suite: vm-disk pvc-resize hook runs non-root

# The resize hook only renders when an existing PVC is being grown
# (lookup-gated on the PVC + a larger .Values.storage), so mock a smaller PVC
# and request a larger size to drive the render, then pin the non-root
# securityContext. Scope to the hook template so the chart's tenant-identifier
# lookups elsewhere don't need a live cluster.
release:
  name: test-vm-disk
  namespace: tenant-test
templates:
  - templates/pvc-resize-hook.yaml
set:
  storage: 2Gi
kubernetesProvider:
  scheme:
    "v1/PersistentVolumeClaim":
      gvr:
        group: ""
        version: "v1"
        resource: "persistentvolumeclaims"
      namespaced: true
  objects:
    - kind: PersistentVolumeClaim
      apiVersion: v1
      metadata:
        name: test-vm-disk
        namespace: tenant-test
      spec:
        resources:
          requests:
            storage: 1Gi
tests:
  - it: pvc-resize hook Job runs under a restrictive non-root securityContext
    documentSelector:
      path: kind
      value: Job
    asserts:
      - equal:
          path: spec.template.spec.securityContext.runAsNonRoot
          value: true
      - equal:
          path: spec.template.spec.securityContext.runAsUser
          value: 65534
      - equal:
          path: spec.template.spec.securityContext.seccompProfile.type
          value: RuntimeDefault
      - equal:
          path: spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation
          value: false
      - contains:
          path: spec.template.spec.containers[0].securityContext.capabilities.drop
          content: ALL

  - it: backoffLimit is set at Job.spec, not silently dropped under the pod spec
    documentSelector:
      path: kind
      value: Job
    asserts:
      - equal:
          path: spec.backoffLimit
          value: 1
      - notExists:
          path: spec.template.spec.backoffLimit