test: add unit tests

Author: maltesander

rust/operator-binary/src/controller/build/properties/config_json.rs

@@ -224,4 +224,31 @@ mod tests {
         // Role-group-level addition is applied on top.
         assert_eq!(config["labels"]["rolegroup"], "default");
     }
+
+    #[test]
+    fn decision_logs_follow_decision_logger_level() {
+        // Decision logging is enabled when the `decision` logger is set above `NONE`.
+        let enabled = config_json_for(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": {
+                "config": { "logging": { "containers": {
+                    "opa": { "loggers": { "decision": { "level": "INFO" } } }
+                } } },
+                "roleGroups": { "default": {} },
+            },
+        }));
+        assert_eq!(enabled["decision_logs"]["console"], true);
+
+        // An explicit `NONE` level keeps decision logging disabled (field omitted).
+        let disabled = config_json_for(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": {
+                "config": { "logging": { "containers": {
+                    "opa": { "loggers": { "decision": { "level": "NONE" } } }
+                } } },
+                "roleGroups": { "default": {} },
+            },
+        }));
+        assert!(disabled.get("decision_logs").is_none_or(Value::is_null));
+    }
 }

rust/operator-binary/src/controller/build/properties/product_logging/mod.rs

@@ -47,4 +47,21 @@ mod tests {
         assert!(content.contains("files_opa_json"));
         assert!(content.contains("files_tracing_rs"));
     }
+
+    #[test]
+    fn bundle_builder_log_level_maps_and_renders_uppercase() {
+        // The sidecar only understands these five levels, so FATAL and NONE collapse onto ERROR.
+        let cases = [
+            (LogLevel::TRACE, "TRACE"),
+            (LogLevel::DEBUG, "DEBUG"),
+            (LogLevel::INFO, "INFO"),
+            (LogLevel::WARN, "WARN"),
+            (LogLevel::ERROR, "ERROR"),
+            (LogLevel::FATAL, "ERROR"),
+            (LogLevel::NONE, "ERROR"),
+        ];
+        for (level, expected) in cases {
+            assert_eq!(BundleBuilderLogLevel::from(level).to_string(), expected);
+        }
+    }
 }

rust/operator-binary/src/controller/build/resource/config_map.rs

@@ -132,4 +132,38 @@ mod tests {
         assert!(data.contains_key("config.json"));
         assert!(data.contains_key("user-info-fetcher.json"));
     }
+
+    #[test]
+    fn renders_vector_yaml_when_agent_enabled() {
+        let cm = build_config_map(json!({
+            "image": { "productVersion": "1.2.3" },
+            "clusterConfig": { "vectorAggregatorConfigMapName": "vector-aggregator-discovery" },
+            "servers": {
+                "config": { "logging": { "enableVectorAgent": true } },
+                "roleGroups": { "default": {} },
+            },
+        }));
+
+        assert!(
+            cm.data
+                .as_ref()
+                .expect("config map data")
+                .contains_key(VECTOR_CONFIG_FILE)
+        );
+    }
+
+    #[test]
+    fn omits_vector_yaml_when_agent_disabled() {
+        let cm = build_config_map(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": { "roleGroups": { "default": {} } },
+        }));
+
+        assert!(
+            !cm.data
+                .as_ref()
+                .expect("config map data")
+                .contains_key(VECTOR_CONFIG_FILE)
+        );
+    }
 }

rust/operator-binary/src/controller/build/resource/daemonset.rs

@@ -1048,4 +1048,87 @@ mod tests {
 
         assert!(volume_names(&ds).contains(&"tls".to_owned()));
     }
+
+    #[test]
+    fn opa_container_serves_https_when_tls_enabled() {
+        let ds = build(&validated_cluster_from_spec(json!({
+            "image": { "productVersion": "1.2.3" },
+            "clusterConfig": { "tls": { "serverSecretClass": "tls" } },
+            "servers": { "roleGroups": { "default": {} } },
+        })));
+        let pod_spec = ds.spec.as_ref().unwrap().template.spec.as_ref().unwrap();
+        let opa = pod_spec
+            .containers
+            .iter()
+            .find(|c| c.name == "opa")
+            .expect("opa container should exist");
+
+        // The single container port is the HTTPS data port.
+        let ports = opa.ports.as_ref().unwrap();
+        assert_eq!(ports.len(), 1);
+        assert_eq!(ports[0].name.as_deref(), Some("https"));
+        assert_eq!(ports[0].container_port, 8443);
+
+        // The probe must speak HTTPS, otherwise it would fail against the TLS-only server.
+        let scheme = opa
+            .liveness_probe
+            .as_ref()
+            .unwrap()
+            .http_get
+            .as_ref()
+            .unwrap()
+            .scheme
+            .clone();
+        assert_eq!(scheme.as_deref(), Some("HTTPS"));
+
+        // The start command binds the HTTPS port and passes the TLS cert/key flags.
+        let args = opa.args.as_ref().unwrap();
+        assert!(args[0].contains("-a 0.0.0.0:8443"));
+        assert!(args[0].contains("--tls-cert-file"));
+    }
+
+    #[test]
+    fn bundle_builder_start_command_silences_console_only_when_none() {
+        let role_group_config = |spec: serde_json::Value| {
+            let cluster = validated_cluster_from_spec(spec);
+            cluster.role_group_configs[&OpaRole::Server]
+                .values()
+                .next()
+                .expect("the default role group should exist")
+                .config
+                .clone()
+        };
+
+        // Console level NONE redirects bundle-builder output to /dev/null (no `tee`).
+        let silenced = role_group_config(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": {
+                "config": { "logging": { "containers": {
+                    "bundle-builder": { "console": { "level": "NONE" } }
+                } } },
+                "roleGroups": { "default": {} },
+            },
+        }));
+        // The redirect is appended directly after the bundle-builder invocation. (`/dev/null` also
+        // appears in the shared bash trap helpers, so match the specific redirect.)
+        assert!(
+            build_bundle_builder_start_command(&silenced, "bundle-builder")
+                .contains("stackable-opa-bundle-builder > /dev/null")
+        );
+
+        // With a console level above NONE, output is not discarded.
+        let logging = role_group_config(json!({
+            "image": { "productVersion": "1.2.3" },
+            "servers": {
+                "config": { "logging": { "containers": {
+                    "bundle-builder": { "console": { "level": "INFO" } }
+                } } },
+                "roleGroups": { "default": {} },
+            },
+        }));
+        assert!(
+            build_bundle_builder_start_command(&logging, "bundle-builder")
+                .contains("stackable-opa-bundle-builder &")
+        );
+    }
 }

rust/operator-binary/src/controller/build/resource/service.rs

@@ -292,4 +292,24 @@ mod tests {
             Some("8081")
         );
     }
+
+    #[test]
+    fn metrics_service_uses_https_scheme_and_port_with_tls() {
+        let cluster = cluster(true);
+        let rg = default_role_group(&cluster);
+        let service = build_rolegroup_metrics_service(&cluster, &rg);
+
+        // The metrics endpoint follows the data port, so it serves on the HTTPS port over `https`.
+        assert_eq!(single_port(&service), ("metrics".to_owned(), 8443));
+
+        let annotations = service.metadata.annotations.unwrap();
+        assert_eq!(
+            annotations.get("prometheus.io/scheme").map(String::as_str),
+            Some("https")
+        );
+        assert_eq!(
+            annotations.get("prometheus.io/port").map(String::as_str),
+            Some("8443")
+        );
+    }
 }