@app-vitals/agent-admin 0.0.1 → 0.1.0

package/src/kubernetes-client.unit.test.ts

@@ -0,0 +1,726 @@
+/**
+ * admin/src/kubernetes-client.unit.test.ts
+ * Unit tests for the Kubernetes API client — pure URL/path building and
+ * request-body shaping. No I/O, no DB, no network.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { ConflictError, NotFoundError } from "./errors.ts";
+import {
+  deploymentBody,
+  deploymentUrl,
+  HttpKubernetesClient,
+  pvcBody,
+  pvcUrl,
+  RecordedKubernetesClient,
+  secretBody,
+  secretUrl,
+  serviceAccountBody,
+  serviceAccountUrl,
+} from "./kubernetes-client.ts";
+
+// ─── URL building: Deployments ──────────────────────────────────────────────
+
+describe("deploymentUrl", () => {
+  const api = "https://kubernetes.default.svc";
+
+  it("builds a collection URL (create/list) with no name", () => {
+    expect(deploymentUrl(api, "shipwright")).toBe(
+      "https://kubernetes.default.svc/apis/apps/v1/namespaces/shipwright/deployments",
+    );
+  });
+
+  it("builds a resource URL (get/delete) with a name", () => {
+    expect(deploymentUrl(api, "shipwright", "agent-abc")).toBe(
+      "https://kubernetes.default.svc/apis/apps/v1/namespaces/shipwright/deployments/agent-abc",
+    );
+  });
+
+  it("strips a trailing slash from the api server", () => {
+    expect(deploymentUrl("https://k8s.local/", "ns", "name")).toBe(
+      "https://k8s.local/apis/apps/v1/namespaces/ns/deployments/name",
+    );
+  });
+});
+
+// ─── URL building: Secrets ──────────────────────────────────────────────────
+
+describe("secretUrl", () => {
+  const api = "https://kubernetes.default.svc";
+
+  it("builds a collection URL (create/list) with no name", () => {
+    expect(secretUrl(api, "shipwright")).toBe(
+      "https://kubernetes.default.svc/api/v1/namespaces/shipwright/secrets",
+    );
+  });
+
+  it("builds a resource URL (get/delete) with a name", () => {
+    expect(secretUrl(api, "shipwright", "agent-secret")).toBe(
+      "https://kubernetes.default.svc/api/v1/namespaces/shipwright/secrets/agent-secret",
+    );
+  });
+
+  it("strips a trailing slash from the api server", () => {
+    expect(secretUrl("https://k8s.local/", "ns", "name")).toBe(
+      "https://k8s.local/api/v1/namespaces/ns/secrets/name",
+    );
+  });
+});
+
+// ─── Request body shaping: Deployments ──────────────────────────────────────
+
+describe("deploymentBody", () => {
+  it("shapes a Deployment manifest with apiVersion/kind and namespaced metadata", () => {
+    const body = deploymentBody("shipwright", {
+      name: "agent-abc",
+      replicas: 1,
+      image: "ghcr.io/example/agent:latest",
+      labels: { app: "agent-abc" },
+    });
+
+    expect(body.apiVersion).toBe("apps/v1");
+    expect(body.kind).toBe("Deployment");
+    expect(body.metadata.name).toBe("agent-abc");
+    expect(body.metadata.namespace).toBe("shipwright");
+    expect(body.metadata.labels).toEqual({ app: "agent-abc" });
+    expect(body.spec.replicas).toBe(1);
+    expect(body.spec.selector.matchLabels).toEqual({ app: "agent-abc" });
+    expect(body.spec.template.spec.containers[0]?.image).toBe(
+      "ghcr.io/example/agent:latest",
+    );
+    expect(body.spec.template.spec.containers[0]?.name).toBe("agent-abc");
+  });
+
+  it("defaults replicas to 1 when omitted", () => {
+    const body = deploymentBody("ns", {
+      name: "x",
+      image: "img:1",
+    });
+    expect(body.spec.replicas).toBe(1);
+  });
+
+  it("derives a default app label from the name when labels omitted", () => {
+    const body = deploymentBody("ns", { name: "myagent", image: "img:1" });
+    expect(body.metadata.labels).toEqual({ app: "myagent" });
