test(charts): add helm unit tests for CRD and RBAC manifest generation

Add charts/kubewarden-controller/tests/rbac_roles_test.yaml to verify that
the controller-gen-generated controller-rbac-roles.yaml contains the expected
Helm labels and annotations on both the ClusterRole and Role resources, and
that additionalLabels and additionalAnnotations values are propagated correctly.

Add charts/kubewarden-crds/tests/crds_test.yaml to verify that each of the
five Kubewarden CRD files renders as a CustomResourceDefinition with the
correct metadata.name and spec.group. Update the helm-unittest Makefile
target to include the kubewarden-crds chart.

Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>

Author: jvanz

Makefile

@@ -47,6 +47,7 @@ test-rust:
 .PHONY: helm-unittest
 helm-unittest:
 	helm unittest charts/kubewarden-controller --file "tests/**/*_test.yaml"
+	helm unittest charts/kubewarden-crds --file "tests/**/*_test.yaml"
 
 .PHONY: test-e2e
 test-e2e: controller-image audit-scanner-image policy-server-image

charts/kubewarden-controller/tests/rbac_roles_test.yaml

@@ -0,0 +1,84 @@
+suite: controller RBAC roles
+templates:
+  - controller-rbac-roles.yaml
+release:
+  namespace: "kubewarden"
+tests:
+  - it: "ClusterRole should have Helm labels"
+    documentSelector:
+      path: kind
+      value: ClusterRole
+    asserts:
+      - isNotNullOrEmpty:
+          path: metadata.labels
+      - equal:
+          path: metadata.labels["app.kubernetes.io/component"]
+          value: controller
+      - equal:
+          path: metadata.labels["app.kubernetes.io/part-of"]
+          value: kubewarden
+      - equal:
+          path: metadata.labels["app.kubernetes.io/managed-by"]
+          value: Helm
+
+  - it: "Role should have Helm labels"
+    documentSelector:
+      path: kind
+      value: Role
+    asserts:
+      - isNotNullOrEmpty:
+          path: metadata.labels
+      - equal:
+          path: metadata.labels["app.kubernetes.io/component"]
+          value: controller
+      - equal:
+          path: metadata.labels["app.kubernetes.io/part-of"]
+          value: kubewarden
+
+  - it: "ClusterRole should include additionalLabels when specified"
+    set:
+      additionalLabels:
+        custom-label: "test-value"
+    documentSelector:
+      path: kind
+      value: ClusterRole
+    asserts:
+      - equal:
+          path: metadata.labels["custom-label"]
+          value: "test-value"
+
+  - it: "Role should include additionalLabels when specified"
+    set:
+      additionalLabels:
+        custom-label: "test-value"
+    documentSelector:
+      path: kind
+      value: Role
+    asserts:
+      - equal:
+          path: metadata.labels["custom-label"]
+          value: "test-value"
+
+  - it: "ClusterRole should include additionalAnnotations when specified"
+    set:
+      additionalAnnotations:
+        custom-annotation: "test-annotation"
+    documentSelector:
+      path: kind
+      value: ClusterRole
+    asserts:
+      - equal:
+          path: metadata.annotations["custom-annotation"]
+          value: "test-annotation"
+
+  - it: "Role should include additionalAnnotations when specified"
+    set:
+      additionalAnnotations:
+        custom-annotation: "test-annotation"
+    documentSelector:
+      path: kind
+      value: Role
+    asserts:
+      - equal:
+          path: metadata.annotations["custom-annotation"]
+          value: "test-annotation"

charts/kubewarden-crds/tests/crds_test.yaml

@@ -0,0 +1,66 @@
+suite: Kubewarden CRDs
+tests:
+  - it: "admissionpolicies CRD should be a CustomResourceDefinition"
+    template: policies.kubewarden.io_admissionpolicies.yaml
+    asserts:
+      - equal:
+          path: kind
+          value: CustomResourceDefinition
+      - equal:
+          path: metadata.name
+          value: admissionpolicies.policies.kubewarden.io
+      - equal:
+          path: spec.group
+          value: policies.kubewarden.io
+
+  - it: "admissionpolicygroups CRD should be a CustomResourceDefinition"
+    template: policies.kubewarden.io_admissionpolicygroups.yaml
+    asserts:
+      - equal:
+          path: kind
+          value: CustomResourceDefinition
+      - equal:
+          path: metadata.name
+          value: admissionpolicygroups.policies.kubewarden.io
+      - equal:
+          path: spec.group
+          value: policies.kubewarden.io
+
+  - it: "clusteradmissionpolicies CRD should be a CustomResourceDefinition"
+    template: policies.kubewarden.io_clusteradmissionpolicies.yaml
+    asserts:
+      - equal:
+          path: kind
+          value: CustomResourceDefinition
+      - equal:
+          path: metadata.name
+          value: clusteradmissionpolicies.policies.kubewarden.io
+      - equal:
+          path: spec.group
+          value: policies.kubewarden.io
+
+  - it: "clusteradmissionpolicygroups CRD should be a CustomResourceDefinition"
+    template: policies.kubewarden.io_clusteradmissionpolicygroups.yaml
+    asserts:
+      - equal:
+          path: kind
+          value: CustomResourceDefinition
+      - equal:
+          path: metadata.name
+          value: clusteradmissionpolicygroups.policies.kubewarden.io
+      - equal:
+          path: spec.group
+          value: policies.kubewarden.io
+
+  - it: "policyservers CRD should be a CustomResourceDefinition"
+    template: policies.kubewarden.io_policyservers.yaml
+    asserts:
+      - equal:
+          path: kind
+          value: CustomResourceDefinition
+      - equal:
+          path: metadata.name
+          value: policyservers.policies.kubewarden.io
+      - equal:
+          path: spec.group
+          value: policies.kubewarden.io