Add helm-unittest suite for operator-crds toggles

.github/workflows/helm-charts-test.yml

@@ -53,6 +53,14 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml
 
+      - name: Run helm-unittest
+        # helm-unittest renders the charts and asserts on the resulting
+        # Kubernetes manifests, catching template regressions that `ct lint`
+        # and `ct install` do not — `helm install` can succeed even when the
+        # rendered output is subtly wrong. The plugin version is pinned in
+        # the Taskfile's `helm-unittest` task.
+        run: task helm-unittest
+
       - name: Create KIND cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
 

Taskfile.yml

@@ -26,6 +26,18 @@ tasks:
       - command -v helm-docs >/dev/null 2>&1 || go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
       - helm-docs --chart-search-root=deploy/charts
 
+  helm-unittest:
+    desc: Run helm-unittest suites against the Helm charts
+    vars:
+      # Pinned version — bump deliberately alongside the matching pin in
+      # .github/workflows/helm-charts-test.yml.
+      HELM_UNITTEST_VERSION: v1.0.3
+    cmds:
+      - >-
+        helm plugin list | grep -q unittest ||
+        helm plugin install https://github.com/helm-unittest/helm-unittest --version {{.HELM_UNITTEST_VERSION}}
+      - helm unittest deploy/charts/operator-crds
+
   mock-install:
     desc: Install the mockgen tool for mock generation
     status:

deploy/charts/operator-crds/.helmignore

@@ -23,6 +23,8 @@
 .vscode/
 # Source CRD files (only wrapped templates are needed)
 files/
+# helm-unittest test suites (not part of the packaged chart)
+tests/
 # Documentation
 CLAUDE.md
 CONTRIBUTING.md

deploy/charts/operator-crds/tests/toggles_test.yaml

@@ -0,0 +1,52 @@
+suite: crds chart toggles
+# Exercises the two values knobs that wrap every CRD template:
+#   crds.install — gates the entire CRD render
+#   crds.keep    — gates the `helm.sh/resource-policy: keep` annotation
+# A regression in either is silent at install time (gate removed →
+# unconditional install still works; keep removed → uninstall silently
+# cascade-deletes CRs). These tests make both behaviours red-on-break.
+# Assertions apply per template — each `templates:` entry renders one
+# CustomResourceDefinition, so the three toggle tests run once per CRD.
+templates:
+  - toolhive.stacklok.dev_embeddingservers.yaml
+  - toolhive.stacklok.dev_mcpexternalauthconfigs.yaml
+  - toolhive.stacklok.dev_mcpgroups.yaml
+  - toolhive.stacklok.dev_mcpoidcconfigs.yaml
+  - toolhive.stacklok.dev_mcpregistries.yaml
+  - toolhive.stacklok.dev_mcpremoteproxies.yaml
+  - toolhive.stacklok.dev_mcpserverentries.yaml
+  - toolhive.stacklok.dev_mcpservers.yaml
+  - toolhive.stacklok.dev_mcptelemetryconfigs.yaml
+  - toolhive.stacklok.dev_mcptoolconfigs.yaml
+  - toolhive.stacklok.dev_mcpwebhookconfigs.yaml
+  - toolhive.stacklok.dev_virtualmcpcompositetooldefinitions.yaml
+  - toolhive.stacklok.dev_virtualmcpservers.yaml
+
+tests:
+  - it: renders the CRD with the keep annotation on chart defaults
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: CustomResourceDefinition
+      - equal:
+          path: metadata.annotations["helm.sh/resource-policy"]
+          value: keep
+
+  - it: renders nothing when crds.install is false
+    set:
+      crds.install: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: omits the keep annotation when crds.keep is false
+    set:
+      crds.keep: false
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: CustomResourceDefinition
+      - notExists:
+          path: metadata.annotations["helm.sh/resource-policy"]