From fbfc270c712c8eb2dac240c0e6643a2b88bcdbda Mon Sep 17 00:00:00 2001
From: Kirill Ilin <stitch14@yandex.ru>
Date: Fri, 6 Nov 2026 18:29:18 +0500
Subject: [PATCH] test(installer): tie each platform source flag to its own
 value

Both secrets were only ever set together, so a cert flag keyed on
platformSourceSecret stayed green. A pull-through cache behind a private
CA usually needs the CA without credentials, which is exactly the case
such a slip breaks. The absence checks match the flag by prefix, since
a whole-element comparison misses the flag rendered with any value.

Assisted-by: LLM
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
---
 .../installer/tests/platform_source_test.yaml | 44 ++++++++++++++++---
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/packages/core/installer/tests/platform_source_test.yaml b/packages/core/installer/tests/platform_source_test.yaml
index 5d2db4033..a925754c1 100644
--- a/packages/core/installer/tests/platform_source_test.yaml
+++ b/packages/core/installer/tests/platform_source_test.yaml
@@ -1,12 +1,47 @@
 suite: cozystack-operator platform source arguments
 
+# Each flag must follow its own value: a pull-through cache behind a private CA
+# often needs the CA without credentials, so a cert flag keyed on the wrong
+# value would bring back the TLS failure while every other case stays green.
+
 templates:
   - templates/cozystack-operator.yaml
 
 tests:
-  - it: passes platformSourceCertSecret to the operator
+  - it: passes platformSourceCertSecret alone, without credentials
+    set:
+      cozystackOperator.platformSourceCertSecret: registry-ca
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --platform-source-cert-secret=registry-ca
+        documentSelector:
+          path: kind
+          value: Deployment
+      - notExists:
+          path: spec.template.spec.containers[0].args[?(@ =~ /^--platform-source-secret=/)]
+        documentSelector:
+          path: kind
+          value: Deployment
+
+  - it: passes platformSourceSecret alone, without the cert flag
+    set:
+      cozystackOperator.platformSourceSecret: registry-creds
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --platform-source-secret=registry-creds
+        documentSelector:
+          path: kind
+          value: Deployment
+      - notExists:
+          path: spec.template.spec.containers[0].args[?(@ =~ /^--platform-source-cert-secret=/)]
+        documentSelector:
+          path: kind
+          value: Deployment
+
+  - it: passes both secrets together
     set:
-      cozystackOperator.platformSourceUrl: oci://registry.internal:8083/cozystack/cozystack/cozystack-packages
       cozystackOperator.platformSourceSecret: registry-creds
       cozystackOperator.platformSourceCertSecret: registry-ca
     asserts:
@@ -25,9 +60,8 @@ tests:
 
   - it: omits the cert secret flag by default
     asserts:
-      - notContains:
-          path: spec.template.spec.containers[0].args
-          content: --platform-source-cert-secret=
+      - notExists:
+          path: spec.template.spec.containers[0].args[?(@ =~ /^--platform-source-cert-secret=/)]
         documentSelector:
           path: kind
           value: Deployment