From 2b9fedc2f31fe7be911c3efbac6276b8ea4a60c1 Mon Sep 17 00:00:00 2001 From: Kirill Ilin Date: Wed, 8 Jul 2026 12:07:53 +0500 Subject: [PATCH] test(keycloak): make the AppRole/token env negative assertions bite The notContains checks matched whole array elements, so a name-only content never equaled the valueFrom entry and the assertion could never fail. Add any:true so "AppRole stores no static token" and, symmetrically, "token mode renders no AppRole vars" are actually verified (confirmed by mutation-testing the template). Assisted-By: Claude AI Signed-off-by: Kirill Ilin --- packages/system/keycloak/tests/encryption_test.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/packages/system/keycloak/tests/encryption_test.yaml b/packages/system/keycloak/tests/encryption_test.yaml index 417c85cb9..0d941541a 100644 --- a/packages/system/keycloak/tests/encryption_test.yaml +++ b/packages/system/keycloak/tests/encryption_test.yaml @@ -151,6 +151,13 @@ tests: content: name: KKP_VAULT_ADDR value: https://vault.vault.svc:8200 + # Token auth must not leak AppRole env vars. any:true matches on the + # element name alone (helm-unittest otherwise deep-equals whole elements). + - notContains: + path: spec.template.spec.containers[0].env + any: true + content: + name: KKP_VAULT_ROLE_ID - it: does not generate a static KEK Secret for the Vault backend template: templates/proxy.yaml @@ -258,8 +265,12 @@ tests: secretKeyRef: name: keycloak-vault-approle key: secret-id + # AppRole must not store a long-lived token. any:true matches on the + # element name alone (helm-unittest otherwise deep-equals whole elements, + # so a name-only content would never match the valueFrom entry). - notContains: path: spec.template.spec.containers[0].env + any: true content: name: KKP_VAULT_TOKEN