chore: import upstream snapshot with attribution

helm-chart/tests/cloud_storage_test.yaml

@@ -0,0 +1,248 @@
+suite: cloud storage template
+templates:
+  - templates/21-cloud-storage.yaml
+tests:
+  - it: should render nothing with default values
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should render ConfigMap with S3 config only
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.region: us-east-1
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cloud-config
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AWS_BUCKET
+          value: "my-bucket"
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AWS_REGION
+          value: "us-east-1"
+        documentIndex: 0
+      - notExists:
+          path: data.SNAPSHOT_AWS_ACCESS_KEY
+        documentIndex: 0
+
+  - it: should render ConfigMap and Secret with S3 config and credentials
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.region: us-east-1
+      tap.snapshots.cloud.s3.accessKey: AKIAIOSFODNN7EXAMPLE
+      tap.snapshots.cloud.s3.secretKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
+    asserts:
+      - hasDocuments:
+          count: 2
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AWS_BUCKET
+          value: "my-bucket"
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AWS_REGION
+          value: "us-east-1"
+        documentIndex: 0
+      - isKind:
+          of: Secret
+        documentIndex: 1
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cloud-secret
+        documentIndex: 1
+      - equal:
+          path: stringData.SNAPSHOT_AWS_ACCESS_KEY
+          value: "AKIAIOSFODNN7EXAMPLE"
+        documentIndex: 1
+      - equal:
+          path: stringData.SNAPSHOT_AWS_SECRET_KEY
+          value: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+        documentIndex: 1
+
+  - it: should render ConfigMap with Azure Blob config only
+    set:
+      tap.snapshots.cloud.azblob.storageAccount: myaccount
+      tap.snapshots.cloud.azblob.container: mycontainer
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AZBLOB_STORAGE_ACCOUNT
+          value: "myaccount"
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AZBLOB_CONTAINER
+          value: "mycontainer"
+        documentIndex: 0
+
+  - it: should render ConfigMap and Secret with Azure Blob config and storage key
+    set:
+      tap.snapshots.cloud.azblob.storageAccount: myaccount
+      tap.snapshots.cloud.azblob.container: mycontainer
+      tap.snapshots.cloud.azblob.storageKey: c29tZWtleQ==
+    asserts:
+      - hasDocuments:
+          count: 2
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AZBLOB_STORAGE_ACCOUNT
+          value: "myaccount"
+        documentIndex: 0
+      - isKind:
+          of: Secret
+        documentIndex: 1
+      - equal:
+          path: stringData.SNAPSHOT_AZBLOB_STORAGE_KEY
+          value: "c29tZWtleQ=="
+        documentIndex: 1
+
+  - it: should render ConfigMap with GCS config only
+    set:
+      tap.snapshots.cloud.gcs.bucket: my-gcs-bucket
+      tap.snapshots.cloud.gcs.project: my-gcp-project
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_GCS_BUCKET
+          value: "my-gcs-bucket"
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_GCS_PROJECT
+          value: "my-gcp-project"
+        documentIndex: 0
+      - notExists:
+          path: data.SNAPSHOT_GCS_CREDENTIALS_JSON
+        documentIndex: 0
+
+  - it: should render ConfigMap and Secret with GCS config and credentials
+    set:
+      tap.snapshots.cloud.gcs.bucket: my-gcs-bucket
+      tap.snapshots.cloud.gcs.project: my-gcp-project
+      tap.snapshots.cloud.gcs.credentialsJson: '{"type":"service_account"}'
+    asserts:
+      - hasDocuments:
+          count: 2
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_GCS_BUCKET
+          value: "my-gcs-bucket"
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_GCS_PROJECT
+          value: "my-gcp-project"
+        documentIndex: 0
+      - isKind:
+          of: Secret
+        documentIndex: 1
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-cloud-secret
+        documentIndex: 1
+      - equal:
+          path: stringData.SNAPSHOT_GCS_CREDENTIALS_JSON
+          value: '{"type":"service_account"}'
+        documentIndex: 1
+
+  - it: should render ConfigMap with GCS bucket only (no project)
+    set:
+      tap.snapshots.cloud.gcs.bucket: my-gcs-bucket
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_GCS_BUCKET
+          value: "my-gcs-bucket"
+        documentIndex: 0
+      - notExists:
+          path: data.SNAPSHOT_GCS_PROJECT
+        documentIndex: 0
+
+  - it: should render ConfigMap with only prefix
+    set:
+      tap.snapshots.cloud.prefix: snapshots/prod
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_CLOUD_PREFIX
+          value: "snapshots/prod"
+        documentIndex: 0
+      - notExists:
+          path: data.SNAPSHOT_AWS_BUCKET
+        documentIndex: 0
+      - notExists:
+          path: data.SNAPSHOT_AZBLOB_STORAGE_ACCOUNT
+        documentIndex: 0
+      - notExists:
+          path: data.SNAPSHOT_GCS_BUCKET
+        documentIndex: 0
+
+  - it: should render ConfigMap with role ARN without credentials (IAM auth)
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.region: us-east-1
+      tap.snapshots.cloud.s3.roleArn: arn:aws:iam::123456789012:role/my-role
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: ConfigMap
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AWS_ROLE_ARN
+          value: "arn:aws:iam::123456789012:role/my-role"
+        documentIndex: 0
+      - equal:
+          path: data.SNAPSHOT_AWS_BUCKET
+          value: "my-bucket"
+        documentIndex: 0
+
+  - it: should render ConfigMap with externalId
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.externalId: ext-12345
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: data.SNAPSHOT_AWS_EXTERNAL_ID
+          value: "ext-12345"
+        documentIndex: 0
+
+  - it: should set correct namespace
+    release:
+      namespace: kubeshark-ns
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: kubeshark-ns
+        documentIndex: 0

