suite: test masterkey secret
templates:
  - secret-masterkey.yaml
tests:
  - it: should create a secret if masterkeySecretName is not set. should start with sk-xxxx (base64 encoded as c2st*)
    template: secret-masterkey.yaml
    set:
      masterkeySecretName: ""
    asserts:
      - isKind:
          of: Secret
      - matchRegex:
          path: data.masterkey
          pattern: ^c2st
          # Note: The masterkey is generated as "sk-<18-random-chars>" in plain text,
          # but stored as base64 encoded in Kubernetes secret (requirement).
          # "sk-" base64 encodes to "c2st", so we check for "^c2st" pattern.
  - it: should reuse the master key already stored in the cluster instead of generating a new one on upgrade
    template: secret-masterkey.yaml
    set:
      masterkeySecretName: ""
    kubernetesProvider:
      scheme:
        "v1/Secret":
          gvr:
            version: "v1"
            resource: "secrets"
          namespaced: true
      objects:
        - kind: Secret
          apiVersion: v1
          metadata:
            name: RELEASE-NAME-litellm-masterkey
            namespace: NAMESPACE
          data:
            masterkey: c2stZXhpc3Rpbmcta2V5
    asserts:
      - equal:
          path: data.masterkey
          value: c2stZXhpc3Rpbmcta2V5
  - it: should let an explicit masterkey value override the one already stored in the cluster
    template: secret-masterkey.yaml
    set:
      masterkeySecretName: ""
      masterkey: sk-explicit
    kubernetesProvider:
      scheme:
        "v1/Secret":
          gvr:
            version: "v1"
            resource: "secrets"
          namespaced: true
      objects:
        - kind: Secret
          apiVersion: v1
          metadata:
            name: RELEASE-NAME-litellm-masterkey
            namespace: NAMESPACE
          data:
            masterkey: c2stZXhpc3Rpbmcta2V5
    asserts:
      - equal:
          path: data.masterkey
          value: c2stZXhwbGljaXQ=
  - it: should not create a secret if masterkeySecretName is set
    template: secret-masterkey.yaml
    set:
      masterkeySecretName: my-secret
    asserts:
      - hasDocuments:
          count: 0