Add e2e tests for pod template spec changes

Signed-off-by: Juan Antonio Osorio <[email protected]>

Author: JAORMX

cmd/thv-operator/controllers/mcpserver_controller.go

@@ -188,6 +188,15 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 		return ctrl.Result{Requeue: true}, nil
 	}
 
+	// Validate PodTemplateSpec early - before other validations
+	// This ensures we fail fast if the spec is invalid
+	if !r.validateAndUpdatePodTemplateStatus(ctx, mcpServer) {
+		// Invalid PodTemplateSpec - return without error to avoid infinite retries
+		// The user must fix the spec and the next reconciliation will retry
+		ctxLogger.Info("Skipping reconciliation due to invalid PodTemplateSpec")
+		return ctrl.Result{}, nil
+	}
+
 	// Check if MCPToolConfig is referenced and handle it
 	if err := r.handleToolConfig(ctx, mcpServer); err != nil {
 		ctxLogger.Error(err, "Failed to handle MCPToolConfig")
@@ -297,14 +306,6 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 	deployment := &appsv1.Deployment{}
 	err = r.Get(ctx, types.NamespacedName{Name: mcpServer.Name, Namespace: mcpServer.Namespace}, deployment)
 	if err != nil && errors.IsNotFound(err) {
-		// Validate PodTemplateSpec and update status
-		if !r.validateAndUpdatePodTemplateStatus(ctx, mcpServer) {
-			// Invalid PodTemplateSpec - return without error to avoid infinite retries
-			// The user must fix the spec and the next reconciliation will retry
-			ctxLogger.Info("Skipping deployment creation due to invalid PodTemplateSpec")
-			return ctrl.Result{}, nil
-		}
-
 		// Define a new deployment
 		dep := r.deploymentForMCPServer(ctx, mcpServer)
 		if dep == nil {
@@ -374,14 +375,6 @@ func (r *MCPServerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (
 
 	// Check if the deployment spec changed
 	if r.deploymentNeedsUpdate(ctx, deployment, mcpServer) {
-		// Validate PodTemplateSpec and update status
-		if !r.validateAndUpdatePodTemplateStatus(ctx, mcpServer) {
-			// Invalid PodTemplateSpec - return without error to avoid infinite retries
-			// The user must fix the spec and the next reconciliation will retry
-			ctxLogger.Info("Skipping deployment update due to invalid PodTemplateSpec")
-			return ctrl.Result{}, nil
-		}
-
 		// Update the deployment
 		newDeployment := r.deploymentForMCPServer(ctx, mcpServer)
 		deployment.Spec = newDeployment.Spec

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/invalid-podtemplatespec/assert-mcpserver-invalid-condition.yaml

@@ -0,0 +1,10 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: MCPServer
+metadata:
+  name: invalid-podtemplate
+  namespace: toolhive-system
+status:
+  conditions:
+  - type: PodTemplateValid
+    status: "False"
+    reason: InvalidPodTemplateSpec

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/invalid-podtemplatespec/assert-no-deployment.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: List
+items:
+- apiVersion: apps/v1
+  kind: Deployment
+  metadata:
+    name: invalid-podtemplate
+    namespace: toolhive-system
+  (x-chainsaw-assert/exists): false

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/invalid-podtemplatespec/chainsaw-test.yaml

@@ -0,0 +1,38 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: invalid-podtemplatespec
+spec:
+  description: Tests that MCPServer with invalid PodTemplateSpec blocks deployment creation
+  timeouts:
+    apply: 30s
+    assert: 60s
+    cleanup: 30s
+  steps:
+  - name: verify-operator
+    description: Ensure operator is ready before testing
+    try:
+    - assert:
+        file: ../../setup/assert-operator-ready.yaml
+      
+  - name: deploy-mcpserver-with-invalid-podtemplatespec
+    description: Deploy MCPServer with invalid PodTemplateSpec and verify deployment is blocked
+    try:
+    - apply:
+        file: mcpserver-invalid.yaml
+    - assert:
+        file: mcpserver-invalid.yaml
+    - assert:
+        file: assert-mcpserver-invalid-condition.yaml
+    - assert:
+        file: assert-no-deployment.yaml
+        
+  - name: cleanup
+    description: Clean up the invalid MCPServer
+    try:
+    - delete:
+        ref:
+          apiVersion: toolhive.stacklok.dev/v1alpha1
+          kind: MCPServer
+          name: invalid-podtemplate
+          namespace: toolhive-system

