suite: chart-computed env keys can't be overridden (round-8 regression net)

release:

name: t

namespace: sim

tests:

- it: app pod uses chart-computed DATABASE_URL even when user tries to override

template: deployment-app.yaml

set:

app.env.BETTER_AUTH_SECRET: x

app.env.ENCRYPTION_KEY: x

app.env.INTERNAL_API_SECRET: x

app.env.CRON_SECRET: x

app.env.DATABASE_URL: "should-be-ignored"

postgresql.auth.password: x

asserts:

- notContains:

path: spec.template.spec.containers[0].env

content:

name: DATABASE_URL

value: "should-be-ignored"

- it: existingSecret inline path skips DATABASE_URL/SOCKET_SERVER_URL

template: deployment-app.yaml

set:

app.secrets.existingSecret.enabled: true

app.secrets.existingSecret.name: my-secret

app.env.DATABASE_URL: "postgres://evil-1:5432/x"

app.env.SOCKET_SERVER_URL: "https://evil-2.example.com"

postgresql.auth.password: x

asserts:

- notContains:

path: spec.template.spec.containers[0].env

content: { name: DATABASE_URL, value: "postgres://evil-1:5432/x" }

- notContains:

path: spec.template.spec.containers[0].env

content: { name: SOCKET_SERVER_URL, value: "https://evil-2.example.com" }

- it: realtime pod existingSecret inline path skips chart-computed keys (round-8)

template: deployment-realtime.yaml

set:

app.secrets.existingSecret.enabled: true

app.secrets.existingSecret.name: my-secret

app.env.DATABASE_URL: "postgres://evil-1:5432/x"

app.env.SOCKET_SERVER_URL: "https://evil-2.example.com"

postgresql.auth.password: x

asserts:

- notContains:

path: spec.template.spec.containers[0].env

content: { name: SOCKET_SERVER_URL, value: "https://evil-2.example.com" }