v2

2026-10-19 12:51:18 -04:00
parent 1bbb5b9898
commit 321f7d8c00
22 changed files with 922 additions and 302 deletions
@@ -0,0 +1,77 @@
+---
+- name: Validate rendering case inputs
+  ansible.builtin.include_tasks: ../tasks/validate.yml
+
+- name: Reset rendered resources
+  ansible.builtin.set_fact:
+    wikideck_test_manifests: {}
+
+- name: Render and parse all Kubernetes templates
+  ansible.builtin.set_fact:
+    wikideck_test_manifests: >-
+      {{ wikideck_test_manifests | combine({item: lookup('ansible.builtin.template',
+         playbook_dir ~ '/../templates/' ~ item ~ '.yml.j2') | from_yaml}) }}
+  loop: [deployment, service, serviceaccount, pvc, ingress, networkpolicy]
+
+- name: Check safety and wiring invariants
+  ansible.builtin.assert:
+    that:
+      - deployment.spec.replicas == 1
+      - deployment.spec.strategy.type == 'Recreate'
+      - deployment.spec.selector.matchLabels == deployment.spec.template.metadata.labels
+      - wikideck_test_manifests.service.spec.selector == deployment.spec.selector.matchLabels
+      - wikideck_test_manifests.networkpolicy.spec.podSelector.matchLabels == deployment.spec.selector.matchLabels
+      - wikideck_test_manifests.service.spec.type == 'ClusterIP'
+      - wikideck_test_manifests.service.spec.ports[0].targetPort == 'http'
+      - pod.serviceAccountName == wikideck_name
+      - not pod.automountServiceAccountToken
+      - not wikideck_test_manifests.serviceaccount.automountServiceAccountToken
+      - pod.securityContext.runAsNonRoot and pod.securityContext.runAsUser == 1000
+      - pod.securityContext.fsGroup == 1000
+      - pod.securityContext.seccompProfile.type == 'RuntimeDefault'
+      - container.securityContext.readOnlyRootFilesystem
+      - not container.securityContext.allowPrivilegeEscalation
+      - container.securityContext.capabilities.drop == ['ALL']
+      - container.image == wikideck_image
+      - container.resources == wikideck_resources
+      - container.ports[0].containerPort == 3001
+      - container.startupProbe.httpGet.path == '/healthz'
+      - container.readinessProbe.httpGet.path == '/healthz'
+      - container.livenessProbe.httpGet.path == '/healthz'
+      - pod.terminationGracePeriodSeconds >= 30
+      - pod.volumes[0].persistentVolumeClaim.claimName == expected_claim
+      - pod.volumes[1].emptyDir.medium == 'Memory'
+      - container.volumeMounts[0].mountPath == '/app/data'
+      - env.HOST == '0.0.0.0' and env.PORT == '3001'
+      - env.WIKIDECK_DATA_DIR == '/app/data' and env.NODE_ENV == 'production'
+      - env.WIKIDECK_OFFLINE == ('1' if wikideck_offline else '0')
+      - (env.PUBLIC_ORIGIN | default('')) == wikideck_public_origin
+      - wikideck_test_manifests.pvc.spec.accessModes == wikideck_storage_access_modes
+      - wikideck_test_manifests.ingress.spec.tls[0].secretName == wikideck_tls_secret_name
+      - wikideck_test_manifests.ingress.spec.rules[0].host == wikideck_ingress_host
+      - wikideck_test_manifests.ingress.spec.rules[0].http.paths[0].backend.service.name == wikideck_name
+      - wikideck_test_manifests.ingress.metadata.annotations == wikideck_ingress_annotations
+      - (wikideck_test_manifests.ingress.spec.ingressClassName | default('')) == wikideck_ingress_class_name
+      - (pod.imagePullSecrets | default([]) | map(attribute='name') | list) == wikideck_image_pull_secrets
+      - wikideck_test_manifests.networkpolicy.spec.policyTypes == ['Ingress', 'Egress']
+      - wikideck_test_manifests.networkpolicy.spec.ingress | length == (1 if wikideck_network_policy_ingress_from | length > 0 else 0)
+      - wikideck_test_manifests.networkpolicy.spec.egress | length == expected_egress_count | int
+  vars:
+    deployment: "{{ wikideck_test_manifests.deployment }}"
+    pod: "{{ deployment.spec.template.spec }}"
+    container: "{{ pod.containers[0] }}"
+    env: "{{ dict(container.env | map(attribute='name') | zip(container.env | map(attribute='value'))) }}"
+    expected_claim: "{{ wikideck_existing_claim if wikideck_existing_claim | length > 0 else wikideck_name ~ '-data' }}"
+    expected_egress_count: >-
+      {{ (1 if wikideck_network_policy_dns_to | length > 0 else 0)
+         + (1 if not wikideck_offline and wikideck_network_policy_https_to | length > 0 else 0) }}
+
+- name: Check omitted default StorageClass
+  ansible.builtin.assert:
+    that: wikideck_test_manifests.pvc.spec.storageClassName is not defined
+  when: wikideck_storage_class is none
+
+- name: Check explicit StorageClass including empty string
+  ansible.builtin.assert:
+    that: wikideck_test_manifests.pvc.spec.storageClassName == wikideck_storage_class
+  when: wikideck_storage_class is not none