+    expect(body.spec.selector.matchLabels).toEqual({ app: "myagent" });
+  });
+
+  it("maps env entries into container env array", () => {
+    const body = deploymentBody("ns", {
+      name: "x",
+      image: "img:1",
+      env: { FOO: "bar", BAZ: "qux" },
+    });
+    expect(body.spec.template.spec.containers[0]?.env).toEqual([
+      { name: "FOO", value: "bar" },
+      { name: "BAZ", value: "qux" },
+    ]);
+  });
+});
+
+// ─── URL building: PVCs ─────────────────────────────────────────────────────
+
+describe("pvcUrl", () => {
+  const api = "https://kubernetes.default.svc";
+
+  it("builds a collection URL (create/list) with no name", () => {
+    expect(pvcUrl(api, "shipwright")).toBe(
+      "https://kubernetes.default.svc/api/v1/namespaces/shipwright/persistentvolumeclaims",
+    );
+  });
+
+  it("builds a resource URL (get/delete) with a name", () => {
+    expect(pvcUrl(api, "shipwright", "agent-abc-home")).toBe(
+      "https://kubernetes.default.svc/api/v1/namespaces/shipwright/persistentvolumeclaims/agent-abc-home",
+    );
+  });
+
+  it("strips a trailing slash from the api server", () => {
+    expect(pvcUrl("https://k8s.local/", "ns", "name")).toBe(
+      "https://k8s.local/api/v1/namespaces/ns/persistentvolumeclaims/name",
+    );
+  });
+});
+
+// ─── Request body shaping: PVCs ──────────────────────────────────────────────
+
+describe("pvcBody", () => {
+  it("shapes a PVC manifest with v1/PersistentVolumeClaim and ReadWriteOnce", () => {
+    const body = pvcBody("shipwright", {
+      name: "agent-abc-home",
+      namespace: "shipwright",
+      storageGi: 40,
+    });
+
+    expect(body.apiVersion).toBe("v1");
+    expect(body.kind).toBe("PersistentVolumeClaim");
+    expect(body.metadata.name).toBe("agent-abc-home");
+    expect(body.metadata.namespace).toBe("shipwright");
+    expect(body.spec.accessModes).toEqual(["ReadWriteOnce"]);
+    expect(body.spec.resources.requests.storage).toBe("40Gi");
+  });
+
+  it("includes storageClassName when provided", () => {
+    const body = pvcBody("shipwright", {
+      name: "agent-abc-home",
+      namespace: "shipwright",
+      storageGi: 20,
+      storageClassName: "standard",
+    });
+
+    expect(body.spec.storageClassName).toBe("standard");
+  });
+
+  it("omits storageClassName when not provided", () => {
+    const body = pvcBody("shipwright", {
+      name: "agent-abc-home",
+      namespace: "shipwright",
+      storageGi: 40,
+    });
+
+    expect(body.spec.storageClassName).toBeUndefined();
+  });
+});
+
+// ─── RecordedKubernetesClient: PVC CRUD ──────────────────────────────────────
+
+describe("RecordedKubernetesClient — PVCs", () => {
+  it("createPvc records and returns the PVC", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      pvcs: {},
+    });
+    const created = await rec.createPvc("ns", {
+      name: "agent-abc-home",
+      namespace: "ns",
+      storageGi: 40,
+    });
+    expect(created.metadata.name).toBe("agent-abc-home");
+    expect(created.spec.accessModes).toEqual(["ReadWriteOnce"]);
+    expect(created.spec.resources.requests.storage).toBe("40Gi");
+
+    const fetched = await rec.getPvc("ns", "agent-abc-home");
+    expect(fetched.metadata.name).toBe("agent-abc-home");
+  });
+
+  it("createPvc throws ConflictError on duplicate", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      pvcs: {},
+    });
+    await rec.createPvc("ns", { name: "dup", namespace: "ns", storageGi: 40 });
+    await expect(
+      rec.createPvc("ns", { name: "dup", namespace: "ns", storageGi: 40 }),
+    ).rejects.toBeInstanceOf(ConflictError);
+  });
+
+  it("getPvc throws NotFoundError for missing PVC", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      pvcs: {},