helm-chart/tests/dissection_storage_test.yaml

@@ -0,0 +1,127 @@
+suite: dissection storage configuration
+templates:
+  - templates/04-hub-deployment.yaml
+tests:
+  - it: should fallback to snapshot storageSize when dissection storageSize is empty
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "20Gi"
+
+  - it: should fallback to snapshot storageClass when dissection storageClass is empty
+    set:
+      tap.snapshots.local.storageClass: gp2
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: gp2
+
+  - it: should not render dissector-storage-class when both dissection and snapshot storageClass are empty
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+
+  - it: should prefer dissection storageSize over snapshot storageSize
+    set:
+      tap.delayedDissection.storageSize: 100Gi
+      tap.snapshots.local.storageSize: 50Gi
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "100Gi"
+
+  - it: should prefer dissection storageClass over snapshot storageClass
+    set:
+      tap.delayedDissection.storageClass: io2
+      tap.snapshots.local.storageClass: gp2
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: io2
+
+  - it: should fallback to snapshot config for both storageSize and storageClass
+    set:
+      tap.snapshots.local.storageSize: 30Gi
+      tap.snapshots.local.storageClass: gp3
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "30Gi"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: gp3
+
+  - it: should not render dissector-storage-size when both dissection and snapshot storageSize are empty
+    set:
+      tap.delayedDissection.storageSize: ""
+      tap.snapshots.local.storageSize: ""
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+
+  - it: should render all dissector args together with custom values
+    set:
+      tap.delayedDissection.cpu: "4"
+      tap.delayedDissection.memory: 8Gi
+      tap.delayedDissection.storageSize: 200Gi
+      tap.delayedDissection.storageClass: local-path
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-cpu
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "4"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-memory
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: 8Gi
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-size
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "200Gi"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-storage-class
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: local-path
+
+  - it: should still render existing dissector-cpu and dissector-memory args
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-cpu
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "1"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -dissector-memory
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: 4Gi

helm-chart/tests/fixtures/values-azblob.yaml

@@ -0,0 +1,9 @@
+tap:
+  snapshots:
+    cloud:
+      provider: azblob
+      prefix: snapshots/
+      azblob:
+        storageAccount: kubesharkstore
+        container: snapshots
+        storageKey: c29tZWtleWhlcmU=

