test: add audit-scanner cert and secret generation unit tests

Signed-off-by: Fabrizio Sestito <[email protected]>

Author: fabriziosestito

charts/kubewarden-controller/tests/webhooks_existing_certifcates_test.yaml

@@ -29,6 +29,14 @@ kubernetesProvider:
       data:
         tls.crt: "dGxzLmNydA==" # "tls.crt" in base64
         tls.key: "dGxzLmtleQ==" # "tls.key" in base64
+    - kind: Secret
+      apiVersion: v1
+      metadata:
+        name: kubewarden-audit-scanner-client-cert
+        namespace: kubewarden
+      data:
+        tls.crt: "dGxzLmNydA==" # "tls.crt" in base64
+        tls.key: "dGxzLmtleQ==" # "tls.key" in base64
 tests:
   - it: "should reuse the existing CA certificate"
     documentSelector:
@@ -47,7 +55,7 @@ tests:
           path: data["old-ca.crt"]
           value: "old-ca.crt"
           decodeBase64: true
-  - it: "should reuse the existing leaf certificate"
+  - it: "should reuse the existing leaf certificate (webhook server)"
     documentSelector:
       path: metadata.name
       value: kubewarden-webhook-server-cert
@@ -60,6 +68,19 @@ tests:
           path: data["tls.key"]
           value: "tls.key"
           decodeBase64: true
+  - it: "should reuse the existing leaf certificate (audit-scanner)"
+    documentSelector:
+      path: metadata.name
+      value: kubewarden-audit-scanner-client-cert
+    asserts:
+      - equal:
+          path: data["tls.crt"]
+          value: "tls.crt"
+          decodeBase64: true
+      - equal:
+          path: data["tls.key"]
+          value: "tls.key"
+          decodeBase64: true
   - it: "should inject the caBundle (ca + old ca) into the webhook configurations"
     documentSelector:
       path: apiVersion

charts/kubewarden-controller/tests/webhooks_test.yaml

@@ -22,6 +22,15 @@ tests:
           path: data["tls.crt"]
       - isNotNullOrEmpty:
           path: data["tls.key"]
+  - it: "should generate a leaf certificate and store it in the kubewarden-audit-scanner-client-cert secret"
+    documentSelector:
+      path: metadata.name
+      value: kubewarden-audit-scanner-client-cert
+    asserts:
+      - isNotNullOrEmpty:
+          path: data["tls.crt"]
+      - isNotNullOrEmpty:
+          path: data["tls.key"]
   - it: "should inject the caBundle into the webhook configurations"
     documentSelector:
       path: apiVersion