+    });
+    await expect(rec.getPvc("ns", "missing")).rejects.toBeInstanceOf(
+      NotFoundError,
+    );
+  });
+
+  it("deletePvc removes the PVC", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      pvcs: {},
+    });
+    await rec.createPvc("ns", { name: "p", namespace: "ns", storageGi: 40 });
+    await rec.deletePvc("ns", "p");
+    await expect(rec.getPvc("ns", "p")).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  it("deletePvc throws NotFoundError for missing PVC", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      pvcs: {},
+    });
+    await expect(rec.deletePvc("ns", "missing")).rejects.toBeInstanceOf(
+      NotFoundError,
+    );
+  });
+
+  it("getPvc returns a pre-seeded PVC from the cassette", async () => {
+    const seeded = {
+      apiVersion: "v1" as const,
+      kind: "PersistentVolumeClaim" as const,
+      metadata: { name: "agent-abc-home", namespace: "shipwright" },
+      spec: {
+        accessModes: ["ReadWriteOnce"],
+        resources: { requests: { storage: "40Gi" } },
+      },
+    };
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      pvcs: { "shipwright/agent-abc-home": seeded },
+    });
+    const fetched = await rec.getPvc("shipwright", "agent-abc-home");
+    expect(fetched.metadata.name).toBe("agent-abc-home");
+  });
+});
+
+// ─── ServiceAccounts: URL, body, and in-memory CRUD ─────────────────────────
+
+describe("serviceAccountUrl", () => {
+  const api = "https://kubernetes.default.svc";
+
+  it("builds a collection URL with no name", () => {
+    expect(serviceAccountUrl(api, "shipwright")).toBe(
+      "https://kubernetes.default.svc/api/v1/namespaces/shipwright/serviceaccounts",
+    );
+  });
+
+  it("builds a resource URL with a name", () => {
+    expect(serviceAccountUrl(api, "shipwright", "agent-abc")).toBe(
+      "https://kubernetes.default.svc/api/v1/namespaces/shipwright/serviceaccounts/agent-abc",
+    );
+  });
+
+  it("strips a trailing slash from the api server", () => {
+    expect(serviceAccountUrl("https://k8s.local/", "ns", "name")).toBe(
+      "https://k8s.local/api/v1/namespaces/ns/serviceaccounts/name",
+    );
+  });
+});
+
+describe("serviceAccountBody", () => {
+  it("shapes a v1 ServiceAccount", () => {
+    expect(serviceAccountBody("shipwright", { name: "agent-abc" })).toEqual({
+      apiVersion: "v1",
+      kind: "ServiceAccount",
+      metadata: { name: "agent-abc", namespace: "shipwright" },
+    });
+  });
+});
+
+describe("RecordedKubernetesClient — ServiceAccounts", () => {
+  const empty = () =>
+    new RecordedKubernetesClient({ deployments: {}, secrets: {} });
+
+  it("createServiceAccount records and returns the ServiceAccount", async () => {
+    const rec = empty();
+    const created = await rec.createServiceAccount("ns", { name: "sa" });
+    expect(created.kind).toBe("ServiceAccount");
+    expect(created.metadata.name).toBe("sa");
+    const fetched = await rec.getServiceAccount("ns", "sa");
+    expect(fetched.metadata.name).toBe("sa");
+  });
+
+  it("createServiceAccount throws ConflictError on duplicate", async () => {
+    const rec = empty();
+    await rec.createServiceAccount("ns", { name: "dup" });
+    await expect(
+      rec.createServiceAccount("ns", { name: "dup" }),
+    ).rejects.toBeInstanceOf(ConflictError);
+  });
+
+  it("getServiceAccount throws NotFoundError when missing", async () => {
+    await expect(
+      empty().getServiceAccount("ns", "missing"),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  it("deleteServiceAccount removes the ServiceAccount", async () => {
+    const rec = empty();
+    await rec.createServiceAccount("ns", { name: "sa" });
