From 77f6cd1af892004fed62fcdd960f189f920ca86d Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Thu, 1 Oct 2026 22:23:25 +0300 Subject: [PATCH] test(redis): assert no external SAN when no namespace map is injected The null-namespace case only checked that the in-cluster name is present, so a chart that emitted a bare "my-redis." SAN, or fell back to the suite-level host, would still pass. It now carries the same absence check as the empty-host case, plus the suite host itself. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin --- packages/apps/redis/tests/tls_test.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/apps/redis/tests/tls_test.yaml b/packages/apps/redis/tests/tls_test.yaml index 69b97b07c..07c107cd0 100644 --- a/packages/apps/redis/tests/tls_test.yaml +++ b/packages/apps/redis/tests/tls_test.yaml @@ -702,6 +702,12 @@ tests: - contains: path: spec.dnsNames content: "rfr-my-redis.tenant-test.svc.cluster.local" + - notContains: + path: spec.dnsNames + content: "my-redis." + - notContains: + path: spec.dnsNames + content: "my-redis.example.com" # ------------------------------------------------------------------ # Null and empty forms. The `default (dict)` guard in _tls.tpl covers a nil