webhooks_coverage_test.yaml

suite: webhooks Helm templating coverage
templates:
  - webhooks.yaml
release:
  namespace: "kubewarden"

tests:
  # ── Group 1: Resource names must be kubewarden-controller-prefixed, not plain controller-gen names ──

  - it: "MutatingWebhookConfiguration should have the kubewarden-controller-prefixed name"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - equal:
          path: metadata.name
          value: kubewarden-controller-mutating-webhook-configuration

  - it: "ValidatingWebhookConfiguration should have the kubewarden-controller-prefixed name"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - equal:
          path: metadata.name
          value: kubewarden-controller-validating-webhook-configuration

  # ── Group 2: Helm labels and annotations must be present on webhook configs ──

  - it: "MutatingWebhookConfiguration should have Helm labels"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - isNotNullOrEmpty:
          path: metadata.labels
      - equal:
          path: metadata.labels["app.kubernetes.io/managed-by"]
          value: Helm

  - it: "ValidatingWebhookConfiguration should have Helm labels"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - isNotNullOrEmpty:
          path: metadata.labels
      - equal:
          path: metadata.labels["app.kubernetes.io/managed-by"]
          value: Helm

  # ── Group 3: caBundle must be present on all webhooks ──

  - it: "all mutating webhooks should have caBundle injected"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - isNotNullOrEmpty:
          path: webhooks[0].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[1].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[2].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[3].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[4].clientConfig.caBundle

  - it: "all validating webhooks should have caBundle injected"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - isNotNullOrEmpty:
          path: webhooks[0].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[1].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[2].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[3].clientConfig.caBundle
      - isNotNullOrEmpty:
          path: webhooks[4].clientConfig.caBundle

  # ── Group 4: service.name must use the release name prefix, not plain 'webhook-service' ──

  - it: "mutating webhooks should use release-prefixed service name, not plain 'webhook-service'"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - matchRegex:
          path: webhooks[0].clientConfig.service.name
          pattern: "^.+-webhook-service$"
      - notEqual:
          path: webhooks[0].clientConfig.service.name
          value: webhook-service

  - it: "validating webhooks should use release-prefixed service name, not plain 'webhook-service'"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - matchRegex:
          path: webhooks[0].clientConfig.service.name
          pattern: "^.+-webhook-service$"
      - notEqual:
          path: webhooks[0].clientConfig.service.name
          value: webhook-service

  # ── Group 5: service.namespace must use the release namespace, not controller-gen's 'system' ──

  - it: "mutating webhooks should use the release namespace, not 'system'"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - equal:
          path: webhooks[0].clientConfig.service.namespace
          value: kubewarden
      - notEqual:
          path: webhooks[0].clientConfig.service.namespace
          value: system

  - it: "validating webhooks should use the release namespace, not 'system'"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - equal:
          path: webhooks[0].clientConfig.service.namespace
          value: kubewarden
      - notEqual:
          path: webhooks[0].clientConfig.service.namespace
          value: system

  # ── Group 6: the 3 TLS/CA Secret documents must be present ──

  - it: "kubewarden-ca Secret should be present"
    documentSelector:
      path: metadata.name
      value: kubewarden-ca
    asserts:
      - equal:
          path: kind
          value: Secret

  - it: "kubewarden-webhook-server-cert Secret should be present"
    documentSelector:
      path: metadata.name
      value: kubewarden-webhook-server-cert
    asserts:
      - equal:
          path: kind
          value: Secret

  - it: "kubewarden-audit-scanner-client-cert Secret should be present"
    documentSelector:
      path: metadata.name
      value: kubewarden-audit-scanner-client-cert
    asserts:
      - equal:
          path: kind
          value: Secret

  # ── Group 7: webhook count must match what controller-gen produces ──

  - it: "MutatingWebhookConfiguration should have exactly 5 webhooks"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - lengthEqual:
          path: webhooks
          count: 5

  - it: "ValidatingWebhookConfiguration should have exactly 5 webhooks"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - lengthEqual:
          path: webhooks
          count: 5

  # ── Group 8: each mutating webhook must be present with correct name and service path ──
  # Note: helm-unittest `contains` does not support deep partial matching on nested fields,
  # so we check `name` presence separately from the service `path` per index.

  - it: "MutatingWebhookConfiguration should have all expected webhook names"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      - contains:
          path: webhooks
          any: true
          content:
            name: madmissionpolicy.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: madmissionpolicygroup.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: mclusteradmissionpolicy.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: mclusteradmissionpolicygroup.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: mpolicyserver.kb.io

  - it: "MutatingWebhookConfiguration should have correct service paths for all webhooks"
    documentSelector:
      path: kind
      value: MutatingWebhookConfiguration
    asserts:
      # Order matches webhooks.yaml: clusteradmissionpolicy, clusteradmissionpolicygroup,
      # policyserver, admissionpolicy, admissionpolicygroup
      - equal:
          path: webhooks[0].clientConfig.service.path
          value: /mutate-policies-kubewarden-io-v1-clusteradmissionpolicy
      - equal:
          path: webhooks[1].clientConfig.service.path
          value: /mutate-policies-kubewarden-io-v1-clusteradmissionpolicygroup
      - equal:
          path: webhooks[2].clientConfig.service.path
          value: /mutate-policies-kubewarden-io-v1-policyserver
      - equal:
          path: webhooks[3].clientConfig.service.path
          value: /mutate-policies-kubewarden-io-v1-admissionpolicy
      - equal:
          path: webhooks[4].clientConfig.service.path
          value: /mutate-policies-kubewarden-io-v1-admissionpolicygroup

  # ── Group 8 (cont.): each validating webhook must be present with correct name and service path ──

  - it: "ValidatingWebhookConfiguration should have all expected webhook names"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      - contains:
          path: webhooks
          any: true
          content:
            name: vadmissionpolicy.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: vadmissionpolicygroup.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: vclusteradmissionpolicy.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: vclusteradmissionpolicygroup.kb.io
      - contains:
          path: webhooks
          any: true
          content:
            name: vpolicyserver.kb.io

  - it: "ValidatingWebhookConfiguration should have correct service paths for all webhooks"
    documentSelector:
      path: kind
      value: ValidatingWebhookConfiguration
    asserts:
      # Order matches webhooks.yaml: clusteradmissionpolicy, clusteradmissionpolicygroup,
      # admissionpolicy, admissionpolicygroup, policyserver
      - equal:
          path: webhooks[0].clientConfig.service.path
          value: /validate-policies-kubewarden-io-v1-clusteradmissionpolicy
      - equal:
          path: webhooks[1].clientConfig.service.path
          value: /validate-policies-kubewarden-io-v1-clusteradmissionpolicygroup
      - equal:
          path: webhooks[2].clientConfig.service.path
          value: /validate-policies-kubewarden-io-v1-admissionpolicy
      - equal:
          path: webhooks[3].clientConfig.service.path
          value: /validate-policies-kubewarden-io-v1-admissionpolicygroup
      - equal:
          path: webhooks[4].clientConfig.service.path
          value: /validate-policies-kubewarden-io-v1-policyserver