+    await rec.deleteServiceAccount("ns", "sa");
+    await expect(rec.getServiceAccount("ns", "sa")).rejects.toBeInstanceOf(
+      NotFoundError,
+    );
+  });
+
+  it("deleteServiceAccount throws NotFoundError when missing", async () => {
+    await expect(
+      empty().deleteServiceAccount("ns", "missing"),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  it("getServiceAccount returns a pre-seeded ServiceAccount", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {},
+      secrets: {},
+      serviceAccounts: {
+        "shipwright/agent-abc": {
+          apiVersion: "v1",
+          kind: "ServiceAccount",
+          metadata: { name: "agent-abc", namespace: "shipwright" },
+        },
+      },
+    });
+    const fetched = await rec.getServiceAccount("shipwright", "agent-abc");
+    expect(fetched.metadata.name).toBe("agent-abc");
+  });
+});
+
+// ─── HttpKubernetesClient: patchDeployment ───────────────────────────────────
+
+describe("HttpKubernetesClient.patchDeployment()", () => {
+  const apiServer = "https://kubernetes.default.svc";
+  const namespace = "shipwright";
+  const name = "agent-abc";
+  const patch = {
+    spec: {
+      template: {
+        spec: {
+          containers: [
+            { name: "agent-abc", image: "ghcr.io/example/agent:v2" },
+          ],
+        },
+      },
+    },
+  };
+
+  it("sends PATCH to deploymentUrl(apiServer, namespace, name)", async () => {
+    let capturedUrl: string | undefined;
+    let capturedMethod: string | undefined;
+
+    const fetchFn = async (url: string | URL | Request, init?: RequestInit) => {
+      capturedUrl = String(url);
+      capturedMethod = init?.method;
+      return new Response(null, { status: 200 });
+    };
+
+    const client = new HttpKubernetesClient({
+      apiServer,
+      token: "test-token",
+      fetchFn: fetchFn as typeof fetch,
+    });
+
+    await client.patchDeployment(namespace, name, patch);
+
+    expect(capturedUrl).toBe(deploymentUrl(apiServer, namespace, name));
+    expect(capturedMethod).toBe("PATCH");
+  });
+
+  it("sends Content-Type: application/strategic-merge-patch+json", async () => {
+    let capturedHeaders: HeadersInit | undefined;
+
+    const fetchFn = async (
+      _url: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      capturedHeaders = init?.headers;
+      return new Response(null, { status: 200 });
+    };
+
+    const client = new HttpKubernetesClient({
+      apiServer,
+      token: "test-token",
+      fetchFn: fetchFn as typeof fetch,
+    });
+
+    await client.patchDeployment(namespace, name, patch);
+
+    const headers = capturedHeaders as Record<string, string>;
+    expect(headers["Content-Type"]).toBe(
+      "application/strategic-merge-patch+json",
+    );
+  });
+
+  it("sends the patch object as JSON body", async () => {
+    let capturedBody: string | undefined;
+
+    const fetchFn = async (
+      _url: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      capturedBody = init?.body as string;
+      return new Response(null, { status: 200 });
+    };
+
+    const client = new HttpKubernetesClient({
+      apiServer,
+      token: "test-token",
+      fetchFn: fetchFn as typeof fetch,
+    });
+
+    await client.patchDeployment(namespace, name, patch);
+
+    expect(capturedBody).toBe(JSON.stringify(patch));
+  });
+
+  it("throws NotFoundError on 404", async () => {
+    const fetchFn = async () =>
+      new Response(JSON.stringify({ message: "not found" }), { status: 404 });
+
+    const client = new HttpKubernetesClient({
+      apiServer,
+      token: "test-token",
+      fetchFn: fetchFn as unknown as typeof fetch,
+    });
+
