From de443de487cf57e57df4dae41185d1b00822fcbe Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Thu, 3 Sep 2026 01:00:20 +0300 Subject: [PATCH] test(mariadb): bind the uninstall assertions to the delete verb Both suites matched only the Secret name list in the hook's script, so replacing kubectl delete with kubectl get left all 106 cases green while the CA private key and the server private key survived the release. The verb is the claim these tests exist to make; the names alone are just text that happens to appear in a shell script. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin --- packages/apps/mariadb/tests/cleanup_hook_test.yaml | 7 +++++-- packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml | 6 ++++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/packages/apps/mariadb/tests/cleanup_hook_test.yaml b/packages/apps/mariadb/tests/cleanup_hook_test.yaml index 3cfcb43ed..cb137f6c9 100644 --- a/packages/apps/mariadb/tests/cleanup_hook_test.yaml +++ b/packages/apps/mariadb/tests/cleanup_hook_test.yaml @@ -23,12 +23,15 @@ tests: path: kind value: Job asserts: + # The verb is part of the assertion. Matching the name list alone leaves + # the whole point of the hook — that these Secrets are REMOVED — pinned by + # nothing, so `kubectl get secret` in place of the delete stays green. - matchRegex: path: spec.template.spec.containers[0].command[2] - pattern: "mariadb-test-metrics-password mariadb-test-repl-password" + pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-metrics-password mariadb-test-repl-password" - matchRegex: path: spec.template.spec.containers[0].command[2] - pattern: "mariadb-test-ca-tls mariadb-test-tls --ignore-not-found" + pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-ca-tls mariadb-test-tls --ignore-not-found" - it: "cleanup Job fails (exits non-zero) when a real delete error occurs, so orphaned resources don't pass silently" documentSelector: diff --git a/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml b/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml index dfec7b891..a1d72168e 100644 --- a/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml +++ b/packages/apps/mariadb/tests/cleanup_pvc_hook_test.yaml @@ -81,12 +81,14 @@ tests: - it: deletes the key-bearing cert-manager Secrets on uninstall documentIndex: 0 asserts: + # Bound to the delete: a name reachable by any other verb says nothing + # about whether the key outlives the release. - matchRegex: path: spec.template.spec.containers[0].command[2] - pattern: "mariadb-test-ca-tls" + pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-ca-tls" - matchRegex: path: spec.template.spec.containers[0].command[2] - pattern: "mariadb-test-tls" + pattern: "(?s)kubectl delete secret -n \\S+.*mariadb-test-tls" # -ca-bundle carries an ownerRef to the MariaDB resource, so Kubernetes # collects it; deleting it here would need a grant that is not warranted. - notMatchRegex: