[Enhancement] Add Helm Unit Tests for RBAC Templates

[synhershko]

Description

The Helm chart currently lacks unit tests to verify that templates render correctly under different configurations.

Motivation

Without automated tests for Helm templates:

• RBAC template bugs can go undetected (like the useRoleBindings bug that was recently fixed)
• Changes to templates are risky and hard to validate
• Regressions can be introduced without notice
• Manual testing is time-consuming and error-prone

Proposed Solution

Add https://github.com/helm-unittest/helm-unittest tests to validate template rendering logic.

Example

Issue #1130 is now fixed with PR #1131, but we don't have tests for it.

Install helm-unittest plugin in CI/CD pipeline: helm plugin install https://github.com/helm-unittest/helm-unittest. Create charts/opensearch-operator/tests/rbac_test.yaml with the following test cases:

1. Test useRoleBindings: false (default behavior)

Verify:

• opensearch-operator-manager-role-cr.yaml renders as kind: ClusterRole
• opensearch-operator-manager-rolebinding.yaml renders as kind: ClusterRoleBinding with roleRef.kind: ClusterRole
• opensearch-operator-proxy-role-cr.yaml renders as kind: ClusterRole
• opensearch-operator-proxy-rolebinding.yaml renders as kind: ClusterRoleBinding with roleRef.kind: ClusterRole
• opensearch-operator-metrics-reader-cr.yaml renders as kind: ClusterRole

2. Test useRoleBindings: true

Verify:

• opensearch-operator-manager-role-cr.yaml renders as kind: Role
• opensearch-operator-manager-rolebinding.yaml renders as kind: RoleBinding with roleRef.kind: Role
• opensearch-operator-proxy-role-cr.yaml renders as kind: Role
• opensearch-operator-proxy-rolebinding.yaml renders as kind: RoleBinding with roleRef.kind: Role
• opensearch-operator-metrics-reader-cr.yaml renders as kind: Role

Example Test Structure:

  suite: test RBAC templates with useRoleBindings
  templates:
    - opensearch-operator-manager-role-cr.yaml
    - opensearch-operator-manager-rolebinding.yaml
    - opensearch-operator-proxy-role-cr.yaml
    - opensearch-operator-proxy-rolebinding.yaml
    - opensearch-operator-metrics-reader-cr.yaml

  tests:
    - it: should create ClusterRole and ClusterRoleBinding when useRoleBindings is false
      set:
        useRoleBindings: false
      asserts:
        - hasDocuments:
            count: 1
          template: opensearch-operator-manager-role-cr.yaml
        - equal:
            path: kind
            value: ClusterRole
          template: opensearch-operator-manager-role-cr.yaml
        - equal:
            path: kind
            value: ClusterRoleBinding
          template: opensearch-operator-manager-rolebinding.yaml
        - equal:
            path: roleRef.kind
            value: ClusterRole
          template: opensearch-operator-manager-rolebinding.yaml
        - equal:
            path: kind
            value: ClusterRole
          template: opensearch-operator-proxy-role-cr.yaml
        - equal:
            path: kind
            value: ClusterRoleBinding
          template: opensearch-operator-proxy-rolebinding.yaml
        - equal:
            path: roleRef.kind
            value: ClusterRole
          template: opensearch-operator-proxy-rolebinding.yaml
        - equal:
            path: kind
            value: ClusterRole
          template: opensearch-operator-metrics-reader-cr.yaml

    - it: should create Role and RoleBinding when useRoleBindings is true
      set:
        useRoleBindings: true
      asserts:
        - hasDocuments:
            count: 1
          template: opensearch-operator-manager-role-cr.yaml
        - equal:
            path: kind
            value: Role
          template: opensearch-operator-manager-role-cr.yaml
        - equal:
            path: kind
            value: RoleBinding
          template: opensearch-operator-manager-rolebinding.yaml
        - equal:
            path: roleRef.kind
            value: Role
          template: opensearch-operator-manager-rolebinding.yaml
        - equal:
            path: kind
            value: Role
          template: opensearch-operator-proxy-role-cr.yaml
        - equal:
            path: kind
            value: RoleBinding
          template: opensearch-operator-proxy-rolebinding.yaml
        - equal:
            path: roleRef.kind
            value: Role
          template: opensearch-operator-proxy-rolebinding.yaml
        - equal:
            path: kind
            value: Role
          template: opensearch-operator-metrics-reader-cr.yaml