+    await expect(
+      client.patchDeployment(namespace, name, patch),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+});
+
+// ─── RecordedKubernetesClient: patchDeployment ───────────────────────────────
+
+describe("RecordedKubernetesClient.patchDeployment()", () => {
+  const makeDeployment = (image: string) => ({
+    apiVersion: "apps/v1" as const,
+    kind: "Deployment" as const,
+    metadata: { name: "agent-abc", namespace: "shipwright" },
+    spec: {
+      replicas: 1,
+      selector: { matchLabels: { app: "agent-abc" } },
+      template: {
+        metadata: { labels: { app: "agent-abc" } },
+        spec: {
+          containers: [{ name: "agent-abc", image }],
+        },
+      },
+    },
+  });
+
+  it("updates containers[0].image from the patch payload", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {
+        "shipwright/agent-abc": makeDeployment("ghcr.io/example/agent:v1"),
+      },
+      secrets: {},
+    });
+
+    await rec.patchDeployment("shipwright", "agent-abc", {
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              { name: "agent-abc", image: "ghcr.io/example/agent:v2" },
+            ],
+          },
+        },
+      },
+    });
+
+    const dep = await rec.getDeployment("shipwright", "agent-abc");
+    expect(dep.spec.template.spec.containers[0]?.image).toBe(
+      "ghcr.io/example/agent:v2",
+    );
+  });
+
+  it("throws NotFoundError when the deployment does not exist", async () => {
+    const rec = new RecordedKubernetesClient({ deployments: {}, secrets: {} });
+
+    await expect(
+      rec.patchDeployment("shipwright", "agent-abc", {
+        spec: {
+          template: {
+            spec: {
+              containers: [
+                { name: "agent-abc", image: "ghcr.io/example/agent:v2" },
+              ],
+            },
+          },
+        },
+      }),
+    ).rejects.toBeInstanceOf(NotFoundError);
+  });
+
+  it("merges resources key-by-key, preserving live keys not in the patch", async () => {
+    const rec = new RecordedKubernetesClient({
+      deployments: {
+        "shipwright/agent-abc": {
+          apiVersion: "apps/v1" as const,
+          kind: "Deployment" as const,
+          metadata: { name: "agent-abc", namespace: "shipwright" },
+          spec: {
+            replicas: 1,
+            selector: { matchLabels: { app: "agent-abc" } },
+            template: {
+              metadata: { labels: { app: "agent-abc" } },
+              spec: {
+                containers: [
+                  {
+                    name: "agent-abc",
+                    image: "ghcr.io/example/agent:v1",
+                    resources: {
+                      requests: { memory: "1Gi", cpu: "500m" },
+                      limits: { memory: "4Gi", cpu: "2" },
+                    },
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+      secrets: {},
+    });
+
+    // Patch only mentions memory — cpu keys (Autopilot-injected) must survive.
+    await rec.patchDeployment("shipwright", "agent-abc", {
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              {
+                name: "agent-abc",
+                image: "ghcr.io/example/agent:v1",
+                resources: {
+                  requests: { memory: "2Gi" },
+                  limits: { memory: "8Gi" },
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+
+    const dep = await rec.getDeployment("shipwright", "agent-abc");
+    const resources = dep.spec.template.spec.containers[0]?.resources;
+    // Patched values applied.
+    expect(resources?.requests?.memory).toBe("2Gi");
+    expect(resources?.limits?.memory).toBe("8Gi");
+    // Live-only keys survived the patch.
