diff --git a/.github/workflows/common.test.yaml b/.github/workflows/common.test.yaml
index 89ecbd95cc3..0760406baf8 100644
--- a/.github/workflows/common.test.yaml
+++ b/.github/workflows/common.test.yaml
@@ -8,6 +8,7 @@ on:
       - '**'
     paths:
       - 'charts/library/**'
+      - 'tests/**'
       - '.github/workflows/common.test.yaml'
       - '.github/ct-install.yaml'
       - '.github/ct-lint.yaml'
diff --git a/tests/library/common/addon_codeserver_spec.rb b/tests/library/common/addon_codeserver_spec.rb
new file mode 100644
index 00000000000..dde34209530
--- /dev/null
+++ b/tests/library/common/addon_codeserver_spec.rb
@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+require_relative '../../test_helper'
+
+class Test < ChartTest
+  @@chart = Chart.new('charts/library/common-test')
+
+  describe @@chart.name do
+    describe 'addon::codeserver' do
+      baseValues = {
+        addons: {
+          codeserver: {
+            enabled: true,
+            volumeMounts: [
+              {
+                name: "config",
+                mountPath: "/data/config"
+              }
+            ]
+          }
+        }
+      }
+
+      it 'defaults to disabled' do
+        deployment = chart.resources(kind: "Deployment").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        codeserverContainer = containers.find{ |c| c["name"] == "codeserver" }
+
+        assert_nil(codeserverContainer)
+      end
+
+      it 'can be enabled' do
+        values = baseValues
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        codeserverContainer = containers.find{ |c| c["name"] == "codeserver" }
+
+        refute_nil(codeserverContainer)
+      end
+
+      it 'a git deployKey can be passed' do
+        values = baseValues.deep_merge_override({
+          addons: {
+            codeserver: {
+              git: {
+                deployKey: "testKey"
+              }
+            }
+          }
+        })
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        secret = chart.resources(kind: "Secret").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        volumes = deployment["spec"]["template"]["spec"]["volumes"]
+        codeserverContainer = containers.find{ |c| c["name"] == "codeserver" }
+        expectedSecretContent = { "id_rsa" => values[:addons][:codeserver][:git][:deployKey] }
+
+        # Check that the secret has been created
+        refute_nil(secret)
+        assert_equal("common-test-deploykey", secret["metadata"]["name"])
+        assert_equal(expectedSecretContent, secret["stringData"])
+
+        # Make sure the deployKey volumeMount is present in the sidecar container
+        deploykeyVolumeMount = codeserverContainer["volumeMounts"].find { |v| v["name"] == "deploykey"}
+        refute_nil(deploykeyVolumeMount)
+        assert_equal("/root/.ssh/id_rsa", deploykeyVolumeMount["mountPath"])
+        assert_equal("id_rsa", deploykeyVolumeMount["subPath"])
+
+        # Make sure the deployKey volume is present in the Deployment
+        deploykeyVolume = volumes.find{ |v| v["name"] == "deploykey" }
+        refute_nil(deploykeyVolume)
+        assert_equal("common-test-deploykey", deploykeyVolume["secret"]["secretName"])
+      end
+
+      it 'a git deployKey can be passed in base64 format' do
+        values = baseValues.deep_merge_override({
+          addons: {
+            codeserver: {
+              git: {
+                deployKeyBase64: "dGVzdEtleQ=="
+              }
+            }
+          }
+        })
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        secret = chart.resources(kind: "Secret").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        volumes = deployment["spec"]["template"]["spec"]["volumes"]
+        codeserverContainer = containers.find{ |c| c["name"] == "codeserver" }
+        expectedSecretContent = { "id_rsa" => values[:addons][:codeserver][:git][:deployKeyBase64] }
+
+        # Check that the secret has been created
+        refute_nil(secret)
+        assert_equal("common-test-deploykey", secret["metadata"]["name"])
+        assert_equal(expectedSecretContent, secret["data"])
+
+        # Make sure the deployKey volumeMount is present in the sidecar container
+        deploykeyVolumeMount = codeserverContainer["volumeMounts"].find { |v| v["name"] == "deploykey"}
+        refute_nil(deploykeyVolumeMount)
+        assert_equal("/root/.ssh/id_rsa", deploykeyVolumeMount["mountPath"])
+        assert_equal("id_rsa", deploykeyVolumeMount["subPath"])
+
+        # Make sure the deployKey volume is present in the Deployment
+        deploykeyVolume = volumes.find{ |v| v["name"] == "deploykey" }
+        refute_nil(deploykeyVolume)
+        assert_equal("common-test-deploykey", deploykeyVolume["secret"]["secretName"])
+      end
+
