From 56dacf50c94dedf134188dba385ec00ee861dc52 Mon Sep 17 00:00:00 2001 From: Kirill Ilin Date: Wed, 8 Jul 2026 14:32:38 +0500 Subject: [PATCH] test(keycloak): assert automountServiceAccountToken on the ServiceAccount Lock in the SA-object token toggle (off by default, on only for kubernetes auth), complementing the pod-level assertions. Assisted-By: Claude AI Signed-off-by: Kirill Ilin --- .../keycloak/tests/encryption_test.yaml | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/packages/system/keycloak/tests/encryption_test.yaml b/packages/system/keycloak/tests/encryption_test.yaml index e7098d7d3..7800c9ed1 100644 --- a/packages/system/keycloak/tests/encryption_test.yaml +++ b/packages/system/keycloak/tests/encryption_test.yaml @@ -358,7 +358,7 @@ tests: - failedTemplate: errorPattern: "encryption.kms.vault.auth must be 'token', 'approle', or 'kubernetes'" - - it: creates a dedicated proxy ServiceAccount + - it: creates a dedicated proxy ServiceAccount with the token off by default template: templates/proxy.yaml documentSelector: path: kind @@ -372,6 +372,29 @@ tests: - equal: path: metadata.name value: keycloak-kms-proxy + - equal: + path: automountServiceAccountToken + value: false + + - it: enables the ServiceAccount token on the SA object for Kubernetes auth + template: templates/proxy.yaml + documentSelector: + path: kind + value: ServiceAccount + set: + encryption.enabled: true + encryption.kms.backend: vault-transit + encryption.kms.vault.address: https://vault.vault.svc:8200 + encryption.kms.vault.keyName: keycloak + encryption.kms.vault.auth: kubernetes + encryption.kms.vault.kubernetes.role: keycloak-proxy + _cluster: + root-host: example.org + cluster-domain: cozy.local + asserts: + - equal: + path: automountServiceAccountToken + value: true - it: runs the proxy under its ServiceAccount with the token off by default template: templates/proxy.yaml