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/invalid-podtemplatespec/mcpserver-invalid.yaml

@@ -0,0 +1,13 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: MCPServer
+metadata:
+  name: invalid-podtemplate
+  namespace: toolhive-system
+spec:
+  image: ghcr.io/stackloklabs/mcp-fetch:latest
+  transport: stdio
+  port: 8080
+  # Invalid PodTemplateSpec - containers should be an array, not a string
+  podTemplateSpec:
+    spec:
+      containers: "invalid-not-an-array"

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/valid-podtemplatespec/assert-deployment-exists.yaml

@@ -0,0 +1,5 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: valid-podtemplate
+  namespace: toolhive-system

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/valid-podtemplatespec/assert-mcpserver-running.yaml

@@ -0,0 +1,8 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: MCPServer
+metadata:
+  name: valid-podtemplate
+  namespace: toolhive-system
+status:
+  message: "MCP server is running"
+  phase: "Running"

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/valid-podtemplatespec/assert-mcpserver-valid-condition.yaml

@@ -0,0 +1,13 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: MCPServer
+metadata:
+  name: valid-podtemplate
+  namespace: toolhive-system
+status:
+  conditions:
+  - type: PodTemplateValid
+    status: "True"
+    reason: ValidPodTemplateSpec
+  - type: ImageValidated
+    status: "True"
+    reason: ImageValidationSkipped

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/valid-podtemplatespec/chainsaw-test.yaml

@@ -0,0 +1,40 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: valid-podtemplatespec
+spec:
+  description: Tests that MCPServer with valid PodTemplateSpec creates deployment successfully
+  timeouts:
+    apply: 30s
+    assert: 60s
+    cleanup: 30s
+  steps:
+  - name: verify-operator
+    description: Ensure operator is ready before testing
+    try:
+    - assert:
+        file: ../../setup/assert-operator-ready.yaml
+      
+  - name: deploy-mcpserver-with-valid-podtemplatespec
+    description: Deploy MCPServer with valid PodTemplateSpec and verify deployment is created
+    try:
+    - apply:
+        file: mcpserver-valid.yaml
+    - assert:
+        file: mcpserver-valid.yaml
+    - assert:
+        file: assert-mcpserver-valid-condition.yaml
+    - assert:
+        file: assert-mcpserver-running.yaml
+    - assert:
+        file: assert-deployment-exists.yaml
+        
+  - name: cleanup
+    description: Clean up the valid MCPServer
+    try:
+    - delete:
+        ref:
+          apiVersion: toolhive.stacklok.dev/v1alpha1
+          kind: MCPServer
+          name: valid-podtemplate
+          namespace: toolhive-system

test/e2e/chainsaw/operator/single-tenancy/test-scenarios/valid-podtemplatespec/mcpserver-valid.yaml

@@ -0,0 +1,21 @@
+apiVersion: toolhive.stacklok.dev/v1alpha1
+kind: MCPServer
+metadata:
+  name: valid-podtemplate
+  namespace: toolhive-system
+spec:
+  image: ghcr.io/stackloklabs/mcp-fetch:latest
+  transport: stdio
+  port: 8080
+  # Valid PodTemplateSpec with proper structure
+  podTemplateSpec:
+    spec:
+      containers:
+      - name: mcp
+        resources:
+          limits:
+            cpu: "100m"
+            memory: "128Mi"
+          requests:
+            cpu: "50m"
+            memory: "64Mi"