From 0c6fa22cb4d08395b6f2b7d02fca91424f315da1 Mon Sep 17 00:00:00 2001
From: Evan Lezar <elezar@nvidia.com>
Date: Tue, 14 Jul 2026 14:42:45 +0200
Subject: [PATCH] test(helm): match CA volumes by name

Signed-off-by: Evan Lezar <elezar@nvidia.com>
---
 .../openshell/tests/gateway_config_test.yaml  | 25 ++++----
 .../tests/statefulset_client_ca_test.yaml     | 59 ++++++++++---------
 2 files changed, 43 insertions(+), 41 deletions(-)

diff --git a/deploy/helm/openshell/tests/gateway_config_test.yaml b/deploy/helm/openshell/tests/gateway_config_test.yaml
index aee396c38f..2c17ab7722 100644
--- a/deploy/helm/openshell/tests/gateway_config_test.yaml
+++ b/deploy/helm/openshell/tests/gateway_config_test.yaml
@@ -49,18 +49,19 @@ tests:
       server.oidc.issuer: https://issuer.example.com
       server.oidc.caConfigMapName: openshell-oidc-ca
     asserts:
-      - equal:
-          path: spec.template.spec.containers[0].volumeMounts[3].name
-          value: oidc-ca
-      - equal:
-          path: spec.template.spec.containers[0].volumeMounts[3].mountPath
-          value: /etc/openshell-tls/oidc-ca
-      - equal:
-          path: spec.template.spec.volumes[2].name
-          value: oidc-ca
-      - equal:
-          path: spec.template.spec.volumes[2].configMap.name
-          value: openshell-oidc-ca
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: oidc-ca
+            mountPath: /etc/openshell-tls/oidc-ca
+          any: true
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: oidc-ca
+            configMap:
+              name: openshell-oidc-ca
+          any: true
 
   # Regression for the P1 bug Drew flagged: grpc_endpoint MUST live in the
   # Kubernetes driver table, not in [openshell.gateway]. The gateway-side
diff --git a/deploy/helm/openshell/tests/statefulset_client_ca_test.yaml b/deploy/helm/openshell/tests/statefulset_client_ca_test.yaml
index a7b02310cf..5e34b83d19 100644
--- a/deploy/helm/openshell/tests/statefulset_client_ca_test.yaml
+++ b/deploy/helm/openshell/tests/statefulset_client_ca_test.yaml
@@ -16,15 +16,15 @@ tests:
       pkiInitJob.enabled: true
       certManager.enabled: false
     asserts:
-      - equal:
-          path: spec.template.spec.volumes[3].name
-          value: tls-client-ca
-      - equal:
-          path: spec.template.spec.volumes[3].secret.secretName
-          value: openshell-server-tls
-      - equal:
-          path: spec.template.spec.volumes[3].secret.items[0].key
-          value: ca.crt
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: tls-client-ca
+            secret:
+              secretName: openshell-server-tls
+              items:
+                - key: ca.crt
+                  path: ca.crt
 
   - it: shares the cert-manager server TLS ca.crt when clientCaFromServerTlsSecret is true
     template: templates/statefulset.yaml
@@ -32,15 +32,15 @@ tests:
       certManager.enabled: true
       certManager.clientCaFromServerTlsSecret: true
     asserts:
-      - equal:
-          path: spec.template.spec.volumes[3].name
-          value: tls-client-ca
-      - equal:
-          path: spec.template.spec.volumes[3].secret.secretName
-          value: openshell-server-tls
-      - equal:
-          path: spec.template.spec.volumes[3].secret.items[0].key
-          value: ca.crt
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: tls-client-ca
+            secret:
+              secretName: openshell-server-tls
+              items:
+                - key: ca.crt
+                  path: ca.crt
 
   # Regression: with cert-manager enabled and pkiInitJob left at its default
   # `true`, the client CA condition must honor certManager precedence and NOT
@@ -54,14 +54,13 @@ tests:
       certManager.clientCaFromServerTlsSecret: false
       pkiInitJob.enabled: true
     asserts:
-      - equal:
-          path: spec.template.spec.volumes[3].name
-          value: tls-client-ca
-      - equal:
-          path: spec.template.spec.volumes[3].secret.secretName
-          value: openshell-server-client-ca
-      - notExists:
-          path: spec.template.spec.volumes[3].secret.items
+      # Exact matching (without any: true) also verifies that secret.items is absent.
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: tls-client-ca
+            secret:
+              secretName: openshell-server-client-ca
 
   # When cert-manager owns TLS, does not share its CA, and no separate client CA
   # secret is configured, there is no client CA to mount: the volume must not
@@ -74,12 +73,14 @@ tests:
       pkiInitJob.enabled: true
       server.tls.clientCaSecretName: ""
     asserts:
-      - lengthEqual:
+      - notContains:
           path: spec.template.spec.volumes
-          count: 3
+          content:
+            name: tls-client-ca
+          any: true
       - notContains:
           path: spec.template.spec.containers[0].volumeMounts
           content:
             name: tls-client-ca
             mountPath: /etc/openshell-tls/client-ca
-            readOnly: true
+          any: true