test(chart): pin the pod checksum roll annotations, the scheduling pass-throughs and the release-named fullname arm

charts/prow-github-app/tests/placement_test.yaml

@@ -0,0 +1,53 @@
+suite: placement
+templates: [deployment.yaml]
+values: [./values/creds.yaml]
+tests:
+  - it: by default the server pod carries no scheduling constraints
+    asserts:
+      - notExists: {path: spec.template.spec.nodeSelector}
+      - notExists: {path: spec.template.spec.tolerations}
+      - notExists: {path: spec.template.spec.affinity}
+      - notExists: {path: spec.template.spec.topologySpreadConstraints}
+  - it: nodeSelector, tolerations, affinity and topologySpreadConstraints pass through to the server pod
+    set:
+      nodeSelector: {kubernetes.io/arch: arm64}
+      tolerations:
+        - {key: dedicated, operator: Equal, value: prow, effect: NoSchedule}
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions: [{key: topology.kubernetes.io/zone, operator: In, values: [eu-1a]}]
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector: {matchLabels: {app.kubernetes.io/component: server}}
+    asserts:
+      - equal: {path: spec.template.spec.nodeSelector, value: {kubernetes.io/arch: arm64}}
+      - equal:
+          path: spec.template.spec.tolerations
+          value: [{key: dedicated, operator: Equal, value: prow, effect: NoSchedule}]
+      - equal:
+          path: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[0].matchExpressions[0].values
+          value: [eu-1a]
+      - lengthEqual: {path: spec.template.spec.topologySpreadConstraints, count: 1}
+      - equal: {path: 'spec.template.spec.topologySpreadConstraints[0].topologyKey', value: topology.kubernetes.io/zone}
+      - equal:
+          path: 'spec.template.spec.topologySpreadConstraints[0].labelSelector.matchLabels'
+          value: {app.kubernetes.io/component: server}
+  - it: podLabels join the selector labels on the pod without touching the selector
+    set:
+      podLabels: {team: infra}
+    asserts:
+      - equal: {path: spec.template.metadata.labels.team, value: infra}
+      - equal: {path: 'spec.template.metadata.labels["app.kubernetes.io/component"]', value: server}
+      - notExists: {path: spec.selector.matchLabels.team}
+      - notExists: {path: metadata.labels.team}
+  - it: podAnnotations join the checksum annotations on the pod
+    set:
+      podAnnotations: {prometheus.io/scrape: 'true'}
+    asserts:
+      - equal: {path: 'spec.template.metadata.annotations["prometheus.io/scrape"]', value: 'true'}
+      - exists: {path: 'spec.template.metadata.annotations["checksum/config"]'}
+      - notExists: {path: 'metadata.annotations["prometheus.io/scrape"]'}

charts/prow-github-app/tests/topology_test.yaml

@@ -151,3 +151,56 @@ tests:
     template: pdb.yaml
     asserts:
       - equal: {path: 'spec.selector.matchLabels["app.kubernetes.io/component"]', value: server}
+  # The checksum annotations are sha256 of `toJson` over the inputs the ConfigMap and the inline Secret carry, so a
+  # changed input rolls the pods. Pinned digests: python3 -c 'import hashlib,json; print(hashlib.sha256(json.dumps(
+  # [{"commands":"","jobs":"lgtm","mergeMethod":"","config":"","dryRun":False},""],separators=(",",":"),sort_keys=True)
+  # .encode()).hexdigest())' for the default config; adding a prow.* value in values.yaml changes it on purpose.
+  - it: the pod checksums cover the whole prow block, the api url and the inline credentials
+    template: deployment.yaml
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+          value: 71e81b761032fc68b0e1de7c124cde478c718a66e7595a8555aa806fe1f49a38
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/secret"]'
+          value: 78c76bc2e5fa8c5be6224db7905ab340dc2baa392872ce605010616016c27fce
+  - it: a changed prow value rolls the pods through checksum/config and leaves checksum/secret alone
+    set:
+      prow.commands: lgtm
+    template: deployment.yaml
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+          value: f54ea32a9910e21460e366eaf798845ba8edd536dd65c8c912c8da0922a1f030
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/secret"]'
+          value: 78c76bc2e5fa8c5be6224db7905ab340dc2baa392872ce605010616016c27fce
+  - it: a changed github.apiUrl rolls the pods through checksum/config
+    set:
+      github.apiUrl: https://ghes.example/api/v3
+    template: deployment.yaml
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+          value: 9cd41ee8f031f59cae69aed6ba8a2d48b4403a424e379d56f796af8e15cf6f76
+  - it: a changed inline credential rolls the pods through checksum/secret only
+    set:
+      github.webhookSecret: t
+    template: deployment.yaml
+    asserts:
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/config"]'
+          value: 71e81b761032fc68b0e1de7c124cde478c718a66e7595a8555aa806fe1f49a38
+      - equal:
+          path: 'spec.template.metadata.annotations["checksum/secret"]'
+          value: a40a40ea843d5efd8f509e8cd1e598d28888158779831f221fac0bfcd306fc49
+  - it: github.existingSecret drops checksum/secret, since the chart no longer owns those bytes
+    set:
+      github.existingSecret: mine
+      github.appId: ''
+      github.privateKey: ''
+      github.webhookSecret: ''
+    template: deployment.yaml
+    asserts:
+      - notExists: {path: 'spec.template.metadata.annotations["checksum/secret"]'}
+      - exists: {path: 'spec.template.metadata.annotations["checksum/config"]'}

charts/prow-github-app/tests/wiring_test.yaml

@@ -170,3 +170,17 @@ tests:
             name: GITHUB_APP_ID
             valueFrom: {secretKeyRef: {name: prow, key: appId}}
         template: deployment.yaml
+  - it: a release named after the chart is not suffixed with the chart name again
+    release:
+      name: prow-github-app-prod
+    asserts:
+      - equal: {path: metadata.name, value: prow-github-app-prod}
+        template: deployment.yaml
+      - equal: {path: metadata.name, value: prow-github-app-prod}
+        template: service.yaml
+      - equal: {path: metadata.name, value: prow-github-app-prod-jobs}
+        template: cronjob.yaml
+      - equal:
+          path: spec.template.spec.containers[0].envFrom
+          value: [{configMapRef: {name: prow-github-app-prod}}]
+        template: deployment.yaml