helm-chart/tests/fixtures/values-cloud-refs.yaml

@@ -0,0 +1,8 @@
+tap:
+  snapshots:
+    cloud:
+      provider: s3
+      configMaps:
+        - my-cloud-config
+      secrets:
+        - my-cloud-secret

helm-chart/tests/fixtures/values-gcs.yaml

@@ -0,0 +1,9 @@
+tap:
+  snapshots:
+    cloud:
+      provider: gcs
+      prefix: snapshots/
+      gcs:
+        bucket: kubeshark-snapshots
+        project: my-gcp-project
+        credentialsJson: '{"type":"service_account","project_id":"my-gcp-project"}'

helm-chart/tests/fixtures/values-s3.yaml

@@ -0,0 +1,10 @@
+tap:
+  snapshots:
+    cloud:
+      provider: s3
+      prefix: snapshots/
+      s3:
+        bucket: kubeshark-snapshots
+        region: us-east-1
+        accessKey: AKIAIOSFODNN7EXAMPLE
+        secretKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

helm-chart/tests/hub_deployment_test.yaml

@@ -0,0 +1,167 @@
+suite: hub deployment cloud integration
+templates:
+  - templates/04-hub-deployment.yaml
+tests:
+  - it: should not render envFrom with default values
+    asserts:
+      - isKind:
+          of: Deployment
+      - notContains:
+          path: spec.template.spec.containers[0].envFrom
+          any: true
+          content:
+            configMapRef:
+              name: RELEASE-NAME-cloud-config
+
+  - it: should render envFrom with inline S3 config
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.region: us-east-1
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: RELEASE-NAME-cloud-config
+
+  - it: should render envFrom secret ref with inline credentials
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.accessKey: AKIAIOSFODNN7EXAMPLE
+      tap.snapshots.cloud.s3.secretKey: secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: RELEASE-NAME-cloud-config
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: RELEASE-NAME-cloud-secret
+
+  - it: should render envFrom with inline GCS config
+    set:
+      tap.snapshots.cloud.gcs.bucket: my-gcs-bucket
+      tap.snapshots.cloud.gcs.project: my-gcp-project
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: RELEASE-NAME-cloud-config
+
+  - it: should render envFrom secret ref with inline GCS credentials
+    set:
+      tap.snapshots.cloud.gcs.bucket: my-gcs-bucket
+      tap.snapshots.cloud.gcs.credentialsJson: '{"type":"service_account"}'
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: RELEASE-NAME-cloud-config
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: RELEASE-NAME-cloud-secret
+
+  - it: should render cloud-storage-provider arg when provider is gcs
+    set:
+      tap.snapshots.cloud.provider: gcs
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -cloud-storage-provider
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: gcs
+
+  - it: should render envFrom with external configMaps
+    set:
+      tap.snapshots.cloud.configMaps:
+        - my-cloud-config
+        - my-other-config
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: my-cloud-config
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: my-other-config
+
+  - it: should render envFrom with external secrets
+    set:
+      tap.snapshots.cloud.secrets:
+        - my-cloud-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: my-cloud-secret
+
+  - it: should render cloud-storage-provider arg when provider is set
+    set:
+      tap.snapshots.cloud.provider: s3
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: -cloud-storage-provider
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: s3
+
+  - it: should not render cloud-storage-provider arg with default values
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].command
+          content: -cloud-storage-provider
+
+  - it: should render envFrom with tap.secrets
+    set:
+      tap.secrets:
+        - my-existing-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: my-existing-secret
+
+  - it: should render both inline and external refs together
+    set:
+      tap.snapshots.cloud.s3.bucket: my-bucket
+      tap.snapshots.cloud.s3.accessKey: key
+      tap.snapshots.cloud.s3.secretKey: secret
+      tap.snapshots.cloud.configMaps:
+        - ext-config
+      tap.snapshots.cloud.secrets:
+        - ext-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: ext-config
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: ext-secret
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: RELEASE-NAME-cloud-config
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: RELEASE-NAME-cloud-secret