109 lines
6.1 KiB
YAML
109 lines
6.1 KiB
YAML
---
|
|
- name: Validate rendering case inputs
|
|
ansible.builtin.include_tasks: ../tasks/validate.yml
|
|
|
|
- name: Reset rendered resources
|
|
ansible.builtin.set_fact:
|
|
wikideck_test_manifests: {}
|
|
|
|
- name: Render and parse all Kubernetes templates
|
|
ansible.builtin.set_fact:
|
|
wikideck_test_manifests: >-
|
|
{{ wikideck_test_manifests | combine({item: lookup('ansible.builtin.template',
|
|
playbook_dir ~ '/../templates/' ~ item ~ '.yml.j2') | from_yaml}) }}
|
|
loop: [deployment, service, serviceaccount, pvc, ingress, networkpolicy]
|
|
|
|
- name: Check safety and wiring invariants
|
|
ansible.builtin.assert:
|
|
that:
|
|
- deployment.spec.replicas == 1
|
|
- deployment.spec.strategy.type == 'Recreate'
|
|
- deployment.spec.selector.matchLabels == deployment.spec.template.metadata.labels
|
|
- wikideck_test_manifests.service.spec.selector == deployment.spec.selector.matchLabels
|
|
- wikideck_test_manifests.networkpolicy.spec.podSelector.matchLabels == deployment.spec.selector.matchLabels
|
|
- wikideck_test_manifests.service.spec.type == 'ClusterIP'
|
|
- wikideck_test_manifests.service.spec.ports[0].targetPort == 'http'
|
|
- pod.serviceAccountName == wikideck_name
|
|
- not pod.automountServiceAccountToken
|
|
- not wikideck_test_manifests.serviceaccount.automountServiceAccountToken
|
|
- pod.securityContext.runAsNonRoot and pod.securityContext.runAsUser == 1000
|
|
- pod.securityContext.fsGroup == 1000
|
|
- pod.securityContext.seccompProfile.type == 'RuntimeDefault'
|
|
- container.securityContext.readOnlyRootFilesystem
|
|
- not container.securityContext.allowPrivilegeEscalation
|
|
- container.securityContext.capabilities.drop == ['ALL']
|
|
- container.image == wikideck_image
|
|
- container.resources == wikideck_resources
|
|
- container.ports[0].containerPort == 3001
|
|
- container.startupProbe.httpGet.path == '/healthz'
|
|
- container.startupProbe.failureThreshold == wikideck_startup_probe_failure_threshold
|
|
- container.startupProbe.periodSeconds == 5
|
|
- container.readinessProbe.httpGet.path == '/healthz'
|
|
- container.livenessProbe.httpGet.path == '/healthz'
|
|
- pod.terminationGracePeriodSeconds >= 30
|
|
- pod.volumes[0].persistentVolumeClaim.claimName == expected_claim
|
|
- pod.volumes[1].emptyDir.medium == 'Memory'
|
|
- container.volumeMounts[0].mountPath == '/app/data'
|
|
- env.HOST == '0.0.0.0' and env.PORT == '3001'
|
|
- env.WIKIDECK_DATA_DIR == '/app/data' and env.NODE_ENV == 'production'
|
|
- env.WIKIDECK_PEERS == wikideck_peers | join(',')
|
|
- env.WIKIDECK_ALLOW_PRIVATE_PEERS == ('1' if wikideck_allow_private_peers else '0')
|
|
- env.WIKIDECK_OFFLINE is not defined
|
|
- env.RANDOMX_BINARY is not defined
|
|
- container.command is not defined and container.args is not defined
|
|
- pod.containers | length == 1
|
|
- (env.PUBLIC_ORIGIN | default('')) == wikideck_public_origin
|
|
- wikideck_test_manifests.pvc.spec.accessModes == wikideck_storage_access_modes
|
|
- wikideck_test_manifests.ingress.spec.tls[0].secretName == wikideck_tls_secret_name
|
|
- wikideck_test_manifests.ingress.spec.rules[0].host == wikideck_ingress_host
|
|
- wikideck_test_manifests.ingress.spec.rules[0].http.paths[0].backend.service.name == wikideck_name
|
|
- wikideck_test_manifests.ingress.metadata.annotations == wikideck_ingress_annotations
|
|
- (wikideck_test_manifests.ingress.spec.ingressClassName | default('')) == wikideck_ingress_class_name
|
|
- (pod.imagePullSecrets | default([]) | map(attribute='name') | list) == wikideck_image_pull_secrets
|
|
- wikideck_test_manifests.networkpolicy.spec.policyTypes == ['Ingress', 'Egress']
|
|
- wikideck_test_manifests.networkpolicy.spec.ingress | length == (1 if wikideck_network_policy_ingress_from | length > 0 else 0)
|
|
- wikideck_test_manifests.networkpolicy.spec.egress | length == expected_egress_count | int
|
|
- wikideck_resources.requests.memory == '512Mi'
|
|
- wikideck_resources.limits.memory == '1Gi'
|
|
vars:
|
|
deployment: "{{ wikideck_test_manifests.deployment }}"
|
|
pod: "{{ deployment.spec.template.spec }}"
|
|
container: "{{ pod.containers[0] }}"
|
|
env: "{{ dict(container.env | map(attribute='name') | zip(container.env | map(attribute='value'))) }}"
|
|
expected_claim: "{{ wikideck_existing_claim if wikideck_existing_claim | length > 0 else wikideck_name ~ '-data' }}"
|
|
expected_egress_count: >-
|
|
{{ (1 if wikideck_network_policy_dns_to | length > 0 else 0)
|
|
+ (1 if wikideck_peers | length > 0 and wikideck_network_policy_https_to | length > 0
|
|
and wikideck_network_policy_https_ports | length > 0 else 0)
|
|
+ (wikideck_network_policy_peer_egress | length if wikideck_peers | length > 0 else 0) }}
|
|
|
|
- name: Check public peer egress destinations and ports
|
|
ansible.builtin.assert:
|
|
that:
|
|
- public_rule.to == wikideck_network_policy_https_to
|
|
- public_rule.ports | map(attribute='port') | list == wikideck_network_policy_https_ports
|
|
- public_rule.ports | map(attribute='protocol') | unique | list == ['TCP']
|
|
vars:
|
|
public_rule: "{{ wikideck_test_manifests.networkpolicy.spec.egress[1 if wikideck_network_policy_dns_to | length > 0 else 0] }}"
|
|
when:
|
|
- wikideck_peers | length > 0
|
|
- wikideck_network_policy_https_to | length > 0
|
|
- wikideck_network_policy_https_ports | length > 0
|
|
|
|
- name: Check explicit peer egress survives unchanged
|
|
ansible.builtin.assert:
|
|
that: wikideck_test_manifests.networkpolicy.spec.egress[-(wikideck_network_policy_peer_egress | length):] == wikideck_network_policy_peer_egress
|
|
when:
|
|
- wikideck_peers | length > 0
|
|
- wikideck_network_policy_peer_egress | length > 0
|
|
|
|
- name: Check omitted default StorageClass
|
|
ansible.builtin.assert:
|
|
that: wikideck_test_manifests.pvc.spec.storageClassName is not defined
|
|
when: wikideck_storage_class is none
|
|
|
|
- name: Check explicit StorageClass including empty string
|
|
ansible.builtin.assert:
|
|
that: wikideck_test_manifests.pvc.spec.storageClassName == wikideck_storage_class
|
|
when: wikideck_storage_class is not none
|