[WIP] Update deployment test - operator

Author: arybolovlev

charts/test/unit/deployment_test.go

@@ -299,14 +299,35 @@ func TestDeploymentOperatorResources(t *testing.T) {
 	assert.Equal(t, d, deployment)
 }
 
-// TODO
 func TestDeploymentOperatorSecurityContext(t *testing.T) {
 	options := &helm.Options{
+		SetValues: map[string]string{
+			"operator.securityContext.allowPrivilegeEscalation": "true",
+			"operator.securityContext.runAsNonRoot":             "true",
+			"operator.securityContext.seccompProfile.type":      "Localhost",
+			"operator.securityContext.capabilities.add":         `{NET_BIND_SERVICE}`,
+		},
 		Version: helmChartVersion,
 	}
 	deployment := renderDeploymentManifest(t, options)
 	d := defaultDeployment()
 
+	d.Spec.Template.Spec.Containers[0].SecurityContext = &corev1.SecurityContext{
+		AllowPrivilegeEscalation: ptr.To(true),
+		RunAsNonRoot:             ptr.To(true),
+		Capabilities: &corev1.Capabilities{
+			Drop: []corev1.Capability{
+				corev1.Capability("ALL"),
+			},
+			Add: []corev1.Capability{
+				corev1.Capability("NET_BIND_SERVICE"),
+			},
+		},
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeLocalhost,
+		},
+	}
+
 	assert.Equal(t, d, deployment)
 }
 
@@ -482,21 +503,34 @@ func TestDeploymentKubeRbacProxyImage(t *testing.T) {
 	assert.Equal(t, d, deployment)
 }
 
-// TODO
 func TestDeploymentKubeRbacProxySecurityContext(t *testing.T) {
 	options := &helm.Options{
-		Version: helmChartVersion,
 		SetValues: map[string]string{
-			"kubeRbacProxy.image.repository": "this",
-			"kubeRbacProxy.image.pullPolicy": string(corev1.PullAlways),
-			"kubeRbacProxy.image.tag":        "0.0.1",
+			"kubeRbacProxy.securityContext.allowPrivilegeEscalation": "true",
+			"kubeRbacProxy.securityContext.runAsNonRoot":             "true",
+			"kubeRbacProxy.securityContext.seccompProfile.type":      "Localhost",
+			"kubeRbacProxy.securityContext.capabilities.add":         `{NET_BIND_SERVICE}`,
 		},
+		Version: helmChartVersion,
 	}
 	deployment := renderDeploymentManifest(t, options)
 	d := defaultDeployment()
 
-	d.Spec.Template.Spec.Containers[1].Image = "this:0.0.1"
-	d.Spec.Template.Spec.Containers[1].ImagePullPolicy = corev1.PullAlways
+	d.Spec.Template.Spec.Containers[1].SecurityContext = &corev1.SecurityContext{
+		AllowPrivilegeEscalation: ptr.To(true),
+		RunAsNonRoot:             ptr.To(true),
+		Capabilities: &corev1.Capabilities{
+			Drop: []corev1.Capability{
+				corev1.Capability("ALL"),
+			},
+			Add: []corev1.Capability{
+				corev1.Capability("NET_BIND_SERVICE"),
+			},
+		},
+		SeccompProfile: &corev1.SeccompProfile{
+			Type: corev1.SeccompProfileTypeLocalhost,
+		},
+	}
 
 	assert.Equal(t, d, deployment)
 }