v2

2026-10-19 12:51:18 -04:00
parent 1bbb5b9898
commit 321f7d8c00
22 changed files with 922 additions and 302 deletions
@@ -0,0 +1,94 @@
+---
+# Offline tests: no Kubernetes credentials or API calls.
+- name: Validate role configuration and rendered Kubernetes resources
+  hosts: localhost
+  connection: local
+  gather_facts: false
+  vars_files:
+    - ../defaults/main.yml
+  tasks:
+    - name: Test rendering variants
+      ansible.builtin.include_tasks: render_case.yml
+      vars:
+        wikideck_image: "{{ render_case.image | default('registry.example.com/wikideck:1.0.0') }}"
+        wikideck_name: "{{ render_case.name | default('wikideck') }}"
+        wikideck_namespace: "{{ render_case.namespace | default('wikideck') }}"
+        wikideck_offline: "{{ render_case.offline | default(false) }}"
+        wikideck_ingress_enabled: "{{ render_case.ingress | default(false) }}"
+        wikideck_ingress_host: wikideck.example.com
+        wikideck_public_origin: "{{ 'https://wikideck.example.com' if render_case.ingress | default(false) else '' }}"
+        wikideck_ingress_class_name: "{{ render_case.ingress_class | default('') }}"
+        wikideck_ingress_annotations: "{{ render_case.annotations | default({}) }}"
+        wikideck_storage_class: "{{ render_case.storage_class | default(none) }}"
+        wikideck_existing_claim: "{{ render_case.existing_claim | default('') }}"
+        wikideck_image_pull_secrets: "{{ render_case.pull_secrets | default([]) }}"
+        wikideck_network_policy_ingress_from: "{{ render_case.ingress_from | default([{'podSelector': {}}]) }}"
+        wikideck_network_policy_dns_to: "{{ render_case.dns_to | default([{'namespaceSelector': {}}]) }}"
+        wikideck_network_policy_https_to: "{{ render_case.https_to | default([{'ipBlock': {'cidr': '0.0.0.0/0'}}]) }}"
+      loop:
+        - label: defaults
+        - label: TLS ingress and existing storage
+          ingress: true
+          ingress_class: nginx
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+          existing_claim: existing-chain
+          storage_class: fast-encrypted
+          pull_secrets: [registry-credentials]
+          name: custom-deck
+          namespace: games
+        - label: offline and no storage class
+          offline: true
+          storage_class: ""
+        - label: default-deny all traffic
+          ingress_from: []
+          dns_to: []
+          https_to: []
+        - label: DNS-only offline mode
+          offline: true
+        - label: digest-pinned image
+          image: registry.example.com/wikideck@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+      loop_control:
+        loop_var: render_case
+        label: "{{ render_case.label }}"
+
+    - name: Test invalid settings are rejected
+      ansible.builtin.include_tasks: invalid_case.yml
+      loop:
+        - label: missing image
+          image: ""
+        - label: untagged image
+          image: registry.example.com/wikideck
+        - label: registry port is not an image tag
+          image: registry.example.com:5000/wikideck
+        - label: malformed image digest
+          image: registry.example.com/wikideck@sha256:abcd
+        - label: invalid resource name
+          name: Invalid_Name
+        - label: unsafe multi-writer storage
+          access_modes: [ReadWriteMany]
+        - label: missing ingress origin
+          ingress: true
+        - label: mismatched ingress origin
+          ingress: true
+          origin: https://another.example.com
+        - label: insecure public origin
+          origin: http://wikideck.example.com
+        - label: origin with path
+          origin: https://wikideck.example.com/path
+        - label: invalid ingress hostname
+          ingress: true
+          host: invalid_host
+          origin: https://wikideck.example.com
+        - label: missing resource limits
+          resources:
+            requests: {cpu: 100m, memory: 128Mi}
+        - label: ambiguous boolean
+          offline: "false"
+        - label: wrong list type
+          pull_secrets: not-a-list
+        - label: empty peer allows all traffic
+          ingress_from: [{}]
+      loop_control:
+        loop_var: invalid_case
+        label: "{{ invalid_case.label }}"