+    expect(resources?.requests?.cpu).toBe("500m");
+    expect(resources?.limits?.cpu).toBe("2");
+  });
+});
+
+// ─── Request body shaping: Secrets ──────────────────────────────────────────
+
+describe("secretBody", () => {
+  it("shapes an Opaque Secret with base64-encoded data", () => {
+    const body = secretBody("shipwright", {
+      name: "agent-secret",
+      stringData: { TOKEN: "s3cr3t", URL: "https://x" },
+    });
+
+    expect(body.apiVersion).toBe("v1");
+    expect(body.kind).toBe("Secret");
+    expect(body.type).toBe("Opaque");
+    expect(body.metadata.name).toBe("agent-secret");
+    expect(body.metadata.namespace).toBe("shipwright");
+    // values are base64-encoded
+    expect(body.data.TOKEN).toBe(Buffer.from("s3cr3t").toString("base64"));
+    expect(body.data.URL).toBe(Buffer.from("https://x").toString("base64"));
+  });
+
+  it("produces empty data for an empty stringData map", () => {
+    const body = secretBody("ns", { name: "empty", stringData: {} });
+    expect(body.data).toEqual({});
+  });
+});
+
+// ─── RecordedKubernetesClient: patchDeployment volumes/mounts/annotations ────
+
+describe("RecordedKubernetesClient.patchDeployment() — policy shapes", () => {
+  const seed = () =>
+    new RecordedKubernetesClient({
+      deployments: {
+        "shipwright/agent-abc": {
+          apiVersion: "apps/v1" as const,
+          kind: "Deployment" as const,
+          metadata: { name: "agent-abc", namespace: "shipwright" },
+          spec: {
+            replicas: 1,
+            selector: { matchLabels: { app: "agent-abc" } },
+            template: {
+              metadata: {
+                labels: { app: "agent-abc" },
+                annotations: { keep: "me", drop: "me" },
+              },
+              spec: {
+                volumes: [
+                  { name: "home", persistentVolumeClaim: { claimName: "h" } },
+                  { name: "claude-policy", configMap: { name: "old" } },
+                ],
+                containers: [
+                  {
+                    name: "agent-abc",
+                    image: "img",
+                    volumeMounts: [
+                      { name: "home", mountPath: "/home/agent" },
+                      { name: "claude-policy", mountPath: "/etc/claude-code" },
+                    ],
+                  },
+                ],
+              },
+            },
+          },
+        },
+      },
+      secrets: {},
+    });
+
+  it("merges volumes by name and volumeMounts by mountPath", async () => {
+    const rec = seed();
+    await rec.patchDeployment("shipwright", "agent-abc", {
+      spec: {
+        template: {
+          spec: {
+            volumes: [{ name: "claude-policy", configMap: { name: "new" } }],
+            containers: [
+              {
+                name: "agent-abc",
+                volumeMounts: [
+                  {
+                    name: "claude-policy",
+                    mountPath: "/etc/claude-code",
+                    readOnly: true,
+                  },
+                ],
+              },
+            ],
+          },
+        },
+      },
+    });
+    const dep = await rec.getDeployment("shipwright", "agent-abc");
+    expect(dep.spec.template.spec.volumes).toEqual([
+      { name: "home", persistentVolumeClaim: { claimName: "h" } },
+      { name: "claude-policy", configMap: { name: "new" } },
+    ]);
+    expect(dep.spec.template.spec.containers[0]?.volumeMounts).toEqual([
+      { name: "home", mountPath: "/home/agent" },
+      { name: "claude-policy", mountPath: "/etc/claude-code", readOnly: true },
+    ]);
+    expect(dep.spec.template.spec.containers[0]?.image).toBe("img");
+  });
+
+  it("removes entries with $patch: delete and annotation keys with null", async () => {
+    const rec = seed();
+    await rec.patchDeployment("shipwright", "agent-abc", {
+      spec: {
+        template: {
+          metadata: { annotations: { drop: null, added: "x" } },
+          spec: {
+            volumes: [{ name: "claude-policy", $patch: "delete" }],
+            containers: [
+              {
+                name: "agent-abc",
+                volumeMounts: [
+                  { mountPath: "/etc/claude-code", $patch: "delete" },
+                ],
+              },
+            ],
+          },
+        },
+      },
+    });
+    const dep = await rec.getDeployment("shipwright", "agent-abc");
+    expect(dep.spec.template.spec.volumes).toEqual([
+      { name: "home", persistentVolumeClaim: { claimName: "h" } },
+    ]);
+    expect(dep.spec.template.spec.containers[0]?.volumeMounts).toEqual([
+      { name: "home", mountPath: "/home/agent" },
+    ]);
+    expect(dep.spec.template.metadata.annotations).toEqual({
+      keep: "me",
+      added: "x",
+    });
+  });
+});