snicholasbarton opened a new pull request, #783:
URL: https://github.com/apache/spark-kubernetes-operator/pull/783
### What changes were proposed in this pull request?
Move the RBAC Helm test assertions into a single block scalar, one `kubectl
auth can-i` per line under `set -ex`. `can-i` already exits non-zero when it
answers "no", and -x echoes each assertion into the pod log beside its answer.
Expand the test assertions to more comprehensively cover cases not already
included:
- Cover every grant; only core resources and spark.apache.org were checked
before.
- Leases are asserted only for a replicated operator, matching the
replicas > 1 condition on that grant.
- Assert the Gateway API grant only where the CRDs are installed. `kubectl
auth can-i` answers "no" for a resource type the cluster does not serve, even
when the rules grant it, so an unguarded assertion would fail on every cluster
without the Gateway API.
- Add negative assertions
- Stop deleting the pod when a hook fails, so its log survives for
inspection. A passing pod is still cleaned up.
### Why are the changes needed?
If a future change breaks the permissions model, the tests will continue to
pass. We should catch breaking changes in tests.
`command: ['bash', '-c']` with a multi-element `args` array passes only the
first element to bash as the script; the rest become positional parameters. Six
of the seven operator assertions and three of the four workload assertions
therefore never ran, and `helm test` passed regardless.
### Does this PR introduce _any_ user-facing change?
No
### How was this patch tested?
Repro listed in the ticket + it should pass CI.
### Was this patch authored or co-authored using generative AI tooling?
Generated by: Claude Code (Opus 5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
