*** Settings ***
Documentation     Integration tests for Kubernetes Helm chart cross-file consistency.
...               Every test case validates interactions between multiple chart files
...               (templates, values.yaml, Chart.yaml, Dockerfile) to catch wiring
...               errors that single-file Behave scenarios cannot detect.
Resource         ${CURDIR}/common.resource
Library           OperatingSystem
Library           Collections
Library           String
Library           Process
Suite Setup       Setup Test Environment
Suite Teardown    Cleanup Test Environment

*** Variables ***
${K8S_DIR}              ${CURDIR}/../k8s
${TEMPLATES_DIR}        ${K8S_DIR}/templates
${DOCKERFILE_SERVER}    ${CURDIR}/../Dockerfile.server
${HELPER}               ${CURDIR}/helper_k8s_helm_chart.py

*** Keywords ***
Assert Rendered Check Result
    [Arguments]    ${result}    ${ok_marker}    ${skip_marker}
    Should Be Equal As Integers    ${result.rc}    0    Render check failed: ${result.stderr}
    ${stdout}=    Strip String    ${result.stdout}
    ${strict}=    Get Environment Variable    CLEVERAGENTS_REQUIRE_HELM_RENDER_ASSERTIONS    false
    ${strict}=    Convert To Lower Case    ${strict}
    IF    '${strict}' == 'true' or '${strict}' == '1' or '${strict}' == 'yes'
        Should Be Equal As Strings    ${stdout}    ${ok_marker}
    ELSE
        ${is_ok}=    Run Keyword And Return Status    Should Be Equal As Strings    ${stdout}    ${ok_marker}
        IF    not ${is_ok}
            Should Be Equal As Strings    ${stdout}    ${skip_marker}
        END
    END

*** Test Cases ***
Port Values Are Consistent Across Templates Values And Dockerfile
    [Documentation]    Cross-file check: service.port and server.port must agree
    ...                in values.yaml, deployment.yaml must reference server.port
    ...                for containerPort, service.yaml must use named port, and
    ...                Dockerfile EXPOSE must match the default port.
    [Tags]    k8s    integration    critical
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_cross_file_port_consistency
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Port consistency check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Port consistency OK

Secrets Template References Match Values Schema And Deployment Wiring
    [Documentation]    Cross-file check: secrets.yaml must reference the same
    ...                credential keys defined in values.yaml, and deployment.yaml
    ...                must reference the same secret key names.
    [Tags]    k8s    integration    critical
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_secrets_structure
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Secrets structure check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Secrets structure OK

Deployment Command Args Match Dockerfile Entrypoint And ASGI Module
    [Documentation]    Cross-file check: Deployment template passes server config
    ...                as CLI args to uvicorn, matching the Dockerfile ENTRYPOINT,
    ...                and both reference the same ASGI application module.
    [Tags]    k8s    integration    critical
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_deployment_command_args
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: deployment-command-args-rendered
    ...    SKIP: deployment-command-args-rendered

Deployment EnvFrom References ConfigMap Name And Values Keys
    [Documentation]    Cross-file check: Deployment template uses envFrom with
    ...                configMapRef matching the ConfigMap name suffix, and the
    ...                ConfigMap env vars correspond to values.yaml server keys.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_envfrom_wiring
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: envfrom-wiring-rendered
    ...    SKIP: envfrom-wiring-rendered

Redis Host Helper Matches Bitnami Naming And Chart Dependency
    [Documentation]    Cross-file check: the Redis host helper uses .Release.Name
    ...                to match Bitnami subchart naming, the deployment template
    ...                uses this helper, and Chart.yaml declares the dependency.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_redis_host_helper
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Redis host helper check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Redis host helper OK

Probe Configuration Matches Between Values And Deployment Template
    [Documentation]    Cross-file check: probes in values.yaml split /live and /ready
    ...                and the deployment template renders them via toYaml.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_probe_config
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Probe config check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Probe config OK

Image Defaults Are Consistent Between Values And Deployment Template
    [Documentation]    Cross-file check: image section in values.yaml has sensible
    ...                defaults and the deployment template correctly references
    ...                repository, pullPolicy, and tag values.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_image_defaults
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Image defaults check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Image defaults OK

Service Defaults Match Between Values And Service Template
    [Documentation]    Cross-file check: service section in values.yaml defaults
    ...                to ClusterIP on port 8000 and the service template
    ...                references the correct values paths.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_service_defaults
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Service defaults check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Service defaults OK

Server Dockerfile Is Multi-Stage With Non-Root User
    [Documentation]    Cross-file check: Dockerfile.server uses multi-stage build
    ...                and creates the same non-root user referenced by the
    ...                podSecurityContext in values.yaml.
    [Tags]    k8s    dockerfile
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_dockerfile_multistage_nonroot
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=30s
    Should Be Equal As Integers    ${result.rc}    0    Dockerfile multi-stage check failed: ${result.stderr}
    Should Contain    ${result.stdout}    Dockerfile multi-stage OK

Redis Disabled Rendering Omits Redis Environment Wiring
    [Documentation]    Render-based check (when Helm is available): with
    ...                redis.enabled=false, rendered Deployment must not
    ...                include Redis environment variables.
    ...                If Helm is unavailable, helper returns a skip note.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_redis_disabled_rendering
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: redis-disabled-rendering
    ...    SKIP: redis-disabled-rendering

Database Existing Secret Rendering Uses Existing Secret Wiring
    [Documentation]    Render-based check (when Helm is available): with
    ...                database.existingSecret configured, rendered Deployment
    ...                should reference that secret for CLEVERAGENTS_DATABASE_URL.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_database_existing_secret_rendering
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: database-existing-secret-rendering
    ...    SKIP: database-existing-secret-rendering

Redis Enabled Existing Secret Rendering Uses Existing Secret Wiring
    [Documentation]    Render-based check (when Helm is available): with
    ...                redis.enabled=true and redis.auth.existingSecret set,
    ...                rendered Deployment should consume that secret.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_redis_enabled_existing_secret_rendering
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: redis-enabled-existing-secret-rendering
    ...    SKIP: redis-enabled-existing-secret-rendering

Redis Enabled Inline Password Rendering Uses Generated Secret Wiring
    [Documentation]    Render-based check (when Helm is available): with
    ...                redis.enabled=true and redis.auth.password set,
    ...                rendered Deployment should reference generated redis Secret.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_redis_enabled_inline_password_rendering
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: redis-enabled-inline-password-rendering
    ...    SKIP: redis-enabled-inline-password-rendering

Redis Enabled Fallback Rendering Uses Bitnami Secret Wiring
    [Documentation]    Render-based check (when Helm is available): with
    ...                redis.enabled=true and no explicit Redis credential,
    ...                rendered Deployment should reference Bitnami secret.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_redis_enabled_bitnami_fallback_rendering
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: redis-enabled-bitnami-fallback-rendering
    ...    SKIP: redis-enabled-bitnami-fallback-rendering

Ingress TLS Rendering Succeeds With TLS Configured
    [Documentation]    Render-based positive check (when Helm is available):
    ...                ingress.enabled=true with TLS configured and
    ...                allowInsecure=false should render Ingress successfully.
    [Tags]    k8s    integration
    ${result}=    Run Process    ${PYTHON}    ${HELPER}    validate_ingress_tls_rendering_success
    ...    cwd=${WORKSPACE}    on_timeout=kill    timeout=120s
    Assert Rendered Check Result
    ...    ${result}
    ...    OK: ingress-tls-rendering-success
    ...    SKIP: ingress-tls-rendering-success