet
          podSpec: {}
        workload-name2:
          enabled: true
          primary: false
          type: Deployment
          podSpec: {}
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
          targetSelector:
            - workload-name1
            - workload-name2
    asserts:
      - documentIndex: &daemonSetDoc 1
        isKind:
          of: DaemonSet
      - documentIndex: *daemonSetDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: test-release-name-common-test
      - documentIndex: &otherDeploymentDoc 2
        isKind:
          of: Deployment
      - documentIndex: *otherDeploymentDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: test-release-name-common-test

  - it: should assign serviceAccount to pod with explicit name
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            serviceAccountName: some-explicit-name
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
          targetSelector:
            - workload-name1
    asserts:
      - documentIndex: &deploymentDoc 1
        isKind:
          of: Deployment
      - documentIndex: *deploymentDoc
        equal:
          path: spec.template.spec.serviceAccountName
          value: some-explicit-name

  # Failures
  - it: should fail with more than 1 SA assigned to a pod
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec: {}
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
          targetSelector:
            - workload-name1
        sa-name2:
          enabled: true
          targetSelector:
            - workload-name1
    asserts:
      - failedTemplate:
          errorMessage: Expected at most 1 ServiceAccount to be assigned on a pod [workload-name1]. But [2] were assigned

  - it: should fail with invalid name on explicit serviceAccountName
    set:
      workload:
        workload-name1:
          enabled: true
          primary: true
          type: Deployment
          podSpec:
            serviceAccountName: some-long-name-that-exceeds-the-63-character-limit-for-kubernetes-objects
      serviceAccount:
        sa-name1:
          enabled: true
          primary: true
          targetSelector:
            - workload-name1
    asserts:
      - failedTemplate:
          errorMessage: Name [some-long-name-that-exceeds-the-63-character-limit-for-kubernetes-objects] is not valid. Must start and end with an alphanumeric lowercase character. It can contain '-'. And must be at most 63 characters.
