chore: import upstream snapshot with attribution

helm/sim/tests/pii_test.yaml

@@ -0,0 +1,185 @@
+suite: pii — optional Presidio service + PII_URL wiring
+release:
+  name: t
+  namespace: sim
+set:
+  app.env.BETTER_AUTH_SECRET: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  app.env.ENCRYPTION_KEY: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+  app.env.INTERNAL_API_SECRET: x
+  app.env.CRON_SECRET: x
+  postgresql.auth.password: xxxxxxxx
+tests:
+  - it: does not render the pii deployment when disabled
+    template: deployment-pii.yaml
+    asserts:
+      - hasDocuments: { count: 0 }
+
+  - it: renders the pii deployment + service when enabled
+    set:
+      pii.enabled: true
+    templates:
+      - deployment-pii.yaml
+      - services.yaml
+    asserts:
+      - template: deployment-pii.yaml
+        isKind: { of: Deployment }
+      - template: deployment-pii.yaml
+        equal: { path: metadata.name, value: t-sim-pii }
+      - template: deployment-pii.yaml
+        equal:
+          path: spec.template.spec.containers[0].ports[0].containerPort
+          value: 5001
+
+  - it: pii pod defaults to the spacy engine
+    template: deployment-pii.yaml
+    set:
+      pii.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_ENGINE
+            value: "spacy"
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_DEVICE
+            value: "cpu"
+
+  - it: pii.engine and pii.device render through to the container env
+    template: deployment-pii.yaml
+    set:
+      pii.enabled: true
+      pii.engine: gliner
+      pii.device: cuda
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_ENGINE
+            value: "gliner"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_DEVICE
+            value: "cuda"
+
+  - it: user-set pii.env cannot override the chart-owned engine keys
+    template: deployment-pii.yaml
+    set:
+      pii.enabled: true
+      pii.env:
+        PII_ENGINE: evil
+        PII_DEVICE: evil
+        PII_GLINER_MODEL: acme/custom-model
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_ENGINE
+            value: "evil"
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_DEVICE
+            value: "evil"
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_GLINER_MODEL
+            value: "acme/custom-model"
+
+  - it: app pod gets chart-computed PII_URL pointing at the in-cluster service
+    template: deployment-app.yaml
+    set:
+      pii.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_URL
+            value: "http://t-sim-pii:5001"
+
+  - it: app pod gets the localhost PII_URL fallback when service disabled
+    template: deployment-app.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_URL
+            value: "http://localhost:5001"
+
+  - it: PII_URL is excluded from the chart-managed app secret
+    template: secrets-app.yaml
+    set:
+      pii.enabled: true
+      app.env.PII_URL: "http://should-not-leak:5001"
+    asserts:
+      - notExists:
+          path: stringData.PII_URL
+
+  - it: user-set PII_URL never overrides the chart-computed inline value
+    template: deployment-app.yaml
+    set:
+      pii.enabled: true
+      app.env.PII_URL: "http://evil-pii:5001"
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: PII_URL
+            value: "http://evil-pii:5001"
+
+  - it: app NetworkPolicy allows egress to the PII service
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      pii.enabled: true
+    documentSelector:
+      path: metadata.name
+      value: t-sim-app
+    asserts:
+      - contains:
+          path: spec.egress
+          content:
+            to:
+              - podSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: sim
+                    app.kubernetes.io/instance: t
+                    app.kubernetes.io/component: pii
+            ports:
+              - protocol: TCP
+                port: 5001
+
+  - it: renders a dedicated NetworkPolicy for the PII service
+    template: networkpolicy.yaml
+    set:
+      networkPolicy.enabled: true
+      pii.enabled: true
+    documentSelector:
+      path: metadata.name
+      value: t-sim-pii
+    asserts:
+      - isKind: { of: NetworkPolicy }
+      - equal:
+          path: spec.podSelector.matchLabels["app.kubernetes.io/component"]
+          value: pii
+
+  - it: pii pod inherits global tolerations (not component-scoped)
+    template: deployment-pii.yaml
+    set:
+      pii.enabled: true
+      tolerations:
+        - key: dedicated
+          operator: Equal
+          value: pii
+          effect: NoSchedule
+    asserts:
+      - contains:
+          path: spec.template.spec.tolerations
+          content:
+            key: dedicated
+            operator: Equal
+            value: pii
+            effect: NoSchedule