+      it 'an existing secret can be passed as a git deployKey' do
+        values = baseValues.deep_merge_override({
+          addons: {
+            codeserver: {
+              git: {
+                deployKeySecret: "existingSecret"
+              }
+            }
+          }
+        })
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        secret = chart.resources(kind: "Secret").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        volumes = deployment["spec"]["template"]["spec"]["volumes"]
+        codeserverContainer = containers.find{ |c| c["name"] == "codeserver" }
+
+        # Check that the secret has not been created
+        assert_nil(secret)
+
+        # Make sure the deployKey volumeMount is present in the sidecar container
+        deploykeyVolumeMount = codeserverContainer["volumeMounts"].find { |v| v["name"] == "deploykey"}
+        refute_nil(deploykeyVolumeMount)
+        assert_equal("/root/.ssh/id_rsa", deploykeyVolumeMount["mountPath"])
+        assert_equal("id_rsa", deploykeyVolumeMount["subPath"])
+
+        # Make sure the deployKey volume is present in the Deployment
+        deploykeyVolume = volumes.find{ |v| v["name"] == "deploykey" }
+        refute_nil(deploykeyVolume)
+        assert_equal(values[:addons][:codeserver][:git][:deployKeySecret], deploykeyVolume["secret"]["secretName"])
+      end
+    end
+  end
+end
diff --git a/tests/library/common/addon_vpn_spec.rb b/tests/library/common/addon_vpn_spec.rb
new file mode 100644
index 00000000000..fbd65305a78
--- /dev/null
+++ b/tests/library/common/addon_vpn_spec.rb
@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+require_relative '../../test_helper'
+
+class Test < ChartTest
+  @@chart = Chart.new('charts/library/common-test')
+
+  describe @@chart.name do
+    describe 'addon::vpn' do
+      it 'defaults to disabled' do
+        deployment = chart.resources(kind: "Deployment").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        openvpnContainer = containers.find{ |c| c["name"] == "openvpn" }
+        wireguardContainer = containers.find{ |c| c["name"] == "wireguard" }
+
+        assert_nil(openvpnContainer)
+        assert_nil(wireguardContainer)
+      end
+
+      it 'openvpn can be enabled' do
+        values = {
+        addons: {
+          vpn: {
+            type: "openvpn"
+          }
+        }
+      }
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        vpnContainer = containers.find{ |c| c["name"] == "openvpn" }
+
+        refute_nil(vpnContainer)
+      end
+
+      it 'wireguard can be enabled' do
+        values = {
+        addons: {
+          vpn: {
+            type: "wireguard"
+          }
+        }
+      }
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        wireguardContainer = containers.find{ |c| c["name"] == "wireguard" }
+
+        refute_nil(wireguardContainer)
+      end
+
+      it 'a openvpn configuration file can be passed' do
+        values = {
+          addons: {
+            vpn: {
+              type: "openvpn",
+              configFile: {
+                enabled: true,
+                hostPath: "/test.conf"
+              }
+            }
+          }
+        }
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        secret = chart.resources(kind: "Secret").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        volumes = deployment["spec"]["template"]["spec"]["volumes"]
+        vpnContainer = containers.find{ |c| c["name"] == "openvpn" }
+
+        # Make sure the deployKey volumeMount is present in the sidecar container
+        vpnconfigVolumeMount = vpnContainer["volumeMounts"].find { |v| v["name"] == "vpnconfig"}
+        refute_nil(vpnconfigVolumeMount)
+        assert_equal("/vpn/vpn.conf", vpnconfigVolumeMount["mountPath"])
+      end
+
+      it 'a wireguard configuration file can be passed' do
+        values = {
+          addons: {
+            vpn: {
+              type: "wireguard",
+              configFile: {
+                enabled: true,
+                hostPath: "/test.conf"
+              }
+            }
+          }
+        }
+
+        chart.value values
+        deployment = chart.resources(kind: "Deployment").first
+        secret = chart.resources(kind: "Secret").first
+        containers = deployment["spec"]["template"]["spec"]["containers"]
+        volumes = deployment["spec"]["template"]["spec"]["volumes"]
+        vpnContainer = containers.find{ |c| c["name"] == "wireguard" }
+
+        # Make sure the deployKey volumeMount is present in the sidecar container
+        vpnconfigVolumeMount = vpnContainer["volumeMounts"].find { |v| v["name"] == "vpnconfig"}
+        refute_nil(vpnconfigVolumeMount)
+        assert_equal("/etc/wireguard/wg0.conf", vpnconfigVolumeMount["mountPath"])
+      end
+    end
+  end
+end